From 6e6a4ba42c5394ecefc711dd268c2eb3788c1f13 Mon Sep 17 00:00:00 2001 From: wangnov <48670012+Wangnov@users.noreply.github.com> Date: Fri, 10 Jul 2026 19:30:42 +0800 Subject: [PATCH 01/21] chore: reserve implementation for #170 From 39ae89d09ce436ff19bf2a6b4450b31a744440cc Mon Sep 17 00:00:00 2001 From: wangnov <48670012+Wangnov@users.noreply.github.com> Date: Fri, 10 Jul 2026 19:30:44 +0800 Subject: [PATCH 02/21] chore: reserve implementation for #171 From ea6c0c95f5f9fe0c1955d178adbbeb83bfe75578 Mon Sep 17 00:00:00 2001 From: wangnov <48670012+Wangnov@users.noreply.github.com> Date: Fri, 10 Jul 2026 21:32:38 +0800 Subject: [PATCH 03/21] fix(release): make mirror promotion monotonic --- .github/workflows/release.yml | 548 ++++- cloudflare/manager-download-router/README.md | 30 +- .../manager-download-router/src/index.js | 38 +- .../test/index.test.js | 40 + docs/release.md | 114 +- package.json | 1 + scripts/check-immutable-releases.mjs | 75 + scripts/check-release-reuse.mjs | 119 ++ scripts/mirror-release.mjs | 1800 +++++++++++++++++ scripts/mirror-release.test.mjs | 1345 ++++++++++++ scripts/release-workflow.test.mjs | 164 ++ scripts/sync-mirror.sh | 245 +-- scripts/validate-release-manifest.mjs | 37 + scripts/verify-release-artifacts.mjs | 63 + scripts/write-release-summary.mjs | 95 +- 15 files changed, 4413 insertions(+), 301 deletions(-) create mode 100644 scripts/check-immutable-releases.mjs create mode 100644 scripts/check-release-reuse.mjs create mode 100755 scripts/mirror-release.mjs create mode 100644 scripts/mirror-release.test.mjs create mode 100644 scripts/release-workflow.test.mjs create mode 100644 scripts/validate-release-manifest.mjs create mode 100644 scripts/verify-release-artifacts.mjs diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 64e88d4..d4ba4e6 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -15,6 +15,23 @@ name: Release # AC_API_KEY_BASE64 base64 of the AuthKey_XXXX.p8 # TAURI_SIGNING_PRIVATE_KEY updater private key (string) # TAURI_SIGNING_PRIVATE_KEY_PASSWORD its password (empty if none) +# IMMUTABLE_RELEASES_READ_TOKEN fine-grained token with repository +# Administration: read-only +# MANAGER_R2_S3_ENDPOINT / MANAGER_R2_PROMOTION_ACCESS_KEY_ID / +# MANAGER_R2_PROMOTION_SECRET_ACCESS_KEY +# R2 S3-compatible read/write access +# MANAGER_IHEP_S3_ENDPOINT / MANAGER_IHEP_S3_BUCKET / +# MANAGER_IHEP_S3_PROMOTION_ACCESS_KEY_ID / +# MANAGER_IHEP_S3_PROMOTION_SECRET_ACCESS_KEY +# IHEP S3-compatible read/write access +# Both mirror backends are required for stable publication. They must already +# contain a valid latest.json baseline and support conditional PutObject +# (If-Match / If-None-Match) plus HeadObject user-metadata round trips. +# GitHub Immutable Releases must be enabled before any release starts; the +# workflow verifies the repository setting with IMMUTABLE_RELEASES_READ_TOKEN. +# Every reused asset is also pinned to the API-provided sha256 digest. +# The old MANAGER_*_ACCESS_KEY_ID / SECRET_ACCESS_KEY names must stay deleted; +# otherwise a historical workflow revision could still perform unconditional writes. # # Optional Windows Authenticode (non-blocking until configured; see docs/windows-signing.md): # WINDOWS_CERTIFICATE base64 of OV/EV code-signing .pfx @@ -26,13 +43,99 @@ on: push: tags: ["v*"] workflow_dispatch: + inputs: + target_tag: + description: "Existing vX.Y.Z release to republish through the current protected workflow" + required: false + default: "" + type: string + allow_mirror_downgrade: + description: "Emergency only: allow this tag to replace a newer mirror latest.json" + required: false + default: false + type: boolean + mirror_downgrade_reason: + description: "Required audit reason when emergency mirror downgrade is enabled" + required: false + default: "" + type: string permissions: contents: read +env: + RELEASE_TAG: ${{ inputs.target_tag || github.ref_name }} + +# Serialize every tag in the repository through one release lane. The mirror +# promotion also uses per-object ETag conditions, so an external/manual writer +# cannot bypass monotonicity merely by racing this workflow. +concurrency: + group: release-latest-${{ github.repository }} + cancel-in-progress: false + queue: max + jobs: + prepare: + if: ${{ startsWith(inputs.target_tag || github.ref_name, 'v') }} + runs-on: ubuntu-latest + environment: release + permissions: + contents: read + outputs: + release_reusable: ${{ steps.lookup.outputs.release_reusable }} + release_asset_digests: ${{ steps.lookup.outputs.release_asset_digests }} + steps: + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false + + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 + with: + node-version: 20 + + - name: Require GitHub Immutable Releases + env: + GH_TOKEN: ${{ secrets.IMMUTABLE_RELEASES_READ_TOKEN }} + run: node scripts/check-immutable-releases.mjs + + - name: Check for an existing immutable release + id: lookup + shell: bash + env: + DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} + DISPATCH_REF_NAME: ${{ github.ref_name }} + GH_TOKEN: ${{ github.token }} + REQUESTED_TARGET_TAG: ${{ inputs.target_tag || '' }} + run: | + set -euo pipefail + if [[ -n "$REQUESTED_TARGET_TAG" && "$DISPATCH_REF_NAME" != "$DEFAULT_BRANCH" ]]; then + echo "::error::target_tag must be dispatched from the default branch ($DEFAULT_BRANCH), not $DISPATCH_REF_NAME" + exit 1 + fi + if [[ ! "$RELEASE_TAG" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$ ]]; then + echo "::error::release tag must be a semantic vX.Y.Z tag: $RELEASE_TAG" + exit 1 + fi + lookup_error="$RUNNER_TEMP/release-lookup-error.txt" + release_json="$RUNNER_TEMP/release.json" + if gh api "repos/$GITHUB_REPOSITORY/releases/tags/$RELEASE_TAG" >"$release_json" 2>"$lookup_error"; then + REQUESTED_TARGET_TAG="$REQUESTED_TARGET_TAG" \ + node scripts/check-release-reuse.mjs "$RELEASE_TAG" "$release_json" + elif grep -q 'HTTP 404' "$lookup_error"; then + if [[ -n "$REQUESTED_TARGET_TAG" ]]; then + echo "::error::target_tag $REQUESTED_TARGET_TAG must already exist as a GitHub Release" + exit 1 + fi + echo "release_reusable=false" >> "$GITHUB_OUTPUT" + else + cat "$lookup_error" >&2 + echo "::error::could not determine whether release $RELEASE_TAG already exists" + exit 1 + fi + build: - if: ${{ github.ref_type == 'tag' && startsWith(github.ref_name, 'v') }} + needs: prepare + if: ${{ needs.prepare.result == 'success' && needs.prepare.outputs.release_reusable != 'true' && github.ref_type == 'tag' && startsWith(github.ref_name, 'v') && !(github.event_name == 'workflow_dispatch' && inputs.target_tag != '') }} # Repo admins should configure the release environment and copy signing # secrets there before moving them off repo-level Actions secrets. environment: release @@ -281,13 +384,75 @@ jobs: - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: - name: bundle-${{ matrix.target }} + name: bundle-${{ matrix.target }}-${{ github.run_id }}-${{ github.run_attempt }} path: dist-artifacts/* if-no-files-found: error + # Signing and notarization are intentionally non-deterministic. Keep every + # successful matrix artifact under an attempt-qualified name, then select the + # earliest successful artifact for each target. A release/stage rerun therefore + # reuses the exact first bytes instead of creating a second immutable payload. + select_artifacts: + needs: [prepare, build] + if: ${{ always() && needs.prepare.result == 'success' }} + runs-on: ubuntu-latest + permissions: + actions: read + contents: read + outputs: + artifact_names: ${{ steps.select.outputs.artifact_names }} + steps: + - name: Select canonical build artifacts + id: select + if: ${{ needs.prepare.outputs.release_reusable != 'true' }} + shell: bash + env: + GH_TOKEN: ${{ github.token }} + run: | + set -euo pipefail + targets=( + aarch64-apple-darwin + x86_64-apple-darwin + x86_64-pc-windows-msvc + aarch64-pc-windows-msvc + ) + names_file="$RUNNER_TEMP/canonical-artifact-names.txt" + : > "$names_file" + for poll in 1 2 3 4 5; do + gh api --paginate \ + "repos/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID/artifacts?per_page=100" \ + --jq '.artifacts[].name' > "$RUNNER_TEMP/run-artifacts.txt" + : > "$names_file" + complete=true + for target in "${targets[@]}"; do + selected="" + for attempt in $(seq 1 "$GITHUB_RUN_ATTEMPT"); do + candidate="bundle-${target}-${GITHUB_RUN_ID}-${attempt}" + if grep -Fxq "$candidate" "$RUNNER_TEMP/run-artifacts.txt"; then + selected="$candidate" + break + fi + done + if [[ -z "$selected" ]]; then + complete=false + break + fi + echo "$selected" >> "$names_file" + done + [[ "$complete" == "true" ]] && break + sleep 5 + done + [[ "$complete" == "true" ]] || { + echo "::error::no complete canonical release artifact set exists for this run" + exit 1 + } + artifact_names="$(jq -Rsc 'split("\n") | map(select(length > 0))' "$names_file")" + echo "artifact_names=$artifact_names" >> "$GITHUB_OUTPUT" + echo "Canonical artifacts: $artifact_names" + release: - if: ${{ github.ref_type == 'tag' && startsWith(github.ref_name, 'v') }} - needs: build + if: ${{ always() && needs.prepare.result == 'success' && needs.select_artifacts.result == 'success' && startsWith(inputs.target_tag || github.ref_name, 'v') }} + needs: [prepare, build, select_artifacts] # Repo admins should configure the release environment and copy mirror # secrets there before moving them off repo-level Actions secrets. environment: release @@ -302,14 +467,167 @@ jobs: with: persist-credentials: false + # Historical workflow revisions used the legacy credential names and wrote + # latest.json unconditionally. Keeping those secrets deleted is the storage + # authorization boundary that makes an old run's "Re-run all jobs" fail + # before it can mutate either mirror. + - name: Enforce legacy mirror credential revocation + shell: bash + env: + LEGACY_R2_ACCESS_KEY_ID: ${{ secrets.MANAGER_R2_ACCESS_KEY_ID }} + LEGACY_R2_SECRET_ACCESS_KEY: ${{ secrets.MANAGER_R2_SECRET_ACCESS_KEY }} + LEGACY_IHEP_ACCESS_KEY_ID: ${{ secrets.MANAGER_IHEP_S3_ACCESS_KEY_ID }} + LEGACY_IHEP_SECRET_ACCESS_KEY: ${{ secrets.MANAGER_IHEP_S3_SECRET_ACCESS_KEY }} + run: | + if [[ -n "$LEGACY_R2_ACCESS_KEY_ID$LEGACY_R2_SECRET_ACCESS_KEY$LEGACY_IHEP_ACCESS_KEY_ID$LEGACY_IHEP_SECRET_ACCESS_KEY" ]]; then + echo "::error::legacy mirror write secrets are still configured; move credentials to the *_PROMOTION_* names and delete all four legacy access-key secrets" + exit 1 + fi + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 with: node-version: 20 - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 - with: - path: dist - merge-multiple: true + # Re-check on every release-job attempt. `prepare` is not rerun by + # "Re-run failed jobs", and publishing a resumed draft while the setting is + # disabled would create a mutable canonical source. + - name: Re-check GitHub Immutable Releases + env: + GH_TOKEN: ${{ secrets.IMMUTABLE_RELEASES_READ_TOKEN }} + run: node scripts/check-immutable-releases.mjs + + # `prepare` may belong to an earlier run attempt when the operator chooses + # "Re-run failed jobs". Refresh the release state inside this job so a + # GitHub Release published by the failed attempt becomes the canonical, + # immutable byte source instead of being uploaded a second time. + - name: Refresh immutable release state + id: live_release + shell: bash + env: + GH_TOKEN: ${{ github.token }} + REQUESTED_TARGET_TAG: ${{ inputs.target_tag || '' }} + run: | + set -euo pipefail + lookup_error="$RUNNER_TEMP/live-release-lookup-error.txt" + release_json="$RUNNER_TEMP/live-release.json" + if gh api "repos/$GITHUB_REPOSITORY/releases/tags/$RELEASE_TAG" >"$release_json" 2>"$lookup_error"; then + REQUESTED_TARGET_TAG="$REQUESTED_TARGET_TAG" \ + node scripts/check-release-reuse.mjs "$RELEASE_TAG" "$release_json" + elif grep -q 'HTTP 404' "$lookup_error"; then + if [[ -n "$REQUESTED_TARGET_TAG" ]]; then + echo "::error::target_tag $REQUESTED_TARGET_TAG must already exist as a GitHub Release" + exit 1 + fi + echo "release_reusable=false" >> "$GITHUB_OUTPUT" + echo "release_asset_digests={}" >> "$GITHUB_OUTPUT" + else + cat "$lookup_error" >&2 + echo "::error::could not refresh release state for $RELEASE_TAG" + exit 1 + fi + + # A target_tag dispatch intentionally checks out the protected default + # branch so historical workflow code cannot run. The updater trust root is + # release data, however, and must come from the target tag: a later key + # rotation must not make valid immutable historical artifacts unverifiable. + - name: Resolve updater trust root for release tag + shell: bash + env: + GH_TOKEN: ${{ github.token }} + run: | + set -euo pipefail + release_config="$RUNNER_TEMP/release-tauri.conf.json" + gh api --method GET \ + -H "Accept: application/vnd.github.raw+json" \ + "repos/$GITHUB_REPOSITORY/contents/src-tauri/tauri.conf.json" \ + -f ref="$RELEASE_TAG" >"$release_config" + if ! updater_public_key="$( + jq -er ' + .plugins.updater.pubkey + | select(type == "string" and length > 0) + | select((contains("\n") or contains("\r")) | not) + | select(test("^[A-Za-z0-9+/]+={0,2}$")) + ' "$release_config" + )"; then + echo "::error::release tag $RELEASE_TAG has no valid single-line updater public key" + exit 1 + fi + printf 'RELEASE_TAURI_CONFIG=%s\n' "$release_config" >> "$GITHUB_ENV" + printf 'MIRROR_UPDATER_PUBLIC_KEY=%s\n' "$updater_public_key" >> "$GITHUB_ENV" + + - name: Download canonical build artifacts + if: ${{ steps.live_release.outputs.release_reusable != 'true' }} + shell: bash + env: + ARTIFACT_NAMES_JSON: ${{ needs.select_artifacts.outputs.artifact_names }} + GH_TOKEN: ${{ github.token }} + run: | + set -euo pipefail + rm -rf dist + mkdir -p dist + jq -er '.[]' <<<"$ARTIFACT_NAMES_JSON" | while IFS= read -r artifact; do + gh run download "$GITHUB_RUN_ID" \ + --repo "$GITHUB_REPOSITORY" \ + --name "$artifact" \ + --dir dist + done + + # A same-tag rerun or emergency downgrade must use the bytes already + # published for that tag. Rebuilding signed/notarized artifacts is + # intentionally non-reproducible and would conflict with immutable keys. + - name: Resolve immutable release artifact source + id: release_source + shell: bash + env: + GH_TOKEN: ${{ github.token }} + RELEASE_ASSET_DIGESTS: ${{ steps.live_release.outputs.release_asset_digests }} + run: | + set -euo pipefail + if [[ "${{ steps.live_release.outputs.release_reusable }}" == "true" ]]; then + published="$RUNNER_TEMP/published-release-artifacts" + rm -rf "$published" + mkdir -p "$published" + gh release download "$RELEASE_TAG" \ + --repo "$GITHUB_REPOSITORY" \ + --dir "$published" \ + --pattern 'CodexAppManager*' \ + --pattern 'latest.json' + test -f "$published/latest.json" || { + echo "::error::published $RELEASE_TAG has no latest.json" + exit 1 + } + jq -e 'type == "object" and length > 0' <<<"$RELEASE_ASSET_DIGESTS" >/dev/null || { + echo "::error::immutable release digest evidence is missing" + exit 1 + } + while IFS=$'\t' read -r name expected_digest; do + file="$published/$name" + test -f "$file" || { + echo "::error::immutable release asset is missing after download: $name" + exit 1 + } + actual_digest="sha256:$(sha256sum "$file" | cut -d' ' -f1)" + if [[ "$actual_digest" != "$expected_digest" ]]; then + echo "::error::immutable release digest mismatch for $name" + exit 1 + fi + echo "Verified immutable release digest: $name" + done < <(jq -r 'to_entries[] | [.key, .value] | @tsv' <<<"$RELEASE_ASSET_DIGESTS") + cp "$published/latest.json" "$RUNNER_TEMP/published-latest.json" + rm "$published/latest.json" + rm -rf dist + mv "$published" dist + echo "existing=true" >> "$GITHUB_OUTPUT" + echo "source=github-release" >> "$GITHUB_OUTPUT" + echo "Reusing immutable artifacts from existing release $RELEASE_TAG" + else + test -d dist || { + echo "::error::no build artifacts are available for new release $RELEASE_TAG" + exit 1 + } + echo "existing=false" >> "$GITHUB_OUTPUT" + echo "source=canonical-actions-artifacts" >> "$GITHUB_OUTPUT" + fi # Validate the merged *publishable* tree (renamed final names), not the # per-target intermediate build directories from the matrix jobs. @@ -322,12 +640,20 @@ jobs: missing=0 require() { local pattern="$1" + local matches # shellcheck disable=SC2086 - if ! compgen -G "dist/$pattern" > /dev/null; then + matches="$(compgen -G "dist/$pattern" || true)" + if [[ -z "$matches" ]]; then echo "::error::[build] missing final artifact matching: $pattern" missing=1 else - echo "OK $pattern → $(compgen -G "dist/$pattern" | tr '\n' ' ')" + while IFS= read -r file; do + if [[ ! -s "$file" ]]; then + echo "::error::[build] empty final artifact: $file" + missing=1 + fi + done <<<"$matches" + echo "OK $pattern → $(tr '\n' ' ' <<<"$matches")" fi } require "CodexAppManager_aarch64.dmg" @@ -350,29 +676,91 @@ jobs: - name: Generate updater manifest (latest.json) env: ALLOW_PARTIAL_RELEASE: ${{ vars.ALLOW_PARTIAL_RELEASE }} - run: node scripts/gen-updater-manifest.mjs "${{ github.ref_name }}" dist + run: | + node scripts/gen-updater-manifest.mjs "$RELEASE_TAG" dist + cp latest.json "$RUNNER_TEMP/artifact-derived-latest.json" + if [[ "${{ steps.release_source.outputs.existing }}" == "true" ]]; then + cp "$RUNNER_TEMP/published-latest.json" latest.json + fi + if [[ "$RELEASE_TAG" != *-* ]]; then + node scripts/validate-release-manifest.mjs \ + "$RELEASE_TAG" \ + latest.json \ + "$RUNNER_TEMP/artifact-derived-latest.json" + fi + + # A wrong private/public updater-key pairing cannot be repaired after an + # immutable GitHub Release is published. Verify the exact local payloads + # (including manifest/sidecar equality) before either mirror staging or + # draft publication. This also protects prereleases, which skip mirrors. + - name: Verify local updater signatures before immutable publication + run: | + node scripts/verify-release-artifacts.mjs \ + latest.json \ + dist \ + "$RELEASE_TAURI_CONFIG" - # Stable releases mirror in two phases: stage immutable versioned assets - # before GitHub Release publication, then promote latest.json only after + # Stable releases stage immutable versioned assets before GitHub Release + # publication, verify them separately, then promote latest.json only after # the GitHub Release succeeds. Pre-releases still skip the mirror entirely. - name: Stage CDN mirror candidate (R2 + IHEP S3) id: mirror_stage - if: ${{ !contains(github.ref_name, '-') }} + if: ${{ !contains(env.RELEASE_TAG, '-') }} env: MIRROR_PHASE: stage + MIRROR_REQUIRED_BACKENDS: r2,ihep + MIRROR_CANDIDATE_ID: ${{ github.run_id }}-${{ github.run_attempt }} + MIRROR_ALLOW_DOWNGRADE: ${{ inputs.allow_mirror_downgrade && '1' || '0' }} + MIRROR_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} + MIRROR_DOWNGRADE_REASON: ${{ inputs.mirror_downgrade_reason || '' }} + MIRROR_WORKFLOW_REF_NAME: ${{ github.ref_name }} + MANAGER_R2_S3_ENDPOINT: ${{ secrets.MANAGER_R2_S3_ENDPOINT }} + MANAGER_R2_BUCKET: ${{ vars.MANAGER_R2_BUCKET }} + MANAGER_R2_ACCESS_KEY_ID: ${{ secrets.MANAGER_R2_PROMOTION_ACCESS_KEY_ID }} + MANAGER_R2_SECRET_ACCESS_KEY: ${{ secrets.MANAGER_R2_PROMOTION_SECRET_ACCESS_KEY }} + MANAGER_IHEP_S3_ENDPOINT: ${{ secrets.MANAGER_IHEP_S3_ENDPOINT }} + MANAGER_IHEP_S3_BUCKET: ${{ secrets.MANAGER_IHEP_S3_BUCKET }} + MANAGER_IHEP_S3_REGION: ${{ secrets.MANAGER_IHEP_S3_REGION }} + MANAGER_IHEP_S3_PREFIX: ${{ secrets.MANAGER_IHEP_S3_PREFIX }} + MANAGER_IHEP_S3_ACCESS_KEY_ID: ${{ secrets.MANAGER_IHEP_S3_PROMOTION_ACCESS_KEY_ID }} + MANAGER_IHEP_S3_SECRET_ACCESS_KEY: ${{ secrets.MANAGER_IHEP_S3_PROMOTION_SECRET_ACCESS_KEY }} + run: | + [ -f dist/latest.json ] || cp latest.json dist/latest.json + bash scripts/sync-mirror.sh dist + # The GitHub Release uploads the root latest.json exactly once. Recreate + # dist/latest.json later for promotion instead of giving the upload + # action two paths with the same asset basename. + rm -f dist/latest.mirror.json dist/latest.json + + # Complete a direct readback from both object stores and force separate + # readbacks through the Worker's R2 and mainland-China IHEP branches. This + # is a verify-only phase: latest.json cannot be changed here. Both public + # branches must pass before GitHub publication becomes immutable. + - name: Verify staged CDN mirror before immutable publication + id: mirror_verify + if: ${{ !contains(env.RELEASE_TAG, '-') }} + env: + MIRROR_PHASE: verify + MIRROR_REQUIRED_BACKENDS: r2,ihep + MIRROR_CANDIDATE_ID: ${{ github.run_id }}-${{ github.run_attempt }} + MIRROR_ALLOW_DOWNGRADE: ${{ inputs.allow_mirror_downgrade && '1' || '0' }} + MIRROR_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} + MIRROR_DOWNGRADE_REASON: ${{ inputs.mirror_downgrade_reason || '' }} + MIRROR_WORKFLOW_REF_NAME: ${{ github.ref_name }} MANAGER_R2_S3_ENDPOINT: ${{ secrets.MANAGER_R2_S3_ENDPOINT }} - MANAGER_R2_ACCESS_KEY_ID: ${{ secrets.MANAGER_R2_ACCESS_KEY_ID }} - MANAGER_R2_SECRET_ACCESS_KEY: ${{ secrets.MANAGER_R2_SECRET_ACCESS_KEY }} + MANAGER_R2_BUCKET: ${{ vars.MANAGER_R2_BUCKET }} + MANAGER_R2_ACCESS_KEY_ID: ${{ secrets.MANAGER_R2_PROMOTION_ACCESS_KEY_ID }} + MANAGER_R2_SECRET_ACCESS_KEY: ${{ secrets.MANAGER_R2_PROMOTION_SECRET_ACCESS_KEY }} MANAGER_IHEP_S3_ENDPOINT: ${{ secrets.MANAGER_IHEP_S3_ENDPOINT }} MANAGER_IHEP_S3_BUCKET: ${{ secrets.MANAGER_IHEP_S3_BUCKET }} MANAGER_IHEP_S3_REGION: ${{ secrets.MANAGER_IHEP_S3_REGION }} MANAGER_IHEP_S3_PREFIX: ${{ secrets.MANAGER_IHEP_S3_PREFIX }} - MANAGER_IHEP_S3_ACCESS_KEY_ID: ${{ secrets.MANAGER_IHEP_S3_ACCESS_KEY_ID }} - MANAGER_IHEP_S3_SECRET_ACCESS_KEY: ${{ secrets.MANAGER_IHEP_S3_SECRET_ACCESS_KEY }} + MANAGER_IHEP_S3_ACCESS_KEY_ID: ${{ secrets.MANAGER_IHEP_S3_PROMOTION_ACCESS_KEY_ID }} + MANAGER_IHEP_S3_SECRET_ACCESS_KEY: ${{ secrets.MANAGER_IHEP_S3_PROMOTION_SECRET_ACCESS_KEY }} run: | [ -f dist/latest.json ] || cp latest.json dist/latest.json bash scripts/sync-mirror.sh dist - rm -f dist/latest.mirror.json + rm -f dist/latest.mirror.json dist/latest.json # ── release notes: the hand-written file from the version-bump PR # (docs/releases/.md, see docs/releases/TEMPLATE.md) wins; @@ -380,7 +768,7 @@ jobs: # empty. GitHub's auto "What's Changed" section is appended either way. - name: Prepare release notes run: | - NOTES="docs/releases/${{ github.ref_name }}.md" + NOTES="docs/releases/$RELEASE_TAG.md" if [ -f "$NOTES" ]; then cp "$NOTES" "$RUNNER_TEMP/release-notes.md" else @@ -432,17 +820,21 @@ jobs: exit "$status" - - name: Publish GitHub Release - id: publish_release + # Explicit draft-first publication keeps asset upload ahead of publication + # for both stable and prerelease tags. This is required when GitHub immutable + # releases are enabled: a published release can no longer accept assets. + - name: Upload GitHub Release draft + id: upload_release_draft + if: ${{ steps.release_source.outputs.existing != 'true' }} uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3 with: - tag_name: ${{ github.ref_name }} - draft: false + tag_name: ${{ env.RELEASE_TAG }} + draft: true # Tags carrying a pre-release identifier (e.g. v0.1.2-rc1) publish as a # prerelease, so GitHub's `releases/latest` — and the updater endpoint # pointing at it — keep resolving to the last stable build instead of # serving a release-candidate to real users. - prerelease: ${{ contains(github.ref_name, '-') }} + prerelease: ${{ contains(env.RELEASE_TAG, '-') }} body_path: ${{ runner.temp }}/release-notes.md generate_release_notes: true files: | @@ -451,36 +843,86 @@ jobs: SHA256SUMS release-assets/* + # Omitting `draft` tells action-gh-release v3 to publish the existing draft + # after all uploads succeeded while retaining its stable/prerelease metadata. + - name: Publish GitHub Release + id: publish_release + if: ${{ steps.release_source.outputs.existing != 'true' }} + uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3 + with: + tag_name: ${{ env.RELEASE_TAG }} + + - name: Verify published immutable Release and asset digests + if: ${{ steps.release_source.outputs.existing != 'true' }} + shell: bash + env: + GH_TOKEN: ${{ github.token }} + run: | + set -euo pipefail + release_json="$RUNNER_TEMP/published-release.json" + verification_log="$RUNNER_TEMP/published-release-verification.log" + verification_output="$RUNNER_TEMP/published-release-verification-output.txt" + verified=false + for attempt in 1 2 3 4 5; do + : > "$verification_log" + : > "$verification_output" + if gh api "repos/$GITHUB_REPOSITORY/releases/tags/$RELEASE_TAG" >"$release_json" 2>"$verification_log" \ + && REQUESTED_TARGET_TAG="$RELEASE_TAG" GITHUB_OUTPUT="$verification_output" \ + node scripts/check-release-reuse.mjs "$RELEASE_TAG" "$release_json" >>"$verification_log" 2>&1; then + verified=true + break + fi + sleep 3 + done + if [[ "$verified" != "true" ]]; then + cat "$verification_log" >&2 + echo "::error::published $RELEASE_TAG did not become immutable with canonical asset digests" + exit 1 + fi + cat "$verification_log" + + # Attest immediately after GitHub confirms the canonical immutable bytes, + # before mirror promotion can fail the job. Keep the subjects limited to + # updater payloads and latest.json: on a failed-job rerun those are fetched + # from the immutable Release and checked against GitHub's canonical SHA-256 + # digests. SHA256SUMS and SBOMs are intentionally excluded because they are + # regenerated locally and are not necessarily the bytes already published. + # A failed attestation must fail the job so the release stays retryable and + # neither mirror promotion nor winget dispatch can proceed without proof. + - name: Attest build provenance + id: attest + if: ${{ steps.publish_release.outcome == 'success' || steps.release_source.outputs.existing == 'true' }} + uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1 + with: + subject-path: | + dist/* + latest.json + - name: Promote CDN mirror latest (R2 + IHEP S3) id: mirror_promote - if: ${{ !contains(github.ref_name, '-') }} + if: ${{ success() && steps.attest.outcome == 'success' && !contains(env.RELEASE_TAG, '-') }} env: MIRROR_PHASE: promote + MIRROR_REQUIRED_BACKENDS: r2,ihep + MIRROR_CANDIDATE_ID: ${{ github.run_id }}-${{ github.run_attempt }} + MIRROR_ALLOW_DOWNGRADE: ${{ inputs.allow_mirror_downgrade && '1' || '0' }} + MIRROR_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} + MIRROR_DOWNGRADE_REASON: ${{ inputs.mirror_downgrade_reason || '' }} + MIRROR_WORKFLOW_REF_NAME: ${{ github.ref_name }} MANAGER_R2_S3_ENDPOINT: ${{ secrets.MANAGER_R2_S3_ENDPOINT }} - MANAGER_R2_ACCESS_KEY_ID: ${{ secrets.MANAGER_R2_ACCESS_KEY_ID }} - MANAGER_R2_SECRET_ACCESS_KEY: ${{ secrets.MANAGER_R2_SECRET_ACCESS_KEY }} + MANAGER_R2_BUCKET: ${{ vars.MANAGER_R2_BUCKET }} + MANAGER_R2_ACCESS_KEY_ID: ${{ secrets.MANAGER_R2_PROMOTION_ACCESS_KEY_ID }} + MANAGER_R2_SECRET_ACCESS_KEY: ${{ secrets.MANAGER_R2_PROMOTION_SECRET_ACCESS_KEY }} MANAGER_IHEP_S3_ENDPOINT: ${{ secrets.MANAGER_IHEP_S3_ENDPOINT }} MANAGER_IHEP_S3_BUCKET: ${{ secrets.MANAGER_IHEP_S3_BUCKET }} MANAGER_IHEP_S3_REGION: ${{ secrets.MANAGER_IHEP_S3_REGION }} MANAGER_IHEP_S3_PREFIX: ${{ secrets.MANAGER_IHEP_S3_PREFIX }} - MANAGER_IHEP_S3_ACCESS_KEY_ID: ${{ secrets.MANAGER_IHEP_S3_ACCESS_KEY_ID }} - MANAGER_IHEP_S3_SECRET_ACCESS_KEY: ${{ secrets.MANAGER_IHEP_S3_SECRET_ACCESS_KEY }} + MANAGER_IHEP_S3_ACCESS_KEY_ID: ${{ secrets.MANAGER_IHEP_S3_PROMOTION_ACCESS_KEY_ID }} + MANAGER_IHEP_S3_SECRET_ACCESS_KEY: ${{ secrets.MANAGER_IHEP_S3_PROMOTION_SECRET_ACCESS_KEY }} run: | [ -f dist/latest.json ] || cp latest.json dist/latest.json bash scripts/sync-mirror.sh dist - - name: Attest build provenance - id: attest - if: ${{ steps.publish_release.outcome == 'success' }} - continue-on-error: true - uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1 - with: - subject-path: | - dist/* - latest.json - SHA256SUMS - release-assets/* - # The release above is created with GITHUB_TOKEN, which by design does not # trigger other workflows — so winget.yml's `on: release` never fires. # Dispatch it explicitly (stable releases only). winget.yml no-ops cleanly @@ -488,11 +930,11 @@ jobs: # so a re-run is harmless. - name: Trigger winget submission id: winget - if: ${{ !contains(github.ref_name, '-') }} + if: ${{ success() && steps.attest.outcome == 'success' && !contains(env.RELEASE_TAG, '-') }} env: GH_TOKEN: ${{ github.token }} run: | - if gh workflow run winget.yml -f release-tag="${{ github.ref_name }}" --repo "${{ github.repository }}"; then + if gh workflow run winget.yml -f release-tag="$RELEASE_TAG" --repo "${{ github.repository }}"; then echo "status=dispatched" >> "$GITHUB_OUTPUT" else echo "::warning::winget dispatch failed" @@ -502,10 +944,26 @@ jobs: - name: Write release summary if: always() env: - PUBLISH_OUTCOME: ${{ steps.publish_release.outcome }} + PUBLISH_OUTCOME: ${{ steps.release_source.outputs.existing == 'true' && 'reused' || steps.publish_release.outcome }} MIRROR_STAGE_OUTCOME: ${{ steps.mirror_stage.outcome }} + MIRROR_VERIFY_OUTCOME: ${{ steps.mirror_verify.outcome }} MIRROR_PROMOTE_OUTCOME: ${{ steps.mirror_promote.outcome }} WINGET_OUTCOME: ${{ steps.winget.outputs.status || steps.winget.outcome }} SBOM_OUTCOME: ${{ steps.sbom.outcome }} ATTESTATION_OUTCOME: ${{ steps.attest.outcome }} run: node scripts/write-release-summary.mjs + + - name: Upload release audit records + if: always() + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + with: + name: release-audit-${{ env.RELEASE_TAG }}-${{ github.run_attempt }} + path: | + manifest-summary.json + updater-signature-verification.json + mirror-stage-summary.json + mirror-verification-summary.json + mirror-promotion-summary.json + SHA256SUMS + if-no-files-found: warn + retention-days: 90 diff --git a/cloudflare/manager-download-router/README.md b/cloudflare/manager-download-router/README.md index 920e514..bb08eea 100644 --- a/cloudflare/manager-download-router/README.md +++ b/cloudflare/manager-download-router/README.md @@ -18,8 +18,12 @@ The updater (`src-tauri/tauri.conf.json`) already checks ## Why a separate latest.json on the mirror `latest.json`'s embedded signatures sign the artifact **bytes**, not the URL, so re-hosting the same files keeps them valid — we only rewrite the download URLs to -`…/manager//`. `scripts/sync-mirror.sh` does this on every -(non-pre-)release. +`…/manager//`. `scripts/sync-mirror.sh` stages stable releases, +then verifies both storage endpoints and separately forces this Worker's R2 and +IHEP branches before the GitHub Release becomes immutable. Probe responses identify +their backend with `X-Codex-Mirror-Backend`; an explicit IHEP probe fails instead +of falling back when its Worker secrets are incomplete. The release repeats that +readback immediately before advancing the mirror's `latest.json` pointer. Installers are uploaded under a **per-version** key (`/`) and `latest.json` stays at the fixed root the updater polls. macOS updater tarballs @@ -31,7 +35,7 @@ self-consistent; v0.1.9+ use the versioned layout.) > ⚠️ The mirror's `latest.json` MUST be refreshed on every stable release, or the > first endpoint serves a stale version and **blocks** updates. That's why the -> `release.yml` "Sync to CDN mirror" step exists. +> `release.yml` stage, verify, and promote steps exist. ## Already provisioned (done) - R2 bucket `codex-app-manager` created. @@ -59,17 +63,27 @@ So each release uploads to the mirror (`release.yml` → `scripts/sync-mirror.sh | Secret | Notes | | --- | --- | | `MANAGER_R2_S3_ENDPOINT` | `https://d39dc6c92d1c4cfde580bf13e946b616.r2.cloudflarestorage.com` | -| `MANAGER_R2_ACCESS_KEY_ID` / `MANAGER_R2_SECRET_ACCESS_KEY` | R2 S3 API token (can reuse the mirror's; account-scoped) | -| `MANAGER_IHEP_S3_ENDPOINT` / `_BUCKET` / `_ACCESS_KEY_ID` / `_SECRET_ACCESS_KEY` | IHEP creds (optional; `_REGION`/`_PREFIX` optional) | +| `MANAGER_R2_PROMOTION_ACCESS_KEY_ID` / `MANAGER_R2_PROMOTION_SECRET_ACCESS_KEY` | R2 S3 API token for the current protected release workflow | +| `MANAGER_IHEP_S3_ENDPOINT` / `_BUCKET` | IHEP endpoint and bucket (`_REGION`/`_PREFIX` optional) | +| `MANAGER_IHEP_S3_PROMOTION_ACCESS_KEY_ID` / `MANAGER_IHEP_S3_PROMOTION_SECRET_ACCESS_KEY` | IHEP token for the current protected release workflow | -R2 secrets missing → step warns and skips (mirror goes stale). IHEP missing → -CN just falls back to R2 via the worker. +Both backends must already contain the same valid `latest.json` baseline and must +support conditional `PutObject` (`If-Match` / `If-None-Match`) plus custom +user-metadata round trips through `HeadObject`. Delete the legacy access-key secret +names after migration so historical workflow revisions cannot perform their old +unconditional write. + +Deploy this Worker revision before enabling the protected release workflow. The +release gate intentionally rejects an older Worker that cannot force and identify +both public backend branches. ## Deploy / manual sync ```bash wrangler deploy # from this directory # manual re-sync of a tag's assets (download release → rewrite → upload): -# gh release download vX.Y.Z -D dist && cp -f dist/latest.json dist/ && \ +# rm -rf dist && gh release download vX.Y.Z -D dist && \ # MANAGER_R2_S3_ENDPOINT=… MANAGER_R2_ACCESS_KEY_ID=… MANAGER_R2_SECRET_ACCESS_KEY=… \ +# MANAGER_IHEP_S3_ENDPOINT=… MANAGER_IHEP_S3_BUCKET=… \ +# MANAGER_IHEP_S3_ACCESS_KEY_ID=… MANAGER_IHEP_S3_SECRET_ACCESS_KEY=… \ # bash ../../scripts/sync-mirror.sh dist ``` diff --git a/cloudflare/manager-download-router/src/index.js b/cloudflare/manager-download-router/src/index.js index 7856a06..34e1717 100644 --- a/cloudflare/manager-download-router/src/index.js +++ b/cloudflare/manager-download-router/src/index.js @@ -38,6 +38,7 @@ export default { } const country = request.cf?.country || request.headers.get("CF-IPCountry") || ""; + const probeBackend = requestedProbeBackend(url); const secondaryCountryCodes = new Set( (env.SECONDARY_COUNTRY_CODES || DEFAULT_SECONDARY_COUNTRY_CODES) .split(",") @@ -46,7 +47,19 @@ export default { ); // ── Mainland China: presign the IHEP S3 object and redirect ────────────── - if (secondaryCountryCodes.has(country.toUpperCase()) && hasSecondaryS3Config(env)) { + const secondaryConfigured = hasSecondaryS3Config(env); + if (probeBackend === "ihep" && !secondaryConfigured) { + return new Response("Secondary mirror is not configured", { + status: 503, + headers: { "X-Codex-Mirror-Backend": "ihep" }, + }); + } + const useSecondary = + probeBackend === "ihep" || + (probeBackend !== "r2" && + secondaryCountryCodes.has(country.toUpperCase()) && + secondaryConfigured); + if (useSecondary) { const objectKey = objectKeyForKey(key, env.SECONDARY_S3_PREFIX || ""); const signedUrl = await presignS3Url({ // Sign for the actual method: the redirect preserves it, and an @@ -62,7 +75,7 @@ export default { expiresInSeconds: ttlSeconds(env.SECONDARY_S3_SIGNED_URL_TTL_SECONDS), responseHeaders: {}, }); - return redirect(signedUrl); + return redirect(signedUrl, "ihep"); } // ── Everyone else: stream straight from the bound R2 bucket ────────────── @@ -74,6 +87,7 @@ export default { object.writeHttpMetadata(headers); // Content-Type etc. from R2 metadata headers.set("ETag", object.httpEtag); headers.set("Cache-Control", cacheControlForKey(key)); + headers.set("X-Codex-Mirror-Backend", "r2"); if (request.method === "HEAD") { return new Response(null, { headers }); } @@ -97,16 +111,32 @@ function hasSecondaryS3Config(env) { ); } +// Release verification must exercise both geographic branches from a single +// GitHub runner. This is a routing selector, not an authorization mechanism: +// every addressed object is already public through this Worker. Requiring the +// run-specific probe token shape prevents ordinary download links from changing +// backend accidentally while allowing CI to force and identify each branch. +function requestedProbeBackend(url) { + const token = url.searchParams.get("cam_probe") || ""; + const backend = url.searchParams.get("cam_backend") || ""; + if (!/^[0-9a-f]{24}$/.test(token)) return null; + return ["r2", "ihep"].includes(backend) ? backend : null; +} + function ttlSeconds(value) { const parsed = Number.parseInt(value || DEFAULT_SIGNED_URL_TTL_SECONDS, 10); if (!Number.isFinite(parsed)) return DEFAULT_SIGNED_URL_TTL_SECONDS; return Math.min(Math.max(parsed, 1), 604800); } -function redirect(location) { +function redirect(location, backend) { return new Response(null, { status: 302, - headers: { Location: location, "Cache-Control": "private, no-store" }, + headers: { + Location: location, + "Cache-Control": "private, no-store", + "X-Codex-Mirror-Backend": backend, + }, }); } diff --git a/cloudflare/manager-download-router/test/index.test.js b/cloudflare/manager-download-router/test/index.test.js index e49431a..fefd681 100644 --- a/cloudflare/manager-download-router/test/index.test.js +++ b/cloudflare/manager-download-router/test/index.test.js @@ -1,6 +1,8 @@ import { describe, expect, it } from "vitest"; import worker from "../src/index.js"; +const PROBE_TOKEN = "0123456789abcdef01234567"; + const latestManifest = JSON.stringify({ version: "0.1.18", platforms: { @@ -140,6 +142,7 @@ describe("manager download router", () => { const jsonRes = await worker.fetch(request("/manager/0.1.18/latest.json"), jsonEnv); expect(jsonRes.status).toBe(200); expect(jsonRes.headers.get("Cache-Control")).toBe("public, max-age=120, s-maxage=120"); + expect(jsonRes.headers.get("X-Codex-Mirror-Backend")).toBe("r2"); const installerEnv = { BUCKET: bucket({ @@ -166,6 +169,7 @@ describe("manager download router", () => { ); expect(res.status).toBe(302); + expect(res.headers.get("X-Codex-Mirror-Backend")).toBe("ihep"); const location = new URL(res.headers.get("Location")); expect(location.origin).toBe("https://s3.example.test"); expect(location.pathname).toBe("/root/mirror-bucket/manager/0.1.18/CodexAppManager_0.1.18_x64-setup.exe"); @@ -195,6 +199,42 @@ describe("manager download router", () => { expect(calls).toEqual(["0.1.18/CodexAppManager_0.1.18_x64-setup.exe"]); }); + it("lets release probes force and identify both geographic backends", async () => { + const calls = []; + const path = "/manager/0.1.18/CodexAppManager_0.1.18_x64-setup.exe"; + const env = { + BUCKET: bucket( + { "0.1.18/CodexAppManager_0.1.18_x64-setup.exe": r2Object("installer") }, + calls, + ), + ...secondaryEnv(), + }; + + const forcedR2 = await worker.fetch( + request(`${path}?cam_probe=${PROBE_TOKEN}&cam_backend=r2`, {}, { country: "CN" }), + env, + ); + expect(forcedR2.status).toBe(200); + expect(forcedR2.headers.get("X-Codex-Mirror-Backend")).toBe("r2"); + expect(await forcedR2.text()).toBe("installer"); + + const forcedIhep = await worker.fetch( + request(`${path}?cam_probe=${PROBE_TOKEN}&cam_backend=ihep`, {}, { country: "US" }), + env, + ); + expect(forcedIhep.status).toBe(302); + expect(forcedIhep.headers.get("X-Codex-Mirror-Backend")).toBe("ihep"); + expect(new URL(forcedIhep.headers.get("Location")).origin).toBe("https://s3.example.test"); + expect(calls).toEqual(["0.1.18/CodexAppManager_0.1.18_x64-setup.exe"]); + + const missingSecondary = await worker.fetch( + request(`${path}?cam_probe=${PROBE_TOKEN}&cam_backend=ihep`), + { BUCKET: bucket({}), ...secondaryEnv({ SECONDARY_S3_SECRET_ACCESS_KEY: "" }) }, + ); + expect(missingSecondary.status).toBe(503); + expect(missingSecondary.headers.get("X-Codex-Mirror-Backend")).toBe("ihep"); + }); + it("rejects empty keys, directory keys, and traversal-looking keys", async () => { const calls = []; const env = { BUCKET: bucket({}, calls) }; diff --git a/docs/release.md b/docs/release.md index 5e6a7e3..ff9369a 100644 --- a/docs/release.md +++ b/docs/release.md @@ -67,6 +67,93 @@ PR-time x64 packaged smoke lives in Required CI (`ci.yml`) also runs standalone engine crate tests for `codex-mac-engine` and `codex-win-engine`. +## Mirror promotion safety + +Stable releases use a stage/verify/promote, dual-backend protocol implemented by +[`scripts/mirror-release.mjs`](../scripts/mirror-release.mjs): + +1. Before uploading anything immutable, cryptographically verify every local + updater payload against its manifest signature and the updater public key in + `tauri.conf.json`. The manifest signature must also equal the local `.sig` + sidecar. This gate runs for prereleases as well as stable releases. +2. Upload immutable, versioned artifacts and a run-specific candidate manifest + to both R2 and IHEP. A versioned object is never overwritten. +3. Before publishing the GitHub Release, download the candidate and **every staged + artifact** directly from each S3 endpoint. Verify every file's byte size and + SHA-256, plus each updater bundle's embedded Tauri/minisign signature with the + public key in `tauri.conf.json`. This includes both DMG installers even though + they are not referenced by the updater manifest. Stable promotion requires all + four updater platforms and requires every manifest signature to match its + downloaded `.sig` sidecar; `ALLOW_PARTIAL_RELEASE` cannot weaken the + mirror gate. The same verify-only phase forces separate downloads of the + run-specific candidate and all four updater payloads through the public + Worker's R2 and mainland-China IHEP branches. Each response must identify the + requested backend, catching bad routes, bucket bindings, Worker secondary + credentials, and presigned redirects before immutable publication. +4. Publish the draft GitHub Release and require GitHub to report that it is + immutable with canonical asset digests. +5. Repeat the complete direct-backend and public-route readback immediately before + promotion, then read each backend's current `latest.json` and compare semantic + versions. Newer candidates advance, same-version reruns are + no-write/idempotent, and older tags fail closed. +6. Publish with ETag (`If-Match` / `If-None-Match`) conditions. If the second + backend or final verification fails, restore every backend already changed, + also using ETag conditions so rollback cannot overwrite a concurrent writer. + +The release workflow has one repository-wide `release-latest-*` concurrency lane +with `queue: max`, so every pending tag remains queued instead of a third tag +replacing the second. The object-store conditions remain the independent backstop +for manual/external writes. `mirror-stage-summary.json`, +`mirror-verification-summary.json`, and `mirror-promotion-summary.json` are shown +in the job summary and retained as workflow artifacts for 90 days. If a runner is +hard-killed after only one +`latest.json` write, a fresh run recognizes the exact candidate identity, leaves +that backend untouched, and conditionally advances only the lagging backend. + +Before `prepare` permits any build, and again at the start of every release-job +attempt, the workflow queries the repository Immutable Releases setting with a +dedicated fine-grained, read-only token. A missing token, failed query, or +`enabled: false` response fails closed before draft upload or mirror publication. + +Same-tag reruns reuse the artifacts and `latest.json` attached to a complete, +published GitHub Release only when GitHub reports `immutable: true` and a canonical +`sha256:` digest for every required asset. The workflow re-hashes every downloaded +asset against those API digests, and rejects a mutable release instead of calling +its current bytes canonical. Only a draft is repairable; a published mutable or +incomplete Release fails closed before any asset upload. The release job performs +this lookup live rather than +trusting `prepare` outputs from an earlier attempt, so **Re-run failed jobs** after +a mirror failure reuses the already-published immutable bytes. While a new or +partial release is still being repaired, the workflow selects the earliest +successful, attempt-qualified Actions artifact for each platform so every rerun +stages the same signed/notarized bytes. It never creates a second byte sequence for +an immutable version key. New releases are uploaded as drafts first and published +only after all assets succeed, including prereleases. Immediately after publish, +the workflow requires the Release itself to report `immutable: true` and canonical +digests for every required asset before any mirror pointer can advance. A +historical Actions run still executes its historical workflow revision, so the +release environment intentionally uses new `*_PROMOTION_*` credential names. The +four legacy access-key secrets listed below must be deleted; the current workflow +has a hard gate that rejects them if they are reintroduced. + +### Emergency mirror downgrade + +A normal old-tag rerun can never downgrade the mirror. For an incident rollback: + +1. Open the current `Release` workflow and dispatch it from the repository's + **default branch** (never select the historical tag's workflow revision). +2. Set `target_tag` to the already-published `vX.Y.Z` release to restore. +3. Enable `allow_mirror_downgrade`. +4. Enter a concrete `mirror_downgrade_reason` (at least 10 characters). + +The workflow downloads the target release's original assets instead of rebuilding +them. The target GitHub Release must be immutable and expose canonical SHA-256 +digests; older mutable releases must first be migrated through an explicitly +reviewed process and cannot be used directly. The script rejects the override on +tag-push events or without GitHub actor/run metadata. The triggering actor (plus +the original workflow actor on a rerun), reason, whether the override was actually +used, and the run URL are written to the promotion audit and job summary. + ## Required GitHub Actions secrets | Secret | What | @@ -80,8 +167,24 @@ Required CI (`ci.yml`) also runs standalone engine crate tests for | `AC_API_KEY_BASE64` | base64 of the `AuthKey_XXXX.p8` | | `TAURI_SIGNING_PRIVATE_KEY` | updater private key | | `TAURI_SIGNING_PRIVATE_KEY_PASSWORD` | its password (empty if none) | - -### Optional Windows Authenticode secrets / vars +| `IMMUTABLE_RELEASES_READ_TOKEN` | fine-grained token used only to read this repository's Immutable Releases setting; grant **Administration: read-only** and store it in the `release` environment | +| `MANAGER_R2_S3_ENDPOINT` | R2 S3-compatible endpoint | +| `MANAGER_R2_PROMOTION_ACCESS_KEY_ID` | R2 write/read credential used only by the protected workflow | +| `MANAGER_R2_PROMOTION_SECRET_ACCESS_KEY` | R2 write/read secret used only by the protected workflow | +| `MANAGER_IHEP_S3_ENDPOINT` | IHEP S3-compatible endpoint | +| `MANAGER_IHEP_S3_BUCKET` | IHEP bucket | +| `MANAGER_IHEP_S3_REGION` | IHEP region; defaults to `auto` when empty | +| `MANAGER_IHEP_S3_PREFIX` | optional object-key prefix for IHEP | +| `MANAGER_IHEP_S3_PROMOTION_ACCESS_KEY_ID` | IHEP write/read credential used only by the protected workflow | +| `MANAGER_IHEP_S3_PROMOTION_SECRET_ACCESS_KEY` | IHEP write/read secret used only by the protected workflow | + +After creating the promotion credentials, delete (and preferably revoke/rotate) +`MANAGER_R2_ACCESS_KEY_ID`, `MANAGER_R2_SECRET_ACCESS_KEY`, +`MANAGER_IHEP_S3_ACCESS_KEY_ID`, and `MANAGER_IHEP_S3_SECRET_ACCESS_KEY` from the +repository and `release` environment. Historical workflow revisions reference +those exact names; leaving any of them available defeats old-run isolation. + +### Optional signing secrets and release variables | Name | What | |---|---| @@ -89,6 +192,7 @@ Required CI (`ci.yml`) also runs standalone engine crate tests for | `WINDOWS_CERTIFICATE_PASSWORD` | password for that .pfx | | `AUTHENTICODE_REQUIRED` (repo **variable**) | `true` → fail release when PE is not `Valid` | | `WINDOWS_TIMESTAMP_URL` (repo **variable**) | optional RFC3161 timestamp URL | +| `MANAGER_R2_BUCKET` (repo **variable**) | R2 bucket; defaults to `codex-app-manager` | Export your local .p12 / .p8 / .pfx to base64 with `base64 -i file -o -`. @@ -98,3 +202,9 @@ Export your local .p12 / .p8 / .pfx to base64 with `base64 -i file -o -`. > > Keep **updater signature**, **Authenticode**, and **SmartScreen reputation** > conceptually separate — see [`docs/windows-signing.md`](./windows-signing.md). +> +> Before enabling promotion, seed both S3-compatible endpoints with a valid +> `latest.json` baseline. Both endpoints must support conditional `PutObject` +> requests (`If-Match` / `If-None-Match`) and must preserve custom user metadata +> through `HeadObject`. Promotion fails closed if either baseline is absent or an +> endpoint cannot enforce those requirements. diff --git a/package.json b/package.json index 89e1ada..8cabff7 100644 --- a/package.json +++ b/package.json @@ -10,6 +10,7 @@ "check": "tsc --noEmit", "lint": "eslint . --max-warnings=0", "test": "vitest run", + "test:release": "vitest run scripts/mirror-release.test.mjs scripts/release-workflow.test.mjs", "tauri": "tauri", "tauri:dev": "tauri dev", "tauri:build": "tauri build", diff --git a/scripts/check-immutable-releases.mjs b/scripts/check-immutable-releases.mjs new file mode 100644 index 0000000..3ab5950 --- /dev/null +++ b/scripts/check-immutable-releases.mjs @@ -0,0 +1,75 @@ +#!/usr/bin/env node + +import { spawnSync } from "node:child_process"; +import { fileURLToPath } from "node:url"; + +const API_VERSION = "2026-03-10"; +const REPOSITORY_PATTERN = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/; + +export function assertImmutableReleasesEnabled(settings) { + if (!settings || typeof settings !== "object" || Array.isArray(settings)) { + throw new Error("GitHub Immutable Releases response must be an object"); + } + if (settings.enabled !== true) { + throw new Error( + "GitHub Immutable Releases are disabled; enable them before starting a release", + ); + } + return { enabled: true }; +} + +export function verifyImmutableReleases({ + repository = process.env.GITHUB_REPOSITORY || "", + token = process.env.GH_TOKEN || "", + runner = spawnSync, +} = {}) { + if (!REPOSITORY_PATTERN.test(repository)) { + throw new Error("GITHUB_REPOSITORY must be an owner/repository name"); + } + if (!token.trim()) { + throw new Error( + "IMMUTABLE_RELEASES_READ_TOKEN is missing; release preflight cannot verify repository settings", + ); + } + + const result = runner( + "gh", + [ + "api", + "-H", + `X-GitHub-Api-Version: ${API_VERSION}`, + `repos/${repository}/immutable-releases`, + ], + { + encoding: "utf8", + env: { ...process.env, GH_TOKEN: token }, + }, + ); + if (result.error || result.status !== 0) { + const detail = String(result.error?.message || result.stderr || result.stdout || "unknown error") + .replace(/\s+/g, " ") + .trim() + .slice(0, 500); + throw new Error( + `could not verify GitHub Immutable Releases with the read-only token: ${detail}`, + ); + } + + let settings; + try { + settings = JSON.parse(result.stdout); + } catch (error) { + throw new Error(`GitHub Immutable Releases response was not valid JSON: ${error.message}`); + } + return assertImmutableReleasesEnabled(settings); +} + +if (process.argv[1] === fileURLToPath(import.meta.url)) { + try { + verifyImmutableReleases(); + console.log("GitHub Immutable Releases are enabled"); + } catch (error) { + console.error(`::error::${error instanceof Error ? error.message : String(error)}`); + process.exitCode = 1; + } +} diff --git a/scripts/check-release-reuse.mjs b/scripts/check-release-reuse.mjs new file mode 100644 index 0000000..fa84e54 --- /dev/null +++ b/scripts/check-release-reuse.mjs @@ -0,0 +1,119 @@ +#!/usr/bin/env node + +import { appendFileSync, readFileSync } from "node:fs"; + +const RELEASE_TAG_PATTERN = + /^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/; + +export function requiredReleaseAssetNames(releaseTag) { + const tag = String(releaseTag); + if (!RELEASE_TAG_PATTERN.test(tag)) { + throw new Error(`release tag must be a semantic vX.Y.Z tag: ${releaseTag}`); + } + const version = tag.slice(1); + return [ + "latest.json", + "CodexAppManager_aarch64.dmg", + "CodexAppManager_x86_64.dmg", + "CodexAppManager_aarch64.app.tar.gz", + "CodexAppManager_aarch64.app.tar.gz.sig", + "CodexAppManager_x86_64.app.tar.gz", + "CodexAppManager_x86_64.app.tar.gz.sig", + `CodexAppManager_${version}_x64-setup.exe`, + `CodexAppManager_${version}_x64-setup.exe.sig`, + `CodexAppManager_${version}_arm64-setup.exe`, + `CodexAppManager_${version}_arm64-setup.exe.sig`, + ]; +} + +export function inspectReleaseForReuse(release, releaseTag) { + if (!release || typeof release !== "object" || Array.isArray(release)) { + throw new Error("GitHub release response must be a JSON object"); + } + const required = requiredReleaseAssetNames(releaseTag); + const assets = Array.isArray(release.assets) ? release.assets : []; + const missing = []; + for (const name of required) { + const matches = assets.filter((asset) => asset?.name === name); + if (matches.length !== 1 || !Number.isFinite(matches[0]?.size) || matches[0].size <= 0) { + missing.push(name); + } + } + + // Drafts are the only repairable state: their assets may still be replaced + // before publication. Never route a published Release back through upload. + if (release.draft !== false) { + return { + digests: {}, + missing, + reason: "draft", + reusable: false, + }; + } + if (release.immutable !== true) { + throw new Error( + `existing release ${releaseTag} is mutable; refusing to treat its current assets as canonical`, + ); + } + if (missing.length > 0) { + throw new Error( + `existing immutable release ${releaseTag} is missing required assets and cannot be repaired: ${missing.join(", ")}`, + ); + } + + const selectedAssets = assets.filter( + (asset) => asset?.name === "latest.json" || asset?.name?.startsWith("CodexAppManager"), + ); + const selectedNames = new Set(); + const digests = {}; + for (const asset of selectedAssets) { + const name = asset.name; + if (selectedNames.has(name)) { + throw new Error(`immutable release has duplicate downloadable asset names: ${name}`); + } + selectedNames.add(name); + if (!Number.isFinite(asset.size) || asset.size <= 0) { + throw new Error(`immutable release downloadable asset is empty: ${name}`); + } + const digest = asset.digest; + if (typeof digest !== "string" || !/^sha256:[0-9a-f]{64}$/.test(digest)) { + throw new Error(`immutable release asset has no canonical SHA-256 digest: ${name}`); + } + digests[name] = digest; + } + return { digests, missing: [], reason: null, reusable: true }; +} + +const isCli = process.argv[1]?.endsWith("check-release-reuse.mjs"); +if (isCli) { + const [, , releaseTag, releaseJsonPath] = process.argv; + const requestedTargetTag = process.env.REQUESTED_TARGET_TAG || ""; + const outputPath = process.env.GITHUB_OUTPUT; + try { + if (!releaseTag || !releaseJsonPath || !outputPath) { + throw new Error( + "usage: check-release-reuse.mjs with GITHUB_OUTPUT set", + ); + } + const release = JSON.parse(readFileSync(releaseJsonPath, "utf8")); + const result = inspectReleaseForReuse(release, releaseTag); + if (!result.reusable && requestedTargetTag) { + throw new Error( + `target_tag ${requestedTargetTag} is draft or missing required release assets: ${result.missing.join(", ") || result.reason}`, + ); + } + appendFileSync(outputPath, `release_reusable=${result.reusable ? "true" : "false"}\n`); + if (result.reusable) { + appendFileSync(outputPath, `release_asset_digests=${JSON.stringify(result.digests)}\n`); + console.log(`Existing immutable release ${releaseTag} has canonical digests for all assets`); + } else { + console.log( + `Existing release ${releaseTag} is not reusable yet (${result.reason}; ${result.missing.join(", ")})`, + ); + } + } catch (error) { + const detail = error instanceof Error ? error.message : String(error); + console.error(`::error::${detail}`); + process.exitCode = 1; + } +} diff --git a/scripts/mirror-release.mjs b/scripts/mirror-release.mjs new file mode 100755 index 0000000..c4bda1f --- /dev/null +++ b/scripts/mirror-release.mjs @@ -0,0 +1,1800 @@ +#!/usr/bin/env node + +import { spawn } from "node:child_process"; +import { + createHash, + createPublicKey, + randomUUID, + verify as cryptoVerify, +} from "node:crypto"; +import { createReadStream, createWriteStream } from "node:fs"; +import { + mkdir, + mkdtemp, + readFile, + readdir, + rm, + stat, + writeFile, +} from "node:fs/promises"; +import { tmpdir } from "node:os"; +import { dirname, join, resolve } from "node:path"; +import { Readable } from "node:stream"; +import { pipeline } from "node:stream/promises"; +import { fileURLToPath } from "node:url"; + +const SCRIPT_DIR = dirname(fileURLToPath(import.meta.url)); +const REPO_ROOT = resolve(SCRIPT_DIR, ".."); +const DEFAULT_MIRROR_BASE = "https://codexapp.agentsmirror.com/manager"; +const LATEST_KEY = "latest.json"; +const SUMMARY_SCHEMA_VERSION = 1; +const ED25519_SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex"); +export const REQUIRED_UPDATER_PLATFORMS = [ + "darwin-aarch64", + "darwin-x86_64", + "windows-x86_64", + "windows-aarch64", +]; + +let interruptedBy = null; +let rollbackInProgress = false; +const activeChildren = new Set(); + +export class ConditionalWriteError extends Error { + constructor(message) { + super(message); + this.name = "ConditionalWriteError"; + } +} + +export class DowngradeBlockedError extends Error { + constructor(message) { + super(message); + this.name = "DowngradeBlockedError"; + } +} + +class WriteOutcomeUncertainError extends Error { + constructor(message) { + super(message); + this.name = "WriteOutcomeUncertainError"; + } +} + +function errorText(error) { + if (error instanceof Error) return error.message; + return String(error); +} + +function nowIso() { + return new Date().toISOString(); +} + +function safeSummaryError(error) { + return errorText(error).replace(/\s+/g, " ").trim().slice(0, 2_000); +} + +function strictBase64(value, label) { + const normalized = String(value).trim(); + if ( + normalized.length === 0 || + normalized.length % 4 !== 0 || + !/^[A-Za-z0-9+/]+={0,2}$/.test(normalized) + ) { + throw new Error(`${label} is not valid base64`); + } + const decoded = Buffer.from(normalized, "base64"); + if (decoded.toString("base64") !== normalized) { + throw new Error(`${label} is not canonical base64`); + } + return decoded; +} + +export function parseSemver(value) { + const text = String(value).trim().replace(/^v/, ""); + const match = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/.exec( + text, + ); + if (!match) throw new Error(`invalid semantic version: ${value}`); + const prerelease = match[4] ? match[4].split(".") : []; + for (const identifier of prerelease) { + if (/^\d+$/.test(identifier) && identifier.length > 1 && identifier.startsWith("0")) { + throw new Error(`invalid semantic version prerelease: ${value}`); + } + } + return { + raw: text, + major: BigInt(match[1]), + minor: BigInt(match[2]), + patch: BigInt(match[3]), + prerelease, + }; +} + +export function compareSemver(left, right) { + const a = parseSemver(left); + const b = parseSemver(right); + for (const key of ["major", "minor", "patch"]) { + if (a[key] < b[key]) return -1; + if (a[key] > b[key]) return 1; + } + if (a.prerelease.length === 0 && b.prerelease.length === 0) return 0; + if (a.prerelease.length === 0) return 1; + if (b.prerelease.length === 0) return -1; + const count = Math.max(a.prerelease.length, b.prerelease.length); + for (let index = 0; index < count; index += 1) { + const av = a.prerelease[index]; + const bv = b.prerelease[index]; + if (av === undefined) return -1; + if (bv === undefined) return 1; + if (av === bv) continue; + const aNumeric = /^\d+$/.test(av); + const bNumeric = /^\d+$/.test(bv); + if (aNumeric && bNumeric) return BigInt(av) < BigInt(bv) ? -1 : 1; + if (aNumeric !== bNumeric) return aNumeric ? -1 : 1; + return av < bv ? -1 : 1; + } + return 0; +} + +function assertSafeSegment(value, label) { + if (!/^[A-Za-z0-9][A-Za-z0-9._+-]{0,127}$/.test(value) || value.includes("..")) { + throw new Error(`${label} contains unsafe characters: ${value}`); + } + return value; +} + +function normalizeMirrorBase(value) { + const parsed = new URL(String(value || DEFAULT_MIRROR_BASE).replace(/\/$/, "")); + if (parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.search || parsed.hash) { + throw new Error("MIRROR_BASE_URL must be an HTTPS origin/path without credentials, query, or fragment"); + } + return parsed.toString().replace(/\/$/, ""); +} + +export function candidateIdFromEnv(env = process.env) { + const explicit = env.MIRROR_CANDIDATE_ID?.trim(); + const fallback = `${env.GITHUB_RUN_ID || "local"}-${env.GITHUB_RUN_ATTEMPT || "1"}`; + return assertSafeSegment(explicit || fallback, "mirror candidate id"); +} + +export function candidateKeyFor(version, candidateId) { + const parsed = parseSemver(version).raw; + assertSafeSegment(parsed, "candidate version"); + assertSafeSegment(candidateId, "mirror candidate id"); + return `candidates/${parsed}/${candidateId}.json`; +} + +function promotionTokenForCandidate(candidateKey) { + return createHash("sha256").update(candidateKey).digest("hex"); +} + +async function readJson(path, label = path) { + let value; + try { + value = JSON.parse(await readFile(path, "utf8")); + } catch (error) { + throw new Error(`cannot read ${label}: ${errorText(error)}`); + } + if (!value || typeof value !== "object" || Array.isArray(value)) { + throw new Error(`${label} must contain a JSON object`); + } + return value; +} + +async function writeJson(path, value) { + await mkdir(dirname(resolve(path)), { recursive: true }); + await writeFile(path, `${JSON.stringify(value, null, 2)}\n`); +} + +async function sha256File(path) { + const hash = createHash("sha256"); + for await (const chunk of createReadStream(path)) hash.update(chunk); + return hash.digest("hex"); +} + +async function blake2bFile(path) { + const hash = createHash("blake2b512"); + for await (const chunk of createReadStream(path)) hash.update(chunk); + return hash.digest(); +} + +function parseUpdaterPublicKey(publicKeyBase64) { + const text = strictBase64(publicKeyBase64, "Tauri updater public key").toString("utf8"); + const lines = text.trim().split(/\r?\n/); + if (lines.length < 2) throw new Error("Tauri updater public key has invalid minisign encoding"); + const raw = strictBase64(lines[1], "minisign public key"); + if (raw.length !== 42 || !["Ed", "ED"].includes(raw.subarray(0, 2).toString("ascii"))) { + throw new Error("Tauri updater public key has unsupported minisign encoding"); + } + return { keyId: raw.subarray(2, 10), key: raw.subarray(10, 42) }; +} + +function parseUpdaterSignature(signatureBase64) { + const text = strictBase64(signatureBase64, "Tauri updater signature").toString("utf8"); + const lines = text.trim().split(/\r?\n/); + if (lines.length !== 4 || !lines[2].startsWith("trusted comment: ")) { + throw new Error("Tauri updater signature has invalid minisign encoding"); + } + const primary = strictBase64(lines[1], "minisign primary signature"); + const global = strictBase64(lines[3], "minisign global signature"); + if (primary.length !== 74 || global.length !== 64) { + throw new Error("Tauri updater signature has invalid minisign lengths"); + } + const algorithm = primary.subarray(0, 2).toString("ascii"); + if (!['Ed', 'ED'].includes(algorithm)) { + throw new Error(`unsupported minisign signature algorithm: ${algorithm}`); + } + return { + algorithm, + keyId: primary.subarray(2, 10), + signature: primary.subarray(10, 74), + trustedComment: lines[2].slice("trusted comment: ".length), + globalSignature: global, + }; +} + +export async function verifyTauriUpdaterSignature( + artifactPath, + signatureBase64, + publicKeyBase64, +) { + const publicKey = parseUpdaterPublicKey(publicKeyBase64); + const signature = parseUpdaterSignature(signatureBase64); + if (!publicKey.keyId.equals(signature.keyId)) { + throw new Error("Tauri updater signature key id does not match configured public key"); + } + const spki = Buffer.concat([ED25519_SPKI_PREFIX, publicKey.key]); + const key = createPublicKey({ key: spki, format: "der", type: "spki" }); + const payload = + signature.algorithm === "ED" + ? await blake2bFile(artifactPath) + : await readFile(artifactPath); + if (!cryptoVerify(null, payload, key, signature.signature)) { + throw new Error("Tauri updater artifact signature is invalid"); + } + const globalPayload = Buffer.concat([ + signature.signature, + Buffer.from(signature.trustedComment, "utf8"), + ]); + if (!cryptoVerify(null, globalPayload, key, signature.globalSignature)) { + throw new Error("Tauri updater trusted-comment signature is invalid"); + } + return true; +} + +function updaterArtifactsFromManifest(manifest, label) { + assertManifestShape(manifest, label); + const seenNames = new Set(); + return Object.entries(manifest.platforms) + .sort(([left], [right]) => left.localeCompare(right)) + .map(([platform, entry]) => { + const parsed = new URL(entry.url); + const rawName = parsed.pathname.split("/").filter(Boolean).at(-1); + const name = rawName ? decodeURIComponent(rawName) : ""; + assertSafeSegment(name, `${label} platform ${platform} artifact name`); + if (seenNames.has(name)) { + throw new Error(`multiple updater platforms resolve to the same artifact: ${name}`); + } + seenNames.add(name); + return { name, platform, signature: entry.signature, url: entry.url }; + }); +} + +export async function verifyLocalUpdaterArtifacts({ + manifest, + distDir, + publicKey, +}) { + const dist = resolve(distDir); + const reports = []; + for (const artifact of updaterArtifactsFromManifest(manifest, "release latest.json")) { + const artifactPath = join(dist, artifact.name); + const sidecarPath = `${artifactPath}.sig`; + let sidecar; + try { + sidecar = (await readFile(sidecarPath, "utf8")).trim(); + } catch (error) { + throw new Error( + `local updater signature sidecar is missing for ${artifact.platform}: ${errorText(error)}`, + ); + } + if (sidecar !== artifact.signature) { + throw new Error( + `local updater signature sidecar does not match manifest for ${artifact.platform}`, + ); + } + const metadata = await stat(artifactPath).catch((error) => { + throw new Error( + `local updater artifact is missing for ${artifact.platform}: ${errorText(error)}`, + ); + }); + if (!metadata.isFile() || metadata.size <= 0) { + throw new Error(`local updater artifact is empty for ${artifact.platform}`); + } + await verifyTauriUpdaterSignature(artifactPath, artifact.signature, publicKey); + reports.push({ + name: artifact.name, + platform: artifact.platform, + sha256: await sha256File(artifactPath), + size: metadata.size, + }); + } + return { artifactCount: reports.length, artifacts: reports, verified: true }; +} + +function manifestReleaseIdentity(manifest) { + const platforms = Object.fromEntries( + Object.entries(manifest.platforms || {}) + .sort(([left], [right]) => left.localeCompare(right)) + .map(([platform, entry]) => [ + platform, + { signature: entry?.signature || "", url: entry?.url || "" }, + ]), + ); + return JSON.stringify({ version: manifest.version, platforms }); +} + +function assertManifestShape(manifest, label) { + const version = parseSemver(manifest.version).raw; + if (!manifest.platforms || typeof manifest.platforms !== "object" || Array.isArray(manifest.platforms)) { + throw new Error(`${label} has no platforms object`); + } + const entries = Object.entries(manifest.platforms); + if (entries.length === 0) throw new Error(`${label} has no updater platforms`); + for (const [platform, entry] of entries) { + if (!entry || typeof entry.url !== "string" || typeof entry.signature !== "string") { + throw new Error(`${label} platform ${platform} is missing url/signature`); + } + if (!entry.url.trim()) { + throw new Error(`${label} platform ${platform} has an empty updater URL`); + } + if (!entry.signature.trim()) { + throw new Error(`${label} platform ${platform} has an empty updater signature`); + } + } + return version; +} + +function assertRequiredUpdaterPlatforms(manifest, label) { + const missing = REQUIRED_UPDATER_PLATFORMS.filter( + (platform) => !Object.hasOwn(manifest.platforms, platform), + ); + if (missing.length > 0) { + throw new Error(`${label} is missing required updater platforms: ${missing.join(", ")}`); + } +} + +export function assertCandidateMatchesRelease(candidateManifest, artifactManifest, releaseTag) { + const tag = String(releaseTag); + if (!tag.startsWith("v")) { + throw new Error(`release tag must start with v: ${releaseTag}`); + } + const expectedVersion = tag.slice(1); + if (parseSemver(expectedVersion).raw !== expectedVersion) { + throw new Error(`release tag must contain a canonical semantic version: ${releaseTag}`); + } + + assertManifestShape(candidateManifest, "candidate latest.json"); + assertManifestShape(artifactManifest, "artifact-derived latest.json"); + assertRequiredUpdaterPlatforms(candidateManifest, "candidate latest.json"); + assertRequiredUpdaterPlatforms(artifactManifest, "artifact-derived latest.json"); + if (candidateManifest.version !== expectedVersion) { + throw new Error( + `candidate latest.json version ${candidateManifest.version} does not match release tag ${releaseTag}`, + ); + } + if (artifactManifest.version !== expectedVersion) { + throw new Error( + `artifact-derived latest.json version ${artifactManifest.version} does not match release tag ${releaseTag}`, + ); + } + if (manifestReleaseIdentity(candidateManifest) !== manifestReleaseIdentity(artifactManifest)) { + throw new Error( + "candidate latest.json platforms/signatures do not match the artifact-derived manifest", + ); + } + return { + platformCount: Object.keys(candidateManifest.platforms).length, + version: expectedVersion, + }; +} + +export async function createMirrorManifest(distDir, mirrorBaseValue = DEFAULT_MIRROR_BASE) { + const dist = resolve(distDir); + const sourcePath = join(dist, "latest.json"); + const manifest = await readJson(sourcePath, "release latest.json"); + const version = assertManifestShape(manifest, "release latest.json"); + const mirrorBase = normalizeMirrorBase(mirrorBaseValue); + const rewritten = structuredClone(manifest); + for (const [platform, entry] of Object.entries(rewritten.platforms)) { + const original = new URL(entry.url); + const rawName = original.pathname.split("/").filter(Boolean).at(-1); + if (!rawName) throw new Error(`platform ${platform} URL has no artifact name`); + const name = decodeURIComponent(rawName); + assertSafeSegment(name, `platform ${platform} artifact name`); + entry.url = `${mirrorBase}/${encodeURIComponent(version)}/${encodeURIComponent(name)}`; + } + const outputPath = join(dist, "latest.mirror.json"); + await writeJson(outputPath, rewritten); + return { manifest: rewritten, mirrorBase, outputPath, version }; +} + +async function expectedArtifactsFromManifest(manifest, distDir, mirrorBase) { + const version = assertManifestShape(manifest, "mirror candidate"); + const expectedBase = `${normalizeMirrorBase(mirrorBase)}/${encodeURIComponent(version)}/`; + const updaterByName = new Map(); + for (const [platform, entry] of Object.entries(manifest.platforms).sort(([a], [b]) => a.localeCompare(b))) { + if (!entry.url.startsWith(expectedBase)) { + throw new Error(`platform ${platform} URL is not under ${expectedBase}`); + } + const parsed = new URL(entry.url); + const rawName = parsed.pathname.split("/").filter(Boolean).at(-1); + const name = rawName ? decodeURIComponent(rawName) : ""; + assertSafeSegment(name, `platform ${platform} artifact name`); + if (updaterByName.has(name)) { + throw new Error(`multiple updater platforms resolve to the same artifact: ${name}`); + } + updaterByName.set(name, { platform, signature: entry.signature }); + } + + for (const [name, updater] of updaterByName) { + const sidecarPath = join(resolve(distDir), `${name}.sig`); + let sidecar; + try { + sidecar = (await readFile(sidecarPath, "utf8")).trim(); + } catch (error) { + throw new Error( + `local updater signature sidecar is missing for ${updater.platform}: ${errorText(error)}`, + ); + } + if (sidecar !== updater.signature) { + throw new Error( + `local updater signature sidecar does not match manifest for ${updater.platform}`, + ); + } + } + + const artifacts = []; + const names = (await readdir(distDir)) + .filter((name) => !["latest.json", "latest.mirror.json"].includes(name)) + .sort(); + for (const name of names) { + assertSafeSegment(name, "release artifact name"); + const localPath = join(resolve(distDir), name); + const metadata = await stat(localPath); + if (!metadata.isFile()) continue; + const updater = updaterByName.get(name); + artifacts.push({ + platform: updater?.platform || null, + name, + key: `${version}/${name}`, + localPath, + size: metadata.size, + sha256: await sha256File(localPath), + signature: updater ? updater.signature : null, + }); + updaterByName.delete(name); + } + if (updaterByName.size > 0) { + throw new Error( + `local release artifacts are missing: ${[...updaterByName.keys()].join(", ")}`, + ); + } + return artifacts; +} + +function publicProbeUrl(value, candidateKey, backend) { + const parsed = new URL(value); + if (parsed.protocol !== "https:") { + throw new Error(`public mirror probe requires HTTPS: ${value}`); + } + parsed.searchParams.set( + "cam_probe", + createHash("sha256").update(candidateKey).digest("hex").slice(0, 24), + ); + parsed.searchParams.set("cam_backend", backend); + return parsed.toString(); +} + +async function downloadPublicObject(fetchImpl, url, destination, label, backend) { + await mkdir(dirname(destination), { recursive: true }); + let lastError; + for (let attempt = 1; attempt <= 5; attempt += 1) { + await rm(destination, { force: true }); + try { + let response = await fetchImpl(url, { + headers: { + "Cache-Control": "no-cache", + "User-Agent": "Codex-App-Manager release verifier", + }, + redirect: backend === "ihep" ? "manual" : "follow", + signal: AbortSignal.timeout(300_000), + }); + const routedBackend = response.headers.get("X-Codex-Mirror-Backend"); + if (routedBackend !== backend) { + await response.body?.cancel().catch(() => {}); + throw new Error( + `Worker reported backend ${routedBackend || "missing"}, expected ${backend}`, + ); + } + if (backend === "ihep") { + if (response.status !== 302) { + await response.body?.cancel().catch(() => {}); + throw new Error(`Worker IHEP probe returned HTTP ${response.status}`); + } + const location = response.headers.get("Location"); + const redirected = location ? new URL(location, url) : null; + if (!redirected || redirected.protocol !== "https:") { + throw new Error("Worker IHEP probe did not return a secure redirect"); + } + await response.body?.cancel().catch(() => {}); + response = await fetchImpl(redirected, { + headers: { "User-Agent": "Codex-App-Manager release verifier" }, + redirect: "follow", + signal: AbortSignal.timeout(300_000), + }); + } + if (!response.ok || !response.body) { + await response.body?.cancel().catch(() => {}); + throw new Error(`HTTP ${response.status}`); + } + await pipeline(Readable.fromWeb(response.body), createWriteStream(destination)); + return { path: destination, size: (await stat(destination)).size, url }; + } catch (error) { + await rm(destination, { force: true }); + lastError = error; + if (attempt < 5) { + await new Promise((resolveDelay) => setTimeout(resolveDelay, attempt * 1_000)); + } + } + } + throw new Error(`${label} public ${backend} download failed: ${errorText(lastError)}`); +} + +async function verifyPublicMirrorBackend({ + backend, + candidateKey, + candidateManifest, + candidatePath, + expectedByPlatform, + mirrorBase, + publicKey, + publicDir, + fetchImpl, +}) { + const encodedCandidateKey = candidateKey + .split("/") + .map((segment) => encodeURIComponent(segment)) + .join("/"); + const candidateUrl = publicProbeUrl( + `${normalizeMirrorBase(mirrorBase)}/${encodedCandidateKey}`, + candidateKey, + backend, + ); + const downloadedCandidate = join(publicDir, backend, "candidate.json"); + const candidateResponse = await downloadPublicObject( + fetchImpl, + candidateUrl, + downloadedCandidate, + "mirror candidate", + backend, + ); + const [localCandidateHash, publicCandidateHash] = await Promise.all([ + sha256File(candidatePath), + sha256File(downloadedCandidate), + ]); + if (localCandidateHash !== publicCandidateHash) { + throw new Error(`public mirror ${backend} candidate bytes do not match this release run`); + } + const publicManifest = await readJson( + downloadedCandidate, + `public mirror ${backend} candidate`, + ); + if ( + manifestReleaseIdentity(publicManifest) !== + manifestReleaseIdentity(candidateManifest) + ) { + throw new Error( + `public mirror ${backend} candidate release identity does not match this release run`, + ); + } + + const artifactReports = []; + for (const updater of updaterArtifactsFromManifest(candidateManifest, "mirror candidate")) { + const expected = expectedByPlatform.get(updater.platform); + if (!expected || expected.name !== updater.name) { + throw new Error( + `public mirror ${backend} probe has no bound artifact for ${updater.platform}`, + ); + } + const publicPath = join(publicDir, backend, updater.name); + const response = await downloadPublicObject( + fetchImpl, + publicProbeUrl(updater.url, candidateKey, backend), + publicPath, + `mirror artifact ${updater.name}`, + backend, + ); + if (response.size !== expected.size) { + throw new Error( + `public mirror ${backend} size mismatch for ${updater.name}: ${response.size} != ${expected.size}`, + ); + } + const publicHash = await sha256File(publicPath); + if (publicHash !== expected.sha256) { + throw new Error(`public mirror ${backend} sha256 mismatch for ${updater.name}`); + } + await verifyTauriUpdaterSignature(publicPath, updater.signature, publicKey); + artifactReports.push({ + name: updater.name, + platform: updater.platform, + sha256: publicHash, + size: response.size, + url: updater.url, + }); + await rm(publicPath, { force: true }); + } + return { + artifactCount: artifactReports.length, + artifacts: artifactReports, + backend, + candidateSha256: publicCandidateHash, + candidateSize: candidateResponse.size, + candidateUrl, + verified: true, + }; +} + +export async function verifyPublicMirrorRoute({ + candidateKey, + candidateManifest, + candidatePath, + expectedArtifacts, + mirrorBase, + publicKey, + workDir, + fetchImpl = fetch, +}) { + const expectedByPlatform = new Map( + expectedArtifacts + .filter((artifact) => artifact.platform) + .map((artifact) => [artifact.platform, artifact]), + ); + const backends = {}; + for (const backend of ["r2", "ihep"]) { + backends[backend] = await verifyPublicMirrorBackend({ + backend, + candidateKey, + candidateManifest, + candidatePath, + expectedByPlatform, + mirrorBase, + publicKey, + publicDir: join(workDir, "public-route"), + fetchImpl, + }); + } + return { + artifactCount: updaterArtifactsFromManifest(candidateManifest, "mirror candidate").length, + backendCount: Object.keys(backends).length, + backends, + verified: Object.values(backends).every((report) => report.verified), + }; +} + +function isNotFound(text) { + return /(?:\b404\b|NoSuchKey|Not Found|does not exist)/i.test(text); +} + +function isConditionalFailure(text) { + return /(?:\b409\b|\b412\b|PreconditionFailed|ConditionalRequestConflict|pre-?condition|conditional request conflict)/i.test( + text, + ); +} + +async function runProcess(command, args, options = {}) { + if (interruptedBy && !rollbackInProgress) { + throw new Error(`release interrupted by ${interruptedBy}`); + } + return await new Promise((resolvePromise, rejectPromise) => { + const child = spawn(command, args, { + cwd: options.cwd, + env: options.env, + stdio: ["ignore", "pipe", "pipe"], + }); + activeChildren.add(child); + let stdout = ""; + let stderr = ""; + child.stdout.on("data", (chunk) => { + if (stdout.length < 1_000_000) stdout += chunk.toString(); + }); + child.stderr.on("data", (chunk) => { + if (stderr.length < 1_000_000) stderr += chunk.toString(); + }); + child.on("error", (error) => { + activeChildren.delete(child); + rejectPromise(error); + }); + child.on("close", (code, signal) => { + activeChildren.delete(child); + const result = { code: code ?? 1, signal, stderr, stdout }; + if (code === 0 || options.allowFailure) resolvePromise(result); + else rejectPromise(new Error(`${command} failed (${code ?? signal}): ${stderr || stdout}`)); + }); + }); +} + +export class AwsObjectStore { + constructor({ name, endpoint, bucket, region, prefix = "", accessKeyId, secretAccessKey, configPath }) { + this.name = name; + this.endpoint = endpoint; + this.bucket = bucket; + this.region = region || "auto"; + this.prefix = prefix.replace(/^\/+|\/+$/g, ""); + this.configPath = configPath; + this.processEnv = { + ...process.env, + AWS_ACCESS_KEY_ID: accessKeyId, + AWS_SECRET_ACCESS_KEY: secretAccessKey, + AWS_DEFAULT_REGION: this.region, + AWS_EC2_METADATA_DISABLED: "true", + AWS_CONFIG_FILE: configPath, + }; + } + + objectKey(key) { + return this.prefix ? `${this.prefix}/${key}` : key; + } + + s3Uri(key) { + return `s3://${this.bucket}/${this.objectKey(key)}`; + } + + async aws(args, options = {}) { + const { env: envOverride = {}, ...runOptions } = options; + return await runProcess( + "aws", + [...args, "--endpoint-url", this.endpoint], + { + ...runOptions, + env: { ...this.processEnv, ...envOverride }, + }, + ); + } + + async head(key) { + const result = await this.aws( + [ + "s3api", + "head-object", + "--bucket", + this.bucket, + "--key", + this.objectKey(key), + "--output", + "json", + ], + { allowFailure: true }, + ); + if (result.code !== 0) { + const detail = `${result.stderr}\n${result.stdout}`; + if (isNotFound(detail)) return null; + throw new Error(`${this.name}: cannot read object metadata for ${key}: ${detail.trim()}`); + } + const metadata = JSON.parse(result.stdout); + if (!metadata.ETag || !Number.isFinite(metadata.ContentLength)) { + throw new Error(`${this.name}: incomplete object metadata for ${key}`); + } + const objectMetadata = Object.fromEntries( + Object.entries(metadata.Metadata || {}).map(([name, value]) => [ + name.toLowerCase(), + String(value), + ]), + ); + return { etag: metadata.ETag, metadata: objectMetadata, size: metadata.ContentLength }; + } + + async download(key, destination) { + await mkdir(dirname(destination), { recursive: true }); + await this.aws([ + "s3", + "cp", + this.s3Uri(key), + destination, + "--only-show-errors", + ]); + } + + async snapshot(key, destination) { + for (let attempt = 1; attempt <= 3; attempt += 1) { + const before = await this.head(key); + if (!before) return { exists: false, etag: null, size: 0, path: null }; + await this.download(key, destination); + const after = await this.head(key); + const localSize = (await stat(destination)).size; + if (after && before.etag === after.etag && after.size === localSize) { + return { + exists: true, + etag: after.etag, + metadata: after.metadata, + size: localSize, + path: destination, + }; + } + await rm(destination, { force: true }); + if (attempt === 3) { + throw new Error(`${this.name}: ${key} changed repeatedly while being downloaded`); + } + } + throw new Error(`${this.name}: could not snapshot ${key}`); + } + + async putObject( + localPath, + key, + { contentType, ifMatch, ifNoneMatch, metadata, singleAttempt = false } = {}, + ) { + const args = [ + "s3api", + "put-object", + "--bucket", + this.bucket, + "--key", + this.objectKey(key), + "--body", + localPath, + "--content-type", + contentType || "application/octet-stream", + "--output", + "json", + ]; + if (ifMatch) args.push("--if-match", ifMatch); + if (ifNoneMatch) args.push("--if-none-match", ifNoneMatch); + if (metadata && Object.keys(metadata).length > 0) { + args.push( + "--metadata", + Object.entries(metadata) + .map(([name, value]) => `${name}=${value}`) + .join(","), + ); + } + const result = await this.aws(args, { + allowFailure: true, + ...(singleAttempt ? { env: { AWS_MAX_ATTEMPTS: "1" } } : {}), + }); + if (result.code !== 0) { + const detail = `${result.stderr}\n${result.stdout}`.trim(); + if (isConditionalFailure(detail)) { + throw new ConditionalWriteError(`${this.name}: conditional write rejected for ${key}`); + } + throw new Error(`${this.name}: upload failed for ${key}: ${detail}`); + } + let response; + try { + response = JSON.parse(result.stdout); + } catch (error) { + throw new WriteOutcomeUncertainError( + `${this.name}: ${key} upload succeeded but its response was not valid JSON: ${errorText(error)}`, + ); + } + if (typeof response.ETag !== "string" || !response.ETag) { + throw new WriteOutcomeUncertainError( + `${this.name}: ${key} upload response did not include the committed ETag`, + ); + } + return { etag: response.ETag, size: (await stat(localPath)).size }; + } + + async putImmutable(localPath, key, contentType, metadata = {}) { + const existing = await this.head(key); + if (existing) return { status: "existing", ...existing }; + try { + const uploaded = await this.putObject(localPath, key, { + contentType, + ifNoneMatch: "*", + metadata, + }); + return { status: "uploaded", ...uploaded }; + } catch (error) { + if (!(error instanceof ConditionalWriteError)) throw error; + const raced = await this.head(key); + if (!raced) throw error; + return { status: "existing-after-race", ...raced }; + } + } + + async putLatestConditional(localPath, expectedEtag, promotionToken = "") { + return await this.putObject(localPath, LATEST_KEY, { + contentType: "application/json", + ...(expectedEtag ? { ifMatch: expectedEtag } : { ifNoneMatch: "*" }), + ...(promotionToken + ? { metadata: { "cam-promotion-token": promotionToken } } + : {}), + singleAttempt: true, + }); + } +} + +function contentType(name) { + if (name.endsWith(".json")) return "application/json"; + if (name.endsWith(".tar.gz")) return "application/gzip"; + if (name.endsWith(".dmg")) return "application/x-apple-diskimage"; + return "application/octet-stream"; +} + +function requiredValue(env, name, backendName) { + const value = env[name]?.trim(); + if (!value) throw new Error(`${backendName} backend requires ${name}`); + return value; +} + +export function backendConfigsFromEnv(env, configPath) { + const required = (env.MIRROR_REQUIRED_BACKENDS || "r2,ihep") + .split(",") + .map((name) => name.trim().toLowerCase()) + .filter(Boolean); + const unknown = required.filter((name) => !["r2", "ihep"].includes(name)); + if (unknown.length > 0) throw new Error(`unknown MIRROR_REQUIRED_BACKENDS: ${unknown.join(", ")}`); + if (!required.includes("r2") || !required.includes("ihep")) { + throw new Error("stable mirror publication requires both r2 and ihep backends"); + } + return [ + new AwsObjectStore({ + name: "r2", + endpoint: requiredValue(env, "MANAGER_R2_S3_ENDPOINT", "r2"), + bucket: env.MANAGER_R2_BUCKET?.trim() || "codex-app-manager", + region: "auto", + accessKeyId: requiredValue(env, "MANAGER_R2_ACCESS_KEY_ID", "r2"), + secretAccessKey: requiredValue(env, "MANAGER_R2_SECRET_ACCESS_KEY", "r2"), + configPath, + }), + new AwsObjectStore({ + name: "ihep", + endpoint: requiredValue(env, "MANAGER_IHEP_S3_ENDPOINT", "ihep"), + bucket: requiredValue(env, "MANAGER_IHEP_S3_BUCKET", "ihep"), + region: env.MANAGER_IHEP_S3_REGION?.trim() || "auto", + prefix: env.MANAGER_IHEP_S3_PREFIX?.trim() || "", + accessKeyId: requiredValue(env, "MANAGER_IHEP_S3_ACCESS_KEY_ID", "ihep"), + secretAccessKey: requiredValue(env, "MANAGER_IHEP_S3_SECRET_ACCESS_KEY", "ihep"), + configPath, + }), + ]; +} + +export function downgradeOverrideFromEnv(env = process.env) { + const requested = env.MIRROR_ALLOW_DOWNGRADE === "1" || env.MIRROR_ALLOW_DOWNGRADE === "true"; + const reason = env.MIRROR_DOWNGRADE_REASON?.trim() || ""; + const eventName = env.GITHUB_EVENT_NAME || ""; + const originalActor = env.GITHUB_ACTOR || ""; + const triggeringActor = env.GITHUB_TRIGGERING_ACTOR || ""; + const actor = triggeringActor || originalActor; + const repository = env.GITHUB_REPOSITORY || ""; + const runId = env.GITHUB_RUN_ID || ""; + const workflowRefName = env.MIRROR_WORKFLOW_REF_NAME || ""; + const defaultBranch = env.MIRROR_DEFAULT_BRANCH || ""; + const runUrl = repository && runId ? `https://github.com/${repository}/actions/runs/${runId}` : ""; + if (requested) { + if (eventName !== "workflow_dispatch") { + throw new Error("mirror downgrade override is accepted only from workflow_dispatch"); + } + if (!workflowRefName || !defaultBranch || workflowRefName !== defaultBranch) { + throw new Error("mirror downgrade override must run from the repository default branch"); + } + if (reason.length < 10) { + throw new Error("mirror downgrade override requires an audit reason of at least 10 characters"); + } + if (!actor || !runUrl) { + throw new Error("mirror downgrade override requires GitHub actor and run audit metadata"); + } + } + return { + actor, + defaultBranch, + eventName, + originalActor, + reason, + requested, + runUrl, + used: false, + triggeringActor, + workflowRefName, + }; +} + +async function updaterPublicKeyFromRepo() { + const config = await readJson(join(REPO_ROOT, "src-tauri", "tauri.conf.json"), "tauri.conf.json"); + const pubkey = config.plugins?.updater?.pubkey; + if (typeof pubkey !== "string" || !pubkey.trim()) { + throw new Error("tauri.conf.json has no updater public key"); + } + return pubkey.trim(); +} + +export async function verifyBackendCandidate({ + backend, + candidateKey, + candidatePath, + candidateManifest, + distDir, + mirrorBase, + publicKey, + workDir, + expectedArtifacts: preparedArtifacts, + candidateSha256, + promotionToken, +}) { + const backendDir = join(workDir, backend.name); + await mkdir(backendDir, { recursive: true }); + const downloadedCandidate = join(backendDir, "candidate.json"); + const remoteCandidate = await backend.snapshot(candidateKey, downloadedCandidate); + if (!remoteCandidate.exists) throw new Error(`${backend.name}: candidate is missing at ${candidateKey}`); + if ( + promotionToken && + remoteCandidate.metadata?.["cam-promotion-token"] !== promotionToken + ) { + throw new Error( + `${backend.name}: candidate metadata does not preserve the promotion token`, + ); + } + const [localCandidateHash, remoteCandidateHash] = await Promise.all([ + candidateSha256 ? Promise.resolve(candidateSha256) : sha256File(candidatePath), + sha256File(downloadedCandidate), + ]); + if (localCandidateHash !== remoteCandidateHash) { + throw new Error(`${backend.name}: candidate bytes do not match this release run`); + } + const remoteManifest = await readJson(downloadedCandidate, `${backend.name} candidate`); + const expectedVersion = assertManifestShape(candidateManifest, "local mirror candidate"); + const remoteVersion = assertManifestShape(remoteManifest, `${backend.name} candidate`); + if (remoteVersion !== expectedVersion || manifestReleaseIdentity(remoteManifest) !== manifestReleaseIdentity(candidateManifest)) { + throw new Error(`${backend.name}: candidate release identity does not match version ${expectedVersion}`); + } + + const expectedArtifacts = + preparedArtifacts || + (await expectedArtifactsFromManifest(candidateManifest, distDir, mirrorBase)); + const artifactReports = []; + for (const artifact of expectedArtifacts) { + const remotePath = join(backendDir, artifact.name); + const remote = await backend.snapshot(artifact.key, remotePath); + if (!remote.exists) throw new Error(`${backend.name}: artifact is missing: ${artifact.key}`); + const remoteHash = await sha256File(remotePath); + if (remote.size !== artifact.size) { + throw new Error( + `${backend.name}: size mismatch for ${artifact.name}: ${remote.size} != ${artifact.size}`, + ); + } + if (remoteHash !== artifact.sha256) { + throw new Error(`${backend.name}: sha256 mismatch for ${artifact.name}`); + } + if (artifact.platform) { + if (!artifact.signature) { + throw new Error(`${backend.name}: updater artifact ${artifact.name} has no signature`); + } + await verifyTauriUpdaterSignature(remotePath, artifact.signature, publicKey); + } + artifactReports.push({ + name: artifact.name, + platform: artifact.platform, + sha256: remoteHash, + signatureVerified: artifact.platform ? true : null, + size: remote.size, + }); + await rm(remotePath, { force: true }); + } + return { + artifactCount: artifactReports.length, + artifacts: artifactReports, + candidateEtag: remoteCandidate.etag, + candidateSha256: remoteCandidateHash, + verified: true, + version: remoteVersion, + }; +} + +function initialSummary(phase, version, candidateKey, override) { + return { + schemaVersion: SUMMARY_SCHEMA_VERSION, + phase, + candidateVersion: version, + candidateKey, + startedAt: nowIso(), + finishedAt: null, + outcome: "running", + error: null, + override: { ...override }, + backends: [], + }; +} + +async function finishSummary(path, summary, outcome, error = null) { + summary.finishedAt = nowIso(); + summary.outcome = outcome; + summary.error = error ? safeSummaryError(error) : null; + await writeJson(path, summary); +} + +export async function stageMirrors({ + backends, + candidateKey, + candidatePath, + distDir, + summaryPath, + version, + override, +}) { + const summary = initialSummary("stage", version, candidateKey, override); + summary.backends = backends.map((backend) => ({ + name: backend.name, + candidate: null, + assets: [], + status: "not-started", + })); + const promotionToken = promotionTokenForCandidate(candidateKey); + let activeSummary = null; + try { + const names = (await readdir(distDir)).sort(); + const assets = names.filter((name) => !["latest.json", "latest.mirror.json"].includes(name)); + for (const backend of backends) { + const backendSummary = summary.backends.find((entry) => entry.name === backend.name); + activeSummary = backendSummary; + backendSummary.status = "staging"; + for (const name of assets) { + assertSafeSegment(name, "release artifact name"); + const localPath = join(distDir, name); + const metadata = await stat(localPath); + if (!metadata.isFile()) continue; + const uploaded = await backend.putImmutable( + localPath, + `${version}/${name}`, + contentType(name), + ); + backendSummary.assets.push({ name, status: uploaded.status }); + } + const candidate = await backend.putImmutable( + candidatePath, + candidateKey, + "application/json", + { "cam-promotion-token": promotionToken }, + ); + backendSummary.candidate = { key: candidateKey, status: candidate.status }; + backendSummary.status = "staged"; + } + await finishSummary(summaryPath, summary, "staged"); + return summary; + } catch (error) { + if (activeSummary?.status === "staging") { + activeSummary.status = "failed"; + activeSummary.error = safeSummaryError(error); + } + await finishSummary(summaryPath, summary, "failed", error); + throw error; + } +} + +async function readCurrentState(backend, workDir, candidateManifest) { + const path = join(workDir, `${backend.name}-previous-latest.json`); + const snapshot = await backend.snapshot(LATEST_KEY, path); + if (!snapshot.exists) { + throw new Error( + `${backend.name}: latest.json is absent; seed both backends with the same valid baseline before enabling transactional promotion`, + ); + } + const manifest = await readJson(path, `${backend.name} current latest.json`); + const currentVersion = assertManifestShape(manifest, `${backend.name} current latest.json`); + const candidateVersion = assertManifestShape(candidateManifest, "candidate latest.json"); + const comparison = compareSemver(currentVersion, candidateVersion); + let decision; + if (comparison < 0) decision = "promote-forward"; + else if (comparison > 0) decision = "blocked-downgrade"; + else if (manifestReleaseIdentity(manifest) === manifestReleaseIdentity(candidateManifest)) { + decision = "idempotent"; + } else { + decision = "blocked-same-version-mismatch"; + } + return { + backend, + currentIdentity: manifestReleaseIdentity(manifest), + currentManifest: manifest, + currentVersion, + decision, + previous: snapshot, + }; +} + +async function snapshotMatchesFile(snapshot, expectedPath) { + if (!snapshot.exists) return false; + const [actual, expected] = await Promise.all([ + sha256File(snapshot.path), + sha256File(expectedPath), + ]); + return actual === expected; +} + +async function observeAmbiguousWrite( + state, + candidatePath, + workDir, + promotionToken, +) { + try { + const observed = await state.backend.snapshot( + LATEST_KEY, + join(workDir, `${state.backend.name}-ambiguous-latest.json`), + ); + if ( + observed.metadata?.["cam-promotion-token"] === promotionToken && + (await snapshotMatchesFile(observed, candidatePath)) + ) { + return observed; + } + } catch { + // The original write error remains the primary failure. Rollback reporting + // will make any uncertainty visible in the audit summary. + } + return null; +} + +async function withRollbackIo(callback) { + const previous = rollbackInProgress; + rollbackInProgress = true; + try { + return await callback(); + } finally { + rollbackInProgress = previous; + } +} + +async function rollbackTouched(touched, summaryByName, workDir) { + const failures = []; + rollbackInProgress = true; + try { + for (const item of [...touched].reverse()) { + const backendSummary = summaryByName.get(item.state.backend.name); + try { + const owned = await item.state.backend.snapshot( + LATEST_KEY, + join(workDir, `${item.state.backend.name}-rollback-ownership.json`), + ); + if ( + !owned.exists || + owned.etag !== item.promotedEtag || + owned.metadata?.["cam-promotion-token"] !== item.promotionToken + ) { + throw new ConditionalWriteError( + `${item.state.backend.name}: latest.json is no longer owned by this promotion`, + ); + } + if (item.state.previous.exists) { + const restored = await item.state.backend.putLatestConditional( + item.state.previous.path, + item.promotedEtag, + `rollback-${randomUUID()}`, + ); + const check = await item.state.backend.snapshot( + LATEST_KEY, + join(workDir, `${item.state.backend.name}-rollback-check.json`), + ); + if (!(await snapshotMatchesFile(check, item.state.previous.path))) { + throw new Error("rollback verification did not match previous latest.json"); + } + item.promotedEtag = restored.etag; + } else { + throw new Error("transactional promotion cannot roll back an unseeded backend"); + } + backendSummary.rollback = "restored"; + } catch (error) { + backendSummary.rollback = "failed"; + backendSummary.rollbackError = safeSummaryError(error); + failures.push(`${item.state.backend.name}: ${errorText(error)}`); + } + } + } finally { + rollbackInProgress = false; + } + return failures; +} + +export async function promoteCandidateTransaction({ + backends, + candidateManifest, + candidatePath, + override, + summary, + workDir, + hooks = {}, + promotionToken = randomUUID(), +}) { + const summaryByName = new Map(summary.backends.map((entry) => [entry.name, entry])); + const states = []; + for (const backend of backends) { + try { + states.push(await readCurrentState(backend, workDir, candidateManifest)); + } catch (error) { + const backendSummary = summaryByName.get(backend.name); + if (backendSummary) backendSummary.error = safeSummaryError(error); + throw error; + } + } + await hooks.afterSnapshots?.(states); + + for (const state of states) { + const backendSummary = summaryByName.get(state.backend.name); + backendSummary.currentVersion = state.currentVersion; + backendSummary.decision = state.decision; + } + + const mismatch = states.find((state) => state.decision === "blocked-same-version-mismatch"); + if (mismatch) { + throw new Error( + `${mismatch.backend.name}: current latest has the candidate version but different artifact/signature identity`, + ); + } + const downgradeStates = states.filter((state) => state.decision === "blocked-downgrade"); + if (downgradeStates.length > 0 && !override.requested) { + throw new DowngradeBlockedError( + `candidate ${candidateManifest.version} is older than ${downgradeStates + .map((state) => `${state.backend.name}=${state.currentVersion}`) + .join(", ")}`, + ); + } + if (downgradeStates.length > 0) { + override.used = true; + summary.override.used = true; + for (const state of downgradeStates) { + state.decision = "promote-downgrade-override"; + summaryByName.get(state.backend.name).decision = state.decision; + } + } + + const toPromote = states.filter((state) => state.decision !== "idempotent"); + if (toPromote.length === 0) { + for (const state of states) { + const backendSummary = summaryByName.get(state.backend.name); + try { + const finalSnapshot = await state.backend.snapshot( + LATEST_KEY, + join(workDir, `${state.backend.name}-idempotent-final.json`), + ); + if (!finalSnapshot.exists || finalSnapshot.etag !== state.previous.etag) { + throw new ConditionalWriteError( + `${state.backend.name}: latest.json changed after the idempotent snapshot`, + ); + } + const finalManifest = await readJson( + finalSnapshot.path, + `${state.backend.name} idempotent final latest.json`, + ); + if ( + manifestReleaseIdentity(finalManifest) !== + manifestReleaseIdentity(candidateManifest) + ) { + throw new ConditionalWriteError( + `${state.backend.name}: latest.json no longer exposes the idempotent candidate`, + ); + } + backendSummary.finalVersion = finalManifest.version; + } catch (error) { + backendSummary.error = safeSummaryError(error); + throw error; + } + } + return { outcome: "idempotent", states }; + } + + const touched = []; + let activeState = null; + try { + for (const state of toPromote) { + activeState = state; + const backendSummary = summaryByName.get(state.backend.name); + await hooks.beforeWrite?.(state); + let promoted; + try { + promoted = await state.backend.putLatestConditional( + candidatePath, + state.previous.etag, + promotionToken, + ); + } catch (error) { + if (error instanceof ConditionalWriteError) { + throw error; + } + const ambiguous = await withRollbackIo(() => + observeAmbiguousWrite( + state, + candidatePath, + workDir, + promotionToken, + ), + ); + if (ambiguous) { + touched.push({ + state, + promotedEtag: ambiguous.etag, + promotionToken, + }); + backendSummary.promotion = "write-outcome-ambiguous"; + } else { + backendSummary.promotion = "write-outcome-unresolved"; + backendSummary.rollback = "uncertain"; + throw new WriteOutcomeUncertainError( + `${state.backend.name}: write failed and ownership could not be resolved after ${errorText(error)}`, + ); + } + throw error; + } + const touchedItem = { + state, + promotedEtag: promoted.etag, + promotionToken, + }; + touched.push(touchedItem); + backendSummary.promotion = "written"; + const check = await state.backend.snapshot( + LATEST_KEY, + join(workDir, `${state.backend.name}-promoted-check.json`), + ); + if ( + check.etag !== promoted.etag || + check.metadata?.["cam-promotion-token"] !== promotionToken + ) { + touched.pop(); + backendSummary.promotion = "ownership-lost"; + backendSummary.rollback = "skipped-concurrent-change"; + throw new ConditionalWriteError( + `${state.backend.name}: latest.json changed after the conditional write`, + ); + } + if (!(await snapshotMatchesFile(check, candidatePath))) { + throw new Error(`${state.backend.name}: promoted latest.json failed byte verification`); + } + backendSummary.promotion = "verified"; + await hooks.afterWrite?.(state); + } + + for (const state of states) { + activeState = state; + const finalSnapshot = await state.backend.snapshot( + LATEST_KEY, + join(workDir, `${state.backend.name}-final-latest.json`), + ); + if (!finalSnapshot.exists) throw new Error(`${state.backend.name}: latest.json disappeared`); + const finalManifest = await readJson( + finalSnapshot.path, + `${state.backend.name} final latest.json`, + ); + if (manifestReleaseIdentity(finalManifest) !== manifestReleaseIdentity(candidateManifest)) { + throw new Error(`${state.backend.name}: final latest.json does not expose the candidate release`); + } + summaryByName.get(state.backend.name).finalVersion = finalManifest.version; + } + return { outcome: override.used ? "downgrade-override-promoted" : "promoted", states }; + } catch (error) { + if (activeState) { + summaryByName.get(activeState.backend.name).error = safeSummaryError(error); + } + const rollbackFailures = await rollbackTouched(touched, summaryByName, workDir); + const ownershipUncertain = error instanceof WriteOutcomeUncertainError; + const failures = ownershipUncertain + ? [...rollbackFailures, `${activeState?.backend.name || "backend"}: write ownership unresolved`] + : rollbackFailures; + summary.rollback = { + attempted: touched.length > 0, + complete: failures.length === 0, + failures, + }; + if (failures.length > 0) { + throw new Error( + `${errorText(error)}; rollback incomplete: ${failures.join("; ")}`, + ); + } + if (touched.length > 0) summary.outcome = "rolled-back"; + throw error; + } +} + +function mirrorVerificationRows(backends, includeTransaction = false) { + return backends.map((backend) => ({ + name: backend.name, + candidateVerification: "not-started", + ...(includeTransaction + ? { + currentVersion: null, + decision: null, + promotion: "not-started", + rollback: "not-needed", + } + : {}), + })); +} + +async function verifyMirrorCandidates({ + backends, + candidateKey, + candidateManifest, + candidatePath, + distDir, + mirrorBase, + publicKey, + summary, + tempRoot, + fetchImpl = fetch, +}) { + const [expectedArtifacts, candidateSha256] = await Promise.all([ + expectedArtifactsFromManifest(candidateManifest, distDir, mirrorBase), + sha256File(candidatePath), + ]); + const promotionToken = promotionTokenForCandidate(candidateKey); + + // Both storage origins must finish a complete candidate + artifact readback + // before any mutable latest.json write. Verification is sequential to cap + // runner disk use. + for (const backend of backends) { + const backendSummary = summary.backends.find((entry) => entry.name === backend.name); + backendSummary.candidateVerification = "running"; + try { + backendSummary.candidate = await verifyBackendCandidate({ + backend, + candidateKey, + candidatePath, + candidateManifest, + distDir, + mirrorBase, + publicKey, + workDir: join(tempRoot, "backend"), + expectedArtifacts, + candidateSha256, + promotionToken, + }); + backendSummary.candidateVerification = "passed"; + } catch (error) { + backendSummary.candidateVerification = "failed"; + backendSummary.error = safeSummaryError(error); + throw error; + } + } + + // Direct S3 readback does not prove that the Worker route used by clients is + // healthy or bound to the expected bucket. Fetch the run-specific candidate + // and every updater payload through their real public HTTPS URLs as a separate + // fail-closed gate. + summary.publicRouteVerification = "running"; + try { + summary.publicRoute = await verifyPublicMirrorRoute({ + candidateKey, + candidateManifest, + candidatePath, + expectedArtifacts, + mirrorBase, + publicKey, + workDir: join(tempRoot, "public"), + fetchImpl, + }); + summary.publicRouteVerification = "passed"; + } catch (error) { + summary.publicRouteVerification = "failed"; + summary.publicRouteError = safeSummaryError(error); + throw error; + } + + return { candidateSha256, expectedArtifacts, promotionToken }; +} + +export async function verifyMirrors({ + backends, + candidateKey, + candidateManifest, + candidatePath, + distDir, + mirrorBase, + override, + publicKey, + summaryPath, + tempRoot, + fetchImpl, +}) { + const version = assertManifestShape(candidateManifest, "candidate latest.json"); + assertRequiredUpdaterPlatforms(candidateManifest, "candidate latest.json"); + const summary = initialSummary("verify", version, candidateKey, override); + summary.backends = mirrorVerificationRows(backends); + summary.publicRouteVerification = "not-started"; + try { + await verifyMirrorCandidates({ + backends, + candidateKey, + candidateManifest, + candidatePath, + distDir, + mirrorBase, + publicKey, + summary, + tempRoot, + fetchImpl, + }); + await finishSummary(summaryPath, summary, "verified"); + return summary; + } catch (error) { + await finishSummary(summaryPath, summary, "failed", error); + throw error; + } +} + +export async function promoteMirrors({ + backends, + candidateKey, + candidateManifest, + candidatePath, + distDir, + mirrorBase, + override, + publicKey, + summaryPath, + tempRoot, + hooks, + fetchImpl, +}) { + const version = assertManifestShape(candidateManifest, "candidate latest.json"); + assertRequiredUpdaterPlatforms(candidateManifest, "candidate latest.json"); + const summary = initialSummary("promote", version, candidateKey, override); + summary.backends = mirrorVerificationRows(backends, true); + summary.publicRouteVerification = "not-started"; + try { + const { promotionToken } = await verifyMirrorCandidates({ + backends, + candidateKey, + candidateManifest, + candidatePath, + distDir, + mirrorBase, + publicKey, + summary, + tempRoot: join(tempRoot, "verify"), + fetchImpl, + }); + + const transaction = await promoteCandidateTransaction({ + backends, + candidateManifest, + candidatePath, + override, + summary, + workDir: join(tempRoot, "transaction"), + hooks, + promotionToken, + }); + await finishSummary(summaryPath, summary, transaction.outcome); + return summary; + } catch (error) { + const outcome = + error instanceof DowngradeBlockedError + ? "blocked-downgrade" + : summary.outcome === "rolled-back" + ? "rolled-back" + : "failed"; + await finishSummary(summaryPath, summary, outcome, error); + throw error; + } +} + +async function createAwsConfig(tempRoot) { + const path = join(tempRoot, "aws-config"); + await writeFile(path, "[default]\nregion = auto\ns3 =\n addressing_style = path\n"); + return path; +} + +function installSignalHandlers() { + const handler = (signal) => { + if (interruptedBy) return; + interruptedBy = signal; + for (const child of activeChildren) child.kill("SIGTERM"); + }; + process.on("SIGINT", handler); + process.on("SIGTERM", handler); + return () => { + process.off("SIGINT", handler); + process.off("SIGTERM", handler); + }; +} + +async function main() { + const distArg = process.argv[2]; + if (!distArg) throw new Error("usage: sync-mirror.sh "); + const distDir = resolve(distArg); + const phase = process.env.MIRROR_PHASE || "all"; + if (!["all", "stage", "verify", "promote"].includes(phase)) { + throw new Error( + `unsupported MIRROR_PHASE=${phase} (expected all, stage, verify, or promote)`, + ); + } + const override = downgradeOverrideFromEnv(process.env); + if (override.requested) { + console.log( + `::warning::[mirror] emergency downgrade override requested by ${safeSummaryError( + override.actor, + )}: ${safeSummaryError(override.reason)} (${override.runUrl})`, + ); + } + const candidateId = candidateIdFromEnv(process.env); + const mirror = await createMirrorManifest( + distDir, + process.env.MIRROR_BASE_URL || DEFAULT_MIRROR_BASE, + ); + const candidateKey = candidateKeyFor(mirror.version, candidateId); + const tempRoot = await mkdtemp(join(tmpdir(), "cam-mirror-release-")); + const removeSignalHandlers = installSignalHandlers(); + try { + const configPath = await createAwsConfig(tempRoot); + const backends = backendConfigsFromEnv(process.env, configPath); + if (phase === "all" || phase === "stage") { + const stageSummaryPath = resolve( + process.env.MIRROR_STAGE_SUMMARY_PATH || "mirror-stage-summary.json", + ); + console.log(`::group::[mirror] stage ${mirror.version} candidate=${candidateKey}`); + await stageMirrors({ + backends, + candidateKey, + candidatePath: mirror.outputPath, + distDir, + summaryPath: stageSummaryPath, + version: mirror.version, + override, + }); + console.log("::endgroup::"); + } + if (phase === "verify") { + const verificationSummaryPath = resolve( + process.env.MIRROR_VERIFICATION_SUMMARY_PATH || + "mirror-verification-summary.json", + ); + const publicKey = process.env.MIRROR_UPDATER_PUBLIC_KEY || (await updaterPublicKeyFromRepo()); + console.log(`::group::[mirror] verify ${mirror.version}`); + await verifyMirrors({ + backends, + candidateKey, + candidateManifest: mirror.manifest, + candidatePath: mirror.outputPath, + distDir, + mirrorBase: mirror.mirrorBase, + override, + publicKey, + summaryPath: verificationSummaryPath, + tempRoot, + }); + console.log("::endgroup::"); + } + if (phase === "all" || phase === "promote") { + const promotionSummaryPath = resolve( + process.env.MIRROR_PROMOTION_SUMMARY_PATH || "mirror-promotion-summary.json", + ); + const publicKey = process.env.MIRROR_UPDATER_PUBLIC_KEY || (await updaterPublicKeyFromRepo()); + console.log(`::group::[mirror] verify and promote ${mirror.version}`); + await promoteMirrors({ + backends, + candidateKey, + candidateManifest: mirror.manifest, + candidatePath: mirror.outputPath, + distDir, + mirrorBase: mirror.mirrorBase, + override, + publicKey, + summaryPath: promotionSummaryPath, + tempRoot, + }); + console.log("::endgroup::"); + } + } finally { + removeSignalHandlers(); + await rm(tempRoot, { force: true, recursive: true }); + } + if (interruptedBy) throw new Error(`release interrupted by ${interruptedBy}`); +} + +const isCli = process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url); +if (isCli) { + main().catch((error) => { + console.error(`::error::[mirror] ${safeSummaryError(error)}`); + process.exitCode = interruptedBy === "SIGINT" ? 130 : interruptedBy === "SIGTERM" ? 143 : 1; + }); +} diff --git a/scripts/mirror-release.test.mjs b/scripts/mirror-release.test.mjs new file mode 100644 index 0000000..3039574 --- /dev/null +++ b/scripts/mirror-release.test.mjs @@ -0,0 +1,1345 @@ +import { + createHash, + generateKeyPairSync, + sign as cryptoSign, +} from "node:crypto"; +import { execFile } from "node:child_process"; +import { + mkdir, + mkdtemp, + readFile, + rm, + writeFile, +} from "node:fs/promises"; +import { tmpdir } from "node:os"; +import { join } from "node:path"; +import { promisify } from "node:util"; + +import { afterEach, describe, expect, it } from "vitest"; + +import { + AwsObjectStore, + ConditionalWriteError, + DowngradeBlockedError, + assertCandidateMatchesRelease, + candidateKeyFor, + compareSemver, + createMirrorManifest, + downgradeOverrideFromEnv, + promoteCandidateTransaction, + promoteMirrors, + verifyBackendCandidate, + verifyLocalUpdaterArtifacts, + verifyMirrors, + verifyPublicMirrorRoute, + verifyTauriUpdaterSignature, +} from "./mirror-release.mjs"; +import { + inspectReleaseForReuse, + requiredReleaseAssetNames, +} from "./check-release-reuse.mjs"; + +const roots = []; +const execFileAsync = promisify(execFile); + +async function tempRoot(name) { + const root = await mkdtemp(join(tmpdir(), `cam-${name}-`)); + roots.push(root); + return root; +} + +afterEach(async () => { + await Promise.all(roots.splice(0).map((root) => rm(root, { force: true, recursive: true }))); +}); + +function hash(body) { + return createHash("sha256").update(body).digest("hex"); +} + +function manifest(version, signature = "test-signature") { + return { + version, + notes: `release ${version}`, + pub_date: "2026-01-01T00:00:00.000Z", + platforms: { + "windows-x86_64": { + signature, + url: `https://mirror.example/manager/${version}/manager-${version}.exe`, + }, + }, + }; +} + +function completeManifest(version, signature = "test-signature") { + return { + version, + notes: `release ${version}`, + pub_date: "2026-01-01T00:00:00.000Z", + platforms: Object.fromEntries( + [ + "darwin-aarch64", + "darwin-x86_64", + "windows-x86_64", + "windows-aarch64", + ].map((platform) => [ + platform, + { + signature, + url: `https://mirror.example/manager/${version}/manager-${platform}-${version}.bin`, + }, + ]), + ), + }; +} + +function completeRelease(releaseTag, overrides = {}) { + const digest = `sha256:${"a".repeat(64)}`; + return { + draft: false, + immutable: true, + assets: requiredReleaseAssetNames(releaseTag).map((name) => ({ + digest, + name, + size: 1, + })), + ...overrides, + }; +} + +async function writeManifest(root, name, value) { + const path = join(root, name); + await mkdir(root, { recursive: true }); + await writeFile(path, `${JSON.stringify(value, null, 2)}\n`); + return path; +} + +function summaryFor(backends, override = overrideOff()) { + return { + backends: backends.map((backend) => ({ + name: backend.name, + candidateVerification: "passed", + promotion: "not-started", + rollback: "not-needed", + })), + outcome: "running", + override: { ...override }, + }; +} + +function overrideOff() { + return { + actor: "", + eventName: "push", + reason: "", + requested: false, + runUrl: "", + used: false, + }; +} + +class MemoryBackend { + constructor(name, objects = {}) { + this.name = name; + this.objects = new Map(); + this.counter = 0; + this.latestPutAttempts = 0; + for (const [key, body] of Object.entries(objects)) this.set(key, body); + } + + set(key, body, metadata = {}) { + const bytes = Buffer.isBuffer(body) ? Buffer.from(body) : Buffer.from(body); + this.counter += 1; + this.objects.set(key, { + body: bytes, + etag: `"${hash(bytes)}-${this.counter}"`, + metadata: { ...metadata }, + }); + } + + body(key) { + return this.objects.get(key)?.body; + } + + async head(key) { + const object = this.objects.get(key); + return object + ? { + etag: object.etag, + metadata: { ...object.metadata }, + size: object.body.length, + } + : null; + } + + async snapshot(key, destination) { + const object = this.objects.get(key); + if (!object) return { exists: false, etag: null, path: null, size: 0 }; + await mkdir(join(destination, ".."), { recursive: true }); + await writeFile(destination, object.body); + return { + exists: true, + etag: object.etag, + metadata: { ...object.metadata }, + path: destination, + size: object.body.length, + }; + } + + async putImmutable(localPath, key, _contentType, metadata = {}) { + const existing = this.objects.get(key); + if (existing) return { status: "existing", etag: existing.etag, size: existing.body.length }; + const body = await readFile(localPath); + this.set(key, body, metadata); + const stored = this.objects.get(key); + return { status: "uploaded", etag: stored.etag, size: stored.body.length }; + } + + async putLatestConditional(localPath, expectedEtag, promotionToken = "") { + this.latestPutAttempts += 1; + const current = this.objects.get("latest.json"); + const matches = expectedEtag ? current?.etag === expectedEtag : !current; + if (!matches) throw new ConditionalWriteError(`${this.name}: stale latest ETag`); + if (this.failLatestPut) throw new Error(`${this.name}: simulated write failure`); + this.set( + "latest.json", + await readFile(localPath), + promotionToken ? { "cam-promotion-token": promotionToken } : {}, + ); + const stored = this.objects.get("latest.json"); + return { etag: stored.etag, size: stored.body.length }; + } + + async deleteLatestConditional(expectedEtag) { + const current = this.objects.get("latest.json"); + if (!current || current.etag !== expectedEtag) { + throw new ConditionalWriteError(`${this.name}: stale delete ETag`); + } + this.objects.delete("latest.json"); + } +} + +function encodedUpdaterSignature(privateKey, keyId, artifact) { + const digest = createHash("blake2b512").update(artifact).digest(); + const signature = cryptoSign(null, digest, privateKey); + const trustedComment = "timestamp:1700000000\tfile:test-artifact"; + const globalSignature = cryptoSign( + null, + Buffer.concat([signature, Buffer.from(trustedComment)]), + privateKey, + ); + const primary = Buffer.concat([Buffer.from("ED"), keyId, signature]); + const text = [ + "untrusted comment: signature from test key", + primary.toString("base64"), + `trusted comment: ${trustedComment}`, + globalSignature.toString("base64"), + ].join("\n"); + return Buffer.from(`${text}\n`).toString("base64"); +} + +function updaterFixture(artifact) { + const { privateKey, publicKey } = generateKeyPairSync("ed25519"); + const publicDer = publicKey.export({ format: "der", type: "spki" }); + const rawPublicKey = publicDer.subarray(publicDer.length - 32); + const keyId = Buffer.from("0102030405060708", "hex"); + const minisignPublic = Buffer.concat([Buffer.from("Ed"), keyId, rawPublicKey]); + const publicText = [ + "untrusted comment: minisign public key: test", + minisignPublic.toString("base64"), + ].join("\n"); + return { + publicKey: Buffer.from(`${publicText}\n`).toString("base64"), + signature: encodedUpdaterSignature(privateKey, keyId, artifact), + }; +} + +function publicRouteFetch(objects, requests = [], { ihepObjects = objects } = {}) { + return async (value) => { + const url = new URL(value); + requests.push(url); + if (url.hostname === "ihep.example") { + const body = ihepObjects.get(url.pathname); + return body === undefined + ? new Response("not found", { status: 404 }) + : new Response(body, { status: 200 }); + } + const backend = url.searchParams.get("cam_backend"); + if (backend === "ihep") { + return new Response(null, { + status: 302, + headers: { + Location: `https://ihep.example${url.pathname}`, + "X-Codex-Mirror-Backend": "ihep", + }, + }); + } + const body = objects.get(url.pathname); + return body === undefined + ? new Response("not found", { status: 404 }) + : new Response(body, { + status: 200, + headers: { "X-Codex-Mirror-Backend": "r2" }, + }); + }; +} + +describe("semantic release ordering", () => { + it("orders stable and prerelease versions without lexical mistakes", () => { + expect(compareSemver("1.10.0", "1.9.9")).toBe(1); + expect(compareSemver("1.0.0-rc.2", "1.0.0-rc.10")).toBe(-1); + expect(compareSemver("1.0.0", "1.0.0-rc.10")).toBe(1); + expect(compareSemver("v2.0.0+build.1", "2.0.0+build.2")).toBe(0); + }); +}); + +describe("release candidate binding", () => { + it("binds the candidate version and complete platform identity to the release tag", () => { + const derived = completeManifest("1.2.3", "artifact-derived-signature"); + const candidate = structuredClone(derived); + + expect(assertCandidateMatchesRelease(candidate, derived, "v1.2.3")).toEqual({ + platformCount: 4, + version: "1.2.3", + }); + + const wrongVersion = structuredClone(candidate); + wrongVersion.version = "9.9.9"; + expect(() => assertCandidateMatchesRelease(wrongVersion, derived, "v1.2.3")).toThrow( + "does not match release tag", + ); + + const missingPlatform = structuredClone(candidate); + delete missingPlatform.platforms["windows-aarch64"]; + expect(() => assertCandidateMatchesRelease(missingPlatform, derived, "v1.2.3")).toThrow( + "missing required updater platforms: windows-aarch64", + ); + + const changedSignature = structuredClone(candidate); + changedSignature.platforms["windows-x86_64"].signature = "different-signature"; + expect(() => assertCandidateMatchesRelease(changedSignature, derived, "v1.2.3")).toThrow( + "platforms/signatures do not match", + ); + }); +}); + +describe("existing GitHub Release reuse", () => { + it("requires GitHub immutability and canonical SHA-256 asset digests", () => { + const releaseTag = "v1.2.3"; + const valid = inspectReleaseForReuse(completeRelease(releaseTag), releaseTag); + expect(valid.reusable).toBe(true); + expect(Object.keys(valid.digests)).toHaveLength(11); + + expect(() => + inspectReleaseForReuse(completeRelease(releaseTag, { immutable: false }), releaseTag), + ).toThrow("is mutable"); + + const mutableAndIncomplete = completeRelease(releaseTag, { immutable: false }); + mutableAndIncomplete.assets.pop(); + expect(() => inspectReleaseForReuse(mutableAndIncomplete, releaseTag)).toThrow("is mutable"); + + const immutableAndIncomplete = completeRelease(releaseTag); + immutableAndIncomplete.assets.pop(); + expect(() => inspectReleaseForReuse(immutableAndIncomplete, releaseTag)).toThrow( + "is missing required assets and cannot be repaired", + ); + + const repairableDraft = completeRelease(releaseTag, { draft: true, immutable: false }); + repairableDraft.assets.pop(); + expect(inspectReleaseForReuse(repairableDraft, releaseTag)).toMatchObject({ + reason: "draft", + reusable: false, + }); + + const missingDigest = completeRelease(releaseTag); + delete missingDigest.assets[0].digest; + expect(() => inspectReleaseForReuse(missingDigest, releaseTag)).toThrow( + "has no canonical SHA-256 digest", + ); + + const unpinnedExtra = completeRelease(releaseTag); + unpinnedExtra.assets.push({ name: "CodexAppManager_extra.zip", size: 10 }); + expect(() => inspectReleaseForReuse(unpinnedExtra, releaseTag)).toThrow( + "has no canonical SHA-256 digest", + ); + }); +}); + +describe("Tauri updater verification", () => { + it("accepts the configured minisign format and rejects changed bytes", async () => { + const root = await tempRoot("updater-signature"); + const artifact = Buffer.from("signed updater bytes"); + const fixture = updaterFixture(artifact); + const path = join(root, "artifact.bin"); + await writeFile(path, artifact); + + await expect( + verifyTauriUpdaterSignature(path, fixture.signature, fixture.publicKey), + ).resolves.toBe(true); + + await writeFile(path, Buffer.from("tampered updater bytes")); + await expect( + verifyTauriUpdaterSignature(path, fixture.signature, fixture.publicKey), + ).rejects.toThrow("artifact signature is invalid"); + }); + + it("verifies local manifest payloads and sidecars before publication", async () => { + const root = await tempRoot("local-updater-signatures"); + const artifact = Buffer.from("locally signed updater bytes"); + const fixture = updaterFixture(artifact); + const candidate = manifest("1.2.3", fixture.signature); + const artifactName = "manager-1.2.3.exe"; + await writeFile(join(root, artifactName), artifact); + await writeFile(join(root, `${artifactName}.sig`), `${fixture.signature}\n`); + + await expect( + verifyLocalUpdaterArtifacts({ + manifest: candidate, + distDir: root, + publicKey: fixture.publicKey, + }), + ).resolves.toMatchObject({ artifactCount: 1, verified: true }); + + const wrongKey = updaterFixture(Buffer.from("different release")).publicKey; + await expect( + verifyLocalUpdaterArtifacts({ + manifest: candidate, + distDir: root, + publicKey: wrongKey, + }), + ).rejects.toThrow("artifact signature is invalid"); + }); +}); + +describe("public mirror route verification", () => { + it("downloads the candidate and every updater payload through public URLs", async () => { + const root = await tempRoot("public-route"); + const artifact = Buffer.from("public updater payload"); + const fixture = updaterFixture(artifact); + const candidate = completeManifest("1.2.3", fixture.signature); + const candidateKey = candidateKeyFor("1.2.3", "public-run"); + const candidatePath = await writeManifest(root, "candidate.json", candidate); + const objects = new Map([ + [`/manager/${candidateKey}`, await readFile(candidatePath)], + ]); + const expectedArtifacts = Object.entries(candidate.platforms).map( + ([platform, entry]) => { + const name = new URL(entry.url).pathname.split("/").at(-1); + objects.set(`/manager/1.2.3/${name}`, artifact); + return { + key: `1.2.3/${name}`, + localPath: join(root, name), + name, + platform, + sha256: hash(artifact), + signature: fixture.signature, + size: artifact.length, + }; + }, + ); + const requests = []; + + const report = await verifyPublicMirrorRoute({ + candidateKey, + candidateManifest: candidate, + candidatePath, + expectedArtifacts, + mirrorBase: "https://mirror.example/manager", + publicKey: fixture.publicKey, + workDir: join(root, "verify"), + fetchImpl: publicRouteFetch(objects, requests), + }); + + expect(report).toMatchObject({ artifactCount: 4, backendCount: 2, verified: true }); + expect(report.backends.r2).toMatchObject({ artifactCount: 4, verified: true }); + expect(report.backends.ihep).toMatchObject({ artifactCount: 4, verified: true }); + expect(requests).toHaveLength(15); + const workerRequests = requests.filter((url) => url.hostname === "mirror.example"); + expect(workerRequests).toHaveLength(10); + expect(workerRequests.every((url) => url.searchParams.has("cam_probe"))).toBe(true); + expect(new Set(workerRequests.map((url) => url.searchParams.get("cam_backend")))).toEqual( + new Set(["r2", "ihep"]), + ); + + const corruptedName = expectedArtifacts[0].name; + const corruptedIhep = new Map(objects); + corruptedIhep.set(`/manager/1.2.3/${corruptedName}`, Buffer.from("corrupt")); + await expect( + verifyPublicMirrorRoute({ + candidateKey, + candidateManifest: candidate, + candidatePath, + expectedArtifacts, + mirrorBase: "https://mirror.example/manager", + publicKey: fixture.publicKey, + workDir: join(root, "corrupt"), + fetchImpl: publicRouteFetch(objects, [], { ihepObjects: corruptedIhep }), + }), + ).rejects.toThrow(`public mirror ihep size mismatch for ${corruptedName}`); + }); +}); + +describe("AWS conditional writes", () => { + function objectStore() { + return new AwsObjectStore({ + name: "r2", + endpoint: "https://r2.example.invalid", + bucket: "manager", + region: "auto", + accessKeyId: "test-access-key", + secretAccessKey: "test-secret-key", + configPath: "/tmp/test-aws-config", + }); + } + + it("uses one attempt and trusts the committing PutObject response ETag", async () => { + const root = await tempRoot("conditional-put"); + const candidatePath = await writeManifest(root, "candidate.json", manifest("1.2.3")); + const backend = objectStore(); + let call; + backend.aws = async (args, options) => { + call = { args, options }; + return { code: 0, stderr: "", stdout: '{"ETag":"\\"committed-etag\\""}' }; + }; + backend.head = async () => { + throw new Error("post-write HEAD must not determine write ownership"); + }; + + const result = await backend.putLatestConditional( + candidatePath, + '"previous-etag"', + "promotion-token", + ); + + expect(result.etag).toBe('"committed-etag"'); + expect(call.options.env).toEqual({ AWS_MAX_ATTEMPTS: "1" }); + expect(call.args).toEqual( + expect.arrayContaining([ + "--if-match", + '"previous-etag"', + "--metadata", + "cam-promotion-token=promotion-token", + ]), + ); + }); + + it("reports a final 412 as a conditional conflict without claiming ownership", async () => { + const root = await tempRoot("conditional-conflict"); + const candidatePath = await writeManifest(root, "candidate.json", manifest("1.2.3")); + const backend = objectStore(); + backend.aws = async () => ({ + code: 1, + stderr: "PreconditionFailed (412)", + stdout: "", + }); + + await expect( + backend.putLatestConditional(candidatePath, '"stale-etag"', "promotion-token"), + ).rejects.toBeInstanceOf(ConditionalWriteError); + }); +}); + +describe("backend candidate verification", () => { + it("downloads candidate and artifact and verifies version, size, hash, and signature", async () => { + const root = await tempRoot("candidate-verify"); + const dist = join(root, "dist"); + await mkdir(dist, { recursive: true }); + const artifact = Buffer.from("release artifact from object storage"); + const fixture = updaterFixture(artifact); + const candidate = manifest("1.2.3", fixture.signature); + const artifactName = "manager-1.2.3.exe"; + const dmgName = "CodexAppManager_aarch64.dmg"; + const signatureName = `${artifactName}.sig`; + const dmg = Buffer.from("macOS installer bytes"); + const signatureSidecar = Buffer.from(`${fixture.signature}\n`); + await writeFile(join(dist, artifactName), artifact); + await writeFile(join(dist, dmgName), dmg); + await writeFile(join(dist, signatureName), signatureSidecar); + const candidatePath = await writeManifest(dist, "latest.mirror.json", candidate); + const key = candidateKeyFor("1.2.3", "run-1"); + const backend = new MemoryBackend("r2", { + [key]: await readFile(candidatePath), + [`1.2.3/${artifactName}`]: artifact, + [`1.2.3/${dmgName}`]: dmg, + [`1.2.3/${signatureName}`]: signatureSidecar, + }); + + const report = await verifyBackendCandidate({ + backend, + candidateKey: key, + candidatePath, + candidateManifest: candidate, + distDir: dist, + mirrorBase: "https://mirror.example/manager", + publicKey: fixture.publicKey, + workDir: join(root, "verify"), + }); + + expect(report.verified).toBe(true); + expect(report.artifactCount).toBe(3); + expect(report.artifacts).toEqual( + expect.arrayContaining([ + expect.objectContaining({ + name: artifactName, + sha256: hash(artifact), + signatureVerified: true, + size: artifact.length, + }), + expect.objectContaining({ + name: dmgName, + sha256: hash(dmg), + signatureVerified: null, + size: dmg.length, + }), + expect.objectContaining({ + name: signatureName, + sha256: hash(signatureSidecar), + signatureVerified: null, + size: signatureSidecar.length, + }), + ]), + ); + }); + + it("rejects an empty platform signature instead of silently skipping verification", async () => { + const root = await tempRoot("candidate-empty-signature"); + const dist = join(root, "dist"); + await mkdir(dist, { recursive: true }); + const candidate = manifest("1.2.3", ""); + const candidatePath = await writeManifest(dist, "latest.mirror.json", candidate); + const key = candidateKeyFor("1.2.3", "run-empty-signature"); + const backend = new MemoryBackend("r2", { + [key]: await readFile(candidatePath), + }); + + await expect( + verifyBackendCandidate({ + backend, + candidateKey: key, + candidatePath, + candidateManifest: candidate, + distDir: dist, + mirrorBase: "https://mirror.example/manager", + publicKey: "deliberately-invalid-public-key", + workDir: join(root, "verify"), + }), + ).rejects.toThrow("empty updater signature"); + }); + + it("requires each manifest signature to match its local sidecar", async () => { + const root = await tempRoot("candidate-sidecar-mismatch"); + const dist = join(root, "dist"); + await mkdir(dist, { recursive: true }); + const artifact = Buffer.from("release artifact from object storage"); + const fixture = updaterFixture(artifact); + const candidate = manifest("1.2.3", fixture.signature); + const artifactName = "manager-1.2.3.exe"; + await writeFile(join(dist, artifactName), artifact); + await writeFile(join(dist, `${artifactName}.sig`), "different-signature\n"); + const candidatePath = await writeManifest(dist, "latest.mirror.json", candidate); + const key = candidateKeyFor("1.2.3", "run-sidecar-mismatch"); + const backend = new MemoryBackend("r2", { + [key]: await readFile(candidatePath), + }); + + await expect( + verifyBackendCandidate({ + backend, + candidateKey: key, + candidatePath, + candidateManifest: candidate, + distDir: dist, + mirrorBase: "https://mirror.example/manager", + publicKey: fixture.publicKey, + workDir: join(root, "verify"), + }), + ).rejects.toThrow("sidecar does not match manifest"); + }); +}); + +describe("pre-publication mirror verification", () => { + it("verifies both origins and the public route without writing latest.json", async () => { + const root = await tempRoot("prepublish-verify"); + const dist = join(root, "dist"); + await mkdir(dist, { recursive: true }); + const artifact = Buffer.from("stable updater payload"); + const fixture = updaterFixture(artifact); + const candidate = completeManifest("1.2.3", fixture.signature); + const candidatePath = await writeManifest(dist, "latest.mirror.json", candidate); + const candidateKey = candidateKeyFor("1.2.3", "verify-run"); + const candidateBytes = await readFile(candidatePath); + const stagedObjects = {}; + const publicObjects = new Map([[`/manager/${candidateKey}`, candidateBytes]]); + for (const entry of Object.values(candidate.platforms)) { + const name = new URL(entry.url).pathname.split("/").at(-1); + const sidecar = Buffer.from(`${fixture.signature}\n`); + await writeFile(join(dist, name), artifact); + await writeFile(join(dist, `${name}.sig`), sidecar); + stagedObjects[`1.2.3/${name}`] = artifact; + stagedObjects[`1.2.3/${name}.sig`] = sidecar; + publicObjects.set(`/manager/1.2.3/${name}`, artifact); + } + const current = Buffer.from(`${JSON.stringify(manifest("1.0.0"))}\n`); + const r2 = new MemoryBackend("r2", { + "latest.json": current, + [candidateKey]: candidateBytes, + ...stagedObjects, + }); + const ihep = new MemoryBackend("ihep", { + "latest.json": current, + [candidateKey]: candidateBytes, + ...stagedObjects, + }); + const promotionToken = hash(Buffer.from(candidateKey)); + r2.objects.get(candidateKey).metadata["cam-promotion-token"] = promotionToken; + ihep.objects.get(candidateKey).metadata["cam-promotion-token"] = promotionToken; + const summaryPath = join(root, "mirror-verification-summary.json"); + + const summary = await verifyMirrors({ + backends: [r2, ihep], + candidateKey, + candidateManifest: candidate, + candidatePath, + distDir: dist, + mirrorBase: "https://mirror.example/manager", + override: overrideOff(), + publicKey: fixture.publicKey, + summaryPath, + tempRoot: join(root, "verify"), + fetchImpl: publicRouteFetch(publicObjects), + }); + + expect(summary.outcome).toBe("verified"); + expect(summary.publicRouteVerification).toBe("passed"); + expect(Object.keys(summary.publicRoute.backends)).toEqual(["r2", "ihep"]); + expect(summary.backends.map((backend) => backend.candidateVerification)).toEqual([ + "passed", + "passed", + ]); + expect([r2.latestPutAttempts, ihep.latestPutAttempts]).toEqual([0, 0]); + expect(JSON.parse(await readFile(summaryPath, "utf8")).outcome).toBe("verified"); + + const corruptedName = new URL(Object.values(candidate.platforms)[0].url).pathname + .split("/") + .at(-1); + const corruptedIhep = new Map(publicObjects); + corruptedIhep.set(`/manager/1.2.3/${corruptedName}`, Buffer.from("corrupt")); + await expect( + promoteMirrors({ + backends: [r2, ihep], + candidateKey, + candidateManifest: candidate, + candidatePath, + distDir: dist, + mirrorBase: "https://mirror.example/manager", + override: overrideOff(), + publicKey: fixture.publicKey, + summaryPath: join(root, "failed-promotion-summary.json"), + tempRoot: join(root, "failed-promote"), + fetchImpl: publicRouteFetch(publicObjects, [], { ihepObjects: corruptedIhep }), + }), + ).rejects.toThrow(`public mirror ihep size mismatch for ${corruptedName}`); + expect([r2.latestPutAttempts, ihep.latestPutAttempts]).toEqual([0, 0]); + }); +}); + +describe("monotonic mirror promotion", () => { + it("blocks an old tag rerun without writing either backend", async () => { + const root = await tempRoot("old-rerun"); + const current = manifest("2.0.0"); + const candidate = manifest("1.9.0"); + const candidatePath = await writeManifest(root, "candidate.json", candidate); + const initial = `${JSON.stringify(current)}\n`; + const backends = [ + new MemoryBackend("r2", { "latest.json": initial }), + new MemoryBackend("ihep", { "latest.json": initial }), + ]; + + await expect( + promoteCandidateTransaction({ + backends, + candidateManifest: candidate, + candidatePath, + override: overrideOff(), + summary: summaryFor(backends), + workDir: join(root, "transaction"), + }), + ).rejects.toBeInstanceOf(DowngradeBlockedError); + + expect(backends.map((backend) => backend.latestPutAttempts)).toEqual([0, 0]); + expect(backends.map((backend) => JSON.parse(backend.body("latest.json")).version)).toEqual([ + "2.0.0", + "2.0.0", + ]); + }); + + it("treats a same-version rerun as a no-write idempotent success", async () => { + const root = await tempRoot("same-version"); + const current = manifest("2.0.0"); + current.pub_date = "2026-01-01T00:00:00Z"; + const candidate = manifest("2.0.0"); + candidate.pub_date = "2026-02-01T00:00:00Z"; + const candidatePath = await writeManifest(root, "candidate.json", candidate); + const original = Buffer.from(`${JSON.stringify(current)}\n`); + const backends = [ + new MemoryBackend("r2", { "latest.json": original }), + new MemoryBackend("ihep", { "latest.json": original }), + ]; + + const result = await promoteCandidateTransaction({ + backends, + candidateManifest: candidate, + candidatePath, + override: overrideOff(), + summary: summaryFor(backends), + workDir: join(root, "transaction"), + }); + + expect(result.outcome).toBe("idempotent"); + expect(backends.map((backend) => backend.latestPutAttempts)).toEqual([0, 0]); + expect(backends.every((backend) => backend.body("latest.json").equals(original))).toBe(true); + }); + + it("rejects a concurrent latest change before returning idempotent", async () => { + const root = await tempRoot("same-version-race"); + const candidate = manifest("2.0.0"); + const candidatePath = await writeManifest(root, "candidate.json", candidate); + const original = Buffer.from(`${JSON.stringify(candidate)}\n`); + const r2 = new MemoryBackend("r2", { "latest.json": original }); + const ihep = new MemoryBackend("ihep", { "latest.json": original }); + const backends = [r2, ihep]; + + await expect( + promoteCandidateTransaction({ + backends, + candidateManifest: candidate, + candidatePath, + override: overrideOff(), + summary: summaryFor(backends), + workDir: join(root, "transaction"), + hooks: { + afterSnapshots: () => { + ihep.set("latest.json", `${JSON.stringify(manifest("2.1.0"))}\n`); + }, + }, + }), + ).rejects.toBeInstanceOf(ConditionalWriteError); + + expect([r2.latestPutAttempts, ihep.latestPutAttempts]).toEqual([0, 0]); + expect(JSON.parse(r2.body("latest.json")).version).toBe("2.0.0"); + expect(JSON.parse(ihep.body("latest.json")).version).toBe("2.1.0"); + }); + + it("uses conditional writes so a concurrent newer release wins without mixed latest pointers", async () => { + const root = await tempRoot("concurrent"); + const initial = `${JSON.stringify(manifest("1.0.0"))}\n`; + const backends = [ + new MemoryBackend("r2", { "latest.json": initial }), + new MemoryBackend("ihep", { "latest.json": initial }), + ]; + const older = manifest("1.1.0"); + const newer = manifest("1.2.0"); + const olderPath = await writeManifest(root, "older.json", older); + const newerPath = await writeManifest(root, "newer.json", newer); + let releaseOlderSnapshots; + let olderSnapshotsReached; + const holdOlder = new Promise((resolvePromise) => { + releaseOlderSnapshots = resolvePromise; + }); + const olderReady = new Promise((resolvePromise) => { + olderSnapshotsReached = resolvePromise; + }); + + const olderRun = promoteCandidateTransaction({ + backends, + candidateManifest: older, + candidatePath: olderPath, + override: overrideOff(), + summary: summaryFor(backends), + workDir: join(root, "older-transaction"), + hooks: { + afterSnapshots: async () => { + olderSnapshotsReached(); + await holdOlder; + }, + }, + }); + await olderReady; + + await promoteCandidateTransaction({ + backends, + candidateManifest: newer, + candidatePath: newerPath, + override: overrideOff(), + summary: summaryFor(backends), + workDir: join(root, "newer-transaction"), + }); + releaseOlderSnapshots(); + + await expect(olderRun).rejects.toBeInstanceOf(ConditionalWriteError); + expect(backends.map((backend) => JSON.parse(backend.body("latest.json")).version)).toEqual([ + "1.2.0", + "1.2.0", + ]); + }); + + it("heals a hard-terminated partial promotion without rewriting the committed backend", async () => { + const root = await tempRoot("partial-terminated-transaction"); + const current = manifest("1.0.0"); + const candidate = manifest("1.1.0"); + const candidatePath = await writeManifest(root, "candidate.json", candidate); + const initial = `${JSON.stringify(current)}\n`; + const r2 = new MemoryBackend("r2", { "latest.json": initial }); + const ihep = new MemoryBackend("ihep", { "latest.json": initial }); + // Model SIGKILL/OOM after the first conditional write committed but before + // the process could enter its rollback handler. + const r2Previous = await r2.head("latest.json"); + await r2.putLatestConditional(candidatePath, r2Previous.etag, "terminated-run"); + const r2AttemptsAfterTermination = r2.latestPutAttempts; + const backends = [r2, ihep]; + const failedResumeSummary = summaryFor(backends); + const realIhepPut = ihep.putLatestConditional.bind(ihep); + let failFirstResume = true; + ihep.putLatestConditional = async (...args) => { + if (failFirstResume) { + failFirstResume = false; + ihep.latestPutAttempts += 1; + throw new ConditionalWriteError("ihep: simulated conditional outage"); + } + return await realIhepPut(...args); + }; + + await expect( + promoteCandidateTransaction({ + backends, + candidateManifest: candidate, + candidatePath, + override: overrideOff(), + promotionToken: "this-run", + summary: failedResumeSummary, + workDir: join(root, "failed-resume"), + }), + ).rejects.toBeInstanceOf(ConditionalWriteError); + + expect(r2.latestPutAttempts).toBe(r2AttemptsAfterTermination); + expect(backends.map((backend) => JSON.parse(backend.body("latest.json")).version)).toEqual([ + "1.1.0", + "1.0.0", + ]); + expect(failedResumeSummary.rollback).toEqual( + expect.objectContaining({ attempted: false, complete: true }), + ); + + await expect( + promoteCandidateTransaction({ + backends, + candidateManifest: candidate, + candidatePath, + override: overrideOff(), + promotionToken: "fresh-run", + summary: summaryFor(backends), + workDir: join(root, "successful-resume"), + }), + ).resolves.toEqual(expect.objectContaining({ outcome: "promoted" })); + + expect(r2.latestPutAttempts).toBe(r2AttemptsAfterTermination); + expect(ihep.latestPutAttempts).toBe(2); + expect(backends.map((backend) => JSON.parse(backend.body("latest.json")).version)).toEqual([ + "1.1.0", + "1.1.0", + ]); + expect(r2.objects.get("latest.json").metadata["cam-promotion-token"]).toBe( + "terminated-run", + ); + expect(ihep.objects.get("latest.json").metadata["cam-promotion-token"]).toBe("fresh-run"); + }); + + it("fails closed before writing when either backend has no baseline latest.json", async () => { + const root = await tempRoot("unseeded-backend"); + const candidate = manifest("1.1.0"); + const candidatePath = await writeManifest(root, "candidate.json", candidate); + const r2 = new MemoryBackend("r2", { + "latest.json": `${JSON.stringify(manifest("1.0.0"))}\n`, + }); + const ihep = new MemoryBackend("ihep"); + const backends = [r2, ihep]; + + await expect( + promoteCandidateTransaction({ + backends, + candidateManifest: candidate, + candidatePath, + override: overrideOff(), + summary: summaryFor(backends), + workDir: join(root, "transaction"), + }), + ).rejects.toThrow("seed both backends"); + + expect(backends.map((backend) => backend.latestPutAttempts)).toEqual([0, 0]); + expect(ihep.body("latest.json")).toBeUndefined(); + }); + + it("never rolls back an ETag that a concurrent writer owns", async () => { + const root = await tempRoot("etag-ownership"); + const current = manifest("1.0.0"); + const candidate = manifest("1.1.0"); + const external = manifest("1.2.0"); + const candidatePath = await writeManifest(root, "candidate.json", candidate); + const r2 = new MemoryBackend("r2", { + "latest.json": `${JSON.stringify(current)}\n`, + }); + const ihep = new MemoryBackend("ihep", { + "latest.json": `${JSON.stringify(current)}\n`, + }); + const realPut = r2.putLatestConditional.bind(r2); + r2.putLatestConditional = async (...args) => { + const committed = await realPut(...args); + r2.set( + "latest.json", + `${JSON.stringify(external)}\n`, + { "cam-promotion-token": "external-run" }, + ); + return committed; + }; + const backends = [r2, ihep]; + const summary = summaryFor(backends); + + await expect( + promoteCandidateTransaction({ + backends, + candidateManifest: candidate, + candidatePath, + override: overrideOff(), + promotionToken: "this-run", + summary, + workDir: join(root, "transaction"), + }), + ).rejects.toBeInstanceOf(ConditionalWriteError); + + expect(JSON.parse(r2.body("latest.json")).version).toBe("1.2.0"); + expect(JSON.parse(ihep.body("latest.json")).version).toBe("1.0.0"); + expect(summary.backends.find((backend) => backend.name === "r2").rollback).toBe( + "skipped-concurrent-change", + ); + }); + + it("observes and rolls back a committed write whose process response was lost", async () => { + const root = await tempRoot("ambiguous-commit"); + const current = manifest("1.0.0"); + const candidate = manifest("1.1.0"); + const candidatePath = await writeManifest(root, "candidate.json", candidate); + const initial = Buffer.from(`${JSON.stringify(current)}\n`); + const r2 = new MemoryBackend("r2", { "latest.json": initial }); + const ihep = new MemoryBackend("ihep", { "latest.json": initial }); + const realPut = r2.putLatestConditional.bind(r2); + let firstWrite = true; + r2.putLatestConditional = async (localPath, expectedEtag, promotionToken) => { + if (!firstWrite) return await realPut(localPath, expectedEtag, promotionToken); + firstWrite = false; + r2.latestPutAttempts += 1; + const currentObject = r2.objects.get("latest.json"); + if (currentObject?.etag !== expectedEtag) { + throw new ConditionalWriteError("r2: stale latest ETag"); + } + r2.set( + "latest.json", + await readFile(localPath), + { "cam-promotion-token": promotionToken }, + ); + throw new Error("simulated process termination after server commit"); + }; + const backends = [r2, ihep]; + const summary = summaryFor(backends); + + await expect( + promoteCandidateTransaction({ + backends, + candidateManifest: candidate, + candidatePath, + override: overrideOff(), + promotionToken: "interrupted-run", + summary, + workDir: join(root, "transaction"), + }), + ).rejects.toThrow("simulated process termination"); + + expect(backends.every((backend) => backend.body("latest.json").equals(initial))).toBe(true); + expect(summary.rollback).toEqual( + expect.objectContaining({ attempted: true, complete: true }), + ); + }); + + it("rolls back the first backend when execution is interrupted between writes", async () => { + const root = await tempRoot("interrupted"); + const current = manifest("1.0.0"); + const candidate = manifest("1.1.0"); + const candidatePath = await writeManifest(root, "candidate.json", candidate); + const initial = Buffer.from(`${JSON.stringify(current)}\n`); + const backends = [ + new MemoryBackend("r2", { "latest.json": initial }), + new MemoryBackend("ihep", { "latest.json": initial }), + ]; + const summary = summaryFor(backends); + + await expect( + promoteCandidateTransaction({ + backends, + candidateManifest: candidate, + candidatePath, + override: overrideOff(), + summary, + workDir: join(root, "transaction"), + hooks: { + afterWrite: (state) => { + if (state.backend.name === "r2") throw new Error("simulated SIGTERM"); + }, + }, + }), + ).rejects.toThrow("simulated SIGTERM"); + + expect(backends.every((backend) => backend.body("latest.json").equals(initial))).toBe(true); + expect(summary.backends.find((backend) => backend.name === "r2").rollback).toBe("restored"); + expect(summary.backends.find((backend) => backend.name === "ihep").promotion).toBe( + "not-started", + ); + }); + + it("does not write latest when one backend candidate verification fails", async () => { + const root = await tempRoot("one-backend-fails"); + const dist = join(root, "dist"); + await mkdir(dist, { recursive: true }); + const artifact = Buffer.from("valid release artifact"); + const fixture = updaterFixture(artifact); + const candidate = completeManifest("1.1.0", fixture.signature); + const artifactNames = Object.values(candidate.platforms).map((entry) => + new URL(entry.url).pathname.split("/").at(-1), + ); + for (const name of artifactNames) { + await writeFile(join(dist, name), artifact); + await writeFile(join(dist, `${name}.sig`), `${fixture.signature}\n`); + } + const candidatePath = await writeManifest(dist, "latest.mirror.json", candidate); + const candidateKey = candidateKeyFor("1.1.0", "run-2"); + const current = Buffer.from(`${JSON.stringify(manifest("1.0.0"))}\n`); + const stagedObjects = Object.fromEntries( + artifactNames.flatMap((name) => [ + [`1.1.0/${name}`, artifact], + [`1.1.0/${name}.sig`, Buffer.from(`${fixture.signature}\n`)], + ]), + ); + const r2 = new MemoryBackend("r2", { + "latest.json": current, + [candidateKey]: await readFile(candidatePath), + ...stagedObjects, + }); + const missingArtifact = artifactNames.at(-1); + const ihepObjects = { ...stagedObjects }; + delete ihepObjects[`1.1.0/${missingArtifact}`]; + const ihep = new MemoryBackend("ihep", { + "latest.json": current, + [candidateKey]: await readFile(candidatePath), + // Deliberately missing one required platform artifact. + ...ihepObjects, + }); + const promotionToken = hash(Buffer.from(candidateKey)); + r2.objects.get(candidateKey).metadata["cam-promotion-token"] = promotionToken; + ihep.objects.get(candidateKey).metadata["cam-promotion-token"] = promotionToken; + const summaryPath = join(root, "promotion-summary.json"); + + await expect( + promoteMirrors({ + backends: [r2, ihep], + candidateKey, + candidateManifest: candidate, + candidatePath, + distDir: dist, + mirrorBase: "https://mirror.example/manager", + override: overrideOff(), + publicKey: fixture.publicKey, + summaryPath, + tempRoot: join(root, "promote"), + }), + ).rejects.toThrow("ihep: artifact is missing"); + + expect([r2.latestPutAttempts, ihep.latestPutAttempts]).toEqual([0, 0]); + const audit = JSON.parse(await readFile(summaryPath, "utf8")); + expect(audit.outcome).toBe("failed"); + expect(audit.backends.map((backend) => backend.candidateVerification)).toEqual([ + "passed", + "failed", + ]); + }); + + it("requires a workflow-dispatch audit trail for emergency downgrade override", () => { + expect(() => + downgradeOverrideFromEnv({ + MIRROR_ALLOW_DOWNGRADE: "1", + MIRROR_DOWNGRADE_REASON: "urgent rollback after launch regression", + GITHUB_EVENT_NAME: "push", + GITHUB_ACTOR: "release-admin", + GITHUB_REPOSITORY: "owner/repo", + GITHUB_RUN_ID: "42", + }), + ).toThrow("only from workflow_dispatch"); + + expect(() => + downgradeOverrideFromEnv({ + MIRROR_ALLOW_DOWNGRADE: "1", + MIRROR_DEFAULT_BRANCH: "main", + MIRROR_DOWNGRADE_REASON: "urgent rollback after launch regression", + MIRROR_WORKFLOW_REF_NAME: "release-experiment", + GITHUB_EVENT_NAME: "workflow_dispatch", + GITHUB_ACTOR: "release-admin", + GITHUB_REPOSITORY: "owner/repo", + GITHUB_RUN_ID: "42", + }), + ).toThrow("default branch"); + + const override = downgradeOverrideFromEnv({ + MIRROR_ALLOW_DOWNGRADE: "1", + MIRROR_DEFAULT_BRANCH: "main", + MIRROR_DOWNGRADE_REASON: "urgent rollback after launch regression", + MIRROR_WORKFLOW_REF_NAME: "main", + GITHUB_EVENT_NAME: "workflow_dispatch", + GITHUB_ACTOR: "release-admin", + GITHUB_TRIGGERING_ACTOR: "incident-commander", + GITHUB_REPOSITORY: "owner/repo", + GITHUB_RUN_ID: "42", + }); + expect(override).toEqual( + expect.objectContaining({ + actor: "incident-commander", + originalActor: "release-admin", + reason: "urgent rollback after launch regression", + requested: true, + runUrl: "https://github.com/owner/repo/actions/runs/42", + }), + ); + }); + + it("uses an audited override to downgrade both backends consistently", async () => { + const root = await tempRoot("audited-downgrade"); + const current = manifest("3.0.0"); + const candidate = manifest("2.5.0"); + const candidatePath = await writeManifest(root, "candidate.json", candidate); + const initial = `${JSON.stringify(current)}\n`; + const backends = [ + new MemoryBackend("r2", { "latest.json": initial }), + new MemoryBackend("ihep", { "latest.json": initial }), + ]; + const override = { + actor: "release-admin", + eventName: "workflow_dispatch", + reason: "rollback production crash regression", + requested: true, + runUrl: "https://github.com/owner/repo/actions/runs/42", + used: false, + }; + const summary = summaryFor(backends, override); + + const result = await promoteCandidateTransaction({ + backends, + candidateManifest: candidate, + candidatePath, + override, + summary, + workDir: join(root, "transaction"), + }); + + expect(result.outcome).toBe("downgrade-override-promoted"); + expect(summary.override.used).toBe(true); + expect(backends.map((backend) => JSON.parse(backend.body("latest.json")).version)).toEqual([ + "2.5.0", + "2.5.0", + ]); + }); +}); + +describe("mirror manifest rewriting", () => { + it("uses an immutable version path and a per-run candidate key", async () => { + const root = await tempRoot("manifest-rewrite"); + const dist = join(root, "dist"); + await mkdir(dist, { recursive: true }); + const source = manifest("3.4.5"); + source.platforms["windows-x86_64"].url = + "https://github.com/owner/repo/releases/download/v3.4.5/manager-3.4.5.exe"; + await writeManifest(dist, "latest.json", source); + + const result = await createMirrorManifest(dist, "https://mirror.example/manager"); + + expect(result.manifest.platforms["windows-x86_64"].url).toBe( + "https://mirror.example/manager/3.4.5/manager-3.4.5.exe", + ); + expect(candidateKeyFor("3.4.5", "987-2")).toBe("candidates/3.4.5/987-2.json"); + }); +}); + +describe("release audit summary", () => { + it("renders per-backend verification, monotonic decisions, rollback, and override audit", async () => { + const root = await tempRoot("release-summary"); + const summaryPath = join(root, "github-summary.md"); + await writeManifest(root, "latest.json", manifest("4.0.0")); + await writeManifest(root, "mirror-stage-summary.json", { + candidateKey: "candidates/4.0.0/42-1.json", + candidateVersion: "4.0.0", + outcome: "staged", + }); + await writeManifest(root, "mirror-verification-summary.json", { + candidateKey: "candidates/4.0.0/42-1.json", + candidateVersion: "4.0.0", + outcome: "verified", + publicRouteVerification: "passed", + }); + await writeManifest(root, "mirror-promotion-summary.json", { + candidateKey: "candidates/4.0.0/42-1.json", + candidateVersion: "4.0.0", + outcome: "downgrade-override-promoted", + override: { + actor: "incident-commander", + originalActor: "release-admin", + reason: "rollback broken production release", + requested: true, + runUrl: "https://github.com/owner/repo/actions/runs/42", + used: true, + }, + backends: [ + { + name: "r2", + candidateVerification: "passed", + currentVersion: "5.0.0", + decision: "promote-downgrade-override", + promotion: "verified", + rollback: "not-needed", + finalVersion: "4.0.0", + }, + { + name: "ihep", + candidateVerification: "passed", + currentVersion: "5.0.0", + decision: "promote-downgrade-override", + promotion: "verified", + rollback: "not-needed", + finalVersion: "4.0.0", + }, + ], + }); + + await execFileAsync(process.execPath, [join(process.cwd(), "scripts/write-release-summary.mjs")], { + cwd: root, + env: { + ...process.env, + GITHUB_REF_NAME: "v4.0.0", + GITHUB_REPOSITORY: "owner/repo", + GITHUB_STEP_SUMMARY: summaryPath, + }, + }); + + const rendered = await readFile(summaryPath, "utf8"); + expect(rendered).toContain("Promotion outcome: **downgrade-override-promoted**"); + expect(rendered).toContain("Pre-publish verification: **verified**"); + expect(rendered).toContain("Public route verification: **passed**"); + expect(rendered).toContain("| r2 | passed | 5.0.0 | promote-downgrade-override | verified"); + expect(rendered).toContain("rollback broken production release"); + expect(rendered).toContain("by `incident-commander` (original workflow actor: `release-admin`)"); + expect(rendered).toContain("https://github.com/owner/repo/actions/runs/42"); + }); +}); diff --git a/scripts/release-workflow.test.mjs b/scripts/release-workflow.test.mjs new file mode 100644 index 0000000..7f919f6 --- /dev/null +++ b/scripts/release-workflow.test.mjs @@ -0,0 +1,164 @@ +import { readFile } from "node:fs/promises"; +import { dirname, join } from "node:path"; +import { fileURLToPath } from "node:url"; + +import { describe, expect, it } from "vitest"; + +import { + assertImmutableReleasesEnabled, + verifyImmutableReleases, +} from "./check-immutable-releases.mjs"; + +const repoRoot = join(dirname(fileURLToPath(import.meta.url)), ".."); +const workflow = await readFile(join(repoRoot, ".github/workflows/release.yml"), "utf8"); +const mirrorRelease = await readFile(join(repoRoot, "scripts/mirror-release.mjs"), "utf8"); +const releaseJob = workflow.slice(workflow.indexOf(" release:\n")); + +describe("release workflow recovery invariants", () => { + it("queues every release run instead of replacing an older pending tag", () => { + expect(workflow).toMatch( + /concurrency:\n\s+group: release-latest-\$\{\{ github\.repository \}\}\n\s+cancel-in-progress: false\n\s+queue: max/, + ); + }); + + it("refreshes immutable Release state inside the release job on failed-job reruns", () => { + expect(releaseJob).toContain("id: live_release"); + expect(releaseJob).toContain( + "if: ${{ steps.live_release.outputs.release_reusable != 'true' }}", + ); + expect(releaseJob).toContain( + "RELEASE_ASSET_DIGESTS: ${{ steps.live_release.outputs.release_asset_digests }}", + ); + expect(releaseJob).toContain( + 'if [[ "${{ steps.live_release.outputs.release_reusable }}" == "true" ]]; then', + ); + expect(releaseJob).not.toContain( + "if: ${{ needs.prepare.outputs.release_reusable != 'true' }}", + ); + }); + + it("uses the target tag updater trust root without executing historical scripts", () => { + const refresh = releaseJob.indexOf("- name: Refresh immutable release state"); + const resolveTrust = releaseJob.indexOf( + "- name: Resolve updater trust root for release tag", + ); + const download = releaseJob.indexOf("- name: Download canonical build artifacts"); + const localVerify = releaseJob.indexOf( + "- name: Verify local updater signatures before immutable publication", + ); + const stage = releaseJob.indexOf("- name: Stage CDN mirror candidate"); + const trustStep = releaseJob.slice(resolveTrust, download); + const localVerifyStep = releaseJob.slice(localVerify, stage); + + expect(resolveTrust).toBeGreaterThan(refresh); + expect(download).toBeGreaterThan(resolveTrust); + expect(trustStep).toContain("gh api --method GET"); + expect(trustStep).toContain("application/vnd.github.raw+json"); + expect(trustStep).toContain('-f ref="$RELEASE_TAG"'); + expect(trustStep).toContain("RELEASE_TAURI_CONFIG="); + expect(trustStep).toContain("MIRROR_UPDATER_PUBLIC_KEY="); + expect(trustStep).toContain('>> "$GITHUB_ENV"'); + expect(localVerifyStep).toContain('"$RELEASE_TAURI_CONFIG"'); + expect(localVerifyStep).not.toContain("src-tauri/tauri.conf.json"); + expect(mirrorRelease).toContain("process.env.MIRROR_UPDATER_PUBLIC_KEY ||"); + }); + + it("fails closed when immutable settings are disabled or cannot be queried", () => { + expect(assertImmutableReleasesEnabled({ enabled: true })).toEqual({ enabled: true }); + expect(() => assertImmutableReleasesEnabled({ enabled: false })).toThrow( + "GitHub Immutable Releases are disabled", + ); + expect(() => + verifyImmutableReleases({ + repository: "owner/repo", + token: "read-only-token", + runner: () => ({ status: 1, stderr: "HTTP 403", stdout: "" }), + }), + ).toThrow("could not verify GitHub Immutable Releases"); + + const prepare = workflow.slice( + workflow.indexOf(" prepare:\n"), + workflow.indexOf(" build:\n"), + ); + expect(prepare).toContain("environment: release"); + expect(prepare).toContain("GH_TOKEN: ${{ secrets.IMMUTABLE_RELEASES_READ_TOKEN }}"); + expect(prepare).toContain("run: node scripts/check-immutable-releases.mjs"); + expect(releaseJob).toContain("run: node scripts/check-immutable-releases.mjs"); + }); + + it("uploads stable and prerelease assets to a draft before publishing", () => { + const localVerify = releaseJob.indexOf( + "- name: Verify local updater signatures before immutable publication", + ); + const stage = releaseJob.indexOf("- name: Stage CDN mirror candidate"); + const mirrorVerify = releaseJob.indexOf( + "- name: Verify staged CDN mirror before immutable publication", + ); + const upload = releaseJob.indexOf("- name: Upload GitHub Release draft"); + const publish = releaseJob.indexOf("- name: Publish GitHub Release"); + const publishedVerify = releaseJob.indexOf( + "- name: Verify published immutable Release and asset digests", + ); + const attest = releaseJob.indexOf("- name: Attest build provenance"); + const promote = releaseJob.indexOf("- name: Promote CDN mirror latest"); + const winget = releaseJob.indexOf("- name: Trigger winget submission"); + const summary = releaseJob.indexOf("- name: Write release summary"); + expect(localVerify).toBeGreaterThan(-1); + expect(stage).toBeGreaterThan(localVerify); + expect(mirrorVerify).toBeGreaterThan(stage); + expect(upload).toBeGreaterThan(mirrorVerify); + expect(upload).toBeGreaterThan(-1); + expect(publish).toBeGreaterThan(upload); + expect(publishedVerify).toBeGreaterThan(publish); + expect(attest).toBeGreaterThan(publishedVerify); + expect(promote).toBeGreaterThan(attest); + + const uploadStep = releaseJob.slice(upload, publish); + const publishStep = releaseJob.slice(publish, publishedVerify); + const verifyStep = releaseJob.slice(publishedVerify, attest); + const attestStep = releaseJob.slice(attest, promote); + const promoteStep = releaseJob.slice(promote, winget); + const wingetStep = releaseJob.slice(winget, summary); + const localVerifyStep = releaseJob.slice(localVerify, stage); + const mirrorVerifyStep = releaseJob.slice(mirrorVerify, upload); + expect(localVerifyStep).toContain("node scripts/verify-release-artifacts.mjs"); + expect(mirrorVerifyStep).toContain("MIRROR_PHASE: verify"); + expect(mirrorVerifyStep).toContain("bash scripts/sync-mirror.sh dist"); + expect(uploadStep).toContain("draft: true"); + expect(uploadStep).toContain("prerelease: ${{ contains(env.RELEASE_TAG, '-') }}"); + expect(uploadStep).toContain("files: |"); + expect(publishStep).not.toMatch(/^\s+draft:/m); + expect(publishStep).not.toContain("files: |"); + expect(verifyStep).toContain("node scripts/check-release-reuse.mjs"); + expect(verifyStep).toContain("did not become immutable with canonical asset digests"); + expect(attestStep).toContain( + "steps.publish_release.outcome == 'success' || steps.release_source.outputs.existing == 'true'", + ); + expect(attestStep).toContain("actions/attest-build-provenance@"); + expect(attestStep).not.toContain("continue-on-error: true"); + expect(promoteStep).toContain("steps.attest.outcome == 'success'"); + expect(wingetStep).toContain("steps.attest.outcome == 'success'"); + expect(releaseJob.slice(0, upload)).toContain( + "rm -f dist/latest.mirror.json dist/latest.json", + ); + }); + + it("attests only immutable Release bytes on a failed-job reuse", () => { + const source = releaseJob.indexOf("- name: Resolve immutable release artifact source"); + const validate = releaseJob.indexOf("- name: Validate final release artifacts"); + const attest = releaseJob.indexOf("- name: Attest build provenance"); + const promote = releaseJob.indexOf("- name: Promote CDN mirror latest"); + const sourceStep = releaseJob.slice(source, validate); + const attestStep = releaseJob.slice(attest, promote); + + expect(sourceStep).toContain("gh release download"); + expect(sourceStep).toContain("--pattern 'CodexAppManager*'"); + expect(sourceStep).toContain("--pattern 'latest.json'"); + expect(sourceStep).toContain('actual_digest="sha256:$(sha256sum "$file"'); + expect(sourceStep).toContain('if [[ "$actual_digest" != "$expected_digest" ]]'); + expect(attestStep).toContain("dist/*"); + expect(attestStep).toContain("latest.json"); + expect(attestStep).not.toContain("SHA256SUMS"); + expect(attestStep).not.toContain("release-assets/*"); + }); +}); diff --git a/scripts/sync-mirror.sh b/scripts/sync-mirror.sh index d055373..de60715 100755 --- a/scripts/sync-mirror.sh +++ b/scripts/sync-mirror.sh @@ -1,243 +1,8 @@ #!/usr/bin/env bash -# Publish the manager's release artifacts + a URL-rewritten latest.json to the -# CDN mirror, so in-app self-update works without depending on GitHub (which is -# slow/blocked for the mainland-China audience). -# -# • R2 (global) — uploaded when MANAGER_R2_* env vars are set. -# • IHEP S3 (CN) — uploaded when MANAGER_IHEP_S3_* env vars are set. -# -# The worker at codexapp.agentsmirror.com/manager/* serves R2 globally and the -# presigned IHEP object for CN. The artifact bytes are identical to the GitHub -# release, so the signatures already embedded in latest.json stay valid — we -# only rewrite the download URLs. -# -# Usage: scripts/sync-mirror.sh -# MIRROR_PHASE=all upload versioned assets + latest.json (default, -# the original one-step behavior) -# MIRROR_PHASE=stage upload versioned assets + latest.candidate.json -# MIRROR_PHASE=promote health-check candidate, then publish latest.json -# -# holds the release assets + the GitHub latest.json produced -# by gen-updater-manifest.mjs. +# Compatibility entry point for the release workflow. The Node implementation +# owns policy, direct backend verification, conditional promotion, and rollback; +# keeping this wrapper preserves the existing local/CI command surface. set -euo pipefail -dist="${1:?usage: sync-mirror.sh }" -phase="${MIRROR_PHASE:-all}" -mirror_base="${MIRROR_BASE_URL:-https://codexapp.agentsmirror.com/manager}" - -case "$phase" in - all|stage|promote) ;; - *) - echo "::error::unsupported MIRROR_PHASE=$phase (expected all, stage, or promote)" >&2 - exit 2 - ;; -esac - -if [ ! -f "$dist/latest.json" ]; then - echo "::error::no latest.json in $dist" >&2 - exit 1 -fi - -# Installers live under a per-version path on the mirror (see below), so read the -# version once and reuse it for both the rewritten URLs and the upload keys. -version="$(node -e 'process.stdout.write(String(JSON.parse(require("fs").readFileSync(process.argv[1],"utf8")).version||""))' "$dist/latest.json")" -if [ -z "$version" ]; then - echo "::error::latest.json has no version" >&2 - exit 1 -fi - -# 1) Mirror variant of latest.json: same signatures, URLs pointed at the mirror. -# Each installer URL gets a // segment so every release is an -# immutable, uniquely-addressed object. The macOS updater tarballs are renamed -# to versionless arch-only names upstream (CodexAppManager_.app.tar.gz), -# so without this each release would reuse one URL — and the worker's long -# installer cache could then serve a previous version's bytes against the new -# latest.json signature, breaking self-update. latest.json itself stays at the -# fixed root path the updater polls. -node -e ' - const fs = require("fs"); - const [dir, base, ver] = [process.argv[1], process.argv[2], process.argv[3]]; - const j = JSON.parse(fs.readFileSync(dir + "/latest.json", "utf8")); - for (const k of Object.keys(j.platforms || {})) { - const name = j.platforms[k].url.split("/").pop(); - j.platforms[k].url = `${base}/${ver}/${name}`; - } - fs.writeFileSync(dir + "/latest.mirror.json", JSON.stringify(j, null, 2) + "\n"); -' "$dist" "$mirror_base" "$version" - -content_type() { - case "$1" in - *.json) echo "application/json" ;; - *.tar.gz) echo "application/gzip" ;; - *.exe) echo "application/octet-stream" ;; - *.dmg) echo "application/x-apple-diskimage" ;; - *) echo "application/octet-stream" ;; - esac -} - -candidate_key="latest.candidate.json" -latest_key="latest.json" - -# Upload every asset (+ the mirror latest.json) to one S3-compatible endpoint. -# Path-style addressing works for both R2 and IHEP. -upload_assets() { # endpoint bucket region access_key secret_key phase [prefix] - local endpoint="$1" bucket="$2" region="$3" ak="$4" sk="$5" mode="$6" prefix="${7:-}" - local f name key - for f in "$dist"/*; do - name="$(basename "$f")" - [ "$name" = "latest.json" ] && continue # GitHub variant — skip - if [ "$name" = "latest.mirror.json" ]; then - if [ "$mode" = "stage" ]; then - key="$candidate_key" # candidate only; updater never polls it - else - key="$latest_key" # original one-step behavior - fi - else - key="$version/$name" # immutable, per-version object - fi - [ -n "$prefix" ] && key="${prefix%/}/$key" - AWS_ACCESS_KEY_ID="$ak" \ - AWS_SECRET_ACCESS_KEY="$sk" \ - AWS_DEFAULT_REGION="$region" \ - aws s3 cp "$f" "s3://$bucket/$key" \ - --endpoint-url "$endpoint" \ - --content-type "$(content_type "$name")" \ - --only-show-errors - echo " ↑ $key" - done -} - -upload_latest() { # endpoint bucket region access_key secret_key [prefix] - local endpoint="$1" bucket="$2" region="$3" ak="$4" sk="$5" prefix="${6:-}" - local key="$latest_key" - [ -n "$prefix" ] && key="${prefix%/}/$key" - AWS_ACCESS_KEY_ID="$ak" \ - AWS_SECRET_ACCESS_KEY="$sk" \ - AWS_DEFAULT_REGION="$region" \ - aws s3 cp "$dist/latest.mirror.json" "s3://$bucket/$key" \ - --endpoint-url "$endpoint" \ - --content-type "application/json" \ - --only-show-errors - echo " ↑ $key" -} - -check_candidate_health() { - local candidate_url="$mirror_base/$candidate_key" - local candidate urls - candidate="$(mktemp)" - urls="$(mktemp)" - CANDIDATE_TMP="$candidate" - CANDIDATE_URLS_TMP="$urls" - trap 'rm -f "$AWS_CONFIG_FILE" "${CANDIDATE_TMP:-}" "${CANDIDATE_URLS_TMP:-}"' EXIT - - echo "→ health-check $candidate_url" - curl -fsSL --retry 3 --max-time 30 "$candidate_url" -o "$candidate" - node - "$candidate" "$version" > "$urls" <<'NODE' -const fs = require("fs"); -const [path, expectedVersion] = process.argv.slice(2); -const manifest = JSON.parse(fs.readFileSync(path, "utf8")); -if (manifest.version !== expectedVersion) { - console.error(`candidate version ${manifest.version || "(missing)"} does not match ${expectedVersion}`); - process.exit(1); -} -const urls = Object.values(manifest.platforms || {}).map((platform) => platform && platform.url).filter(Boolean); -if (urls.length === 0) { - console.error("candidate has no platform URLs"); - process.exit(1); -} -for (const url of urls) console.log(url); -NODE - - while IFS= read -r url; do - [ -n "$url" ] || continue - echo " HEAD $url" - curl -fsSI --retry 3 --max-time 30 "$url" >/dev/null - done < "$urls" -} - -r2_configured() { - [ -n "${MANAGER_R2_S3_ENDPOINT:-}" ] && [ -n "${MANAGER_R2_ACCESS_KEY_ID:-}" ] && [ -n "${MANAGER_R2_SECRET_ACCESS_KEY:-}" ] -} - -ihep_configured() { - [ -n "${MANAGER_IHEP_S3_ENDPOINT:-}" ] && [ -n "${MANAGER_IHEP_S3_BUCKET:-}" ] && [ -n "${MANAGER_IHEP_S3_ACCESS_KEY_ID:-}" ] && [ -n "${MANAGER_IHEP_S3_SECRET_ACCESS_KEY:-}" ] -} - -sync_r2_assets() { - if r2_configured; then - echo "→ R2 (${MANAGER_R2_BUCKET:-codex-app-manager})" - upload_assets "$MANAGER_R2_S3_ENDPOINT" "${MANAGER_R2_BUCKET:-codex-app-manager}" "auto" \ - "$MANAGER_R2_ACCESS_KEY_ID" "$MANAGER_R2_SECRET_ACCESS_KEY" "$phase" - else - if [ "${ALLOW_STALE_MIRROR:-}" = "1" ]; then - echo "::warning::MANAGER_R2_* not set — skipped R2 mirror sync because ALLOW_STALE_MIRROR=1" - else - echo "::error::MANAGER_R2_* not set — refusing stable release with stale self-update mirror (set ALLOW_STALE_MIRROR=1 only for an intentional manual/pre-release bypass)" >&2 - exit 1 - fi - fi -} - -sync_ihep_assets() { - if ihep_configured; then - echo "→ IHEP S3 (${MANAGER_IHEP_S3_BUCKET})" - upload_assets "$MANAGER_IHEP_S3_ENDPOINT" "$MANAGER_IHEP_S3_BUCKET" "${MANAGER_IHEP_S3_REGION:-auto}" \ - "$MANAGER_IHEP_S3_ACCESS_KEY_ID" "$MANAGER_IHEP_S3_SECRET_ACCESS_KEY" "$phase" "${MANAGER_IHEP_S3_PREFIX:-}" - else - echo "IHEP S3 not configured — CN falls back to R2 via the worker" - fi -} - -promote_r2_latest() { - if r2_configured; then - echo "→ R2 promote (${MANAGER_R2_BUCKET:-codex-app-manager})" - upload_latest "$MANAGER_R2_S3_ENDPOINT" "${MANAGER_R2_BUCKET:-codex-app-manager}" "auto" \ - "$MANAGER_R2_ACCESS_KEY_ID" "$MANAGER_R2_SECRET_ACCESS_KEY" - else - if [ "${ALLOW_STALE_MIRROR:-}" = "1" ]; then - echo "::warning::MANAGER_R2_* not set — skipped R2 latest promote because ALLOW_STALE_MIRROR=1" - else - echo "::error::MANAGER_R2_* not set — cannot promote latest.json" >&2 - exit 1 - fi - fi -} - -promote_ihep_latest() { - if ihep_configured; then - echo "→ IHEP S3 promote (${MANAGER_IHEP_S3_BUCKET})" - upload_latest "$MANAGER_IHEP_S3_ENDPOINT" "$MANAGER_IHEP_S3_BUCKET" "${MANAGER_IHEP_S3_REGION:-auto}" \ - "$MANAGER_IHEP_S3_ACCESS_KEY_ID" "$MANAGER_IHEP_S3_SECRET_ACCESS_KEY" "${MANAGER_IHEP_S3_PREFIX:-}" - else - echo "IHEP S3 not configured — CN falls back to R2 via the worker" - fi -} - -# Force path-style addressing via a temp config — the AWS CLI ignores an -# AWS_S3_ADDRESSING_STYLE env var, and both R2 and IHEP need path-style here. -export AWS_EC2_METADATA_DISABLED=true -AWS_CONFIG_FILE="$(mktemp)" -export AWS_CONFIG_FILE -printf '[default]\nregion = auto\ns3 =\n addressing_style = path\n' > "$AWS_CONFIG_FILE" -trap 'rm -f "$AWS_CONFIG_FILE"' EXIT - -case "$phase" in - all|stage) - sync_r2_assets - sync_ihep_assets - echo "✓ mirror $phase done" - ;; - promote) - if r2_configured; then - check_candidate_health - elif [ "${ALLOW_STALE_MIRROR:-}" = "1" ]; then - echo "::warning::skipped mirror health check because MANAGER_R2_* is not set and ALLOW_STALE_MIRROR=1" - else - echo "::error::MANAGER_R2_* not set — cannot health-check or promote latest.json" >&2 - exit 1 - fi - promote_ihep_latest - promote_r2_latest - echo "✓ mirror promote done" - ;; -esac +ROOT="$(cd "$(dirname "$0")/.." && pwd)" +exec node "$ROOT/scripts/mirror-release.mjs" "$@" diff --git a/scripts/validate-release-manifest.mjs b/scripts/validate-release-manifest.mjs new file mode 100644 index 0000000..ba25f4e --- /dev/null +++ b/scripts/validate-release-manifest.mjs @@ -0,0 +1,37 @@ +#!/usr/bin/env node + +import { readFile } from "node:fs/promises"; + +import { assertCandidateMatchesRelease } from "./mirror-release.mjs"; + +const [, , releaseTag, candidatePath, artifactManifestPath] = process.argv; +if (!releaseTag || !candidatePath || !artifactManifestPath) { + console.error( + "usage: validate-release-manifest.mjs ", + ); + process.exit(2); +} + +const readManifest = async (path, label) => { + try { + return JSON.parse(await readFile(path, "utf8")); + } catch (error) { + const detail = error instanceof Error ? error.message : String(error); + throw new Error(`cannot read ${label}: ${detail}`); + } +}; + +try { + const [candidate, artifactManifest] = await Promise.all([ + readManifest(candidatePath, "candidate latest.json"), + readManifest(artifactManifestPath, "artifact-derived latest.json"), + ]); + const result = assertCandidateMatchesRelease(candidate, artifactManifest, releaseTag); + console.log( + `[manifest] candidate is bound to ${releaseTag} (${result.platformCount} updater platforms)`, + ); +} catch (error) { + const detail = error instanceof Error ? error.message : String(error); + console.error(`::error::[manifest] ${detail}`); + process.exitCode = 1; +} diff --git a/scripts/verify-release-artifacts.mjs b/scripts/verify-release-artifacts.mjs new file mode 100644 index 0000000..7a9f25e --- /dev/null +++ b/scripts/verify-release-artifacts.mjs @@ -0,0 +1,63 @@ +#!/usr/bin/env node + +import { readFile, writeFile } from "node:fs/promises"; +import { resolve } from "node:path"; + +import { verifyLocalUpdaterArtifacts } from "./mirror-release.mjs"; + +function usage() { + return "usage: verify-release-artifacts.mjs "; +} + +async function readJson(path, label) { + try { + return JSON.parse(await readFile(path, "utf8")); + } catch (error) { + const detail = error instanceof Error ? error.message : String(error); + throw new Error(`cannot read ${label}: ${detail}`); + } +} + +async function main() { + const [manifestArg, distArg, configArg] = process.argv.slice(2); + if (!manifestArg || !distArg || !configArg) throw new Error(usage()); + + const manifest = await readJson(resolve(manifestArg), "updater manifest"); + const config = await readJson(resolve(configArg), "Tauri configuration"); + const publicKey = config.plugins?.updater?.pubkey; + if (typeof publicKey !== "string" || !publicKey.trim()) { + throw new Error("Tauri configuration has no updater public key"); + } + + const report = await verifyLocalUpdaterArtifacts({ + manifest, + distDir: resolve(distArg), + publicKey: publicKey.trim(), + }); + const summaryPath = resolve( + process.env.UPDATER_SIGNATURE_SUMMARY_PATH || + "updater-signature-verification.json", + ); + await writeFile( + summaryPath, + `${JSON.stringify( + { + ...report, + manifestVersion: manifest.version, + verifiedAt: new Date().toISOString(), + }, + null, + 2, + )}\n`, + ); + console.log( + `[release] cryptographically verified ${report.artifactCount} updater artifacts`, + ); +} + +main().catch((error) => { + console.error( + `::error::[release] ${error instanceof Error ? error.message : String(error)}`, + ); + process.exitCode = 1; +}); diff --git a/scripts/write-release-summary.mjs b/scripts/write-release-summary.mjs index 299999d..22f11bf 100644 --- a/scripts/write-release-summary.mjs +++ b/scripts/write-release-summary.mjs @@ -2,7 +2,7 @@ import { appendFileSync, existsSync, readFileSync } from "node:fs"; const env = process.env; -const tag = env.GITHUB_REF_NAME || env.RELEASE_TAG || ""; +const tag = env.RELEASE_TAG || env.GITHUB_REF_NAME || ""; const repo = env.GITHUB_REPOSITORY || "Wangnov/Codex-App-Manager"; const mirrorBase = (env.MIRROR_BASE_URL || "https://codexapp.agentsmirror.com/manager").replace(/\/$/, ""); const summaryPath = env.GITHUB_STEP_SUMMARY; @@ -12,9 +12,27 @@ if (!summaryPath) { process.exit(0); } -const readJson = (path) => (existsSync(path) ? JSON.parse(readFileSync(path, "utf8")) : null); +const readJson = (path) => { + if (!existsSync(path)) return null; + try { + return JSON.parse(readFileSync(path, "utf8")); + } catch (error) { + return { readError: error instanceof Error ? error.message : String(error) }; + } +}; +const cell = (value) => + String(value ?? "") + .replace(/\s+/g, " ") + .replaceAll("|", "\\|") + .replaceAll("`", "'") + .replaceAll("<", "<") + .replaceAll(">", ">") + .slice(0, 500); const manifest = readJson("latest.json"); const manifestSummary = readJson("manifest-summary.json"); +const mirrorStage = readJson("mirror-stage-summary.json"); +const mirrorVerification = readJson("mirror-verification-summary.json"); +const mirrorPromotion = readJson("mirror-promotion-summary.json"); const version = manifest?.version || (tag ? tag.replace(/^v/, "") : ""); const releaseUrl = `https://github.com/${repo}/releases/tag/${tag}`; const latestUrl = `${mirrorBase}/latest.json`; @@ -69,6 +87,78 @@ if (checksums.length > 0) { rows.push("_SHA256SUMS was not generated._"); } +rows.push(""); +rows.push("## Mirror publication audit"); +rows.push(""); +if (mirrorStage || mirrorVerification || mirrorPromotion) { + const audit = mirrorPromotion || mirrorVerification || mirrorStage; + rows.push(`Candidate: \`${cell(audit?.candidateVersion || version)}\``); + rows.push(`Candidate object: \`${cell(audit?.candidateKey || "unknown")}\``); + rows.push(`Stage outcome: **${cell(mirrorStage?.outcome || "missing")}**`); + rows.push( + `Pre-publish verification: **${cell(mirrorVerification?.outcome || "not-run")}**`, + ); + rows.push(`Promotion outcome: **${cell(mirrorPromotion?.outcome || "not-run")}**`); + rows.push( + `Public route verification: **${cell( + mirrorPromotion?.publicRouteVerification || + mirrorVerification?.publicRouteVerification || + "not-run", + )}**`, + ); + if (mirrorPromotion?.error || mirrorVerification?.error || mirrorStage?.error) { + rows.push( + `Mirror error: \`${cell( + mirrorPromotion?.error || mirrorVerification?.error || mirrorStage?.error, + )}\``, + ); + } + rows.push(""); + rows.push("| Backend | Candidate verification | Previous | Decision | Promotion | Rollback | Final | Error |"); + rows.push("| --- | --- | --- | --- | --- | --- | --- | --- |"); + const backendRows = + mirrorPromotion?.backends || mirrorVerification?.backends || mirrorStage?.backends || []; + for (const backend of backendRows) { + rows.push( + `| ${cell(backend.name)} | ${cell(backend.candidateVerification || backend.status)} | ${cell( + backend.currentVersion || "absent", + )} | ${cell(backend.decision)} | ${cell(backend.promotion)} | ${cell( + backend.rollback, + )} | ${cell(backend.finalVersion)} | ${cell( + backend.error || backend.rollbackError, + )} |`, + ); + } + const override = audit?.override; + rows.push(""); + if (override?.requested) { + const originalActor = + override.originalActor && override.originalActor !== override.actor + ? ` (original workflow actor: \`${cell(override.originalActor)}\`)` + : ""; + rows.push( + `Emergency downgrade override: **requested=${cell(override.requested)}, used=${cell( + override.used, + )}** by \`${cell(override.actor)}\`${originalActor}; reason: ${cell(override.reason)}; [workflow audit](${cell( + override.runUrl, + )}).`, + ); + } else { + rows.push("Emergency downgrade override: not requested."); + } + if (mirrorPromotion?.rollback?.complete === false) { + rows.push( + "**Manual intervention required:** promotion rollback was incomplete; inspect the per-backend errors before another release.", + ); + } else if (["failed", "blocked-downgrade", "rolled-back"].includes(mirrorPromotion?.outcome)) { + rows.push( + "This run left no owned mirror-pointer advance in place; any completed rollback is shown per backend above.", + ); + } +} else { + rows.push("_No mirror audit record was produced (pre-release, skipped job, or failure before staging)._ "); +} + rows.push(""); rows.push("## Job status"); rows.push(""); @@ -76,6 +166,7 @@ rows.push("| Item | Status |"); rows.push("| --- | --- |"); rows.push(`| GitHub Release | ${env.PUBLISH_OUTCOME || "unknown"} |`); rows.push(`| Mirror stage | ${env.MIRROR_STAGE_OUTCOME || "skipped"} |`); +rows.push(`| Mirror pre-publish verify | ${env.MIRROR_VERIFY_OUTCOME || "skipped"} |`); rows.push(`| Mirror promote | ${env.MIRROR_PROMOTE_OUTCOME || "skipped"} |`); rows.push(`| winget dispatch | ${env.WINGET_OUTCOME || "skipped"} |`); rows.push(`| SBOM | ${env.SBOM_OUTCOME || "skipped"} |`); From 4c1d083da100910d5ba9490b82d755bd61e00392 Mon Sep 17 00:00:00 2001 From: wangnov <48670012+Wangnov@users.noreply.github.com> Date: Fri, 10 Jul 2026 22:00:28 +0800 Subject: [PATCH 04/21] feat(delivery): complete signed manager updates --- .github/workflows/release.yml | 115 ++- .github/workflows/win-installer-check.yml | 11 +- docs/release.md | 42 +- docs/releases/FALLBACK.md | 4 +- docs/releases/TEMPLATE.md | 4 +- docs/windows-signing.md | 244 ++--- scripts/gen-updater-manifest.mjs | 15 +- scripts/prepare-windows-authenticode.ps1 | 103 ++ scripts/verify-windows-authenticode.ps1 | 57 +- scripts/windows-packaged-smoke.ps1 | 89 +- src-tauri/installer/installer.nsi | 15 +- src-tauri/src/app/manager_update_handoff.rs | 222 +++++ src-tauri/src/app/manager_update_runtime.rs | 269 ++++++ src-tauri/src/app/mod.rs | 2 + src-tauri/src/app/oplock.rs | 27 + src-tauri/src/commands.rs | 735 ++++++++++++++- src-tauri/src/errors.rs | 16 +- src-tauri/src/lib.rs | 5 + src-tauri/src/state.rs | 146 ++- src/app/App.tsx | 73 +- src/app/i18n.tsx | 110 +++ src/app/managerUpdate.test.tsx | 731 +++++++++++++++ src/app/managerUpdate.tsx | 985 ++++++++++++++++++++ src/app/styles.css | 87 ++ src/app/views/About.tsx | 143 ++- src/app/views/Home.tsx | 21 +- src/app/views/WinHome.tsx | 19 +- src/services/managerApi.test.ts | 69 ++ src/services/managerApi.ts | 59 +- src/shared/types.ts | 32 +- 30 files changed, 4015 insertions(+), 435 deletions(-) create mode 100644 scripts/prepare-windows-authenticode.ps1 create mode 100644 src-tauri/src/app/manager_update_handoff.rs create mode 100644 src-tauri/src/app/manager_update_runtime.rs create mode 100644 src/app/managerUpdate.test.tsx create mode 100644 src/app/managerUpdate.tsx diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 64e88d4..f2b1185 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,8 +1,8 @@ name: Release # Tag-driven cross-platform release: -# build (unsigned) → macOS finalize (adaptive icon + inside-out Developer ID -# sign + notarize + staple + repackage updater/dmg) → collect → publish a +# build (Windows inside-out Authenticode; macOS unsigned) → macOS finalize +# (adaptive icon + inside-out Developer ID sign + notarize + staple + repackage) → collect → publish a # GitHub Release with the Tauri updater manifest (latest.json). # # Required repo secrets (Settings ▸ Secrets and variables ▸ Actions / release env): @@ -16,10 +16,9 @@ name: Release # TAURI_SIGNING_PRIVATE_KEY updater private key (string) # TAURI_SIGNING_PRIVATE_KEY_PASSWORD its password (empty if none) # -# Optional Windows Authenticode (non-blocking until configured; see docs/windows-signing.md): +# Required Windows Authenticode (release environment; see docs/windows-signing.md): # WINDOWS_CERTIFICATE base64 of OV/EV code-signing .pfx # WINDOWS_CERTIFICATE_PASSWORD password for that .pfx -# vars.AUTHENTICODE_REQUIRED set to "true" to fail release when PE is unsigned # vars.WINDOWS_TIMESTAMP_URL optional RFC3161 timestamp URL override on: @@ -95,16 +94,38 @@ jobs: security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" "$KC" security list-keychains -d user -s "$KC" $(security list-keychains -d user | sed s/\"//g) - # ── Build WITHOUT a tauri signingIdentity; we sign inside-out after ──── - - name: Build (Tauri, unsigned) + # ── Windows: import the release PFX and generate a private, per-job Tauri + # config. certificateThumbprint signs the main PE; NSIS receives the + # same RFC3161 command via !uninstfinalize, then Tauri signs the outer + # installer. A missing certificate is a hard release failure. + - name: Prepare Windows Authenticode (required) + id: windows_signing + if: matrix.os == 'windows' + shell: pwsh + env: + WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }} + WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }} + WINDOWS_TIMESTAMP_URL: ${{ vars.WINDOWS_TIMESTAMP_URL }} + run: | + & .\scripts\prepare-windows-authenticode.ps1 ` + -ConfigPath ".tauri-authenticode.conf.json" + + # macOS remains unsigned here and is finalized below. Windows consumes the + # generated config so all three PE layers are signed during bundling. + - name: Build (Tauri) shell: bash # Bundling downloads toolchains on the fly (e.g. the NSIS archive from # GitHub) which occasionally 504s and fails the whole release. Retry a # few times so a transient download hiccup doesn't sink the run — cargo # output is cached, so a retry mostly just re-runs the bundling step. run: | + args=(--target "${{ matrix.target }}") + if [ "${{ matrix.os }}" = "windows" ]; then + [ -f "$TAURI_AUTHENTICODE_CONFIG" ] || { echo "::error::missing generated Authenticode config"; exit 1; } + args+=(--config "$TAURI_AUTHENTICODE_CONFIG") + fi for attempt in 1 2 3; do - npm run tauri build -- --target ${{ matrix.target }} && exit 0 + npm run tauri build -- "${args[@]}" && exit 0 echo "::warning::tauri build attempt ${attempt} failed (often a transient NSIS/toolchain download, e.g. HTTP 504) — retrying in 20s" sleep 20 done @@ -168,43 +189,46 @@ jobs: & .\scripts\windows-pe-arch.ps1 -Path @($setup | ForEach-Object { $_.FullName }) } if ($target -like "aarch64-*") { - Write-Host "::notice::ARM64 main PE asserted machine=0xAA64 (cross-build on x64). Full install/launch smoke remains x64-only until ARM64 runners or trusted virtualization is available." + Write-Host "::notice::ARM64 main PE asserted machine=0xAA64 (cross-build on x64). Install/signature/upgrade/uninstall smoke runs below; only native ARM64 app launch still needs ARM64 hardware or trusted virtualization." } - # ── Windows: optional Authenticode (OV/EV) on final NSIS installer ──── - # Non-blocking until WINDOWS_CERTIFICATE is configured in the release - # environment. When present, signs the published -setup.exe. Full - # inside-out signing of main binary + uninstaller should eventually - # move into tauri build via certificateThumbprint (docs/windows-signing.md). - # This is independent of the Tauri updater minisign key below. - - name: Authenticode-sign Windows installer (optional) + # ── Windows: mandatory Authenticode + RFC3161 gate ──────────────────── + # Tauri restores target/.../release/codex-app-manager.exe to its + # unsigned, unpatched build input after bundling, so only the outer + # installer is inspectable here. Packaged smoke installs each target and + # verifies the signed embedded main executable and uninstall.exe. + - name: Verify Windows installer Authenticode (required) if: matrix.os == 'windows' shell: pwsh - env: - WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }} - WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }} - WINDOWS_TIMESTAMP_URL: ${{ vars.WINDOWS_TIMESTAMP_URL }} run: | - $setup = Get-ChildItem "src-tauri/target/${{ matrix.target }}/release/bundle/nsis/*-setup.exe" -ErrorAction Stop - & .\scripts\sign-windows-authenticode.ps1 -Path $setup.FullName -Stage "sign" + $target = "${{ matrix.target }}" + $setup = Get-ChildItem "src-tauri/target/$target/release/bundle/nsis/*-setup.exe" -ErrorAction Stop + & .\scripts\verify-windows-authenticode.ps1 ` + -Path $setup.FullName ` + -Mode required ` + -ExpectedThumbprint $env:WINDOWS_CERTIFICATE_THUMBPRINT ` + -RequireTimestamp ` + -SigningConfigPath $env:TAURI_AUTHENTICODE_CONFIG ` + -Stage "sign-verify" - - name: Verify Authenticode on Windows installer + - name: Verify signed installed app and uninstaller (all Windows targets) if: matrix.os == 'windows' shell: pwsh - env: - AUTHENTICODE_MODE: ${{ vars.AUTHENTICODE_REQUIRED == 'true' && 'required' || 'optional' }} run: | + $skipLaunch = "${{ matrix.target }}" -like "aarch64-*" $setup = Get-ChildItem "src-tauri/target/${{ matrix.target }}/release/bundle/nsis/*-setup.exe" -ErrorAction Stop - & .\scripts\verify-windows-authenticode.ps1 ` - -Path $setup.FullName ` - -Mode $env:AUTHENTICODE_MODE ` - -Stage "sign-verify" + & .\scripts\windows-packaged-smoke.ps1 ` + -Installer $setup.FullName ` + -AuthenticodeMode required ` + -ExpectedThumbprint $env:WINDOWS_CERTIFICATE_THUMBPRINT ` + -RequireTimestamp ` + -SigningConfigPath $env:TAURI_AUTHENTICODE_CONFIG ` + -SkipLaunch:$skipLaunch # ── Windows: sign the NSIS installer for the updater ────────────────── - # The build is intentionally unsigned for Authenticode (until OV/EV is - # configured), so Tauri emits no updater `.sig` during build. In Tauri 2 - # the Windows updater ships the `-setup.exe` itself, so signing it here - # with the updater key — exactly what finalize-macos.sh does for the + # The Windows updater ships the Authenticode-signed `-setup.exe` itself. + # Signing those final bytes here with the updater key — exactly what + # finalize-macos.sh does for the # .app.tar.gz — is equivalent to `createUpdaterArtifacts` and is what # gets windows-x86_64 and windows-aarch64 into latest.json. Without it # the manifest has macOS platforms only and Windows in-app self-update @@ -279,6 +303,33 @@ jobs: fi echo "::endgroup::" + - name: Verify final publishable Windows installer (required) + if: matrix.os == 'windows' + shell: pwsh + run: | + $setup = Get-ChildItem "$env:GITHUB_WORKSPACE/dist-artifacts/*-setup.exe" -ErrorAction Stop + & .\scripts\verify-windows-authenticode.ps1 ` + -Path $setup.FullName ` + -Mode required ` + -ExpectedThumbprint $env:WINDOWS_CERTIFICATE_THUMBPRINT ` + -RequireTimestamp ` + -SigningConfigPath $env:TAURI_AUTHENTICODE_CONFIG ` + -Stage "publish-sign-verify" + + - name: Remove temporary Windows signing material + if: always() && matrix.os == 'windows' + shell: pwsh + run: | + if ($env:WINDOWS_CERTIFICATE_THUMBPRINT) { + Remove-Item -LiteralPath "Cert:\CurrentUser\My\$env:WINDOWS_CERTIFICATE_THUMBPRINT" -ErrorAction SilentlyContinue + } + if ($env:WINDOWS_CERTIFICATE_TEMP_DIR -and (Test-Path -LiteralPath $env:WINDOWS_CERTIFICATE_TEMP_DIR)) { + Remove-Item -LiteralPath $env:WINDOWS_CERTIFICATE_TEMP_DIR -Recurse -Force -ErrorAction SilentlyContinue + } + if ($env:TAURI_AUTHENTICODE_CONFIG -and (Test-Path -LiteralPath $env:TAURI_AUTHENTICODE_CONFIG)) { + Remove-Item -LiteralPath $env:TAURI_AUTHENTICODE_CONFIG -Force -ErrorAction SilentlyContinue + } + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: bundle-${{ matrix.target }} diff --git a/.github/workflows/win-installer-check.yml b/.github/workflows/win-installer-check.yml index f2bff1b..00dda68 100644 --- a/.github/workflows/win-installer-check.yml +++ b/.github/workflows/win-installer-check.yml @@ -6,7 +6,7 @@ name: Windows installer check # install → first launch → upgrade → uninstall. # # Also probes Authenticode on the installer and installed PE files in -# non-blocking (optional) mode until OV/EV secrets are configured. +# non-blocking (optional) mode because pull requests never receive the PFX. # # ARM64 is NOT smoke-tested here: GitHub-hosted runners are x64, and a # cross-built ARM64 PE is not runtime verification. See docs/windows-signing.md. @@ -28,6 +28,7 @@ on: - "package-lock.json" - "scripts/windows-*.ps1" - "scripts/sign-windows-authenticode.ps1" + - "scripts/prepare-windows-authenticode.ps1" - "scripts/verify-windows-authenticode.ps1" - ".github/workflows/win-installer-check.yml" workflow_dispatch: @@ -65,7 +66,7 @@ jobs: # pull_request trigger running PR-authored code (config/template/hooks), so # exposing TAURI_SIGNING_PRIVATE_KEY / WINDOWS_CERTIFICATE would let a PR # exfiltrate keys. createUpdaterArtifacts is off; Authenticode remains a - # release-time concern (release.yml) with optional post-build path. + # release-time concern (release.yml) with mandatory inside-out signing. - name: Build NSIS installer id: build shell: bash @@ -101,8 +102,8 @@ jobs: - name: Authenticode probe (optional / non-blocking) shell: pwsh env: - # Flip to "required" via repo variable once OV/EV is wired into release. - AUTHENTICODE_MODE: ${{ vars.AUTHENTICODE_REQUIRED == 'true' && 'required' || 'optional' }} + # Pull requests never receive the release PFX secret. + AUTHENTICODE_MODE: optional run: | & .\scripts\verify-windows-authenticode.ps1 ` -Path "${{ steps.artifact.outputs.installer }}" ` @@ -112,7 +113,7 @@ jobs: - name: Packaged lifecycle smoke (install / launch / upgrade / uninstall) shell: pwsh env: - AUTHENTICODE_MODE: ${{ vars.AUTHENTICODE_REQUIRED == 'true' && 'required' || 'optional' }} + AUTHENTICODE_MODE: optional run: | & .\scripts\windows-packaged-smoke.ps1 ` -Installer "${{ steps.artifact.outputs.installer }}" ` diff --git a/docs/release.md b/docs/release.md index 5e6a7e3..a013419 100644 --- a/docs/release.md +++ b/docs/release.md @@ -47,19 +47,24 @@ Windows has no light/dark adaptive app icon (`.ico` is static) — the single Default icon is used. NSIS installer + updater bundle are produced by `tauri build`; no Apple-style finalize step. -Post-build on the Windows matrix (see [`release.yml`](../.github/workflows/release.yml)): - -1. **PE arch diagnostic** — `scripts/windows-pe-arch.ps1` records x64 vs ARM64 - machine types. ARM64 is cross-built on x64 runners; this is **not** runtime - verification ([`docs/windows-signing.md`](./windows-signing.md)). -2. **Optional Authenticode** — `scripts/sign-windows-authenticode.ps1` signs the - final `-setup.exe` when `WINDOWS_CERTIFICATE` is present; otherwise skips. -3. **Authenticode verify** — `scripts/verify-windows-authenticode.ps1` in - `optional` mode by default; set `AUTHENTICODE_REQUIRED=true` to gate. -4. **Tauri updater `.sig`** — `npx tauri signer sign` (always required for - Windows in-app update entries in `latest.json`). -5. **Collect final artifacts** — space-stripped names under `dist-artifacts/`, - with an explicit check that both `-setup.exe` and `-setup.exe.sig` exist. +Windows release builds are signed inside-out (see +[`release.yml`](../.github/workflows/release.yml)): + +1. **Prepare Authenticode** — import the release PFX and generate a temporary + Tauri config with the exact certificate thumbprint, SHA-256, and RFC3161 + timestamping (`tsp=true`). Missing credentials hard-fail the tag build. +2. **Build + sign all PE layers** — Tauri signs the main executable, the NSIS + uninstaller generated through `!uninstfinalize`, and the outer installer. +3. **Required verification** — every layer must report + `Get-AuthenticodeSignature.Status == Valid`, match the imported thumbprint, + and include a timestamp countersigner. x64 runs the full lifecycle; ARM64 is + installed on the x64 host to inspect its payload but is not launched there. +4. **Tauri updater `.sig`** — `npx tauri signer sign` authenticates the final, + Authenticode-signed installer bytes used by in-app updates. +5. **Collect + verify final artifacts** — space-stripped names under + `dist-artifacts/`, then another required signature check on the exact setup + executable that will be uploaded. +6. **Always clean up** — remove the temporary PFX directory and imported cert. PR-time x64 packaged smoke lives in [`win-installer-check.yml`](../.github/workflows/win-installer-check.yml) @@ -80,14 +85,13 @@ Required CI (`ci.yml`) also runs standalone engine crate tests for | `AC_API_KEY_BASE64` | base64 of the `AuthKey_XXXX.p8` | | `TAURI_SIGNING_PRIVATE_KEY` | updater private key | | `TAURI_SIGNING_PRIVATE_KEY_PASSWORD` | its password (empty if none) | +| `WINDOWS_CERTIFICATE` | base64 of the OV/EV code-signing **.pfx** (release env) | +| `WINDOWS_CERTIFICATE_PASSWORD` | password for that .pfx; may be empty only when the PFX has no password | -### Optional Windows Authenticode secrets / vars +### Optional release variables | Name | What | |---|---| -| `WINDOWS_CERTIFICATE` | base64 of OV/EV code-signing **.pfx** (release env) | -| `WINDOWS_CERTIFICATE_PASSWORD` | password for that .pfx | -| `AUTHENTICODE_REQUIRED` (repo **variable**) | `true` → fail release when PE is not `Valid` | | `WINDOWS_TIMESTAMP_URL` (repo **variable**) | optional RFC3161 timestamp URL | Export your local .p12 / .p8 / .pfx to base64 with `base64 -i file -o -`. @@ -97,4 +101,6 @@ Export your local .p12 / .p8 / .pfx to base64 with `base64 -i file -o -`. > adjust them if your `productName`/bundler config changes the filenames. > > Keep **updater signature**, **Authenticode**, and **SmartScreen reputation** -> conceptually separate — see [`docs/windows-signing.md`](./windows-signing.md). +> conceptually separate. Authenticode is mandatory for new tag builds, but a +> valid publisher signature does not guarantee instant SmartScreen reputation. +> See [`docs/windows-signing.md`](./windows-signing.md). diff --git a/docs/releases/FALLBACK.md b/docs/releases/FALLBACK.md index 9d86bd6..0e9c725 100644 --- a/docs/releases/FALLBACK.md +++ b/docs/releases/FALLBACK.md @@ -16,8 +16,8 @@ | Windows · x64 | [CodexAppManager_x64-setup.exe](https://codexapp.agentsmirror.com/manager/latest/CodexAppManager_x64-setup.exe) | | Windows · ARM64 | [CodexAppManager_arm64-setup.exe](https://codexapp.agentsmirror.com/manager/latest/CodexAppManager_arm64-setup.exe) | -**Windows 签名状态:** `CodexAppManager_x64-setup.exe` / `CodexAppManager_arm64-setup.exe` 当前没有 Authenticode 代码签名,首次运行可能出现 SmartScreen 提示;`.sig` / `latest.json` 里的 Tauri updater 签名只用于应用内自更新的字节校验,不代表 Windows 发行者信任。详情见 [Windows signing and verification](https://github.com/Wangnov/Codex-App-Manager/blob/main/docs/windows-signing.md)。 -**Windows signing status:** `CodexAppManager_x64-setup.exe` / `CodexAppManager_arm64-setup.exe` are not Authenticode-signed yet, so SmartScreen may warn on first run; the Tauri updater signature in `.sig` / `latest.json` verifies in-app update bytes only and is not Windows publisher trust. See [Windows signing and verification](https://github.com/Wangnov/Codex-App-Manager/blob/main/docs/windows-signing.md). +**Windows 信任说明:** x64 / ARM64 安装器、主程序和卸载器均带 Authenticode 发行者签名与 RFC3161 时间戳;`.sig` / `latest.json` 中的 Tauri updater 签名另行保护应用内更新字节。SmartScreen 信誉仍由 Microsoft 独立评估,可能出现的信誉提示不等于任一签名失效。详情见 [Windows signing and verification](https://github.com/Wangnov/Codex-App-Manager/blob/main/docs/windows-signing.md)。 +**Windows trust:** The x64 / ARM64 installer, app, and uninstaller carry an Authenticode publisher signature and RFC3161 timestamp; the separate Tauri updater signature in `.sig` / `latest.json` protects in-app update bytes. Microsoft evaluates SmartScreen reputation independently, so a reputation prompt does not mean either signature failed. See [Windows signing and verification](https://github.com/Wangnov/Codex-App-Manager/blob/main/docs/windows-signing.md). **核验下载:** 本页 Assets 带有 `SHA256SUMS`;Windows 用 `Get-FileHash .\CodexAppManager_x64-setup.exe -Algorithm SHA256` 或替换为 ARM64 文件名,macOS 用 `shasum -a 256 CodexAppManager_aarch64.dmg`,再与 `SHA256SUMS` 比对。 **Verify downloads:** This release includes `SHA256SUMS` in Assets; on Windows run `Get-FileHash .\CodexAppManager_x64-setup.exe -Algorithm SHA256` or swap in the ARM64 filename, and on macOS run `shasum -a 256 CodexAppManager_aarch64.dmg`, then compare with `SHA256SUMS`. diff --git a/docs/releases/TEMPLATE.md b/docs/releases/TEMPLATE.md index 8c81d84..ac5607d 100644 --- a/docs/releases/TEMPLATE.md +++ b/docs/releases/TEMPLATE.md @@ -42,8 +42,8 @@ | Windows · x64 | [CodexAppManager_x64-setup.exe](https://codexapp.agentsmirror.com/manager/latest/CodexAppManager_x64-setup.exe) | | Windows · ARM64 | [CodexAppManager_arm64-setup.exe](https://codexapp.agentsmirror.com/manager/latest/CodexAppManager_arm64-setup.exe) | -**Windows 签名状态:** `CodexAppManager_x64-setup.exe` / `CodexAppManager_arm64-setup.exe` 当前没有 Authenticode 代码签名,首次运行可能出现 SmartScreen 提示;`.sig` / `latest.json` 里的 Tauri updater 签名只用于应用内自更新的字节校验,不代表 Windows 发行者信任。详情见 [Windows signing and verification](https://github.com/Wangnov/Codex-App-Manager/blob/main/docs/windows-signing.md)。 -**Windows signing status:** `CodexAppManager_x64-setup.exe` / `CodexAppManager_arm64-setup.exe` are not Authenticode-signed yet, so SmartScreen may warn on first run; the Tauri updater signature in `.sig` / `latest.json` verifies in-app update bytes only and is not Windows publisher trust. See [Windows signing and verification](https://github.com/Wangnov/Codex-App-Manager/blob/main/docs/windows-signing.md). +**Windows 信任说明:** x64 / ARM64 安装器、主程序和卸载器均带 Authenticode 发行者签名与 RFC3161 时间戳;`.sig` / `latest.json` 中的 Tauri updater 签名另行保护应用内更新字节。SmartScreen 信誉仍由 Microsoft 独立评估,可能出现的信誉提示不等于任一签名失效。详情见 [Windows signing and verification](https://github.com/Wangnov/Codex-App-Manager/blob/main/docs/windows-signing.md)。 +**Windows trust:** The x64 / ARM64 installer, app, and uninstaller carry an Authenticode publisher signature and RFC3161 timestamp; the separate Tauri updater signature in `.sig` / `latest.json` protects in-app update bytes. Microsoft evaluates SmartScreen reputation independently, so a reputation prompt does not mean either signature failed. See [Windows signing and verification](https://github.com/Wangnov/Codex-App-Manager/blob/main/docs/windows-signing.md). **核验下载:** 本页 Assets 带有 `SHA256SUMS`;Windows 用 `Get-FileHash .\CodexAppManager_x64-setup.exe -Algorithm SHA256` 或替换为 ARM64 文件名,macOS 用 `shasum -a 256 CodexAppManager_aarch64.dmg`,再与 `SHA256SUMS` 比对。 **Verify downloads:** This release includes `SHA256SUMS` in Assets; on Windows run `Get-FileHash .\CodexAppManager_x64-setup.exe -Algorithm SHA256` or swap in the ARM64 filename, and on macOS run `shasum -a 256 CodexAppManager_aarch64.dmg`, then compare with `SHA256SUMS`. diff --git a/docs/windows-signing.md b/docs/windows-signing.md index bec12cd..a7dde00 100644 --- a/docs/windows-signing.md +++ b/docs/windows-signing.md @@ -1,208 +1,128 @@ # Windows signing and verification -This project currently ships a Windows NSIS installer without Authenticode code -signing. The installer is still published through GitHub Releases and the -agentsmirror download mirror, and every release includes `SHA256SUMS` so users -can verify the bytes they downloaded. +The release workflow uses three independent trust mechanisms. Authenticode +identifies the Windows publisher, the Tauri updater signature protects the +bytes consumed by in-app updates, and SmartScreen reputation is a Microsoft +risk signal that neither signature can guarantee. Keep them separate when +triaging a warning or a failed release. -CI already prepares the Authenticode **path** (sign script, verify script, optional -release step, packaged lifecycle smoke). Certificate secrets are optional and -non-blocking until budget/demand justify an OV/EV cert. +Historical releases keep the signing status recorded in their own release +notes. The mandatory pipeline below applies starting with the first release +built from this workflow revision. ## 中文 -### 当前状态 +### 发布状态 -- macOS 构建已经使用 Developer ID 签名并完成 Apple 公证。 -- Windows 安装器 `CodexAppManager_x64-setup.exe` / `CodexAppManager_arm64-setup.exe` 当前没有 Authenticode 代码签名。 -- Windows 应用内自更新包带有 Tauri updater 签名,用于校验下载字节没有被篡改。 -- Windows 首次手动运行安装器时可能出现 SmartScreen 提示;这是预期风险,不是更新器签名失效。 -- CI 已接入安装包冒烟(x64:`install → launch → upgrade → uninstall`)与 Authenticode 探测;证书未配置时签名步骤跳过且校验为非阻塞。 +- Windows 正式发布必须提供 OV/EV Authenticode `.pfx`；缺少证书或密码会直接阻断 tag 发布。 +- x64 与 ARM64 的主程序、NSIS `uninstall.exe`、外层 `-setup.exe` 均由同一张证书签名，并使用 SHA-256 + RFC3161 时间戳。 +- CI 要求每层 `Get-AuthenticodeSignature` 都为 `Valid`、签名证书 thumbprint 与本次导入证书完全一致，并存在时间戳 countersigner。 +- PR 构建不会取得发布证书，仍以 unsigned 方式验证打包模板和安装生命周期；PR 的 optional 探测不代表正式发布可以未签名。 +- Windows 应用内更新仍另外要求 Tauri updater `.sig`；它覆盖已经完成 Authenticode 签名的最终安装器字节。 -### 三个概念 +### 三个独立概念 -**Tauri updater 签名:** `latest.json` 里的 `signature` 对安装包字节签名。它保护应用内自更新下载,确保镜像或网络传输没有改包。它不参与 Windows 系统的发行者信任判断,也不能消除 SmartScreen 提示。实现:`npx tauri signer sign` + `TAURI_SIGNING_PRIVATE_KEY`。 +**Authenticode 代码签名** -**Authenticode 代码签名:** Windows 对 PE 文件和安装器使用的代码签名体系。拥有 OV 或 EV 证书后,安装器可以显示发行者身份,并更容易建立系统信任。本项目当前还没有给 Windows 安装器做 Authenticode 签名。实现路径见下文「CI / 发布管线」。 +Windows 对 PE 文件和安装器使用的发行者签名。本项目在 `tauri build` 前导入 PFX，并通过临时 Tauri config 配置 `certificateThumbprint`、`digestAlgorithm=sha256`、RFC3161 `timestampUrl` 与 `tsp=true`。Tauri 按 inside-out 顺序签主程序、NSIS 生成的卸载器和外层安装器。 -**SmartScreen 信誉:** Microsoft Defender SmartScreen 会结合签名身份、下载量、历史信誉和风险信号做拦截判断。EV 证书通常能更快建立信誉;OV 证书和未签名分发都需要累积信誉,未签名安装器首次运行更容易被提示。 +**Tauri updater 签名** -### 如何核验下载 +`latest.json` 的 `signature` 对应用内更新所下载的最终安装器字节签名。它防止 GitHub、镜像或传输链路改包，但不向 Windows 声明发行者身份。实现使用 `TAURI_SIGNING_PRIVATE_KEY` 和 `npx tauri signer sign`；其私钥与 Authenticode PFX 完全不同。 -1. 从 [GitHub Releases](https://github.com/Wangnov/Codex-App-Manager/releases/latest) 或 agentsmirror 镜像下载对应安装包。 -2. 从同一个 release 的 Assets 下载 `SHA256SUMS`。 -3. 在本机计算哈希并与 `SHA256SUMS` 中的同名文件比对。 +**SmartScreen 信誉** -Windows PowerShell: +Microsoft Defender SmartScreen 会综合发行者、文件流行度、历史与其他风险信号。一个 Authenticode 签名可以让系统显示可验证的发行者，但不能承诺新证书或新工件绝不出现 SmartScreen 提示。看到 SmartScreen 提示也不等于 Tauri updater 签名失败。 -```powershell -Get-FileHash .\CodexAppManager_x64-setup.exe -Algorithm SHA256 -Get-FileHash .\CodexAppManager_arm64-setup.exe -Algorithm SHA256 -``` - -macOS: - -```bash -shasum -a 256 CodexAppManager_aarch64.dmg -shasum -a 256 CodexAppManager_x86_64.dmg -``` +### 发布硬门 -如果哈希不一致,不要运行该文件,请重新下载或在 issue 中反馈下载来源和文件名。 +Windows matrix 的顺序如下： -### 分发渠道与成本评估 +1. `prepare-windows-authenticode.ps1` 解码并导入 PFX，生成仅用于当前 job 的 Tauri signing config。 +2. `tauri build --config ...` 完成三层 inside-out Authenticode 签名，并让自定义 NSIS 模板优先使用 bundler 准备的已签名插件目录。 +3. `verify-windows-authenticode.ps1 -Mode required` 验证外层安装器。Tauri 打包结束后会把 `target/.../release/codex-app-manager.exe` 恢复成 unsigned、未 patch 的构建输入，因此这个 raw 中间文件只用于 PE 架构诊断，不作为签名硬门。 +4. `windows-packaged-smoke.ps1` 安装包并直接验证安装后的主程序与 `uninstall.exe`。 + - x64 执行 `install → launch → upgrade → uninstall`。 + - ARM64 在 x64 runner 上执行安装、签名验证、升级和卸载，但跳过 ARM64 主程序启动；完整 ARM64 运行验收仍需 ARM64 设备或可信虚拟化。 +5. 对 Authenticode 签名后的最终 `-setup.exe` 生成独立的 Tauri updater `.sig`。 +6. 收集无空格的发布文件名后，再次对最终待发布安装器执行 required 验证。 +7. 无论成功失败都移除临时证书和 PFX 目录。 -**GitHub Releases + agentsmirror + SHA256SUMS:** 这是当前主渠道。优点是透明、可回溯、可独立核验;缺点是 Windows 无 Authenticode 时仍可能触发 SmartScreen。 +任何一层缺失、`Status != Valid`、证书 thumbprint 不符、没有时间戳、没有 updater `.sig`，发布 job 都失败。RFC3161 同时由生成配置中的 `tsp=true` / SHA-256 / timestamp URL 和工件上的 timestamp countersigner 证明。 -**winget:** `Wangnov.CodexAppManager` 已在 microsoft/winget-pkgs 中可用,本仓库会在稳定版发布后自动提交新版本。winget 可接受未签名 NSIS 安装器,但新增架构或元数据变化仍可能触发人工审查。 +### 必需配置 -**Microsoft Store / Partner Center:** 这是中期可选路径,需要开发者账号、MSIX 打包和商店审核。优点是用户信任更强,缺点是流程和维护成本更高。 +在 GitHub `release` environment 配置： -**OV / EV 代码签名证书:** 证书不是当前发布阻塞项。后续可在 Windows 下载量、企业用户需求或支持成本达到明确阈值后重新评估。EV 成本更高但信誉建立更快;OV 成本较低但仍需累积 SmartScreen 信誉。 - -**不推荐的降本方式:** 不把私钥托管给不可信第三方,不合租硬件令牌,不把代码签名能力转交给无法审计的渠道。 - -### 风险披露 - -未签名 Windows 安装器意味着用户首次运行可能需要在 SmartScreen 中选择更多信息后继续。项目通过公开 release、镜像直链、`SHA256SUMS`、Tauri updater 签名和透明文档降低篡改与误解风险;这不能替代 Authenticode,但可以让用户在证书预算到位前做独立核验。 - -### CI / 发布管线(Authenticode 路径) - -| 阶段 | 行为 | 阻塞? | +| 名称 | 类型 | 用途 | |---|---|---| -| `ci.yml` Rust | 独立跑 `codex-mac-engine` / `codex-win-engine` 测试 | 是(required) | -| `win-installer-check.yml` | 构建 x64 NSIS → Authenticode 探测 → 安装/启动/升级/卸载冒烟 | 否(路径变更时跑) | -| `release.yml` Windows | PE 架构诊断 → 可选 Authenticode 签名 → Authenticode 校验 → Tauri updater `.sig` → 收集**最终**工件 | updater `.sig` 与工件齐全为阻塞;Authenticode 默认非阻塞 | -| ARM64 | 交叉构建 + PE machine=`0xAA64` 诊断;**不是**实机运行验证 | 交叉构建失败阻塞;运行验证见下 | - -**启用 Authenticode(证书就绪后):** - -1. 在 `release` environment 配置 secrets: - - `WINDOWS_CERTIFICATE` — base64 编码的 OV/EV `.pfx` - - `WINDOWS_CERTIFICATE_PASSWORD` — pfx 密码 -2. (可选) repo variable `WINDOWS_TIMESTAMP_URL` 覆盖默认 RFC3161 时间戳。 -3. 确认 `release.yml` 的 *Authenticode-sign Windows installer* 步骤对 `-setup.exe` 签出 `Valid`。 -4. 将 repo variable `AUTHENTICODE_REQUIRED=true`,使 `verify-windows-authenticode.ps1` 在 `required` 模式下失败即阻断发布。 -5. 中期目标:在 `tauri build` 前导入证书并配置 `bundle.windows.certificateThumbprint`,让主程序 + uninstaller + installer 在打包期一并签名(比只签外层 setup 更完整)。 - -脚本: - -- [`scripts/sign-windows-authenticode.ps1`](../scripts/sign-windows-authenticode.ps1) — 有证书则签,无证书则跳过(exit 0)。 -- [`scripts/verify-windows-authenticode.ps1`](../scripts/verify-windows-authenticode.ps1) — `optional` / `required`。 -- [`scripts/windows-packaged-smoke.ps1`](../scripts/windows-packaged-smoke.ps1) — x64 生命周期冒烟。 -- [`scripts/windows-pe-arch.ps1`](../scripts/windows-pe-arch.ps1) — 读取 PE machine type。 - -失败日志阶段标签:`[build]` / `[sign]` / `[sign-verify]` / `[install]` / `[launch]` / `[upgrade]` / `[uninstall]`。 - -### ARM64 运行验证策略 - -- GitHub-hosted `windows-latest` 是 **x64**。`aarch64-pc-windows-msvc` 目标是交叉编译,产物经 `windows-pe-arch.ps1` 确认 machine=`0xAA64`。 -- **交叉构建成功 ≠ 运行验证。** 完整 install/launch/upgrade/uninstall 冒烟只在 x64 runner 上对 x64 安装包执行。 -- ARM64 实机或可信虚拟化验收清单(人工 / 自备 runner): - 1. 安装 `CodexAppManager_arm64-setup.exe`(被动 `/P` 或 UI)。 - 2. 确认 `%LOCALAPPDATA%\Codex App Manager\codex-app-manager.exe` 存在且 PE 为 ARM64。 - 3. 首次启动管理器 UI,无崩溃。 - 4. 再跑一遍安装器 `/P /UPDATE` 升级路径。 - 5. 卸载后主程序消失。 - 6. 若已配置 Authenticode,确认 installer / 主程序 / uninstaller 的 `Get-AuthenticodeSignature` 为 `Valid`。 +| `WINDOWS_CERTIFICATE` | secret | base64 编码的 OV/EV 代码签名 `.pfx` | +| `WINDOWS_CERTIFICATE_PASSWORD` | secret | PFX 密码；证书无密码时可以为空 | +| `WINDOWS_TIMESTAMP_URL` | variable，可选 | RFC3161 服务地址；默认 `http://timestamp.digicert.com` | +| `TAURI_SIGNING_PRIVATE_KEY` | secret | Tauri updater 私钥，不是 Authenticode 证书 | +| `TAURI_SIGNING_PRIVATE_KEY_PASSWORD` | secret | updater 私钥密码 | -## English +不再使用 `AUTHENTICODE_REQUIRED` 开关：tag release 永远是 required。不要把 PFX 暴露给 `pull_request` workflow，也不要把真实证书提交进仓库。 -### Current status +### 用户核验 -- macOS builds are Developer ID signed and Apple notarized. -- The Windows installers `CodexAppManager_x64-setup.exe` / `CodexAppManager_arm64-setup.exe` are not Authenticode-signed yet. -- Windows in-app update artifacts carry the Tauri updater signature, which verifies the downloaded bytes. -- SmartScreen may warn when users manually run the Windows installer for the first time; that is the known distribution risk, not an updater-signature failure. -- CI already runs x64 packaged lifecycle smoke (`install → launch → upgrade → uninstall`) and Authenticode probes; signing is skipped and verification is non-blocking until a certificate is configured. +在 Windows 上可直接查看三层签名： -### Three separate concepts - -**Tauri updater signature:** The `signature` field in `latest.json` signs the installer bytes. It protects in-app self-update downloads from tampering across mirrors and network hops. It is not Windows publisher trust and does not remove SmartScreen warnings. Implementation: `npx tauri signer sign` + `TAURI_SIGNING_PRIVATE_KEY`. - -**Authenticode code signing:** This is the Windows code-signing system for PE files and installers. With an OV or EV certificate, the installer can show a publisher identity and build operating-system trust. This project does not currently Authenticode-sign the Windows installer. The prepared CI path is documented below. - -**SmartScreen reputation:** Microsoft Defender SmartScreen combines signing identity, download volume, historical reputation, and risk signals. EV certificates usually establish reputation faster; OV certificates and unsigned distribution still need reputation to build, and unsigned installers are more likely to warn on first run. - -### How to verify downloads - -1. Download the installer from [GitHub Releases](https://github.com/Wangnov/Codex-App-Manager/releases/latest) or the agentsmirror mirror. -2. Download `SHA256SUMS` from Assets on the same release. -3. Compute the local hash and compare it with the matching filename in `SHA256SUMS`. +```powershell +Get-AuthenticodeSignature .\CodexAppManager_x64-setup.exe | Format-List Status,SignerCertificate,TimeStamperCertificate +Get-AuthenticodeSignature "$env:LOCALAPPDATA\Codex App Manager\codex-app-manager.exe" | Format-List Status,SignerCertificate,TimeStamperCertificate +Get-AuthenticodeSignature "$env:LOCALAPPDATA\Codex App Manager\uninstall.exe" | Format-List Status,SignerCertificate,TimeStamperCertificate +``` -Windows PowerShell: +发布页仍提供 `SHA256SUMS`，用于确认下载文件与 release 资产逐字节一致： ```powershell Get-FileHash .\CodexAppManager_x64-setup.exe -Algorithm SHA256 Get-FileHash .\CodexAppManager_arm64-setup.exe -Algorithm SHA256 ``` -macOS: +哈希、Authenticode、updater `.sig` 各自回答不同问题，不能互相替代。 -```bash -shasum -a 256 CodexAppManager_aarch64.dmg -shasum -a 256 CodexAppManager_x86_64.dmg -``` +### 相关脚本 + +- [`scripts/prepare-windows-authenticode.ps1`](../scripts/prepare-windows-authenticode.ps1) — 正式发布导入证书并生成 Tauri 配置；凭据缺失即失败。 +- [`scripts/verify-windows-authenticode.ps1`](../scripts/verify-windows-authenticode.ps1) — `required` 发布硬门；`optional` 仅供无 secret 的 PR / 本地诊断。 +- [`scripts/windows-packaged-smoke.ps1`](../scripts/windows-packaged-smoke.ps1) — 安装后验证主程序与卸载器，并覆盖升级、卸载路径。 +- [`scripts/sign-windows-authenticode.ps1`](../scripts/sign-windows-authenticode.ps1) — 旧的本地单文件签名工具；正式发布不依赖它。 +- [`scripts/windows-pe-arch.ps1`](../scripts/windows-pe-arch.ps1) — 验证 x64 / ARM64 PE machine type。 -If the hash does not match, do not run the file. Download it again or open an -issue with the source URL and filename. +## English + +### Release state -### Distribution channels and cost +- Windows releases require an OV/EV Authenticode PFX. Missing credentials hard-fail the tag build. +- The x64 and ARM64 main executable, generated NSIS uninstaller, and outer setup executable are signed by the same certificate with SHA-256 and an RFC3161 timestamp. +- CI requires `Get-AuthenticodeSignature.Status == Valid`, an exact match to the imported certificate thumbprint, and a timestamp countersigner on every layer. +- Pull requests do not receive release secrets. They intentionally build unsigned packages and run optional probes plus lifecycle smoke; this does not make unsigned release artifacts acceptable. +- In-app updates separately require a Tauri updater `.sig` over the final Authenticode-signed setup bytes. -**GitHub Releases + agentsmirror + SHA256SUMS:** This is the current primary channel. It is transparent, traceable, and independently verifiable, but the unsigned Windows installer can still trigger SmartScreen. +### Three independent mechanisms -**winget:** `Wangnov.CodexAppManager` is available in microsoft/winget-pkgs, and this repository auto-submits new stable releases. winget accepts unsigned NSIS installers, but a new architecture or metadata change can still receive manual review. +**Authenticode** is Windows publisher identity for PE files. The release job imports the PFX and gives Tauri a private config with `certificateThumbprint`, SHA-256, an RFC3161 timestamp URL, and `tsp=true`. Tauri signs the main executable, generated uninstaller, and outer NSIS installer inside-out; the custom template also selects Tauri's private signed NSIS plugin directory. -**Microsoft Store / Partner Center:** This is a medium-term option. It requires a developer account, MSIX packaging, and Store review. It improves user trust but adds process and maintenance cost. +**The Tauri updater signature** authenticates the final bytes referenced by `latest.json`. It protects downloads from tampering across GitHub, the mirror, and transport hops. It does not establish a Windows publisher. Its private key is separate from the Authenticode PFX. -**OV / EV code-signing certificate:** A certificate is not a release blocker today. Re-evaluate when Windows download volume, enterprise demand, or support cost crosses a clear threshold. EV costs more but establishes reputation faster; OV costs less but still needs SmartScreen reputation to build. +**SmartScreen reputation** is a Microsoft risk signal based on more than the presence of a signature. Authenticode provides a verifiable publisher but cannot promise that a new certificate or artifact will never trigger a warning. A SmartScreen warning is also not evidence that the updater signature failed. -**Cost shortcuts to avoid:** Do not custody private keys with untrusted third parties, share hardware tokens, or hand signing capability to channels that cannot be audited. +### Release gate -### Risk disclosure +The Windows jobs prepare the certificate, build with inside-out signing, verify the outer setup executable, install each architecture's package to inspect the signed embedded main/uninstaller, create the independent updater signature, collect the final names, and verify the publishable setup again. Tauri restores `target/.../release/codex-app-manager.exe` to its unsigned, unpatched build input after bundling, so that raw intermediate is used only for the PE architecture diagnostic and is not a signature gate. x64 runs the full launch lifecycle; ARM64 performs install/signature/upgrade/uninstall checks on the x64 host but requires ARM64 hardware or trusted virtualization for a real launch test. -An unsigned Windows installer means users may need to choose more information -and continue through SmartScreen on first run. The project reduces tampering and -confusion risk with public releases, mirror permalinks, `SHA256SUMS`, Tauri -updater signatures, and transparent documentation. Those mitigations do not -replace Authenticode, but they let users verify downloads independently until -certificate budget and demand justify Windows code signing. +There is no `AUTHENTICODE_REQUIRED` toggle for a tag release. Any missing layer, non-`Valid` status, wrong thumbprint, absent timestamp, or missing updater signature blocks publication. The PFX and imported certificate are removed in an `always()` cleanup step. -### CI / release pipeline (Authenticode path) +### Required release environment -| Stage | Behavior | Blocking? | +| Name | Kind | Purpose | |---|---|---| -| `ci.yml` Rust | Standalone `codex-mac-engine` / `codex-win-engine` tests | Yes (required) | -| `win-installer-check.yml` | Build x64 NSIS → Authenticode probe → install/launch/upgrade/uninstall smoke | No (path-filtered) | -| `release.yml` Windows | PE arch diagnostic → optional Authenticode sign → Authenticode verify → Tauri updater `.sig` → collect **final** artifacts | Updater `.sig` + artifact set block; Authenticode optional by default | -| ARM64 | Cross-build + PE machine=`0xAA64` diagnostic; **not** runtime verification | Cross-build failure blocks; runtime verification below | - -**Turning on Authenticode (when a cert is available):** - -1. Add secrets on the `release` environment: - - `WINDOWS_CERTIFICATE` — base64-encoded OV/EV `.pfx` - - `WINDOWS_CERTIFICATE_PASSWORD` — pfx password -2. Optionally set repo variable `WINDOWS_TIMESTAMP_URL` for the RFC3161 timestamp server. -3. Confirm the *Authenticode-sign Windows installer* step produces `Valid` on `-setup.exe`. -4. Set repo variable `AUTHENTICODE_REQUIRED=true` so `verify-windows-authenticode.ps1` runs in `required` mode and fails the release if unsigned. -5. Medium-term: import the cert before `tauri build` and set `bundle.windows.certificateThumbprint` so the main binary, uninstaller, and installer are all signed during packaging (more complete than outer-setup-only signing). - -Scripts: - -- [`scripts/sign-windows-authenticode.ps1`](../scripts/sign-windows-authenticode.ps1) — signs when a cert is present; skips with exit 0 otherwise. -- [`scripts/verify-windows-authenticode.ps1`](../scripts/verify-windows-authenticode.ps1) — `optional` / `required`. -- [`scripts/windows-packaged-smoke.ps1`](../scripts/windows-packaged-smoke.ps1) — x64 lifecycle smoke. -- [`scripts/windows-pe-arch.ps1`](../scripts/windows-pe-arch.ps1) — PE machine type probe. - -Failure log stage tags: `[build]` / `[sign]` / `[sign-verify]` / `[install]` / `[launch]` / `[upgrade]` / `[uninstall]`. - -### ARM64 runtime verification strategy - -- GitHub-hosted `windows-latest` is **x64**. The `aarch64-pc-windows-msvc` target is cross-compiled; `windows-pe-arch.ps1` asserts machine=`0xAA64`. -- **A successful cross-build is not runtime verification.** Full install/launch/upgrade/uninstall smoke runs only for the x64 installer on x64 runners. -- ARM64 bare-metal or trusted virtualization checklist (manual / self-hosted runner): - 1. Install `CodexAppManager_arm64-setup.exe` (passive `/P` or UI). - 2. Confirm `%LOCALAPPDATA%\Codex App Manager\codex-app-manager.exe` exists and is an ARM64 PE. - 3. First-launch the manager UI without crash. - 4. Re-run the installer with `/P /UPDATE` (upgrade path). - 5. Uninstall and confirm the main binary is gone. - 6. If Authenticode is configured, confirm installer / main / uninstaller `Get-AuthenticodeSignature` is `Valid`. +| `WINDOWS_CERTIFICATE` | secret | base64-encoded OV/EV code-signing PFX | +| `WINDOWS_CERTIFICATE_PASSWORD` | secret | PFX password; may be empty for an unprotected PFX | +| `WINDOWS_TIMESTAMP_URL` | optional variable | RFC3161 endpoint; defaults to `http://timestamp.digicert.com` | +| `TAURI_SIGNING_PRIVATE_KEY` | secret | Tauri updater private key, not the Authenticode certificate | +| `TAURI_SIGNING_PRIVATE_KEY_PASSWORD` | secret | updater-key password | + +Never expose the PFX to a pull-request workflow or commit certificate material to the repository. Historical release notes retain the actual status of those older artifacts. diff --git a/scripts/gen-updater-manifest.mjs b/scripts/gen-updater-manifest.mjs index 37ad561..a7001e3 100644 --- a/scripts/gen-updater-manifest.mjs +++ b/scripts/gen-updater-manifest.mjs @@ -17,6 +17,17 @@ if (!tag || !dir) { } const version = tag.replace(/^v/, ""); const REPO = "Wangnov/Codex-App-Manager"; +const releaseNotesPath = join("docs", "releases", `${tag}.md`); +const updaterNotes = (markdown) => { + // Release pages start with a GitHub-only banner and end with the fixed + // download/signature table. The in-app sheet needs the reviewed summary and + // user-visible changes, not raw HTML or another set of install links. + const withoutBanner = markdown.replace(/^\s*[\s\S]*?<\/p>\s*/i, ""); + return withoutBanner.split(/^##\s+📦\s+/m, 1)[0].trim(); +}; +const notes = existsSync(releaseNotesPath) + ? updaterNotes(readFileSync(releaseNotesPath, "utf8")) || `Codex App Manager ${tag}` + : `Codex App Manager ${tag}`; const downloadUrl = (file) => `https://github.com/${REPO}/releases/download/${tag}/${encodeURIComponent(file)}`; @@ -80,7 +91,9 @@ if (missing.length > 0) { const manifest = { version, - notes: `Codex App Manager ${tag}`, + // The same reviewed release note shown on GitHub powers the in-app details + // view. Older/fallback builds still receive a short non-empty label. + notes, pub_date: new Date().toISOString(), platforms, }; diff --git a/scripts/prepare-windows-authenticode.ps1 b/scripts/prepare-windows-authenticode.ps1 new file mode 100644 index 0000000..d939905 --- /dev/null +++ b/scripts/prepare-windows-authenticode.ps1 @@ -0,0 +1,103 @@ +# Import the release code-signing certificate and generate the Tauri config used +# for inside-out Windows signing (main executable, NSIS uninstaller, installer). +# +# This script is intentionally release-only: missing credentials are fatal. Pull +# request workflows must never receive the PFX secret; they keep building unsigned +# installers and exercise the same NSIS template in optional verification mode. + +[CmdletBinding()] +param( + [string]$CertificateBase64 = $env:WINDOWS_CERTIFICATE, + [string]$CertificatePassword = $env:WINDOWS_CERTIFICATE_PASSWORD, + [string]$TimestampUrl = $(if ($env:WINDOWS_TIMESTAMP_URL) { $env:WINDOWS_TIMESTAMP_URL } else { "http://timestamp.digicert.com" }), + [string]$ConfigPath = $(Join-Path ([System.IO.Path]::GetTempPath()) "tauri-authenticode.conf.json"), + [string]$Stage = "sign-prepare" +) + +Set-StrictMode -Version Latest +$ErrorActionPreference = "Stop" + +function Fail-Stage([string]$Message) { + Write-Host "::error::[$Stage] $Message" + throw "[$Stage] $Message" +} + +if ([string]::IsNullOrWhiteSpace($CertificateBase64)) { + Fail-Stage "WINDOWS_CERTIFICATE is required for a release build" +} +if ([string]::IsNullOrWhiteSpace($TimestampUrl)) { + Fail-Stage "WINDOWS_TIMESTAMP_URL must resolve to an RFC3161 timestamp service" +} + +$timestamp = $null +try { + $timestamp = [Uri]$TimestampUrl +} +catch { + Fail-Stage "WINDOWS_TIMESTAMP_URL is not a valid absolute URL" +} +if (-not $timestamp.IsAbsoluteUri -or $timestamp.Scheme -notin @("http", "https")) { + Fail-Stage "WINDOWS_TIMESTAMP_URL must use http or https" +} + +$tempDir = Join-Path ([System.IO.Path]::GetTempPath()) ("cam-authenticode-" + [guid]::NewGuid().ToString("n")) +New-Item -ItemType Directory -Path $tempDir | Out-Null +$pfxPath = Join-Path $tempDir "codesign.pfx" + +try { + [IO.File]::WriteAllBytes($pfxPath, [Convert]::FromBase64String($CertificateBase64.Trim())) + $securePass = if ([string]::IsNullOrEmpty($CertificatePassword)) { + New-Object System.Security.SecureString + } + else { + ConvertTo-SecureString -String $CertificatePassword -AsPlainText -Force + } + + $imported = @(Import-PfxCertificate ` + -FilePath $pfxPath ` + -CertStoreLocation Cert:\CurrentUser\My ` + -Password $securePass) + $certificate = $imported | + Where-Object { $_.HasPrivateKey } | + Select-Object -First 1 + if (-not $certificate) { + Fail-Stage "the imported PFX contains no certificate with a private key" + } + + $thumbprint = $certificate.Thumbprint.Replace(" ", "").ToUpperInvariant() + $configDir = Split-Path -Parent $ConfigPath + if ($configDir) { + New-Item -ItemType Directory -Path $configDir -Force | Out-Null + } + @{ + bundle = @{ + windows = @{ + certificateThumbprint = $thumbprint + digestAlgorithm = "sha256" + timestampUrl = $TimestampUrl + tsp = $true + } + } + } | ConvertTo-Json -Depth 6 | Set-Content -LiteralPath $ConfigPath -Encoding utf8 + + Write-Host "[$Stage] imported subject=$($certificate.Subject) thumbprint=$thumbprint" + Write-Host "[$Stage] generated Tauri Authenticode config: $ConfigPath" + + if ($env:GITHUB_ENV) { + "TAURI_AUTHENTICODE_CONFIG=$ConfigPath" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8 + "WINDOWS_CERTIFICATE_THUMBPRINT=$thumbprint" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8 + "WINDOWS_CERTIFICATE_TEMP_DIR=$tempDir" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8 + } + if ($env:GITHUB_OUTPUT) { + "thumbprint=$thumbprint" | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8 + "config=$ConfigPath" | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8 + } +} +catch { + if (Test-Path -LiteralPath $tempDir) { + Remove-Item -LiteralPath $tempDir -Recurse -Force -ErrorAction SilentlyContinue + } + throw +} + +return diff --git a/scripts/verify-windows-authenticode.ps1 b/scripts/verify-windows-authenticode.ps1 index 2616f7b..3dedb2e 100644 --- a/scripts/verify-windows-authenticode.ps1 +++ b/scripts/verify-windows-authenticode.ps1 @@ -1,11 +1,10 @@ # Verify Authenticode signatures on Windows PE files (installer, app, uninstaller). # # Modes: -# optional — report status; unsigned/NotSigned exits 0 (current milestone while -# OV/EV cert budget is not in place). Fail only if a path is missing -# or Get-AuthenticodeSignature itself errors. -# required — every path must have Status -eq Valid. Use after cert is wired -# into release (repo var AUTHENTICODE_REQUIRED=true). +# optional — PR/local diagnostic for builds that intentionally receive no +# release certificate. Reports unsigned files without blocking. +# required — release gate: every path must have Status -eq Valid. Can also +# pin the imported thumbprint and require RFC3161 evidence. # # Usage: # pwsh scripts/verify-windows-authenticode.ps1 -Path a.exe,b.exe -Mode optional @@ -25,6 +24,18 @@ param( # When set (required mode), SignerCertificate.Subject must contain this. [string]$ExpectedSubject = "", + # When set (required mode), the signer must be the exact certificate that + # the release job imported, not merely any locally trusted publisher. + [string]$ExpectedThumbprint = "", + + # Tauri is configured with tsp=true (/tr + /td SHA256). Requiring a + # countersigner here ensures the RFC3161 timestamp was actually embedded. + [switch]$RequireTimestamp, + + # Required together with -RequireTimestamp. The generated Tauri config is + # the build-time proof that signing used RFC3161 (/tr), not legacy /t. + [string]$SigningConfigPath = "", + [string]$Stage = "sign-verify" ) @@ -44,6 +55,24 @@ function Fail-Stage([string]$Message) { throw "[$Stage] $Message" } +if ($RequireTimestamp) { + if ([string]::IsNullOrWhiteSpace($SigningConfigPath) -or -not (Test-Path -LiteralPath $SigningConfigPath)) { + Fail-Stage "-RequireTimestamp also requires the generated Tauri signing config" + } + $signingConfig = Get-Content -LiteralPath $SigningConfigPath -Raw | ConvertFrom-Json + $windowsSigning = $signingConfig.bundle.windows + if ($windowsSigning.tsp -ne $true) { + Fail-Stage "Tauri signing config must set bundle.windows.tsp=true (RFC3161 /tr)" + } + if ([string]::IsNullOrWhiteSpace([string]$windowsSigning.timestampUrl)) { + Fail-Stage "Tauri signing config has no RFC3161 timestampUrl" + } + if ([string]$windowsSigning.digestAlgorithm -ne "sha256") { + Fail-Stage "Tauri signing config must use SHA256" + } + Write-Host "[$Stage] RFC3161 config asserted: tsp=true digest=sha256 url=$($windowsSigning.timestampUrl)" +} + Write-Stage "Authenticode verification (mode=$Mode)" $results = @() @@ -66,19 +95,21 @@ foreach ($raw in $Path) { $sig = Get-AuthenticodeSignature -LiteralPath $item.FullName $subject = if ($sig.SignerCertificate) { $sig.SignerCertificate.Subject } else { "" } + $thumbprint = if ($sig.SignerCertificate) { $sig.SignerCertificate.Thumbprint.Replace(" ", "").ToUpperInvariant() } else { "" } + $timestampSubject = if ($sig.TimeStamperCertificate) { $sig.TimeStamperCertificate.Subject } else { "" } $status = [string]$sig.Status $ok = $false switch ($Mode) { "optional" { - # NotSigned is expected until OV/EV is configured. HashMismatch / + # PR builds intentionally receive no release secret. HashMismatch / # NotTrusted / UnknownError still surface as warnings for visibility. if ($status -eq "Valid") { $ok = $true } elseif ($status -eq "NotSigned") { $ok = $true - Write-Host "::warning::[$Stage] unsigned (expected until Authenticode cert is configured): $($item.Name)" + Write-Host "::warning::[$Stage] unsigned (expected only for PR/local diagnostics): $($item.Name)" } else { # Soft-fail in optional mode: report but do not block release. @@ -95,6 +126,14 @@ foreach ($raw in $Path) { $ok = $false Write-Host "::error::[$Stage] $($item.Name): subject '$subject' does not contain '$ExpectedSubject'" } + elseif ($ExpectedThumbprint -and ($thumbprint -ne $ExpectedThumbprint.Replace(" ", "").ToUpperInvariant())) { + $ok = $false + Write-Host "::error::[$Stage] $($item.Name): signer thumbprint '$thumbprint' does not match the release certificate" + } + elseif ($RequireTimestamp -and -not $sig.TimeStamperCertificate) { + $ok = $false + Write-Host "::error::[$Stage] $($item.Name): no RFC3161 timestamp countersigner" + } else { $ok = $true } @@ -107,10 +146,12 @@ foreach ($raw in $Path) { Path = $item.FullName Status = $status Subject = $subject + Thumbprint = $thumbprint + TimestampSubject = $timestampSubject Ok = $ok } - Write-Host (" {0,-12} {1} {2}" -f $status, $item.Name, $subject) + Write-Host (" {0,-12} {1} signer={2} timestamp={3}" -f $status, $item.Name, $subject, $timestampSubject) } $results | Format-Table -AutoSize | Out-String | Write-Host diff --git a/scripts/windows-packaged-smoke.ps1 b/scripts/windows-packaged-smoke.ps1 index 0baf91d..d2ca521 100644 --- a/scripts/windows-packaged-smoke.ps1 +++ b/scripts/windows-packaged-smoke.ps1 @@ -1,12 +1,13 @@ -# Windows x64 packaged lifecycle smoke test. +# Windows packaged lifecycle and signature smoke test. # # Stages (each failure message is prefixed so CI logs pin the phase): # build — caller already built; this script only consumes the installer # install — passive NSIS install (/P) -# launch — first start of the installed main executable +# launch — first start of the installed main executable (or explicit skip +# for an ARM64 payload inspected on an x64 runner) # upgrade — re-run installer with /P /UPDATE (in-place upgrade path) # uninstall — passive uninstall of the installed product (always attempted in finally) -# sign-verify — optional Authenticode probe on installer + installed PE files +# sign-verify — mode-controlled Authenticode check on installer + installed PE files # # Usage (prefer in-process from CI shell:pwsh steps — nested `pwsh -File` breaks # array binding for -Path on some runners): @@ -24,7 +25,11 @@ param( [string]$MainBinaryName = "codex-app-manager", [int]$LaunchSeconds = 12, [ValidateSet("optional", "required", "skip")] - [string]$AuthenticodeMode = "optional" + [string]$AuthenticodeMode = "optional", + [string]$ExpectedThumbprint = "", + [switch]$RequireTimestamp, + [string]$SigningConfigPath = "", + [switch]$SkipLaunch ) Set-StrictMode -Version Latest @@ -97,7 +102,13 @@ try { # ── sign-verify (installer artifact, pre-install) ─────────────────────── if ($AuthenticodeMode -ne "skip" -and (Test-Path $verifyScript)) { Write-Stage "sign-verify" "Probe Authenticode on installer ($AuthenticodeMode)" - & $verifyScript -Path $installerItem.FullName -Mode $AuthenticodeMode -Stage "sign-verify" + & $verifyScript ` + -Path $installerItem.FullName ` + -Mode $AuthenticodeMode ` + -ExpectedThumbprint $ExpectedThumbprint ` + -RequireTimestamp:$RequireTimestamp ` + -SigningConfigPath $SigningConfigPath ` + -Stage "sign-verify" Close-Stage } @@ -129,33 +140,46 @@ try { # ── sign-verify (installed PE) ────────────────────────────────────────── if ($AuthenticodeMode -ne "skip" -and (Test-Path $verifyScript)) { Write-Stage "sign-verify" "Probe Authenticode on installed executable + uninstaller" - & $verifyScript -Path @($mainExe, $uninstaller) -Mode $AuthenticodeMode -Stage "sign-verify" + & $verifyScript ` + -Path @($mainExe, $uninstaller) ` + -Mode $AuthenticodeMode ` + -ExpectedThumbprint $ExpectedThumbprint ` + -RequireTimestamp:$RequireTimestamp ` + -SigningConfigPath $SigningConfigPath ` + -Stage "sign-verify" Close-Stage } # ── launch ────────────────────────────────────────────────────────────── - Write-Stage "launch" "First launch (${LaunchSeconds}s observe window)" - Stop-AppProcesses $MainBinaryName + if ($SkipLaunch) { + Write-Stage "launch" "Skipped: cross-architecture signature install smoke" + Write-Host "[launch] main executable was installed and signature-verified but is not runnable on this host architecture" + Close-Stage + } + else { + Write-Stage "launch" "First launch (${LaunchSeconds}s observe window)" + Stop-AppProcesses $MainBinaryName - $proc = Start-Process -FilePath $mainExe -PassThru -WindowStyle Minimized - Start-Sleep -Seconds $LaunchSeconds + $proc = Start-Process -FilePath $mainExe -PassThru -WindowStyle Minimized + Start-Sleep -Seconds $LaunchSeconds - if ($proc.HasExited) { - # A GUI app exiting immediately with non-zero is a real failure. Exit 0 can - # happen if single-instance hands off, but a brand-new install should stay up. - if ($proc.ExitCode -ne 0) { - Fail-Stage "launch" "process exited early with code $($proc.ExitCode)" + if ($proc.HasExited) { + # A GUI app exiting immediately with non-zero is a real failure. Exit 0 can + # happen if single-instance hands off, but a brand-new install should stay up. + if ($proc.ExitCode -ne 0) { + Fail-Stage "launch" "process exited early with code $($proc.ExitCode)" + } + Write-Host "::warning::[launch] process exited during observe window with code 0 — treating as soft pass" } - Write-Host "::warning::[launch] process exited during observe window with code 0 — treating as soft pass" - } - else { - Write-Host "[launch] process still running (pid=$($proc.Id)) — first launch OK" - Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue - Start-Sleep -Seconds 2 + else { + Write-Host "[launch] process still running (pid=$($proc.Id)) — first launch OK" + Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue + Start-Sleep -Seconds 2 + } + # Ensure nothing leftover holds files open for upgrade. + Stop-AppProcesses $MainBinaryName + Close-Stage } - # Ensure nothing leftover holds files open for upgrade. - Stop-AppProcesses $MainBinaryName - Close-Stage # ── upgrade ───────────────────────────────────────────────────────────── Write-Stage "upgrade" "Re-run installer with /P /UPDATE" @@ -171,6 +195,20 @@ try { Write-Host "[upgrade] post-upgrade PE size=$((Get-Item -LiteralPath $mainExe).Length) bytes" Close-Stage + # The upgrade path rewrites both payload files. Verify the bytes that remain + # installed, not only the first-install copies. + if ($AuthenticodeMode -ne "skip" -and (Test-Path $verifyScript)) { + Write-Stage "sign-verify" "Verify post-upgrade executable + uninstaller" + & $verifyScript ` + -Path @($mainExe, $uninstaller) ` + -Mode $AuthenticodeMode ` + -ExpectedThumbprint $ExpectedThumbprint ` + -RequireTimestamp:$RequireTimestamp ` + -SigningConfigPath $SigningConfigPath ` + -Stage "sign-verify" + Close-Stage + } + # ── uninstall (happy path) ────────────────────────────────────────────── Write-Stage "uninstall" "Passive uninstall (/P)" Stop-AppProcesses $MainBinaryName @@ -187,7 +225,8 @@ try { $didInstall = $false Close-Stage - Write-Host "Packaged lifecycle smoke passed: install → launch → upgrade → uninstall" + $launchLabel = if ($SkipLaunch) { "signature-only launch skip" } else { "launch" } + Write-Host "Packaged lifecycle smoke passed: install → $launchLabel → upgrade → uninstall" } catch { $smokeFailed = $true diff --git a/src-tauri/installer/installer.nsi b/src-tauri/installer/installer.nsi index 214d758..ac3c370 100644 --- a/src-tauri/installer/installer.nsi +++ b/src-tauri/installer/installer.nsi @@ -1,8 +1,9 @@ ; ───────────────────────────────────────────────────────────────────────────── ; Codex App Manager — custom NSIS installer template. -; Vendored verbatim from Tauri's default (@tauri-apps/cli v2.11.2) and lightly -; customized; every {{handlebars}} variable and all Tauri install/uninstall logic -; is preserved. Local changes are marked with "[codex-app-manager]". +; Based on Tauri's default (@tauri-apps/cli v2.11.2) and lightly customized; +; compatibility fragments are kept in sync with the pinned CLI. Every +; {{handlebars}} variable and all Tauri install/uninstall logic is preserved. +; Local changes are marked with "[codex-app-manager]". ; Re-sync with upstream when bumping the Tauri CLI. Branding (icon/header/sidebar) ; and the installer languages are driven from tauri.conf.json > bundle.windows.nsis; ; translated welcome/finish copy can be layered in here later (per-language LangStrings). @@ -22,6 +23,14 @@ ManifestDPIAwareness PerMonitorV2 SetCompressor /SOLID "{{compression}}" !endif +; Keep above !include to stay ahead of any plugin command. Tauri signs a private +; plugin copy when Windows code signing is configured; using the system plugin +; directory here would silently embed unsigned DLLs in an otherwise signed setup. +; https://github.com/tauri-apps/tauri/pull/15422 +{{#if signed_plugins_path}} +!addplugindir "{{signed_plugins_path}}" +{{/if}} + !include MUI2.nsh !include FileFunc.nsh !include x64.nsh diff --git a/src-tauri/src/app/manager_update_handoff.rs b/src-tauri/src/app/manager_update_handoff.rs new file mode 100644 index 0000000..0439654 --- /dev/null +++ b/src-tauri/src/app/manager_update_handoff.rs @@ -0,0 +1,222 @@ +//! Durable Windows manager-updater handoff state. +//! +//! `tauri-plugin-updater` launches NSIS and immediately terminates the old +//! process. A renderer event cannot be the only evidence during that gap, so +//! the backend fsyncs this record before entering `Update::install`. A newly +//! opened old build restores both the UI fence and the shared operation lock. + +#[cfg(any(target_os = "windows", test))] +use std::{fs, path::Path}; +use std::{ + io, + time::{SystemTime, UNIX_EPOCH}, +}; + +use serde::{Deserialize, Serialize}; + +#[cfg(any(target_os = "windows", test))] +use crate::app::atomic_file; +#[cfg(target_os = "windows")] +use crate::app::paths; + +pub const HANDOFF_MAX_AGE_MS: u64 = 10 * 60 * 1_000; +const MAX_FUTURE_SKEW_MS: u64 = 60 * 1_000; + +#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)] +#[serde(rename_all = "camelCase")] +pub struct ManagerUpdateHandoff { + pub version: String, + pub current_version: String, + pub body: Option, + pub started_at_unix_ms: u64, +} + +impl ManagerUpdateHandoff { + pub fn is_expired_at(&self, now_unix_ms: u64) -> bool { + self.started_at_unix_ms == 0 + || self.started_at_unix_ms > now_unix_ms.saturating_add(MAX_FUTURE_SKEW_MS) + || now_unix_ms.saturating_sub(self.started_at_unix_ms) >= HANDOFF_MAX_AGE_MS + } +} + +#[derive(Debug, Clone, PartialEq, Eq)] +pub enum ManagerUpdateHandoffStatus { + None, + Active(ManagerUpdateHandoff), + Expired(ManagerUpdateHandoff), +} + +pub fn now_unix_ms() -> u64 { + SystemTime::now() + .duration_since(UNIX_EPOCH) + .unwrap_or_default() + .as_millis() + .try_into() + .unwrap_or(u64::MAX) +} + +#[cfg(target_os = "windows")] +fn handoff_path() -> io::Result { + paths::data_dir() + .map(|dir| dir.join("manager-update-handoff.json")) + .ok_or_else(|| { + io::Error::new( + io::ErrorKind::NotFound, + "manager data directory unavailable", + ) + }) +} + +pub fn persist_for_platform(record: &ManagerUpdateHandoff) -> io::Result<()> { + #[cfg(target_os = "windows")] + { + persist_at(&handoff_path()?, record) + } + #[cfg(not(target_os = "windows"))] + { + let _ = record; + Ok(()) + } +} + +pub fn clear_for_platform() { + #[cfg(target_os = "windows")] + if let Ok(path) = handoff_path() { + clear_at(&path); + } +} + +pub fn status_for_platform(current_version: &str) -> ManagerUpdateHandoffStatus { + #[cfg(target_os = "windows")] + { + handoff_path() + .ok() + .map_or(ManagerUpdateHandoffStatus::None, |path| { + status_at(&path, current_version, now_unix_ms()) + }) + } + #[cfg(not(target_os = "windows"))] + { + let _ = current_version; + ManagerUpdateHandoffStatus::None + } +} + +#[cfg(any(target_os = "windows", test))] +fn persist_at(path: &Path, record: &ManagerUpdateHandoff) -> io::Result<()> { + let bytes = serde_json::to_vec(record) + .map_err(|error| io::Error::new(io::ErrorKind::InvalidData, error))?; + atomic_file::write_atomic(path, &bytes) +} + +#[cfg(any(target_os = "windows", test))] +fn load_at(path: &Path) -> Option { + let backup = atomic_file::backup_path(path); + if !path.exists() && !backup.exists() { + return None; + } + atomic_file::read_with_recovery(path).0 +} + +#[cfg(any(target_os = "windows", test))] +fn clear_at(path: &Path) { + let _ = fs::remove_file(path); + let _ = fs::remove_file(atomic_file::backup_path(path)); +} + +#[cfg(any(target_os = "windows", test))] +fn status_at(path: &Path, current_version: &str, now: u64) -> ManagerUpdateHandoffStatus { + let Some(record) = load_at(path) else { + clear_at(path); + return ManagerUpdateHandoffStatus::None; + }; + if record.version == current_version || record.current_version != current_version { + clear_at(path); + return ManagerUpdateHandoffStatus::None; + } + if record.is_expired_at(now) { + clear_at(path); + return ManagerUpdateHandoffStatus::Expired(record); + } + ManagerUpdateHandoffStatus::Active(record) +} + +#[cfg(test)] +mod tests { + use std::{ + fs, + sync::atomic::{AtomicU64, Ordering}, + }; + + use super::{ + clear_at, load_at, persist_at, status_at, ManagerUpdateHandoff, ManagerUpdateHandoffStatus, + HANDOFF_MAX_AGE_MS, + }; + + static TEST_COUNTER: AtomicU64 = AtomicU64::new(1); + + fn test_path(name: &str) -> std::path::PathBuf { + let id = TEST_COUNTER.fetch_add(1, Ordering::Relaxed); + let dir = std::path::PathBuf::from(env!("CARGO_MANIFEST_DIR")) + .join("target") + .join("test-data") + .join(format!( + "manager-handoff-{name}-{}-{id}", + std::process::id() + )); + let _ = fs::remove_dir_all(&dir); + fs::create_dir_all(&dir).unwrap(); + dir.join("handoff.json") + } + + fn record(started_at_unix_ms: u64) -> ManagerUpdateHandoff { + ManagerUpdateHandoff { + version: "2.0.0".into(), + current_version: "1.0.0".into(), + body: Some("notes".into()), + started_at_unix_ms, + } + } + + #[test] + fn roundtrips_and_clears_both_primary_and_backup() { + let path = test_path("roundtrip"); + persist_at(&path, &record(100)).unwrap(); + persist_at(&path, &record(200)).unwrap(); + assert_eq!(load_at(&path), Some(record(200))); + + clear_at(&path); + assert!(load_at(&path).is_none()); + let _ = fs::remove_dir_all(path.parent().unwrap()); + } + + #[test] + fn status_only_fences_the_exact_old_version_for_a_bounded_window() { + let path = test_path("status"); + persist_at(&path, &record(1_000)).unwrap(); + assert!(matches!( + status_at(&path, "1.0.0", 1_001), + ManagerUpdateHandoffStatus::Active(_) + )); + + assert!(matches!( + status_at(&path, "1.0.0", 1_000 + HANDOFF_MAX_AGE_MS), + ManagerUpdateHandoffStatus::Expired(_) + )); + assert!(load_at(&path).is_none()); + + persist_at(&path, &record(2_000)).unwrap(); + assert_eq!( + status_at(&path, "2.0.0", 2_001), + ManagerUpdateHandoffStatus::None + ); + assert!(load_at(&path).is_none()); + let _ = fs::remove_dir_all(path.parent().unwrap()); + } + + #[test] + fn rejects_zero_and_implausibly_future_timestamps() { + assert!(record(0).is_expired_at(1)); + assert!(record(61_001).is_expired_at(1)); + } +} diff --git a/src-tauri/src/app/manager_update_runtime.rs b/src-tauri/src/app/manager_update_runtime.rs new file mode 100644 index 0000000..a8d017e --- /dev/null +++ b/src-tauri/src/app/manager_update_runtime.rs @@ -0,0 +1,269 @@ +//! Renderer-independent state for the manager's own updater. +//! +//! Tauri commands outlive a WebView navigation. Keeping this state behind the +//! application `ManagerState` lets a freshly loaded renderer reattach to an +//! in-flight download, recover a terminal error, or relaunch after a successful +//! macOS install whose original JavaScript caller disappeared. + +use std::sync::{Arc, Mutex}; + +use serde::Serialize; + +use crate::errors::CommandError; + +#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)] +#[serde(rename_all = "kebab-case")] +pub enum ManagerUpdateRuntimePhase { + Downloading, + Installing, + Installed, + Error, +} + +#[derive(Debug, Clone, PartialEq, Eq, Serialize)] +#[serde(rename_all = "camelCase")] +pub struct ManagerUpdateRuntimeSnapshot { + pub revision: u64, + pub version: String, + pub current_version: String, + pub body: Option, + pub phase: ManagerUpdateRuntimePhase, + pub downloaded: u64, + pub total: Option, + pub failure: Option, + pub handoff_started_at: Option, +} + +#[derive(Debug, Default)] +struct Inner { + revision: u64, + snapshot: Option, +} + +#[derive(Clone, Default)] +pub struct ManagerUpdateRuntime { + inner: Arc>, +} + +impl ManagerUpdateRuntime { + pub fn snapshot(&self) -> Option { + self.inner + .lock() + .unwrap_or_else(|poisoned| poisoned.into_inner()) + .snapshot + .clone() + } + + pub fn begin( + &self, + version: String, + current_version: String, + body: Option, + ) -> ManagerUpdateRuntimeSnapshot { + self.replace(|revision| ManagerUpdateRuntimeSnapshot { + revision, + version, + current_version, + body, + phase: ManagerUpdateRuntimePhase::Downloading, + downloaded: 0, + total: None, + failure: None, + handoff_started_at: None, + }) + } + + pub fn downloading( + &self, + downloaded: u64, + total: Option, + ) -> Option { + self.mutate(|snapshot| { + snapshot.phase = ManagerUpdateRuntimePhase::Downloading; + snapshot.downloaded = downloaded; + snapshot.total = total; + snapshot.failure = None; + snapshot.handoff_started_at = None; + }) + } + + pub fn installing( + &self, + handoff_started_at: Option, + ) -> Option { + self.mutate(|snapshot| { + snapshot.phase = ManagerUpdateRuntimePhase::Installing; + snapshot.failure = None; + snapshot.handoff_started_at = handoff_started_at; + }) + } + + pub fn recover_installing( + &self, + version: String, + current_version: String, + body: Option, + handoff_started_at: u64, + ) -> ManagerUpdateRuntimeSnapshot { + self.replace(|revision| ManagerUpdateRuntimeSnapshot { + revision, + version, + current_version, + body, + phase: ManagerUpdateRuntimePhase::Installing, + downloaded: 0, + total: None, + failure: None, + handoff_started_at: Some(handoff_started_at), + }) + } + + pub fn installed(&self) -> Option { + self.mutate(|snapshot| { + snapshot.phase = ManagerUpdateRuntimePhase::Installed; + snapshot.failure = None; + snapshot.handoff_started_at = None; + }) + } + + pub fn failed(&self, failure: CommandError) -> Option { + self.mutate(|snapshot| { + snapshot.phase = ManagerUpdateRuntimePhase::Error; + snapshot.failure = Some(failure); + snapshot.handoff_started_at = None; + }) + } + + pub fn acknowledge_terminal( + &self, + revision: u64, + version: &str, + current_version: &str, + ) -> bool { + let mut inner = self + .inner + .lock() + .unwrap_or_else(|poisoned| poisoned.into_inner()); + let should_clear = inner.snapshot.as_ref().is_some_and(|snapshot| { + snapshot.revision == revision + && snapshot.version == version + && snapshot.current_version == current_version + && matches!( + snapshot.phase, + ManagerUpdateRuntimePhase::Installed | ManagerUpdateRuntimePhase::Error + ) + }); + if should_clear { + inner.snapshot = None; + } + should_clear + } + + fn replace( + &self, + create: impl FnOnce(u64) -> ManagerUpdateRuntimeSnapshot, + ) -> ManagerUpdateRuntimeSnapshot { + let mut inner = self + .inner + .lock() + .unwrap_or_else(|poisoned| poisoned.into_inner()); + inner.revision = inner.revision.saturating_add(1); + let snapshot = create(inner.revision); + inner.snapshot = Some(snapshot.clone()); + snapshot + } + + fn mutate( + &self, + update: impl FnOnce(&mut ManagerUpdateRuntimeSnapshot), + ) -> Option { + let mut inner = self + .inner + .lock() + .unwrap_or_else(|poisoned| poisoned.into_inner()); + inner.revision = inner.revision.saturating_add(1); + let revision = inner.revision; + let snapshot = inner.snapshot.as_mut()?; + update(snapshot); + snapshot.revision = revision; + Some(snapshot.clone()) + } +} + +#[cfg(test)] +mod tests { + use super::{ManagerUpdateRuntime, ManagerUpdateRuntimePhase}; + use crate::errors::CommandError; + + #[test] + fn preserves_progress_and_terminal_state_across_handles() { + let runtime = ManagerUpdateRuntime::default(); + let other_handle = runtime.clone(); + + let started = runtime.begin( + "2.0.0".to_string(), + "1.0.0".to_string(), + Some("notes".to_string()), + ); + let progress = runtime.downloading(5, Some(10)).unwrap(); + let installing = runtime.installing(Some(123)).unwrap(); + let installed = runtime.installed().unwrap(); + + assert!(started.revision < progress.revision); + assert!(progress.revision < installing.revision); + assert!(installing.revision < installed.revision); + assert_eq!(installed.phase, ManagerUpdateRuntimePhase::Installed); + assert_eq!(installing.handoff_started_at, Some(123)); + assert_eq!(installed.handoff_started_at, None); + assert_eq!(installed.downloaded, 5); + assert_eq!(other_handle.snapshot(), Some(installed)); + } + + #[test] + fn records_structured_terminal_failure() { + let runtime = ManagerUpdateRuntime::default(); + runtime.begin("2.0.0".into(), "1.0.0".into(), None); + let failed = runtime + .failed(CommandError { + code: "network".into(), + message: "offline".into(), + }) + .unwrap(); + + assert_eq!(failed.phase, ManagerUpdateRuntimePhase::Error); + assert_eq!(failed.failure.unwrap().code, "network"); + } + + #[test] + fn terminal_ack_is_compare_and_swap_safe() { + let runtime = ManagerUpdateRuntime::default(); + runtime.begin("2.0.0".into(), "1.0.0".into(), None); + let failed = runtime + .failed(CommandError { + code: "stale_expectation".into(), + message: "changed".into(), + }) + .unwrap(); + + assert!(!runtime.acknowledge_terminal( + failed.revision.saturating_sub(1), + &failed.version, + &failed.current_version, + )); + assert!(runtime.snapshot().is_some()); + assert!(runtime.acknowledge_terminal( + failed.revision, + &failed.version, + &failed.current_version, + )); + assert!(runtime.snapshot().is_none()); + + let active = runtime.begin("3.0.0".into(), "2.0.0".into(), None); + assert!(!runtime.acknowledge_terminal( + active.revision, + &active.version, + &active.current_version, + )); + assert_eq!(runtime.snapshot(), Some(active)); + } +} diff --git a/src-tauri/src/app/mod.rs b/src-tauri/src/app/mod.rs index cf29106..fa1fc46 100644 --- a/src-tauri/src/app/mod.rs +++ b/src-tauri/src/app/mod.rs @@ -6,6 +6,8 @@ pub mod disk; pub mod install_tx; pub mod logging; pub mod mac_update; +pub mod manager_update_handoff; +pub mod manager_update_runtime; pub mod op_phase; pub mod operation_outcome; pub mod oplock; diff --git a/src-tauri/src/app/oplock.rs b/src-tauri/src/app/oplock.rs index 09a4856..290e5a9 100644 --- a/src-tauri/src/app/oplock.rs +++ b/src-tauri/src/app/oplock.rs @@ -17,6 +17,7 @@ const DEFAULT_STALE_AFTER_SECS: u64 = 5 * 60; pub enum OperationKind { Install, Update, + ManagerUpdate, Uninstall, SetInstallRoot, Adopt, @@ -27,6 +28,7 @@ impl OperationKind { match self { Self::Install => "install", Self::Update => "update", + Self::ManagerUpdate => "manager-update", Self::Uninstall => "uninstall", Self::SetInstallRoot => "set-install-root", Self::Adopt => "adopt", @@ -620,6 +622,31 @@ mod tests { let _ = fs::remove_dir_all(path.parent().unwrap()); } + #[test] + fn manager_update_lease_blocks_codex_mutations() { + let path = lock_path("manager-update"); + let manager = OperationManager::new(path.clone()); + let guard = manager.begin(OperationKind::ManagerUpdate).unwrap(); + + assert_eq!(guard.kind().as_str(), "manager-update"); + assert_eq!( + manager.snapshot().map(|snapshot| snapshot.kind), + Some(OperationKind::ManagerUpdate) + ); + assert!(matches!( + manager.begin(OperationKind::Install), + Err(OperationError::BusySameProcess("manager-update")) + )); + assert!(matches!( + manager.begin(OperationKind::Update), + Err(OperationError::BusySameProcess("manager-update")) + )); + + drop(guard); + assert!(manager.begin(OperationKind::Update).is_ok()); + let _ = fs::remove_dir_all(path.parent().unwrap()); + } + #[test] fn detached_token_must_be_ended_once() { let path = lock_path("detached"); diff --git a/src-tauri/src/commands.rs b/src-tauri/src/commands.rs index b7e1d3b..dfecfcd 100644 --- a/src-tauri/src/commands.rs +++ b/src-tauri/src/commands.rs @@ -1,4 +1,9 @@ -use std::path::{Path, PathBuf}; +use std::{ + future::Future, + path::{Path, PathBuf}, + sync::Arc, + time::Duration, +}; use codex_win_engine::InstalledWindowsCodex; use serde::{Deserialize, Serialize}; @@ -20,6 +25,16 @@ use crate::app::mac_update::{ uninstall_macos, InstalledCodex, MacInstallStatus, MacPerformReport, MacStageReport, MacUninstallReport, MacUpdateReport, PerformExpectation, }; +use crate::app::manager_update_handoff::clear_for_platform as clear_manager_update_handoff; +#[cfg(target_os = "windows")] +use crate::app::manager_update_handoff::{ + now_unix_ms, persist_for_platform as persist_manager_update_handoff, + ManagerUpdateHandoff, +}; +use crate::app::manager_update_handoff::{ + status_for_platform as manager_update_handoff_status, ManagerUpdateHandoffStatus, +}; +use crate::app::manager_update_runtime::ManagerUpdateRuntimeSnapshot; use crate::app::op_phase::{OperationPhase, QuitPolicy}; use crate::app::operation_outcome::{AncillaryRetryReport, AncillaryRetryRequest}; use crate::app::oplock::{ @@ -46,7 +61,7 @@ use crate::app::win_update::{ use crate::domain::settings::AppSettings as DomainAppSettings; use crate::domain::target::OperatingSystem; use crate::errors::{AppError, CommandError}; -use crate::state::ManagerState; +use crate::state::{manager_update_handoff_timeout, ManagerState}; fn normalize_windows_source_base(raw: &str) -> Option { let mut base = raw.trim().trim_end_matches('/').to_string(); @@ -158,8 +173,48 @@ pub struct ManagerUpdateMetadata { pub body: Option, } -fn manager_updater_builder( +const MANAGER_UPDATE_STATE_EVENT: &str = "manager://update-state"; +const MANAGER_UPDATE_CHECK_TIMEOUT: Duration = Duration::from_secs(30); +const MANAGER_UPDATE_CONNECT_TIMEOUT: Duration = Duration::from_secs(15); +const MANAGER_UPDATE_READ_TIMEOUT: Duration = Duration::from_secs(30); + +fn emit_manager_update_state(app: &AppHandle, snapshot: ManagerUpdateRuntimeSnapshot) { + let _ = app.emit(MANAGER_UPDATE_STATE_EVENT, snapshot); +} + +fn persist_manager_update_handoff_before_install( + snapshot: &ManagerUpdateRuntimeSnapshot, +) -> Result, AppError> { + #[cfg(target_os = "windows")] + { + let started_at_unix_ms = now_unix_ms(); + persist_manager_update_handoff(&ManagerUpdateHandoff { + version: snapshot.version.clone(), + current_version: snapshot.current_version.clone(), + body: snapshot.body.clone(), + started_at_unix_ms, + }) + .map_err(|error| AppError::Internal(format!("persist manager updater handoff: {error}")))?; + Ok(Some(started_at_unix_ms)) + } + #[cfg(not(target_os = "windows"))] + { + let _ = snapshot; + Ok(None) + } +} + +fn release_manager_update_handoff_guard(state: &ManagerState) { + state + .manager_update_handoff_guard + .lock() + .unwrap_or_else(|poisoned| poisoned.into_inner()) + .take(); +} + +fn manager_updater_builder_for_endpoints( app: &AppHandle, + endpoints: Option>, ) -> Result { let saved = PersistedAppSettings::load(); let mut builder = app.updater_builder(); @@ -176,7 +231,145 @@ fn manager_updater_builder( builder = builder.proxy(proxy); } } - Ok(builder) + if let Some(endpoints) = endpoints { + builder = builder + .endpoints(endpoints) + .map_err(|e| AppError::Engine(format!("configure manager updater endpoints: {e}")))?; + } + // `UpdaterBuilder::timeout` only reaches manifest checks. The updater + // deliberately creates downloads without that total timeout, so keep + // downloads unbounded while data is flowing and enforce a read-stall + // timeout through the shared reqwest client configuration instead. + Ok(builder + .timeout(MANAGER_UPDATE_CHECK_TIMEOUT) + .configure_client(|client| { + client + .connect_timeout(MANAGER_UPDATE_CONNECT_TIMEOUT) + .read_timeout(MANAGER_UPDATE_READ_TIMEOUT) + })) +} + +fn configured_manager_update_endpoints(app: &AppHandle) -> Result, AppError> { + let raw = app + .config() + .plugins + .0 + .get("updater") + .cloned() + .ok_or_else(|| AppError::Internal("missing updater plugin configuration".to_string()))?; + let config: tauri_plugin_updater::Config = serde_json::from_value(raw) + .map_err(|e| AppError::Internal(format!("read updater plugin configuration: {e}")))?; + if config.endpoints.is_empty() { + return Err(AppError::Internal( + "updater plugin has no configured endpoints".to_string(), + )); + } + Ok(config.endpoints) +} + +async fn download_with_manager_fallback( + endpoints: Vec, + mut attempt: Attempt, +) -> Result +where + Attempt: FnMut(url::Url) -> AttemptFuture, + AttemptFuture: Future>, +{ + let mut failures = Vec::new(); + let mut stale_failures = Vec::new(); + for endpoint in endpoints { + let origin = redact_url(endpoint.as_str()); + match attempt(endpoint).await { + Ok(value) => return Ok(value), + // Consent is bound to the exact expected version/current pair, not + // to one particular feed. A stale mirror may safely fall through to + // GitHub, but no mismatching package is ever downloaded/installed. + Err(AppError::StaleExpectation(message)) => { + log::warn!("manager updater endpoint is stale origin={origin} error={message}"); + stale_failures.push(format!("{origin}: {message}")); + } + Err(err) => { + log::warn!("manager updater endpoint attempt failed origin={origin} error={err}"); + failures.push(format!("{origin}: {err}")); + } + } + } + + if !stale_failures.is_empty() { + let mut details = stale_failures; + details.extend(failures); + return Err(AppError::StaleExpectation(format!( + "管理器更新内容已变化，请重新检查后再确认。({})", + details.join("; ") + ))); + } + + Err(AppError::Engine(format!( + "manager update download failed for all configured endpoints: {}", + failures.join("; ") + ))) +} + +async fn check_with_manager_fallback( + endpoints: Vec, + mut attempt: Attempt, +) -> Result, AppError> +where + Attempt: FnMut(url::Url) -> AttemptFuture, + AttemptFuture: Future, AppError>>, +{ + let mut failures_after_last_success = Vec::new(); + let mut saw_no_update = false; + + for endpoint in endpoints { + let origin = redact_url(endpoint.as_str()); + match attempt(endpoint).await { + Ok(Some(update)) => return Ok(Some(update)), + Ok(None) => { + // A valid but stale mirror (including HTTP 204) is not proof + // that the authoritative fallback has no update. Continue all + // the way through the configured feeds. A later successful + // no-update result supersedes earlier transport failures. + log::debug!("manager updater endpoint has no update origin={origin}"); + saw_no_update = true; + failures_after_last_success.clear(); + } + Err(err) => { + log::warn!("manager updater check failed origin={origin} error={err}"); + failures_after_last_success.push(format!("{origin}: {err}")); + } + } + } + + if saw_no_update && failures_after_last_success.is_empty() { + return Ok(None); + } + + Err(AppError::Engine(format!( + "manager update check failed for all configured endpoints: {}", + failures_after_last_success.join("; ") + ))) +} + +async fn download_then_install_manager_update( + endpoints: Vec, + attempt: Attempt, + install: Install, +) -> Result<(), AppError> +where + Attempt: FnMut(url::Url) -> AttemptFuture, + AttemptFuture: Future>, + Install: FnOnce(T) -> Result<(), AppError>, +{ + // The fallback boundary ends when a fully downloaded package has passed its + // Tauri signature verification. Installation is invoked exactly once. + let package = download_with_manager_fallback(endpoints, attempt).await?; + install(package) +} + +struct DownloadedManagerUpdate { + update: tauri_plugin_updater::Update, + bytes: Vec, } fn manager_update_matches_confirmation( @@ -192,13 +385,20 @@ fn manager_update_matches_confirmation( pub async fn manager_check_update( app: AppHandle, ) -> Result, CommandError> { - let updater = manager_updater_builder(&app)? - .build() - .map_err(|e| AppError::Engine(format!("build manager updater: {e}")))?; - let update = updater - .check() - .await - .map_err(|e| AppError::Engine(format!("check manager update: {e}")))?; + let endpoints = configured_manager_update_endpoints(&app)?; + let update = check_with_manager_fallback(endpoints, |endpoint| { + let app = app.clone(); + async move { + let updater = manager_updater_builder_for_endpoints(&app, Some(vec![endpoint]))? + .build() + .map_err(|e| AppError::Engine(format!("build manager updater: {e}")))?; + updater + .check() + .await + .map_err(|e| AppError::Engine(format!("check manager update: {e}"))) + } + }) + .await?; Ok(update.map(|update| ManagerUpdateMetadata { version: update.version, current_version: update.current_version, @@ -206,36 +406,219 @@ pub async fn manager_check_update( })) } +#[tauri::command] +pub fn manager_get_update_runtime( + app: AppHandle, + state: State<'_, ManagerState>, +) -> Option { + let snapshot = state.manager_update.snapshot()?; + if snapshot.handoff_started_at.is_none() { + return Some(snapshot); + } + + let current_version = app.package_info().version.to_string(); + match manager_update_handoff_status(¤t_version) { + ManagerUpdateHandoffStatus::Active(record) + if record.version == snapshot.version + && record.current_version == snapshot.current_version + && record.started_at_unix_ms == snapshot.handoff_started_at.unwrap_or_default() => + { + Some(snapshot) + } + ManagerUpdateHandoffStatus::Active(_) + | ManagerUpdateHandoffStatus::Expired(_) + | ManagerUpdateHandoffStatus::None => { + // Missing, mismatched, or expired durable evidence must release the + // recovered cross-process lock and become an explicit retry surface. + clear_manager_update_handoff(); + release_manager_update_handoff_guard(&state); + state + .manager_update + .failed(manager_update_handoff_timeout()) + } + } +} + +#[tauri::command] +pub fn manager_ack_update_runtime( + state: State<'_, ManagerState>, + revision: u64, + version: String, + current_version: String, +) -> bool { + state + .manager_update + .acknowledge_terminal(revision, &version, ¤t_version) +} + #[tauri::command] pub async fn manager_install_update( app: AppHandle, + state: State<'_, ManagerState>, expected_version: String, expected_current_version: String, + expected_body: Option, ) -> Result<(), CommandError> { - let updater = manager_updater_builder(&app)? - .build() - .map_err(|e| AppError::Engine(format!("build manager updater: {e}")))?; - let update = updater - .check() - .await - .map_err(|e| AppError::Engine(format!("check manager update before install: {e}")))? - .ok_or_else(|| AppError::Engine("No manager update is available.".to_string()))?; - if !manager_update_matches_confirmation( - &update.version, - &update.current_version, - &expected_version, - &expected_current_version, - ) { - return Err(AppError::StaleExpectation( - "管理器更新内容已变化，请重新检查后再确认。".to_string(), + // Own the same process/cross-process lock as Codex mutations. This is both + // the final busy preflight and a race-free reservation: once acquired, no + // install/update can start while the manager package is downloading. + let op = begin_guard(&state, OperationKind::ManagerUpdate)?; + let start = state.manager_update.begin( + expected_version.clone(), + expected_current_version.clone(), + expected_body, + ); + emit_manager_update_state(&app, start); + + let result = async { + state + .operations + .set_phase(op.token(), OperationPhase::Downloading) + .map_err(AppError::from)?; + let endpoints = configured_manager_update_endpoints(&app)?; + let runtime_for_attempts = state.manager_update.clone(); + let operations_for_attempts = state.operations.clone(); + let token_for_attempts = op.token().clone(); + let app_for_attempts = app.clone(); + let expected_version = Arc::new(expected_version); + let expected_current_version = Arc::new(expected_current_version); + + download_then_install_manager_update( + endpoints, + move |endpoint| { + let runtime = runtime_for_attempts.clone(); + let operations = operations_for_attempts.clone(); + let token = token_for_attempts.clone(); + let app = app_for_attempts.clone(); + let expected_version = Arc::clone(&expected_version); + let expected_current_version = Arc::clone(&expected_current_version); + async move { + operations + .set_phase(&token, OperationPhase::Downloading) + .map_err(AppError::from)?; + if let Some(snapshot) = runtime.downloading(0, None) { + emit_manager_update_state(&app, snapshot); + } + + let updater = + manager_updater_builder_for_endpoints(&app, Some(vec![endpoint.clone()]))? + .build() + .map_err(|e| AppError::Engine(format!("build manager updater: {e}")))?; + let update = updater + .check() + .await + .map_err(|e| { + AppError::Engine(format!("check manager update before install: {e}")) + })? + .ok_or_else(|| { + AppError::StaleExpectation( + "管理器更新内容已变化，请重新检查后再确认。".to_string(), + ) + })?; + if !manager_update_matches_confirmation( + &update.version, + &update.current_version, + expected_version.as_str(), + expected_current_version.as_str(), + ) { + return Err(AppError::StaleExpectation( + "管理器更新内容已变化，请重新检查后再确认。".to_string(), + )); + } + + let source = redact_url(endpoint.as_str()); + let runtime_for_progress = runtime.clone(); + let operations_for_progress = operations.clone(); + let token_for_progress = token.clone(); + let app_for_progress = app.clone(); + let operations_for_verify = operations.clone(); + let token_for_verify = token.clone(); + let mut downloaded = 0_u64; + let bytes = update + .download( + move |chunk, total| { + downloaded = downloaded.saturating_add(chunk as u64); + let _ = operations_for_progress.set_progress( + &token_for_progress, + OperationProgress { + downloaded, + total: total.unwrap_or(0), + source: source.clone(), + }, + ); + if let Some(snapshot) = + runtime_for_progress.downloading(downloaded, total) + { + emit_manager_update_state(&app_for_progress, snapshot); + } + }, + move || { + // `download` invokes this before minisign verification. + // Verifying remains interruptible and may still fall back. + let _ = operations_for_verify + .set_phase(&token_for_verify, OperationPhase::Verifying); + }, + ) + .await + .map_err(|e| AppError::Engine(format!("download manager update: {e}")))?; + Ok(DownloadedManagerUpdate { update, bytes }) + } + }, + |package| { + // This is the no-return boundary on Windows. Set all durable and + // renderer-independent state before invoking the installer. + state + .operations + .set_phase(op.token(), OperationPhase::Committing) + .map_err(AppError::from)?; + let runtime = state.manager_update.snapshot().ok_or_else(|| { + AppError::Internal("manager update runtime disappeared before install".into()) + })?; + let handoff_started_at = persist_manager_update_handoff_before_install(&runtime)?; + let snapshot = state + .manager_update + .installing(handoff_started_at) + .ok_or_else(|| { + clear_manager_update_handoff(); + AppError::Internal( + "manager update runtime disappeared during install handoff".into(), + ) + })?; + emit_manager_update_state(&app, snapshot); + let installed = package + .update + .install(package.bytes) + .map_err(|e| AppError::Engine(format!("install manager update: {e}"))); + if installed.is_err() { + clear_manager_update_handoff(); + } + installed + }, ) - .into()); + .await?; + + state + .operations + .set_phase(op.token(), OperationPhase::Finishing) + .map_err(AppError::from)?; + if let Some(snapshot) = state.manager_update.installed() { + emit_manager_update_state(&app, snapshot); + } + clear_manager_update_handoff(); + Ok::<(), AppError>(()) + } + .await; + + match result { + Ok(()) => Ok(()), + Err(err) => { + let command_error = CommandError::from(err); + if let Some(snapshot) = state.manager_update.failed(command_error.clone()) { + emit_manager_update_state(&app, snapshot); + } + Err(command_error) + } } - update - .download_and_install(|_, _| {}, || {}) - .await - .map_err(|e| AppError::Engine(format!("install manager update: {e}")))?; - Ok(()) } fn windows_domain_settings_for_persisted(state: &ManagerState) -> DomainAppSettings { @@ -1818,11 +2201,14 @@ pub async fn win_uninstall( #[cfg(test)] mod tests { use super::{ + check_with_manager_fallback, download_then_install_manager_update, install_root_from_picked_dir, manager_update_matches_confirmation, normalize_windows_source_base, validate_install_root_path, validated_custom_proxy_for_settings, }; + use crate::errors::AppError; use std::fs; + use std::sync::{Arc, Mutex}; fn temp_path(name: &str) -> std::path::PathBuf { std::env::temp_dir().join(format!("{name}-{}", std::process::id())) @@ -1876,6 +2262,289 @@ mod tests { )); } + fn manager_update_test_endpoints() -> Vec { + vec![ + url::Url::parse("https://mirror.example/latest.json").unwrap(), + url::Url::parse("https://github.com/example/releases/latest/download/latest.json") + .unwrap(), + ] + } + + #[test] + fn manager_update_check_falls_back_after_primary_reports_no_update() { + let attempts = Arc::new(Mutex::new(Vec::new())); + let attempts_for_check = Arc::clone(&attempts); + + let result = tauri::async_runtime::block_on(check_with_manager_fallback( + manager_update_test_endpoints(), + move |endpoint| { + let attempts = Arc::clone(&attempts_for_check); + async move { + attempts + .lock() + .unwrap() + .push(endpoint.host_str().unwrap().to_string()); + if endpoint.host_str() == Some("mirror.example") { + Ok(None) + } else { + Ok(Some("github-update")) + } + } + }, + )); + + assert_eq!(result.unwrap(), Some("github-update")); + assert_eq!( + *attempts.lock().unwrap(), + vec!["mirror.example", "github.com"] + ); + } + + #[test] + fn manager_update_check_falls_back_after_primary_check_failure() { + let attempts = Arc::new(Mutex::new(Vec::new())); + let attempts_for_check = Arc::clone(&attempts); + + let result = tauri::async_runtime::block_on(check_with_manager_fallback( + manager_update_test_endpoints(), + move |endpoint| { + let attempts = Arc::clone(&attempts_for_check); + async move { + attempts + .lock() + .unwrap() + .push(endpoint.host_str().unwrap().to_string()); + if endpoint.host_str() == Some("mirror.example") { + Err(AppError::Engine( + "manifest has no current platform".to_string(), + )) + } else { + Ok(Some("github-update")) + } + } + }, + )); + + assert_eq!(result.unwrap(), Some("github-update")); + assert_eq!( + *attempts.lock().unwrap(), + vec!["mirror.example", "github.com"] + ); + } + + #[test] + fn manager_update_check_accepts_final_no_update_after_primary_failure() { + let result = tauri::async_runtime::block_on(check_with_manager_fallback( + manager_update_test_endpoints(), + |endpoint| async move { + if endpoint.host_str() == Some("mirror.example") { + Err(AppError::Engine("timed out".to_string())) + } else { + Ok(None::<&'static str>) + } + }, + )); + + assert_eq!(result.unwrap(), None); + } + + #[test] + fn manager_update_check_rejects_unconfirmed_no_update() { + let error = tauri::async_runtime::block_on(check_with_manager_fallback( + manager_update_test_endpoints(), + |endpoint| async move { + if endpoint.host_str() == Some("mirror.example") { + Ok(None::<&'static str>) + } else { + Err(AppError::Engine("timed out".to_string())) + } + }, + )) + .unwrap_err(); + + assert!(error.to_string().contains("github.com")); + assert!(error.to_string().contains("timed out")); + } + + #[test] + fn manager_update_falls_back_after_mirror_artifact_failure() { + let attempts = Arc::new(Mutex::new(Vec::new())); + let installed = Arc::new(Mutex::new(Vec::new())); + let attempts_for_download = Arc::clone(&attempts); + let installed_for_install = Arc::clone(&installed); + + let result = tauri::async_runtime::block_on(download_then_install_manager_update( + manager_update_test_endpoints(), + move |endpoint| { + let attempts = Arc::clone(&attempts_for_download); + async move { + attempts + .lock() + .unwrap() + .push(endpoint.host_str().unwrap().to_string()); + if endpoint.host_str() == Some("mirror.example") { + Err(AppError::Engine( + "download manager update: HTTP 404".to_string(), + )) + } else { + Ok("github-verified-package") + } + } + }, + move |package| { + installed_for_install.lock().unwrap().push(package); + Ok(()) + }, + )); + + assert!(result.is_ok()); + assert_eq!( + *attempts.lock().unwrap(), + vec!["mirror.example", "github.com"] + ); + assert_eq!(*installed.lock().unwrap(), vec!["github-verified-package"]); + } + + #[test] + fn manager_update_falls_back_after_mirror_stream_resets() { + let attempts = Arc::new(Mutex::new(Vec::new())); + let attempts_for_download = Arc::clone(&attempts); + + let result = tauri::async_runtime::block_on(download_then_install_manager_update( + manager_update_test_endpoints(), + move |endpoint| { + let attempts = Arc::clone(&attempts_for_download); + async move { + attempts + .lock() + .unwrap() + .push(endpoint.host_str().unwrap().to_string()); + if endpoint.host_str() == Some("mirror.example") { + Err(AppError::Engine( + "download manager update: connection reset mid-stream".to_string(), + )) + } else { + Ok("github-verified-package") + } + } + }, + |_| Ok(()), + )); + + assert!(result.is_ok()); + assert_eq!( + *attempts.lock().unwrap(), + vec!["mirror.example", "github.com"] + ); + } + + #[test] + fn manager_update_falls_back_when_primary_manifest_is_stale() { + let attempts = Arc::new(Mutex::new(Vec::new())); + let attempts_for_download = Arc::clone(&attempts); + + let result = tauri::async_runtime::block_on(download_then_install_manager_update( + manager_update_test_endpoints(), + move |endpoint| { + let attempts = Arc::clone(&attempts_for_download); + async move { + attempts + .lock() + .unwrap() + .push(endpoint.host_str().unwrap().to_string()); + if endpoint.host_str() == Some("mirror.example") { + Err(AppError::StaleExpectation("mirror is stale".to_string())) + } else { + Ok("github-exact-expected-package") + } + } + }, + |_| Ok(()), + )); + + assert!(result.is_ok()); + assert_eq!( + *attempts.lock().unwrap(), + vec!["mirror.example", "github.com"] + ); + } + + #[test] + fn manager_update_reports_when_both_artifact_sources_fail() { + let attempts = Arc::new(Mutex::new(Vec::new())); + let install_called = Arc::new(Mutex::new(false)); + let attempts_for_download = Arc::clone(&attempts); + let install_called_for_install = Arc::clone(&install_called); + + let error = tauri::async_runtime::block_on(download_then_install_manager_update::< + &'static str, + _, + _, + _, + >( + manager_update_test_endpoints(), + move |endpoint| { + let attempts = Arc::clone(&attempts_for_download); + async move { + attempts + .lock() + .unwrap() + .push(endpoint.host_str().unwrap().to_string()); + Err(AppError::Engine(format!( + "download failed from {}", + endpoint.host_str().unwrap() + ))) + } + }, + move |_| { + *install_called_for_install.lock().unwrap() = true; + Ok(()) + }, + )) + .unwrap_err(); + + assert_eq!( + *attempts.lock().unwrap(), + vec!["mirror.example", "github.com"] + ); + assert!(!*install_called.lock().unwrap()); + assert!(error.to_string().contains("mirror.example")); + assert!(error.to_string().contains("github.com")); + } + + #[test] + fn manager_update_never_falls_back_after_install_starts() { + let attempts = Arc::new(Mutex::new(Vec::new())); + let install_calls = Arc::new(Mutex::new(0_u32)); + let attempts_for_download = Arc::clone(&attempts); + let install_calls_for_install = Arc::clone(&install_calls); + + let error = tauri::async_runtime::block_on(download_then_install_manager_update( + manager_update_test_endpoints(), + move |endpoint| { + let attempts = Arc::clone(&attempts_for_download); + async move { + attempts + .lock() + .unwrap() + .push(endpoint.host_str().unwrap().to_string()); + Ok("verified-package") + } + }, + move |_| { + *install_calls_for_install.lock().unwrap() += 1; + Err(AppError::Engine( + "installer failed after launch".to_string(), + )) + }, + )) + .unwrap_err(); + + assert_eq!(*attempts.lock().unwrap(), vec!["mirror.example"]); + assert_eq!(*install_calls.lock().unwrap(), 1); + assert!(error.to_string().contains("installer failed after launch")); + } + #[test] fn rejects_non_empty_non_codex_install_root() { let root = temp_path("codex-manager-non-empty-root"); diff --git a/src-tauri/src/errors.rs b/src-tauri/src/errors.rs index 2e31f12..26f7d7d 100644 --- a/src-tauri/src/errors.rs +++ b/src-tauri/src/errors.rs @@ -137,6 +137,8 @@ pub fn classify(message: &str) -> ErrorKind { } if m.contains("could not resolve") + || m.contains("network error") + || m.contains("error sending request") || m.contains("failed to connect") || m.contains("connection refused") || m.contains("connection reset") @@ -194,7 +196,7 @@ impl From for AppError { } } -#[derive(Debug, Serialize)] +#[derive(Debug, Clone, PartialEq, Eq, Serialize)] #[serde(rename_all = "camelCase")] pub struct CommandError { pub code: String, @@ -254,6 +256,18 @@ mod tests { assert_eq!(classify("download cancelled"), ErrorKind::Cancelled); } + #[test] + fn manager_updater_transport_errors_are_network_failures() { + assert_eq!( + classify("check manager update: network error: dns lookup failed"), + ErrorKind::Network + ); + assert_eq!( + classify("install manager update: error sending request for url"), + ErrorKind::Network + ); + } + #[test] fn combined_retry_message_classifies_on_the_fresh_attempt() { // resume's incidental range failure (33) must not mask the fresh diff --git a/src-tauri/src/lib.rs b/src-tauri/src/lib.rs index aff96e3..89d3c0d 100644 --- a/src-tauri/src/lib.rs +++ b/src-tauri/src/lib.rs @@ -161,6 +161,8 @@ pub fn run() { commands::mac_launch_codex, commands::mac_uninstall, commands::manager_check_update, + commands::manager_ack_update_runtime, + commands::manager_get_update_runtime, commands::manager_install_update, commands::get_settings, commands::set_settings, @@ -199,6 +201,9 @@ pub fn run() { commands::log_frontend_error, ]) .setup(|app| { + let current_version = app.package_info().version.to_string(); + app.state::() + .restore_manager_update_handoff(¤t_version); #[cfg(target_os = "macos")] install_macos_menu(app)?; log::info!( diff --git a/src-tauri/src/state.rs b/src-tauri/src/state.rs index 466174e..49c0043 100644 --- a/src-tauri/src/state.rs +++ b/src-tauri/src/state.rs @@ -3,7 +3,12 @@ use std::sync::Mutex; use crate::adapters::host; use crate::app::config_health::ConfigHealth; -use crate::app::oplock::OperationManager; +use crate::app::manager_update_handoff::{ + status_for_platform as manager_update_handoff_status, ManagerUpdateHandoff, + ManagerUpdateHandoffStatus, +}; +use crate::app::manager_update_runtime::ManagerUpdateRuntime; +use crate::app::oplock::{OperationGuard, OperationKind, OperationManager}; use crate::app::provenance::ProvenanceStore; use crate::app::settings_store::AppSettings as PersistedAppSettings; use crate::domain::manifest::MirrorEndpoints; @@ -18,9 +23,56 @@ pub struct ManagerState { /// exit handlers stop intercepting and let the process go. pub force_quit: AtomicBool, pub operations: OperationManager, + pub manager_update: ManagerUpdateRuntime, + /// Holds the shared operation lock when an old Windows build is reopened + /// while its updater-owned NSIS child is still replacing files. + pub manager_update_handoff_guard: Mutex>, pub config_health: Mutex, } +fn restore_manager_update_handoff(runtime: &ManagerUpdateRuntime, record: &ManagerUpdateHandoff) { + runtime.recover_installing( + record.version.clone(), + record.current_version.clone(), + record.body.clone(), + record.started_at_unix_ms, + ); +} + +pub(crate) fn manager_update_handoff_timeout() -> crate::errors::CommandError { + crate::errors::CommandError { + code: "timeout".to_string(), + message: "manager updater handoff expired before the target version launched".to_string(), + } +} + +fn restore_manager_update_handoff_status( + status: ManagerUpdateHandoffStatus, + operations: &OperationManager, + runtime: &ManagerUpdateRuntime, +) -> Option { + match status { + ManagerUpdateHandoffStatus::Active(record) => { + restore_manager_update_handoff(runtime, &record); + match operations.begin(OperationKind::ManagerUpdate) { + Ok(guard) => Some(guard), + Err(error) => { + // Another live manager may still own the same filesystem + // lock. The restored runtime still fences this renderer. + log::warn!("could not restore manager handoff operation lock: {error}"); + None + } + } + } + ManagerUpdateHandoffStatus::Expired(record) => { + restore_manager_update_handoff(runtime, &record); + runtime.failed(manager_update_handoff_timeout()); + None + } + ManagerUpdateHandoffStatus::None => None, + } +} + impl ManagerState { pub fn new() -> Self { let target = Target::current(); @@ -41,6 +93,7 @@ impl ManagerState { .map(|dir| dir.join("operation.lock")) .unwrap_or_else(|| std::env::temp_dir().join("codex-app-manager-operation.lock")); let operations = OperationManager::new(lock_path); + let manager_update = ManagerUpdateRuntime::default(); Self { target, @@ -48,9 +101,23 @@ impl ManagerState { endpoints, force_quit: AtomicBool::new(false), operations, + manager_update, + manager_update_handoff_guard: Mutex::new(None), config_health, } } + + pub(crate) fn restore_manager_update_handoff(&self, current_version: &str) { + let guard = restore_manager_update_handoff_status( + manager_update_handoff_status(current_version), + &self.operations, + &self.manager_update, + ); + *self + .manager_update_handoff_guard + .lock() + .unwrap_or_else(|poisoned| poisoned.into_inner()) = guard; + } } impl Default for ManagerState { @@ -58,3 +125,80 @@ impl Default for ManagerState { Self::new() } } + +#[cfg(test)] +mod tests { + use std::{ + fs, + sync::atomic::{AtomicU64, Ordering}, + }; + + use super::restore_manager_update_handoff_status; + use crate::app::manager_update_handoff::{ManagerUpdateHandoff, ManagerUpdateHandoffStatus}; + use crate::app::manager_update_runtime::{ManagerUpdateRuntime, ManagerUpdateRuntimePhase}; + use crate::app::oplock::{OperationError, OperationKind, OperationManager}; + + static TEST_COUNTER: AtomicU64 = AtomicU64::new(1); + + fn operations(name: &str) -> (OperationManager, std::path::PathBuf) { + let id = TEST_COUNTER.fetch_add(1, Ordering::Relaxed); + let dir = std::path::PathBuf::from(env!("CARGO_MANIFEST_DIR")) + .join("target") + .join("test-data") + .join(format!("state-handoff-{name}-{}-{id}", std::process::id())); + let _ = fs::remove_dir_all(&dir); + fs::create_dir_all(&dir).unwrap(); + (OperationManager::new(dir.join("operation.lock")), dir) + } + + fn record() -> ManagerUpdateHandoff { + ManagerUpdateHandoff { + version: "2.0.0".into(), + current_version: "1.0.0".into(), + body: Some("notes".into()), + started_at_unix_ms: 123, + } + } + + #[test] + fn active_handoff_restores_runtime_and_blocks_codex_operations() { + let (operations, dir) = operations("active"); + let runtime = ManagerUpdateRuntime::default(); + let guard = restore_manager_update_handoff_status( + ManagerUpdateHandoffStatus::Active(record()), + &operations, + &runtime, + ) + .unwrap(); + + let snapshot = runtime.snapshot().unwrap(); + assert_eq!(snapshot.phase, ManagerUpdateRuntimePhase::Installing); + assert_eq!(snapshot.handoff_started_at, Some(123)); + assert!(matches!( + operations.begin(OperationKind::Update), + Err(OperationError::BusySameProcess("manager-update")) + )); + + drop(guard); + assert!(operations.begin(OperationKind::Update).is_ok()); + let _ = fs::remove_dir_all(dir); + } + + #[test] + fn expired_handoff_restores_a_retryable_terminal_without_a_lock() { + let (operations, dir) = operations("expired"); + let runtime = ManagerUpdateRuntime::default(); + let guard = restore_manager_update_handoff_status( + ManagerUpdateHandoffStatus::Expired(record()), + &operations, + &runtime, + ); + + assert!(guard.is_none()); + let snapshot = runtime.snapshot().unwrap(); + assert_eq!(snapshot.phase, ManagerUpdateRuntimePhase::Error); + assert_eq!(snapshot.failure.unwrap().code, "timeout"); + assert!(operations.begin(OperationKind::Update).is_ok()); + let _ = fs::remove_dir_all(dir); + } +} diff --git a/src/app/App.tsx b/src/app/App.tsx index c538f4f..52ec737 100644 --- a/src/app/App.tsx +++ b/src/app/App.tsx @@ -10,6 +10,12 @@ import { Settings } from "./views/Settings"; import { About } from "./views/About"; import { Uninstall } from "./views/Uninstall"; import { CodexConfig } from "./views/CodexConfig"; +import { + ManagerUpdateBanner, + ManagerUpdateProvider, + ManagerUpdateSheet, + useManagerUpdate, +} from "./managerUpdate"; type View = "home" | "settings" | "about" | "uninstall" | "config"; @@ -30,6 +36,7 @@ function focusPageTarget(root: ParentNode | null) { function Shell() { const [view, setView] = useState("home"); + const managerUpdate = useManagerUpdate(); // Skip the first paint: NavBar / Home already own initial focus; stealing it // on mount is noisier than helpful for keyboard users. const skipInitialFocus = useRef(true); @@ -61,34 +68,40 @@ function Shell() { return ( <> -
- setView("settings")} /> -
- {view === "settings" ? ( -
- withViewTransition(() => setView("home"))} - onOpenAbout={() => setView("about")} - onOpenUninstall={() => setView("uninstall")} - onOpenConfig={() => setView("config")} +
+
+ setView("settings")} + managerUpdateSlot={} />
- ) : null} - {view === "about" ? ( -
- setView("settings")} /> -
- ) : null} - {view === "uninstall" ? ( -
- setView("settings")} /> -
- ) : null} - {view === "config" ? ( -
- setView("settings")} /> -
- ) : null} + {view === "settings" ? ( +
+ withViewTransition(() => setView("home"))} + onOpenAbout={() => setView("about")} + onOpenUninstall={() => setView("uninstall")} + onOpenConfig={() => setView("config")} + /> +
+ ) : null} + {view === "about" ? ( +
+ setView("settings")} /> +
+ ) : null} + {view === "uninstall" ? ( +
+ setView("settings")} /> +
+ ) : null} + {view === "config" ? ( +
+ setView("settings")} /> +
+ ) : null} +
+ setView("settings")} /> ); } @@ -101,7 +114,13 @@ export function App() { - + + {/* Keep updater state alive when an unrelated view render fails; + the outer boundary still catches provider-level failures. */} + + + + diff --git a/src/app/i18n.tsx b/src/app/i18n.tsx index 96355f4..63ae10d 100644 --- a/src/app/i18n.tsx +++ b/src/app/i18n.tsx @@ -244,6 +244,16 @@ const ZH = { "about.mgrUpToDate": "管理器已是最新版。", "about.mgrFound": "发现管理器新版本 {version}", "about.mgrConfirmBody": "将下载并安装管理器更新,完成后自动重启管理器。", + "managerUpdate.later": "稍后提醒", + "managerUpdate.viewNotes": "查看说明", + "managerUpdate.downloading": "正在下载…", + "managerUpdate.notes": "版本说明", + "managerUpdate.noNotes": "此版本没有附加说明。", + "managerUpdate.networkHint": "已自动尝试镜像与 GitHub。你可以重试，或到网络设置检查代理。", + "managerUpdate.restart": "立即重启", + "managerUpdate.restartRequired": "版本 {version} 已安装，需要重启管理器才能完成升级。", + "managerUpdate.relaunchFailed": "更新已安装，但管理器未能自动重启。请立即重试或稍后手动重启。", + "managerUpdate.completed": "管理器已升级到 {version}。", "about.feedback": "反馈与支持", "about.openLogsDir": "打开日志目录", "about.copyDiagnostics": "复制诊断信息", @@ -522,6 +532,16 @@ const EN: Record = { "about.mgrUpToDate": "The manager is up to date.", "about.mgrFound": "Manager version {version} is available", "about.mgrConfirmBody": "The manager update will download, install, and restart the manager.", + "managerUpdate.later": "Remind me later", + "managerUpdate.viewNotes": "View notes", + "managerUpdate.downloading": "Downloading…", + "managerUpdate.notes": "Release notes", + "managerUpdate.noNotes": "No additional notes were provided for this release.", + "managerUpdate.networkHint": "The mirror and GitHub were tried automatically. Retry, or check the proxy in Network settings.", + "managerUpdate.restart": "Restart now", + "managerUpdate.restartRequired": "Version {version} is installed. Restart the manager to finish updating.", + "managerUpdate.relaunchFailed": "The update was installed, but the manager could not restart. Retry now or restart it manually later.", + "managerUpdate.completed": "The manager was updated to {version}.", "about.feedback": "Feedback & support", "about.openLogsDir": "Open logs folder", "about.copyDiagnostics": "Copy diagnostics", @@ -797,6 +817,16 @@ const FR: Record = { "about.mgrUpToDate": "Le gestionnaire est à jour.", "about.mgrFound": "La version {version} du gestionnaire est disponible", "about.mgrConfirmBody": "La mise à jour du gestionnaire sera téléchargée, installée, puis le gestionnaire redémarrera.", + "managerUpdate.later": "Me le rappeler plus tard", + "managerUpdate.viewNotes": "Voir les notes", + "managerUpdate.downloading": "Téléchargement…", + "managerUpdate.notes": "Notes de version", + "managerUpdate.noNotes": "Aucune note supplémentaire pour cette version.", + "managerUpdate.networkHint": "Le miroir et GitHub ont été essayés automatiquement. Réessayez ou vérifiez le proxy dans les réglages réseau.", + "managerUpdate.restart": "Redémarrer maintenant", + "managerUpdate.restartRequired": "La version {version} est installée. Redémarrez le gestionnaire pour terminer la mise à jour.", + "managerUpdate.relaunchFailed": "La mise à jour est installée, mais le gestionnaire n’a pas pu redémarrer. Réessayez ou redémarrez-le manuellement plus tard.", + "managerUpdate.completed": "Le gestionnaire a été mis à jour vers la version {version}.", "about.feedback": "Retours et support", "about.openLogsDir": "Ouvrir le dossier des journaux", "about.copyDiagnostics": "Copier le diagnostic", @@ -1077,6 +1107,16 @@ const ZH_TW: Record = { "about.mgrUpToDate": "管理員已是最新版。", "about.mgrFound": "發現管理員新版本 {version}", "about.mgrConfirmBody": "將下載並安裝管理員更新，完成後自動重新啟動管理員。", + "managerUpdate.later": "稍後提醒", + "managerUpdate.viewNotes": "查看說明", + "managerUpdate.downloading": "正在下載…", + "managerUpdate.notes": "版本說明", + "managerUpdate.noNotes": "此版本沒有附加說明。", + "managerUpdate.networkHint": "已自動嘗試鏡像與 GitHub。你可以重試，或到網路設定檢查代理。", + "managerUpdate.restart": "立即重新啟動", + "managerUpdate.restartRequired": "版本 {version} 已安裝，需要重新啟動管理員才能完成更新。", + "managerUpdate.relaunchFailed": "更新已安裝，但管理員未能自動重新啟動。請立即重試或稍後手動重新啟動。", + "managerUpdate.completed": "管理員已升級至 {version}。", "about.feedback": "意見回饋與支援", "about.openLogsDir": "打開日誌目錄", "about.copyDiagnostics": "複製診斷資訊", @@ -1363,6 +1403,16 @@ const DE: Record = { "about.mgrUpToDate": "Der Manager ist aktuell.", "about.mgrFound": "Manager-Version {version} ist verfügbar", "about.mgrConfirmBody": "Das Manager-Update wird heruntergeladen und installiert; danach startet der Manager neu.", + "managerUpdate.later": "Später erinnern", + "managerUpdate.viewNotes": "Hinweise anzeigen", + "managerUpdate.downloading": "Wird heruntergeladen…", + "managerUpdate.notes": "Versionshinweise", + "managerUpdate.noNotes": "Für diese Version wurden keine zusätzlichen Hinweise bereitgestellt.", + "managerUpdate.networkHint": "Spiegelserver und GitHub wurden automatisch versucht. Versuchen Sie es erneut oder prüfen Sie den Proxy in den Netzwerkeinstellungen.", + "managerUpdate.restart": "Jetzt neu starten", + "managerUpdate.restartRequired": "Version {version} ist installiert. Starten Sie den Manager neu, um das Update abzuschließen.", + "managerUpdate.relaunchFailed": "Das Update wurde installiert, aber der Manager konnte nicht neu starten. Versuchen Sie es erneut oder starten Sie ihn später manuell.", + "managerUpdate.completed": "Der Manager wurde auf {version} aktualisiert.", "about.feedback": "Feedback & Support", "about.openLogsDir": "Log-Ordner öffnen", "about.copyDiagnostics": "Diagnose kopieren", @@ -1649,6 +1699,16 @@ const KO: Record = { "about.mgrUpToDate": "관리자가 최신 상태입니다.", "about.mgrFound": "관리자 버전 {version} 사용 가능", "about.mgrConfirmBody": "관리자 업데이트를 다운로드하고 설치한 뒤 관리자를 다시 시작합니다.", + "managerUpdate.later": "나중에 알림", + "managerUpdate.viewNotes": "설명 보기", + "managerUpdate.downloading": "다운로드 중…", + "managerUpdate.notes": "릴리스 노트", + "managerUpdate.noNotes": "이 릴리스에는 추가 설명이 없습니다.", + "managerUpdate.networkHint": "미러와 GitHub를 자동으로 시도했습니다. 다시 시도하거나 네트워크 설정에서 프록시를 확인하세요.", + "managerUpdate.restart": "지금 다시 시작", + "managerUpdate.restartRequired": "버전 {version}이(가) 설치되었습니다. 업데이트를 완료하려면 관리자를 다시 시작하세요.", + "managerUpdate.relaunchFailed": "업데이트가 설치되었지만 관리자를 다시 시작하지 못했습니다. 지금 다시 시도하거나 나중에 수동으로 다시 시작하세요.", + "managerUpdate.completed": "관리자가 {version}(으)로 업데이트되었습니다.", "about.feedback": "피드백 및 지원", "about.openLogsDir": "로그 폴더 열기", "about.copyDiagnostics": "진단 정보 복사", @@ -1923,6 +1983,16 @@ const JA: Record = { "about.mgrUpToDate": "マネージャーは最新です。", "about.mgrFound": "マネージャーのバージョン {version} が利用できます", "about.mgrConfirmBody": "マネージャーの更新をダウンロードしてインストールし、完了後にマネージャーを再起動します。", + "managerUpdate.later": "後で通知", + "managerUpdate.viewNotes": "説明を見る", + "managerUpdate.downloading": "ダウンロード中…", + "managerUpdate.notes": "リリースノート", + "managerUpdate.noNotes": "このリリースには追加の説明がありません。", + "managerUpdate.networkHint": "ミラーと GitHub を自動的に試しました。再試行するか、ネットワーク設定でプロキシを確認してください。", + "managerUpdate.restart": "今すぐ再起動", + "managerUpdate.restartRequired": "バージョン {version} をインストールしました。更新を完了するにはマネージャーを再起動してください。", + "managerUpdate.relaunchFailed": "更新はインストールされましたが、マネージャーを再起動できませんでした。再試行するか、後で手動で再起動してください。", + "managerUpdate.completed": "マネージャーを {version} に更新しました。", "about.feedback": "フィードバックとサポート", "about.openLogsDir": "ログフォルダーを開く", "about.copyDiagnostics": "診断情報をコピー", @@ -2189,6 +2259,16 @@ const RU: Record = { "about.mgrUpToDate": "Менеджер уже обновлен.", "about.mgrFound": "Доступна версия менеджера {version}", "about.mgrConfirmBody": "Обновление менеджера будет загружено и установлено, затем менеджер перезапустится.", + "managerUpdate.later": "Напомнить позже", + "managerUpdate.viewNotes": "Показать описание", + "managerUpdate.downloading": "Загрузка…", + "managerUpdate.notes": "Примечания к выпуску", + "managerUpdate.noNotes": "Для этого выпуска нет дополнительных примечаний.", + "managerUpdate.networkHint": "Зеркало и GitHub были проверены автоматически. Повторите попытку или проверьте прокси в настройках сети.", + "managerUpdate.restart": "Перезапустить сейчас", + "managerUpdate.restartRequired": "Версия {version} установлена. Перезапустите менеджер, чтобы завершить обновление.", + "managerUpdate.relaunchFailed": "Обновление установлено, но менеджер не удалось перезапустить. Повторите попытку или перезапустите его вручную позже.", + "managerUpdate.completed": "Менеджер обновлён до версии {version}.", "about.feedback": "Отзывы и поддержка", "about.openLogsDir": "Открыть папку журналов", "about.copyDiagnostics": "Скопировать диагностику", @@ -2455,6 +2535,16 @@ const AR: Record = { "about.mgrUpToDate": "المدير مُحدَّث.", "about.mgrFound": "يتوفر إصدار المدير {version}", "about.mgrConfirmBody": "سيتم تنزيل تحديث المدير وتثبيته، ثم سيُعاد تشغيل المدير.", + "managerUpdate.later": "ذكّرني لاحقاً", + "managerUpdate.viewNotes": "عرض الملاحظات", + "managerUpdate.downloading": "جارٍ التنزيل…", + "managerUpdate.notes": "ملاحظات الإصدار", + "managerUpdate.noNotes": "لا توجد ملاحظات إضافية لهذا الإصدار.", + "managerUpdate.networkHint": "تمت محاولة المرآة وGitHub تلقائياً. أعد المحاولة أو تحقق من الوكيل في إعدادات الشبكة.", + "managerUpdate.restart": "إعادة التشغيل الآن", + "managerUpdate.restartRequired": "تم تثبيت الإصدار {version}. أعد تشغيل المدير لإكمال التحديث.", + "managerUpdate.relaunchFailed": "تم تثبيت التحديث، لكن تعذرت إعادة تشغيل المدير. حاول الآن أو أعد تشغيله يدوياً لاحقاً.", + "managerUpdate.completed": "تم تحديث المدير إلى الإصدار {version}.", "about.feedback": "ملاحظات ودعم", "about.openLogsDir": "فتح مجلد السجلات", "about.copyDiagnostics": "نسخ التشخيص", @@ -2721,6 +2811,16 @@ const ES: Record = { "about.mgrUpToDate": "El gestor está actualizado.", "about.mgrFound": "La versión {version} del gestor está disponible", "about.mgrConfirmBody": "La actualización del gestor se descargará, se instalará y reiniciará el gestor.", + "managerUpdate.later": "Recordármelo más tarde", + "managerUpdate.viewNotes": "Ver notas", + "managerUpdate.downloading": "Descargando…", + "managerUpdate.notes": "Notas de la versión", + "managerUpdate.noNotes": "No hay notas adicionales para esta versión.", + "managerUpdate.networkHint": "El espejo y GitHub se probaron automáticamente. Reinténtalo o revisa el proxy en la configuración de red.", + "managerUpdate.restart": "Reiniciar ahora", + "managerUpdate.restartRequired": "La versión {version} está instalada. Reinicia el gestor para completar la actualización.", + "managerUpdate.relaunchFailed": "La actualización se instaló, pero el gestor no pudo reiniciarse. Reinténtalo o reinícialo manualmente más tarde.", + "managerUpdate.completed": "El gestor se actualizó a la versión {version}.", "about.feedback": "Comentarios y soporte", "about.openLogsDir": "Abrir carpeta de registros", "about.copyDiagnostics": "Copiar diagnóstico", @@ -2987,6 +3087,16 @@ const PT_BR: Record = { "about.mgrUpToDate": "O gerenciador está atualizado.", "about.mgrFound": "A versão {version} do gerenciador está disponível", "about.mgrConfirmBody": "A atualização do gerenciador será baixada e instalada; depois o gerenciador reiniciará.", + "managerUpdate.later": "Lembrar mais tarde", + "managerUpdate.viewNotes": "Ver notas", + "managerUpdate.downloading": "Baixando…", + "managerUpdate.notes": "Notas da versão", + "managerUpdate.noNotes": "Não há notas adicionais para esta versão.", + "managerUpdate.networkHint": "O espelho e o GitHub foram tentados automaticamente. Tente novamente ou verifique o proxy nas configurações de rede.", + "managerUpdate.restart": "Reiniciar agora", + "managerUpdate.restartRequired": "A versão {version} foi instalada. Reinicie o gerenciador para concluir a atualização.", + "managerUpdate.relaunchFailed": "A atualização foi instalada, mas o gerenciador não pôde reiniciar. Tente novamente ou reinicie-o manualmente mais tarde.", + "managerUpdate.completed": "O gerenciador foi atualizado para {version}.", "about.feedback": "Feedback e suporte", "about.openLogsDir": "Abrir pasta de logs", "about.copyDiagnostics": "Copiar diagnóstico", diff --git a/src/app/managerUpdate.test.tsx b/src/app/managerUpdate.test.tsx new file mode 100644 index 0000000..2c02324 --- /dev/null +++ b/src/app/managerUpdate.test.tsx @@ -0,0 +1,731 @@ +import { act, render, screen, waitFor } from "@testing-library/react"; +import userEvent from "@testing-library/user-event"; +import { beforeEach, describe, expect, it, vi } from "vitest"; + +import { listen } from "@tauri-apps/api/event"; + +import { managerApi, type ManagerUpdateAvailable } from "../services/managerApi"; +import type { ManagerUpdateRuntimeSnapshot } from "../shared/types"; +import { I18nProvider } from "./i18n"; +import { ThemeProvider } from "./theme"; +import { About } from "./views/About"; +import { + MANAGER_UPDATE_COMPLETION_KEY, + MANAGER_UPDATE_HANDOFF_GRACE_MS, + MANAGER_UPDATE_STATE_EVENT, + MANAGER_UPDATE_SNOOZE_KEY, + ManagerUpdateBanner, + ManagerUpdateProvider, + ManagerUpdateSheet, + useManagerUpdate, +} from "./managerUpdate"; + +vi.mock("../services/managerApi", async (importOriginal) => { + const actual = await importOriginal(); + return { + ...actual, + managerApi: { + ...actual.managerApi, + checkManagerUpdate: vi.fn(), + acknowledgeManagerUpdateRuntime: vi.fn(), + getManagerUpdateRuntime: vi.fn(), + installManagerUpdate: vi.fn(), + relaunchManager: vi.fn(), + }, + }; +}); + +const api = vi.mocked(managerApi); +const listenMock = vi.mocked(listen); +const AVAILABLE: ManagerUpdateAvailable = { + kind: "available", + version: "2.0.0", + currentVersion: "1.0.0", + body: "# 2.0.0\n\nReliable delivery notes.", +}; + +function runtimeSnapshot( + overrides: Partial = {}, +): ManagerUpdateRuntimeSnapshot { + return { + revision: 1, + version: AVAILABLE.version, + currentVersion: AVAILABLE.currentVersion, + body: AVAILABLE.body, + phase: "downloading", + downloaded: 0, + total: null, + failure: null, + ...overrides, + }; +} + +function Probe() { + const state = useManagerUpdate(); + return ( + + ); +} + +function renderManager({ + currentVersion = "1.0.0", + startupDelayMs = 0, + periodicIntervalMs = 60_000, + includeAbout = false, +}: { + currentVersion?: string; + startupDelayMs?: number; + periodicIntervalMs?: number; + includeAbout?: boolean; +} = {}) { + return render( + + + + + + {includeAbout ? : null} + + + + , + ); +} + +describe("manager self-update state machine", () => { + let onRuntime: ((event: { payload: ManagerUpdateRuntimeSnapshot }) => void) | undefined; + + beforeEach(() => { + localStorage.setItem("cam.lang", "zh-CN"); + api.checkManagerUpdate.mockReset(); + api.acknowledgeManagerUpdateRuntime.mockReset(); + api.getManagerUpdateRuntime.mockReset(); + api.installManagerUpdate.mockReset(); + api.relaunchManager.mockReset(); + api.checkManagerUpdate.mockResolvedValue({ kind: "none" }); + api.acknowledgeManagerUpdateRuntime.mockResolvedValue(true); + api.getManagerUpdateRuntime.mockResolvedValue(null); + api.installManagerUpdate.mockResolvedValue(undefined); + api.relaunchManager.mockResolvedValue(undefined); + onRuntime = undefined; + listenMock.mockImplementation((event, handler) => { + if (event === MANAGER_UPDATE_STATE_EVENT) { + onRuntime = handler as typeof onRuntime; + } + return Promise.resolve(() => {}); + }); + }); + + it("checks on startup, presents notes on Home, and never installs without confirmation", async () => { + const user = userEvent.setup(); + api.checkManagerUpdate.mockResolvedValue(AVAILABLE); + renderManager(); + + expect(await screen.findByText("发现管理器新版本 2.0.0")).toBeInTheDocument(); + expect(api.installManagerUpdate).not.toHaveBeenCalled(); + + await user.click(screen.getByRole("button", { name: "查看说明" })); + expect(await screen.findByRole("dialog")).toHaveTextContent("Reliable delivery notes."); + expect(screen.getByLabelText("1.0.0 → 2.0.0")).toBeInTheDocument(); + + await user.click(screen.getAllByRole("button", { name: "稍后提醒" })[1]); + expect(screen.queryByText("发现管理器新版本 2.0.0")).not.toBeInTheDocument(); + expect(JSON.parse(localStorage.getItem(MANAGER_UPDATE_SNOOZE_KEY) ?? "null")).toEqual( + expect.objectContaining({ version: "2.0.0" }), + ); + }); + + it("rechecks at the bounded periodic cadence without overlapping startup work", async () => { + vi.useFakeTimers(); + try { + let resolveStartup: (() => void) | undefined; + api.checkManagerUpdate + .mockImplementationOnce( + () => + new Promise((resolve) => { + resolveStartup = () => resolve({ kind: "none" }); + }), + ) + .mockResolvedValue({ kind: "none" }); + renderManager({ periodicIntervalMs: 60_000 }); + + await act(async () => { + await Promise.resolve(); + await Promise.resolve(); + await Promise.resolve(); + }); + + await act(async () => { + vi.advanceTimersByTime(1); + await Promise.resolve(); + }); + expect(api.checkManagerUpdate).toHaveBeenCalledTimes(1); + + await act(async () => { + vi.advanceTimersByTime(60_000); + await Promise.resolve(); + }); + expect(api.checkManagerUpdate).toHaveBeenCalledTimes(1); + + await act(async () => { + resolveStartup?.(); + await Promise.resolve(); + }); + await act(async () => { + vi.advanceTimersByTime(60_000); + await Promise.resolve(); + }); + expect(api.checkManagerUpdate).toHaveBeenCalledTimes(2); + } finally { + vi.useRealTimers(); + } + }); + + it("keeps startup network failures silent until the user opens a recovery surface", async () => { + api.checkManagerUpdate.mockRejectedValue({ code: "network", message: "offline" }); + renderManager(); + + await waitFor(() => + expect(screen.getByTestId("manager-failure")).toHaveTextContent("network"), + ); + expect(screen.getByTestId("manager-status")).toHaveTextContent("idle"); + expect(screen.queryByRole("dialog")).not.toBeInTheDocument(); + expect(screen.queryByRole("alert")).not.toBeInTheDocument(); + }); + + it("keeps retry checks busy and offers Close after no update is found", async () => { + const user = userEvent.setup(); + let resolveRetry: ((value: { kind: "none" }) => void) | undefined; + api.checkManagerUpdate + .mockRejectedValueOnce({ code: "network", message: "offline" }) + .mockImplementationOnce( + () => + new Promise((resolve) => { + resolveRetry = resolve; + }), + ); + renderManager({ startupDelayMs: 60_000, includeAbout: true }); + + await user.click(screen.getByRole("button", { name: /^检查管理器更新/ })); + expect(await screen.findByRole("alert")).toHaveTextContent("无法连接更新服务器"); + + await user.click(screen.getByRole("button", { name: "重试" })); + expect(screen.getByTestId("manager-status")).toHaveTextContent("checking"); + expect(screen.getByRole("dialog")).toHaveTextContent("检查中…"); + expect(screen.getByRole("button", { name: "检查中…" })).toBeDisabled(); + expect(screen.getByRole("button", { name: "返回" })).toBeEnabled(); + expect(screen.queryByRole("button", { name: "稍后提醒" })).not.toBeInTheDocument(); + expect(screen.queryByRole("button", { name: "更新" })).not.toBeInTheDocument(); + + await act(async () => { + resolveRetry?.({ kind: "none" }); + await Promise.resolve(); + }); + expect(screen.getByTestId("manager-status")).toHaveTextContent("up-to-date"); + expect(screen.getByRole("dialog")).toHaveTextContent("管理器已是最新版。"); + await user.click(screen.getAllByRole("button", { name: "关闭" }).at(-1)!); + await waitFor(() => expect(screen.queryByRole("dialog")).not.toBeInTheDocument()); + }); + + it("renders real byte progress and preserves a retry path for offline failures", async () => { + const user = userEvent.setup(); + let rejectInstall: ((cause: unknown) => void) | undefined; + api.checkManagerUpdate.mockResolvedValue(AVAILABLE); + api.installManagerUpdate.mockImplementation( + () => new Promise((_resolve, reject) => (rejectInstall = reject)), + ); + const view = renderManager(); + + await user.click(await screen.findByRole("button", { name: "查看说明" })); + await user.click(screen.getByRole("button", { name: "更新" })); + await waitFor(() => expect(onRuntime).toBeDefined()); + act(() => { + onRuntime?.({ + payload: { + revision: 2, + version: "2.0.0", + currentVersion: "1.0.0", + body: AVAILABLE.body, + phase: "downloading", + downloaded: 5 * 1024 * 1024, + total: 10 * 1024 * 1024, + failure: null, + }, + }); + }); + expect(screen.getByText("5.0 / 10.0 MiB")).toBeInTheDocument(); + expect(view.container.querySelector(".manager-update-progress .bar-fill")).toHaveStyle({ + width: "50%", + }); + + act(() => rejectInstall?.({ code: "network", message: "offline" })); + expect(await screen.findByTestId("manager-failure")).toHaveTextContent("network"); + expect(screen.getByRole("alert")).toHaveTextContent("无法连接更新服务器"); + expect(screen.getByRole("button", { name: "网络" })).toBeEnabled(); + expect(screen.getByRole("button", { name: "重试" })).toBeEnabled(); + expect(screen.getByText(/镜像与 GitHub/)).toBeInTheDocument(); + }); + + it("blocks manager installation while a Codex operation owns the backend lock", async () => { + const user = userEvent.setup(); + api.checkManagerUpdate.mockResolvedValue(AVAILABLE); + api.installManagerUpdate.mockRejectedValue({ + code: "operation_busy", + message: "Codex update is still committing", + }); + renderManager(); + + await user.click(await screen.findByRole("button", { name: "查看说明" })); + await user.click(screen.getByRole("button", { name: "更新" })); + + expect(await screen.findByTestId("manager-failure")).toHaveTextContent("operation_busy"); + expect(screen.getByRole("alert")).toHaveTextContent("已有操作正在进行"); + expect(screen.queryByRole("button", { name: "网络" })).not.toBeInTheDocument(); + expect(screen.getByRole("button", { name: "重试" })).toBeEnabled(); + }); + + it("keeps an installed marker and offers relaunch retry when automatic restart fails", async () => { + const user = userEvent.setup(); + api.checkManagerUpdate.mockResolvedValue(AVAILABLE); + api.relaunchManager + .mockRejectedValueOnce(new Error("process plugin unavailable")) + .mockRejectedValueOnce(new Error("process plugin still unavailable")) + .mockResolvedValueOnce(undefined); + renderManager({ includeAbout: true }); + + await user.click(await screen.findByRole("button", { name: "查看说明" })); + await user.click(screen.getByRole("button", { name: "更新" })); + + expect(await screen.findByRole("alert")).toHaveTextContent("更新已安装，但管理器未能自动重启"); + expect(JSON.parse(localStorage.getItem(MANAGER_UPDATE_COMPLETION_KEY) ?? "null")).toEqual( + expect.objectContaining({ from: "1.0.0", to: "2.0.0", stage: "installed" }), + ); + expect( + screen.getAllByText("版本 2.0.0 已安装，需要重启管理器才能完成升级。"), + ).toHaveLength(2); + + await user.click(screen.getByRole("button", { name: "取消" })); + await waitFor(() => expect(screen.queryByRole("dialog")).not.toBeInTheDocument()); + expect(screen.queryByRole("button", { name: "更新" })).not.toBeInTheDocument(); + expect(screen.getByRole("button", { name: "立即重启" })).toBeEnabled(); + + // A retry launched from the compact Home banner must reopen the error + // surface if relaunch still fails instead of looking like a dead button. + await user.click(screen.getByRole("button", { name: "立即重启" })); + expect(api.relaunchManager).toHaveBeenCalledTimes(2); + expect(await screen.findByRole("dialog")).toHaveTextContent( + "更新已安装，但管理器未能自动重启", + ); + await user.click(screen.getByRole("button", { name: "取消" })); + await waitFor(() => expect(screen.queryByRole("dialog")).not.toBeInTheDocument()); + + // About shares the same state: its check entry only reopens the restart + // surface and cannot check the feed or install the same package again. + await user.click(screen.getByRole("button", { name: /^检查管理器更新/ })); + expect(await screen.findByRole("dialog")).toHaveTextContent("需要重启管理器"); + expect(api.checkManagerUpdate).toHaveBeenCalledTimes(1); + expect(api.installManagerUpdate).toHaveBeenCalledTimes(1); + + await user.click(screen.getAllByRole("button", { name: "立即重启" }).at(-1)!); + expect(api.relaunchManager).toHaveBeenCalledTimes(3); + expect(screen.getByTestId("manager-status")).toHaveTextContent("relaunching"); + }); + + it("writes a download marker before invoking the platform updater", async () => { + const user = userEvent.setup(); + api.checkManagerUpdate.mockResolvedValue(AVAILABLE); + api.installManagerUpdate.mockImplementation(() => new Promise(() => {})); + const view = renderManager(); + + await user.click(await screen.findByRole("button", { name: "查看说明" })); + await user.click(screen.getByRole("button", { name: "更新" })); + + expect(JSON.parse(localStorage.getItem(MANAGER_UPDATE_COMPLETION_KEY) ?? "null")).toEqual( + expect.objectContaining({ from: "1.0.0", to: "2.0.0", stage: "downloading" }), + ); + view.unmount(); + localStorage.removeItem(MANAGER_UPDATE_COMPLETION_KEY); + }); + + it("reattaches to an in-flight manager update after a renderer reload", async () => { + localStorage.setItem( + MANAGER_UPDATE_COMPLETION_KEY, + JSON.stringify({ + from: "1.0.0", + to: "2.0.0", + installedAt: Date.now(), + stage: "downloading", + }), + ); + api.getManagerUpdateRuntime.mockResolvedValue( + runtimeSnapshot({ downloaded: 5 * 1024 * 1024, total: 10 * 1024 * 1024 }), + ); + const view = renderManager(); + + expect(await screen.findByTestId("manager-status")).toHaveTextContent("downloading"); + expect(screen.getByText("5.0 / 10.0 MiB")).toBeInTheDocument(); + expect(view.container.querySelector(".manager-update-progress .bar-fill")).toHaveStyle({ + width: "50%", + }); + expect(JSON.parse(localStorage.getItem(MANAGER_UPDATE_COMPLETION_KEY) ?? "null")).toEqual( + expect.objectContaining({ from: "1.0.0", to: "2.0.0", stage: "downloading" }), + ); + expect(api.checkManagerUpdate).not.toHaveBeenCalled(); + }); + + it("discards an interrupted pre-handoff download without fencing a new process", async () => { + localStorage.setItem( + MANAGER_UPDATE_COMPLETION_KEY, + JSON.stringify({ + from: "1.0.0", + to: "2.0.0", + installedAt: Date.now(), + stage: "downloading", + }), + ); + renderManager({ currentVersion: "1.0.0" }); + + expect(localStorage.getItem(MANAGER_UPDATE_COMPLETION_KEY)).toBeNull(); + expect(screen.getByTestId("manager-status")).not.toHaveTextContent("installing"); + await waitFor(() => expect(api.checkManagerUpdate).toHaveBeenCalledTimes(1)); + expect(api.installManagerUpdate).not.toHaveBeenCalled(); + }); + + it("restores a durable Windows handoff when the renderer never promoted its marker", async () => { + localStorage.setItem( + MANAGER_UPDATE_COMPLETION_KEY, + JSON.stringify({ + from: "1.0.0", + to: "2.0.0", + installedAt: Date.now(), + stage: "downloading", + }), + ); + api.getManagerUpdateRuntime.mockResolvedValue( + runtimeSnapshot({ + revision: 1, + phase: "installing", + handoffStartedAt: Date.now(), + }), + ); + renderManager({ currentVersion: "1.0.0" }); + + expect(await screen.findByTestId("manager-status")).toHaveTextContent("installing"); + expect(JSON.parse(localStorage.getItem(MANAGER_UPDATE_COMPLETION_KEY) ?? "null")).toEqual( + expect.objectContaining({ from: "1.0.0", to: "2.0.0", stage: "installing" }), + ); + expect(api.checkManagerUpdate).not.toHaveBeenCalled(); + expect(screen.getByRole("button", { name: "正在安装…" })).toBeDisabled(); + }); + + it("does not let an older hydration snapshot overwrite a newer runtime event", async () => { + let resolveRuntime: ((snapshot: ManagerUpdateRuntimeSnapshot | null) => void) | undefined; + api.getManagerUpdateRuntime.mockImplementation( + () => + new Promise((resolve) => { + resolveRuntime = resolve; + }), + ); + renderManager(); + await waitFor(() => expect(onRuntime).toBeDefined()); + + act(() => { + onRuntime?.({ payload: runtimeSnapshot({ revision: 2, phase: "installing" }) }); + }); + expect(screen.getByTestId("manager-status")).toHaveTextContent("installing"); + expect(JSON.parse(localStorage.getItem(MANAGER_UPDATE_COMPLETION_KEY) ?? "null")).toEqual( + expect.objectContaining({ from: "1.0.0", to: "2.0.0", stage: "installing" }), + ); + + await act(async () => { + resolveRuntime?.(runtimeSnapshot({ revision: 1, phase: "downloading" })); + await Promise.resolve(); + }); + expect(screen.getByTestId("manager-status")).toHaveTextContent("installing"); + expect(api.checkManagerUpdate).not.toHaveBeenCalled(); + }); + + it("does not let an in-flight startup check overwrite a recovered runtime", async () => { + let resolveCheck: ((value: typeof AVAILABLE) => void) | undefined; + api.checkManagerUpdate.mockImplementation( + () => + new Promise((resolve) => { + resolveCheck = resolve; + }), + ); + renderManager(); + await waitFor(() => expect(api.checkManagerUpdate).toHaveBeenCalledTimes(1)); + await waitFor(() => expect(onRuntime).toBeDefined()); + + act(() => { + onRuntime?.({ payload: runtimeSnapshot({ revision: 3, phase: "installing" }) }); + }); + await act(async () => { + resolveCheck?.(AVAILABLE); + await Promise.resolve(); + }); + + expect(screen.getByTestId("manager-status")).toHaveTextContent("installing"); + expect(screen.getByRole("dialog")).toHaveTextContent("正在安装"); + }); + + it("polls an active runtime to terminal state when event subscription fails", async () => { + vi.useFakeTimers(); + try { + listenMock.mockRejectedValueOnce(new Error("event bus unavailable")); + api.getManagerUpdateRuntime + .mockResolvedValueOnce(runtimeSnapshot({ revision: 1, phase: "downloading" })) + .mockResolvedValueOnce(runtimeSnapshot({ revision: 2, phase: "installed" })); + api.relaunchManager.mockRejectedValueOnce(new Error("relaunch unavailable")); + renderManager(); + + await act(async () => { + await Promise.resolve(); + await Promise.resolve(); + await Promise.resolve(); + }); + expect(screen.getByTestId("manager-status")).toHaveTextContent("downloading"); + + await act(async () => { + vi.advanceTimersByTime(800); + await Promise.resolve(); + await Promise.resolve(); + }); + expect(api.getManagerUpdateRuntime).toHaveBeenCalledTimes(2); + expect(api.relaunchManager).toHaveBeenCalledTimes(1); + expect(screen.getByTestId("manager-status")).toHaveTextContent( + "installed-awaiting-relaunch", + ); + } finally { + vi.useRealTimers(); + } + }); + + it("retries a failed initial runtime query while a provisional handoff exists", async () => { + vi.useFakeTimers(); + try { + localStorage.setItem( + MANAGER_UPDATE_COMPLETION_KEY, + JSON.stringify({ + from: "1.0.0", + to: "2.0.0", + installedAt: Date.now(), + stage: "installing", + }), + ); + listenMock.mockRejectedValueOnce(new Error("event bus unavailable")); + api.getManagerUpdateRuntime + .mockRejectedValueOnce(new Error("invoke bridge reloading")) + .mockResolvedValueOnce(runtimeSnapshot({ revision: 1, phase: "downloading" })) + .mockResolvedValueOnce(runtimeSnapshot({ revision: 2, phase: "installed" })); + api.relaunchManager.mockRejectedValueOnce(new Error("relaunch unavailable")); + renderManager(); + + await act(async () => { + await Promise.resolve(); + await Promise.resolve(); + }); + expect(api.getManagerUpdateRuntime).toHaveBeenCalledTimes(1); + expect(localStorage.getItem(MANAGER_UPDATE_COMPLETION_KEY)).not.toBeNull(); + expect(api.checkManagerUpdate).not.toHaveBeenCalled(); + + await act(async () => { + vi.advanceTimersByTime(800); + await Promise.resolve(); + await Promise.resolve(); + }); + expect(screen.getByTestId("manager-status")).toHaveTextContent("downloading"); + expect(api.checkManagerUpdate).not.toHaveBeenCalled(); + + await act(async () => { + vi.advanceTimersByTime(800); + await Promise.resolve(); + await Promise.resolve(); + }); + expect(api.relaunchManager).toHaveBeenCalledTimes(1); + expect(screen.getByTestId("manager-status")).toHaveTextContent( + "installed-awaiting-relaunch", + ); + } finally { + vi.useRealTimers(); + } + }); + + it("recovers a macOS terminal install and retries relaunch after renderer loss", async () => { + localStorage.setItem( + MANAGER_UPDATE_COMPLETION_KEY, + JSON.stringify({ + from: "1.0.0", + to: "2.0.0", + installedAt: Date.now(), + stage: "installing", + }), + ); + api.getManagerUpdateRuntime.mockResolvedValue( + runtimeSnapshot({ revision: 4, phase: "installed", downloaded: 10, total: 10 }), + ); + api.relaunchManager.mockRejectedValueOnce(new Error("process plugin unavailable")); + renderManager(); + + await waitFor(() => expect(api.relaunchManager).toHaveBeenCalledTimes(1)); + expect(await screen.findByRole("alert")).toHaveTextContent( + "更新已安装，但管理器未能自动重启", + ); + expect(screen.getByTestId("manager-status")).toHaveTextContent( + "installed-awaiting-relaunch", + ); + expect(JSON.parse(localStorage.getItem(MANAGER_UPDATE_COMPLETION_KEY) ?? "null")).toEqual( + expect.objectContaining({ from: "1.0.0", to: "2.0.0", stage: "installed" }), + ); + }); + + it("restores a terminal update failure instead of silently starting over", async () => { + localStorage.setItem( + MANAGER_UPDATE_COMPLETION_KEY, + JSON.stringify({ + from: "1.0.0", + to: "2.0.0", + installedAt: Date.now(), + stage: "installing", + }), + ); + api.getManagerUpdateRuntime.mockResolvedValue( + runtimeSnapshot({ + revision: 3, + phase: "error", + failure: { code: "network", message: "mirror and GitHub failed" }, + }), + ); + renderManager(); + + expect(await screen.findByTestId("manager-failure")).toHaveTextContent("network"); + expect(screen.getByRole("alert")).toHaveTextContent("无法连接更新服务器"); + expect(localStorage.getItem(MANAGER_UPDATE_COMPLETION_KEY)).toBeNull(); + expect(api.checkManagerUpdate).not.toHaveBeenCalled(); + }); + + it("CAS-acknowledges a stale terminal before refreshing consent", async () => { + const user = userEvent.setup(); + const staleRuntime = runtimeSnapshot({ + revision: 5, + phase: "error", + failure: { code: "stale_expectation", message: "changed" }, + }); + api.checkManagerUpdate.mockResolvedValue(AVAILABLE); + api.getManagerUpdateRuntime + .mockResolvedValueOnce(null) + .mockResolvedValueOnce(staleRuntime); + api.installManagerUpdate.mockRejectedValueOnce({ + code: "stale_expectation", + message: "changed", + }); + renderManager(); + + await user.click(await screen.findByRole("button", { name: "查看说明" })); + await user.click(screen.getByRole("button", { name: "更新" })); + + await waitFor(() => + expect(api.acknowledgeManagerUpdateRuntime).toHaveBeenCalledWith(staleRuntime), + ); + expect(api.checkManagerUpdate).toHaveBeenCalledTimes(2); + expect(screen.getByTestId("manager-status")).toHaveTextContent("available"); + act(() => { + onRuntime?.({ payload: staleRuntime }); + }); + expect(screen.getByTestId("manager-status")).toHaveTextContent("available"); + }); + + it("uses the launched target version as proof of a Windows updater handoff", async () => { + const user = userEvent.setup(); + localStorage.setItem( + MANAGER_UPDATE_COMPLETION_KEY, + JSON.stringify({ + from: "1.0.0", + to: "2.0.0", + installedAt: Date.now(), + stage: "installing", + }), + ); + renderManager({ currentVersion: "2.0.0", startupDelayMs: 60_000 }); + + expect(screen.getByText("管理器已升级到 2.0.0。")).toBeInTheDocument(); + await waitFor(() => expect(localStorage.getItem(MANAGER_UPDATE_COMPLETION_KEY)).toBeNull()); + await user.click(screen.getByRole("button", { name: "关闭" })); + expect(screen.queryByText("管理器已升级到 2.0.0。")).not.toBeInTheDocument(); + }); + + it("keeps a fresh Windows handoff fenced before expiring it", async () => { + vi.useFakeTimers(); + try { + localStorage.setItem( + MANAGER_UPDATE_COMPLETION_KEY, + JSON.stringify({ + from: "1.0.0", + to: "2.0.0", + installedAt: Date.now(), + stage: "installing", + }), + ); + renderManager({ currentVersion: "1.0.0", startupDelayMs: 1 }); + + await act(async () => { + await Promise.resolve(); + await Promise.resolve(); + await Promise.resolve(); + }); + expect(screen.getByTestId("manager-status")).toHaveTextContent("installing"); + expect(localStorage.getItem(MANAGER_UPDATE_COMPLETION_KEY)).not.toBeNull(); + expect(api.checkManagerUpdate).not.toHaveBeenCalled(); + expect(screen.getByRole("button", { name: "正在安装…" })).toBeDisabled(); + + await act(async () => { + vi.advanceTimersByTime(MANAGER_UPDATE_HANDOFF_GRACE_MS); + await Promise.resolve(); + await Promise.resolve(); + await Promise.resolve(); + }); + expect(localStorage.getItem(MANAGER_UPDATE_COMPLETION_KEY)).toBeNull(); + expect(screen.getByTestId("manager-status")).toHaveTextContent("idle"); + + await act(async () => { + vi.advanceTimersByTime(1); + await Promise.resolve(); + await Promise.resolve(); + }); + expect(api.checkManagerUpdate).toHaveBeenCalledTimes(1); + expect(api.installManagerUpdate).not.toHaveBeenCalled(); + } finally { + vi.useRealTimers(); + } + }); + + it("restores installed-awaiting-relaunch when the old process is opened again", async () => { + localStorage.setItem( + MANAGER_UPDATE_COMPLETION_KEY, + JSON.stringify({ + from: "1.0.0", + to: "2.0.0", + installedAt: Date.now(), + stage: "installed", + }), + ); + renderManager({ currentVersion: "1.0.0" }); + + expect(screen.getByTestId("manager-status")).toHaveTextContent( + "installed-awaiting-relaunch", + ); + expect( + screen.getByText("版本 2.0.0 已安装，需要重启管理器才能完成升级。"), + ).toBeInTheDocument(); + expect(screen.getByRole("button", { name: "立即重启" })).toBeEnabled(); + await waitFor(() => expect(api.checkManagerUpdate).not.toHaveBeenCalled()); + expect(api.installManagerUpdate).not.toHaveBeenCalled(); + }); +}); diff --git a/src/app/managerUpdate.tsx b/src/app/managerUpdate.tsx new file mode 100644 index 0000000..e019fcd --- /dev/null +++ b/src/app/managerUpdate.tsx @@ -0,0 +1,985 @@ +import { + createContext, + useCallback, + useContext, + useEffect, + useId, + useMemo, + useRef, + useState, + type ReactNode, +} from "react"; +import { listen } from "@tauri-apps/api/event"; + +import { + errorCode, + managerApi, + type ManagerUpdateAvailable, +} from "../services/managerApi"; +import type { + ManagerUpdateProgress, + ManagerUpdateRuntimeSnapshot, +} from "../shared/types"; +import { FailureBanner, Ring, StatusBanner } from "./components"; +import { resolveFailure, type FailureSurface } from "./errorCopy"; +import { Icon } from "./icons"; +import { useI18n } from "./i18n"; +import { Sheet } from "./Sheet"; + +export const MANAGER_UPDATE_STATE_EVENT = "manager://update-state"; +export const MANAGER_UPDATE_STARTUP_DELAY_MS = 1_500; +export const MANAGER_UPDATE_PERIODIC_INTERVAL_MS = 6 * 60 * 60 * 1_000; +export const MANAGER_UPDATE_SNOOZE_MS = 24 * 60 * 60 * 1_000; +export const MANAGER_UPDATE_SNOOZE_KEY = "cam.manager-update-snooze"; +export const MANAGER_UPDATE_COMPLETION_KEY = "cam.manager-update-completion"; +export const MANAGER_UPDATE_HANDOFF_GRACE_MS = 10 * 60 * 1_000; + +const APP_VERSION = import.meta.env.VITE_APP_VERSION ?? "0.0.0"; + +type ManagerUpdateStatus = + | "idle" + | "checking" + | "available" + | "up-to-date" + | "development" + | "downloading" + | "installing" + | "relaunching" + | "installed-awaiting-relaunch" + | "error"; + +type CheckOptions = { + manual?: boolean; + openWhenAvailable?: boolean; +}; + +type Completion = { + from: string; + to: string; + installedAt: number; + /** + * `downloading` is written before invoking the updater and must never be + * treated as proof that Windows handed off to NSIS. `installing` is written + * only after the backend reports that no-return boundary. Seeing the target + * version on the next launch is the durable proof that the handoff completed. + * + * Markers without a stage come from older builds and are treated as + * `installed` for backwards compatibility. + */ + stage?: "downloading" | "installing" | "installed"; +}; + +type Snooze = { + version: string; + remindAt: number; +}; + +interface ManagerUpdateContextValue { + status: ManagerUpdateStatus; + update: ManagerUpdateAvailable | null; + progress: ManagerUpdateProgress | null; + failure: FailureSurface | null; + detailsOpen: boolean; + snoozed: boolean; + completion: Completion | null; + check: (options?: CheckOptions) => Promise; + openDetails: () => void; + closeDetails: () => void; + remindLater: () => void; + install: () => Promise; + retryRelaunch: () => Promise; + dismissCompletion: () => void; +} + +const ManagerUpdateContext = createContext(null); + +function readJson(key: string): T | null { + try { + const raw = localStorage.getItem(key); + return raw ? (JSON.parse(raw) as T) : null; + } catch { + return null; + } +} + +function writeJson(key: string, value: unknown) { + try { + localStorage.setItem(key, JSON.stringify(value)); + } catch { + // A disabled/full localStorage must not block a signed update or relaunch. + } +} + +function removeStored(key: string) { + try { + localStorage.removeItem(key); + } catch { + // Best effort only. + } +} + +function completionStateForVersion(currentVersion: string): { + completion: Completion | null; + awaitingUpdate: ManagerUpdateAvailable | null; + provisional: Completion | null; +} { + const completion = readJson(MANAGER_UPDATE_COMPLETION_KEY); + if (!completion) return { completion: null, awaitingUpdate: null, provisional: null }; + if (completion.to === currentVersion) { + // This process is already the requested target. That is stronger evidence + // than the old process receiving an install result (which never happens on + // Windows because the updater exits it after handing off to NSIS). + return { + completion: { ...completion, stage: "installed" }, + awaitingUpdate: null, + provisional: null, + }; + } + // The updater committed a replacement but the old process did not relaunch. + // Restoring this state prevents a reopened old build from installing again. + if (completion.from === currentVersion && completion.to !== currentVersion) { + if (completion.stage === "installing") { + // Do not synchronously discard this marker. A renderer reload keeps the + // backend command alive; runtime hydration decides whether this is an + // active handoff or a genuinely stale cold-start marker. + return { completion: null, awaitingUpdate: null, provisional: completion }; + } + if (completion.stage === "downloading") { + // A process can exit or crash before Update::install reaches its Windows + // installer handoff. The backend runtime is process-local, so a fresh + // process must not turn this pre-handoff marker into a grace-period lock. + removeStored(MANAGER_UPDATE_COMPLETION_KEY); + return { completion: null, awaitingUpdate: null, provisional: null }; + } + return { + completion: null, + awaitingUpdate: { + kind: "available", + version: completion.to, + currentVersion: completion.from, + }, + provisional: null, + }; + } + // Unrelated/malformed markers must never claim this build completed. + removeStored(MANAGER_UPDATE_COMPLETION_KEY); + return { completion: null, awaitingUpdate: null, provisional: null }; +} + +function snoozedFor(update: ManagerUpdateAvailable | null): boolean { + if (!update) return false; + const snooze = readJson(MANAGER_UPDATE_SNOOZE_KEY); + if (!snooze || snooze.version !== update.version) return false; + if (snooze.remindAt <= Date.now()) { + removeStored(MANAGER_UPDATE_SNOOZE_KEY); + return false; + } + return true; +} + +function contextualRelaunchFailure( + cause: unknown, + message: string, + t: ReturnType["t"], +): FailureSurface { + const failure = resolveFailure(cause, t); + return { + ...failure, + code: "manager_relaunch_failed", + message, + recoverable: true, + }; +} + +export function ManagerUpdateProvider({ + children, + currentVersion = APP_VERSION, + startupDelayMs = MANAGER_UPDATE_STARTUP_DELAY_MS, + periodicIntervalMs = MANAGER_UPDATE_PERIODIC_INTERVAL_MS, +}: { + children: ReactNode; + currentVersion?: string; + startupDelayMs?: number; + periodicIntervalMs?: number; +}) { + const { t } = useI18n(); + const [initialCompletion] = useState(() => completionStateForVersion(currentVersion)); + const [status, setStatus] = useState(() => + initialCompletion.awaitingUpdate + ? "installed-awaiting-relaunch" + : initialCompletion.provisional + ? "installing" + : "idle", + ); + const [update, setUpdate] = useState( + initialCompletion.awaitingUpdate ?? + (initialCompletion.provisional + ? { + kind: "available", + version: initialCompletion.provisional.to, + currentVersion: initialCompletion.provisional.from, + } + : null), + ); + const [progress, setProgress] = useState( + initialCompletion.provisional + ? { phase: "installing", downloaded: 0, total: null } + : null, + ); + const [failure, setFailure] = useState(null); + const [detailsOpen, setDetailsOpen] = useState(Boolean(initialCompletion.provisional)); + const [snoozed, setSnoozed] = useState(false); + const [completion, setCompletion] = useState( + initialCompletion.completion, + ); + const [runtimeHydrated, setRuntimeHydrated] = useState(false); + const checkInFlightRef = useRef | null>(null); + const installInFlightRef = useRef(Boolean(initialCompletion.provisional)); + const ownsInstallRef = useRef(false); + const lastRuntimeRevisionRef = useRef(0); + const lastRuntimeSnapshotRef = useRef(null); + const recoveredRuntimeRef = useRef(false); + const recoveredInstalledRuntimeRef = useRef(false); + const automaticRelaunchAttemptedRef = useRef(false); + // Once the updater has committed the new package, this process must never + // check or install again. Only a relaunch can load the newly installed build. + const installedAwaitingRelaunchRef = useRef(Boolean(initialCompletion.awaitingUpdate)); + const updateRef = useRef(update); + updateRef.current = update; + + useEffect(() => { + // The upgraded process owns the in-memory success banner. Consume the + // durable handoff marker now so a later app launch cannot repeat it. + if (initialCompletion.completion) { + removeStored(MANAGER_UPDATE_COMPLETION_KEY); + } + }, [initialCompletion.completion]); + + const check = useCallback( + (options: CheckOptions = {}) => { + if (installInFlightRef.current || installedAwaitingRelaunchRef.current) { + return Promise.resolve(); + } + if (checkInFlightRef.current) return checkInFlightRef.current; + + const task = (async () => { + const runtimeRevisionAtStart = lastRuntimeRevisionRef.current; + setStatus("checking"); + if (options.manual) setFailure(null); + try { + const result = await managerApi.checkManagerUpdate(); + if ( + lastRuntimeRevisionRef.current !== runtimeRevisionAtStart || + installInFlightRef.current || + installedAwaitingRelaunchRef.current + ) { + return; + } + setFailure(null); + if (result.kind === "available") { + setUpdate(result); + setSnoozed(snoozedFor(result)); + setStatus("available"); + if (options.openWhenAvailable) setDetailsOpen(true); + } else { + setUpdate(null); + setSnoozed(false); + setStatus(result.kind === "development" ? "development" : "up-to-date"); + } + } catch (cause) { + if ( + lastRuntimeRevisionRef.current !== runtimeRevisionAtStart || + installInFlightRef.current || + installedAwaitingRelaunchRef.current + ) { + return; + } + const next = resolveFailure(cause, t); + setStatus(options.manual ? "error" : updateRef.current ? "available" : "idle"); + setFailure(next); + if (options.manual) setDetailsOpen(true); + } + })().finally(() => { + checkInFlightRef.current = null; + }); + checkInFlightRef.current = task; + return task; + }, + [t], + ); + + const applyRuntimeSnapshot = useCallback( + (snapshot: ManagerUpdateRuntimeSnapshot) => { + if ( + snapshot.currentVersion !== currentVersion || + snapshot.revision <= lastRuntimeRevisionRef.current + ) { + return; + } + lastRuntimeRevisionRef.current = snapshot.revision; + lastRuntimeSnapshotRef.current = snapshot; + const available: ManagerUpdateAvailable = { + kind: "available", + version: snapshot.version, + currentVersion: snapshot.currentVersion, + body: snapshot.body, + }; + setUpdate(available); + setSnoozed(false); + + if (snapshot.phase === "downloading" || snapshot.phase === "installing") { + installInFlightRef.current = true; + installedAwaitingRelaunchRef.current = false; + writeJson(MANAGER_UPDATE_COMPLETION_KEY, { + from: snapshot.currentVersion, + to: snapshot.version, + installedAt: Date.now(), + stage: snapshot.phase, + } satisfies Completion); + setFailure(null); + setProgress({ + phase: snapshot.phase, + downloaded: snapshot.downloaded, + total: snapshot.total, + }); + setStatus(snapshot.phase); + setDetailsOpen(true); + return; + } + + if (snapshot.phase === "installed") { + installedAwaitingRelaunchRef.current = true; + if (!ownsInstallRef.current) { + installInFlightRef.current = false; + recoveredInstalledRuntimeRef.current = true; + } + const marker: Completion = { + from: snapshot.currentVersion, + to: snapshot.version, + installedAt: Date.now(), + stage: "installed", + }; + writeJson(MANAGER_UPDATE_COMPLETION_KEY, marker); + removeStored(MANAGER_UPDATE_SNOOZE_KEY); + setProgress({ + phase: "installed", + downloaded: snapshot.downloaded, + total: snapshot.total, + }); + setFailure(null); + setStatus("installed-awaiting-relaunch"); + setDetailsOpen(true); + return; + } + + installInFlightRef.current = false; + ownsInstallRef.current = false; + installedAwaitingRelaunchRef.current = false; + removeStored(MANAGER_UPDATE_COMPLETION_KEY); + setProgress(null); + setFailure( + resolveFailure( + snapshot.failure ?? { + code: "engine_error", + message: "manager update failed", + }, + t, + ), + ); + setStatus("error"); + setDetailsOpen(true); + }, + [currentVersion, t], + ); + + useEffect(() => { + let disposed = false; + let unlisten: (() => void) | null = null; + let pollTimer: number | null = null; + let awaitingHydration = true; + let hydrationFailures = 0; + const provisionalMarker = + initialCompletion.provisional?.from === currentVersion + ? initialCompletion.provisional + : null; + const hasProvisionalMarker = Boolean(provisionalMarker); + const hydrationStartedAt = Date.now(); + const markerInstalledAt = Number(provisionalMarker?.installedAt); + const markerAgeAtHydration = + Number.isFinite(markerInstalledAt) && markerInstalledAt > 0 + ? Math.max(0, hydrationStartedAt - markerInstalledAt) + : 0; + const provisionalDeadline = + hydrationStartedAt + Math.max(0, MANAGER_UPDATE_HANDOFF_GRACE_MS - markerAgeAtHydration); + const isActive = (snapshot: ManagerUpdateRuntimeSnapshot | null) => + snapshot?.phase === "downloading" || snapshot?.phase === "installing"; + + function clearPoll() { + if (pollTimer != null) { + window.clearTimeout(pollTimer); + pollTimer = null; + } + } + + function finishHydration() { + if (!awaitingHydration || disposed) return; + awaitingHydration = false; + setRuntimeHydrated(true); + } + + function provisionalGraceRemaining() { + if (!provisionalMarker) return 0; + return Math.max(0, provisionalDeadline - Date.now()); + } + + function releaseProvisionalHandoff() { + removeStored(MANAGER_UPDATE_COMPLETION_KEY); + installInFlightRef.current = false; + ownsInstallRef.current = false; + setUpdate(null); + setProgress(null); + setFailure(null); + setStatus("idle"); + setDetailsOpen(false); + } + + async function queryRuntime() { + let next: ManagerUpdateRuntimeSnapshot | null = null; + try { + next = await managerApi.getManagerUpdateRuntime(); + } catch { + if (disposed) return; + if (awaitingHydration) { + hydrationFailures += 1; + if (hasProvisionalMarker && lastRuntimeRevisionRef.current === 0) { + const remaining = provisionalGraceRemaining(); + if (remaining > 0) { + schedulePoll(Math.min(800, remaining)); + return; + } + releaseProvisionalHandoff(); + finishHydration(); + } else if ( + isActive(lastRuntimeSnapshotRef.current) || + hydrationFailures < 3 + ) { + schedulePoll(); + } else { + // With no durable evidence of an updater handoff, do not disable + // normal checks forever merely because the runtime query failed. + finishHydration(); + } + } else if (isActive(lastRuntimeSnapshotRef.current)) { + schedulePoll(); + } + return; + } + if (disposed) return; + const relevant = next?.currentVersion === currentVersion ? next : null; + if (relevant) { + recoveredRuntimeRef.current = true; + applyRuntimeSnapshot(relevant); + } + if ( + awaitingHydration && + hasProvisionalMarker && + lastRuntimeRevisionRef.current === 0 + ) { + const remaining = provisionalGraceRemaining(); + if (remaining > 0) { + // A Windows process can be reopened after Tauri has handed the NSIS + // child off and exited. Its fresh marker is the only cross-process + // evidence during that gap, so retain it and keep install controls + // fenced until the installer has had a bounded chance to finish. + schedulePoll(remaining); + return; + } + releaseProvisionalHandoff(); + } + finishHydration(); + if (isActive(relevant ?? lastRuntimeSnapshotRef.current)) schedulePoll(); + } + + function schedulePoll(delayMs = 800) { + clearPoll(); + pollTimer = window.setTimeout(() => { + void queryRuntime(); + }, delayMs); + } + + void (async () => { + try { + const fn = await listen( + MANAGER_UPDATE_STATE_EVENT, + (event) => { + if (!disposed) { + if (event.payload.currentVersion === currentVersion) { + recoveredRuntimeRef.current = true; + } + applyRuntimeSnapshot(event.payload); + } + }, + ); + if (disposed) { + fn(); + return; + } + unlisten = fn; + } catch { + // Browser preview and an already-closing WebView have no event bus. + } + await queryRuntime(); + })(); + return () => { + disposed = true; + clearPoll(); + unlisten?.(); + }; + }, [applyRuntimeSnapshot, currentVersion, initialCompletion.provisional]); + + useEffect(() => { + if (!runtimeHydrated) return; + const startup = recoveredRuntimeRef.current + ? null + : window.setTimeout(() => void check(), Math.max(0, startupDelayMs)); + const periodic = window.setInterval( + () => void check(), + Math.max(60_000, periodicIntervalMs), + ); + return () => { + if (startup != null) window.clearTimeout(startup); + window.clearInterval(periodic); + }; + }, [check, periodicIntervalMs, runtimeHydrated, startupDelayMs]); + + const openDetails = useCallback(() => setDetailsOpen(true), []); + const closeDetails = useCallback(() => { + if (installInFlightRef.current) return; + setDetailsOpen(false); + }, []); + + const remindLater = useCallback(() => { + const current = updateRef.current; + if ( + !current || + installInFlightRef.current || + installedAwaitingRelaunchRef.current + ) { + return; + } + writeJson(MANAGER_UPDATE_SNOOZE_KEY, { + version: current.version, + remindAt: Date.now() + MANAGER_UPDATE_SNOOZE_MS, + } satisfies Snooze); + setSnoozed(true); + setDetailsOpen(false); + }, []); + + const acknowledgeTerminalRuntime = useCallback( + async (expectedFailureCode?: string) => { + try { + const snapshot = await managerApi.getManagerUpdateRuntime(); + if ( + !snapshot || + (snapshot.phase !== "installed" && snapshot.phase !== "error") || + (expectedFailureCode && snapshot.failure?.code !== expectedFailureCode) + ) { + return false; + } + const acknowledged = await managerApi.acknowledgeManagerUpdateRuntime(snapshot); + if (acknowledged) { + // Fence out an already-queued terminal event for the state we just + // consumed. A subsequent update begins at a higher backend revision. + lastRuntimeRevisionRef.current = Math.max( + lastRuntimeRevisionRef.current, + snapshot.revision, + ); + if (lastRuntimeSnapshotRef.current?.revision === snapshot.revision) { + lastRuntimeSnapshotRef.current = null; + } + } + return acknowledged; + } catch { + return false; + } + }, + [], + ); + + const retryRelaunch = useCallback(async () => { + if (installInFlightRef.current || !installedAwaitingRelaunchRef.current) return; + installInFlightRef.current = true; + setFailure(null); + setStatus("relaunching"); + try { + await managerApi.relaunchManager(); + } catch (cause) { + setFailure(contextualRelaunchFailure(cause, t("managerUpdate.relaunchFailed"), t)); + setStatus("installed-awaiting-relaunch"); + setDetailsOpen(true); + installInFlightRef.current = false; + ownsInstallRef.current = false; + } + }, [t]); + + useEffect(() => { + if ( + !runtimeHydrated || + status !== "installed-awaiting-relaunch" || + !recoveredInstalledRuntimeRef.current || + ownsInstallRef.current || + automaticRelaunchAttemptedRef.current + ) { + return; + } + automaticRelaunchAttemptedRef.current = true; + void retryRelaunch(); + }, [retryRelaunch, runtimeHydrated, status]); + + const install = useCallback(async () => { + const current = updateRef.current; + if ( + !current || + installInFlightRef.current || + installedAwaitingRelaunchRef.current + ) { + return; + } + installInFlightRef.current = true; + ownsInstallRef.current = true; + setDetailsOpen(true); + setFailure(null); + setProgress({ phase: "downloading", downloaded: 0, total: null }); + setStatus("downloading"); + let installed = false; + const pendingMarker: Completion = { + from: current.currentVersion, + to: current.version, + installedAt: Date.now(), + stage: "downloading", + }; + // Persist the active download before invoking the updater. The backend + // runtime event promotes this to `installing` only when Windows reaches the + // NSIS handoff; code after the await is a macOS/Linux path. + writeJson(MANAGER_UPDATE_COMPLETION_KEY, pendingMarker); + try { + await managerApi.installManagerUpdate(current); + installed = true; + installedAwaitingRelaunchRef.current = true; + const marker: Completion = { + ...pendingMarker, + installedAt: Date.now(), + stage: "installed", + }; + writeJson(MANAGER_UPDATE_COMPLETION_KEY, marker); + removeStored(MANAGER_UPDATE_SNOOZE_KEY); + setStatus("relaunching"); + await managerApi.relaunchManager(); + } catch (cause) { + if (installed) { + setFailure(contextualRelaunchFailure(cause, t("managerUpdate.relaunchFailed"), t)); + setStatus("installed-awaiting-relaunch"); + } else if (errorCode(cause) === "stale_expectation") { + removeStored(MANAGER_UPDATE_COMPLETION_KEY); + installInFlightRef.current = false; + ownsInstallRef.current = false; + setProgress(null); + setUpdate(null); + await acknowledgeTerminalRuntime("stale_expectation"); + await check({ manual: true, openWhenAvailable: true }); + return; + } else { + removeStored(MANAGER_UPDATE_COMPLETION_KEY); + setFailure(resolveFailure(cause, t)); + setStatus("error"); + } + installInFlightRef.current = false; + ownsInstallRef.current = false; + } + }, [acknowledgeTerminalRuntime, check, t]); + + const dismissCompletion = useCallback(() => { + removeStored(MANAGER_UPDATE_COMPLETION_KEY); + setCompletion(null); + void acknowledgeTerminalRuntime(); + }, [acknowledgeTerminalRuntime]); + + const value = useMemo( + () => ({ + status, + update, + progress, + failure, + detailsOpen, + snoozed, + completion, + check, + openDetails, + closeDetails, + remindLater, + install, + retryRelaunch, + dismissCompletion, + }), + [ + status, + update, + progress, + failure, + detailsOpen, + snoozed, + completion, + check, + openDetails, + closeDetails, + remindLater, + install, + retryRelaunch, + dismissCompletion, + ], + ); + + return {children}; +} + +export function useManagerUpdate(): ManagerUpdateContextValue { + const value = useContext(ManagerUpdateContext); + if (!value) throw new Error("useManagerUpdate must be used inside ManagerUpdateProvider"); + return value; +} + +export function ManagerUpdateBanner() { + const { t } = useI18n(); + const state = useManagerUpdate(); + + if (state.completion) { + return ( + + {t("nav.close")} + + } + > + {t("managerUpdate.completed", { version: state.completion.to })} + + ); + } + if ( + state.update && + (state.status === "installed-awaiting-relaunch" || state.status === "relaunching") + ) { + return ( + void state.retryRelaunch()} + > + {t("managerUpdate.restart")} + + } + > + {t("managerUpdate.restartRequired", { version: state.update.version })} + + ); + } + if (!state.update || state.snoozed) return null; + + return ( +
+ + + + + } + > + {t("about.mgrFound", { version: state.update.version })} + +
+ ); +} + +function progressLabel(progress: ManagerUpdateProgress | null): string | null { + if (!progress || progress.phase !== "downloading") return null; + const downloaded = (progress.downloaded / 1024 / 1024).toFixed(1); + if (!progress.total || progress.total <= 0) return `${downloaded} MiB`; + const total = (progress.total / 1024 / 1024).toFixed(1); + return `${downloaded} / ${total} MiB`; +} + +export function ManagerUpdateSheet({ onOpenSettings }: { onOpenSettings: () => void }) { + const { t } = useI18n(); + const state = useManagerUpdate(); + const titleId = useId(); + const bodyId = useId(); + const busy = ["checking", "downloading", "installing", "relaunching"].includes( + state.status, + ); + const noUpdateResult = state.status === "up-to-date" || state.status === "development"; + const busyLabel = + state.status === "checking" + ? t("about.mgrChecking") + : state.status === "downloading" + ? t("managerUpdate.downloading") + : t("progress.installing"); + const pct = + state.progress?.total && state.progress.total > 0 + ? Math.min(100, (state.progress.downloaded / state.progress.total) * 100) + : null; + const notes = state.update?.body?.trim(); + const awaitingRelaunch = state.status === "installed-awaiting-relaunch"; + const networkFailure = + state.failure?.code === "network" || state.failure?.code === "timeout"; + + return ( + + +

+ {state.status === "checking" + ? t("about.checkManager") + : state.update + ? t("confirm.title", { version: state.update.version }) + : t("about.checkManager")} +

+

+ {state.status === "checking" + ? t("about.mgrChecking") + : awaitingRelaunch && state.update + ? t("managerUpdate.restartRequired", { version: state.update.version }) + : state.status === "up-to-date" + ? t("about.mgrUpToDate") + : state.status === "development" + ? t("about.mgrDev") + : state.update + ? t("about.mgrConfirmBody") + : t("about.mgrUnavailable")} +

+ + {state.update ? ( +
+ {state.update.currentVersion} + + {state.update.version} +
+ ) : null} + + {notes ? ( +
+ {t("managerUpdate.notes")} + 
{notes}
+
+ ) : state.update ? ( +

{t("managerUpdate.noNotes")}

+ ) : null} + + {busy ? ( +
+
+ {busyLabel} + {progressLabel(state.progress)} +
+
+
+
+
+ ) : null} + + {state.failure ? : null} + {networkFailure ? ( +

{t("managerUpdate.networkHint")}

+ ) : null} + +
+ {state.status === "installed-awaiting-relaunch" ? ( + <> + + + + ) : state.failure ? ( + <> + {networkFailure ? ( + + ) : ( + + )} + + + ) : busy ? ( + + ) : noUpdateResult ? ( + + ) : ( + <> + + + + )} +
+ + ); +} diff --git a/src/app/styles.css b/src/app/styles.css index 16ad0bf..9044653 100644 --- a/src/app/styles.css +++ b/src/app/styles.css @@ -227,6 +227,9 @@ body { #root { padding: var(--window-gutter-top) var(--window-gutter-x) var(--window-gutter-bottom); } +.manager-app-content { + display: contents; +} button { font-family: inherit; cursor: pointer; @@ -1761,6 +1764,22 @@ button.row.danger:hover { opacity: 0.5; cursor: default; } +.manager-update-banner > .banner { + flex-wrap: wrap; +} +.manager-update-banner > .banner > [role="status"] { + flex: 1; + min-width: 190px; +} +.manager-update-banner-actions { + width: 100%; + display: flex; + justify-content: flex-end; + gap: 4px; +} +.manager-update-banner-actions .linkbtn { + margin-inline-start: 0; +} /* ── Result strip (update / install outcome) ─────────────────────────────── */ /* Owns its lifecycle (auto-dismiss + ✕), unlike the static .banner notes. A @@ -2042,6 +2061,74 @@ button.row.danger:hover { font-size: var(--fs-sm); line-height: 1.55; } +.manager-update-version { + margin: var(--space-sm) auto 0; + display: inline-flex; + align-items: center; + gap: 9px; + padding: 6px 11px; + border: 1px solid var(--line); + border-radius: var(--r-pill); + background: var(--surface-2); + color: var(--text-soft); + font-family: var(--mono); + font-size: var(--fs-sm); + font-variant-numeric: tabular-nums; +} +.manager-update-version span[aria-hidden="true"] { + color: var(--accent-deep); +} +.manager-update-notes { + margin-top: var(--space-sm); + text-align: start; +} +.manager-update-notes strong { + display: block; + margin-bottom: 6px; + font-size: var(--fs-sm); +} +.manager-update-notes pre { + max-height: 170px; + overflow: auto; + padding: 10px 11px; + border: 1px solid var(--line); + border-radius: var(--r-md); + background: var(--surface-2); + color: var(--text-soft); + white-space: pre-wrap; + overflow-wrap: anywhere; + font-family: var(--font); + font-size: var(--fs-caption); + line-height: 1.5; + user-select: text; +} +.manager-update-empty-notes, +.manager-update-network-hint { + color: var(--text-faint) !important; + font-size: var(--fs-caption) !important; +} +.manager-update-progress { + margin-top: var(--space-sm); +} +.manager-update-progress-head { + display: flex; + justify-content: space-between; + gap: var(--space-xs); + color: var(--text-soft); + font-size: var(--fs-sm); + font-variant-numeric: tabular-nums; +} +.manager-update-progress .bar { + margin-top: 8px; +} +.sheet .manager-update-progress + .failure-banner, +.sheet .manager-update-notes + .failure-banner { + margin-top: var(--space-sm); +} +.about-action-message { + padding: 0 14px 10px; + color: var(--text-soft); +} .sheet-path { margin-top: var(--space-sm); padding: 9px 10px; diff --git a/src/app/views/About.tsx b/src/app/views/About.tsx index f579de1..0978d25 100644 --- a/src/app/views/About.tsx +++ b/src/app/views/About.tsx @@ -1,87 +1,81 @@ -import { useCallback, useId, useState } from "react"; +import { useCallback, useState } from "react"; -import { managerApi, type ManagerUpdateAvailable } from "../../services/managerApi"; +import { managerApi } from "../../services/managerApi"; import { userErrorMessage } from "../errorCopy"; import { Icon, CodexMark } from "../icons"; import { useI18n } from "../i18n"; -import { NavBar, Ring } from "../components"; +import { NavBar } from "../components"; import { formatDiagnostics } from "../diagnostics"; -import { Sheet } from "../Sheet"; +import { useManagerUpdate } from "../managerUpdate"; const APP_VERSION = import.meta.env.VITE_APP_VERSION ?? "0.0.0"; const REPO_URL = "https://github.com/Wangnov/Codex-App-Manager"; export function About({ onBack }: { onBack: () => void }) { const { t } = useI18n(); - const [mgrBusy, setMgrBusy] = useState(false); - const [mgrMsg, setMgrMsg] = useState(null); - const [pendingUpdate, setPendingUpdate] = useState(null); - const updateTitleId = useId(); - const updateBodyId = useId(); - - const closeUpdateConfirm = useCallback(() => { - if (mgrBusy) return; - void pendingUpdate?.discard(); - setPendingUpdate(null); - }, [mgrBusy, pendingUpdate]); + const managerUpdate = useManagerUpdate(); + const [actionMsg, setActionMsg] = useState(null); + const mgrBusy = ["checking", "downloading", "installing", "relaunching"].includes( + managerUpdate.status, + ); + const mgrNavigationLocked = ["downloading", "installing", "relaunching"].includes( + managerUpdate.status, + ); + let managerStatusMessage: string | null = null; + if (managerUpdate.failure) { + managerStatusMessage = managerUpdate.failure.message; + } else if (managerUpdate.status === "checking") { + managerStatusMessage = t("about.mgrChecking"); + } else if (managerUpdate.status === "downloading") { + managerStatusMessage = t("managerUpdate.downloading"); + } else if (managerUpdate.status === "installing") { + managerStatusMessage = t("progress.installing"); + } else if (managerUpdate.status === "installed-awaiting-relaunch" && managerUpdate.update) { + managerStatusMessage = t("managerUpdate.restartRequired", { + version: managerUpdate.update.version, + }); + } else if (managerUpdate.update) { + managerStatusMessage = t("about.mgrFound", { version: managerUpdate.update.version }); + } else if (managerUpdate.status === "up-to-date") { + managerStatusMessage = t("about.mgrUpToDate"); + } else if (managerUpdate.status === "development") { + managerStatusMessage = t("about.mgrDev"); + } + let managerStatusValue = ""; + if (managerUpdate.status === "downloading") { + managerStatusValue = t("managerUpdate.downloading"); + } else if (managerUpdate.status === "installed-awaiting-relaunch") { + managerStatusValue = t("managerUpdate.restart"); + } else if (mgrBusy) { + managerStatusValue = t("about.mgrChecking"); + } const checkManager = useCallback(async () => { - setMgrBusy(true); - setMgrMsg(null); - if (pendingUpdate) { - void pendingUpdate.discard(); - setPendingUpdate(null); + setActionMsg(null); + if (managerUpdate.status === "installed-awaiting-relaunch") { + managerUpdate.openDetails(); + return; } - try { - const result = await managerApi.checkManagerUpdate(); - if (result.kind === "available") { - setPendingUpdate(result); - setMgrMsg(t("about.mgrFound", { version: result.version })); - } else if (result.kind === "none") { - setMgrMsg(t("about.mgrUpToDate")); - } else if (result.kind === "development") { - setMgrMsg(t("about.mgrDev")); - } else { - setMgrMsg(t("about.mgrUnavailable")); - } - } catch (cause) { - setMgrMsg(userErrorMessage(cause, t)); - } finally { - setMgrBusy(false); - } - }, [pendingUpdate, t]); - - const installManagerUpdate = useCallback(async () => { - if (!pendingUpdate) return; - setMgrBusy(true); - setMgrMsg(t("progress.installing")); - try { - await pendingUpdate.installAndRelaunch(); - } catch (cause) { - setMgrMsg(userErrorMessage(cause, t)); - setPendingUpdate(null); - } finally { - setMgrBusy(false); - } - }, [pendingUpdate, t]); + await managerUpdate.check({ manual: true, openWhenAvailable: true }); + }, [managerUpdate]); const openLogsDir = useCallback(async () => { - setMgrMsg(null); + setActionMsg(null); try { await managerApi.openLogsDir(); } catch (cause) { - setMgrMsg(userErrorMessage(cause, t)); + setActionMsg(userErrorMessage(cause, t)); } }, [t]); const copyDiagnostics = useCallback(async () => { - setMgrMsg(null); + setActionMsg(null); try { const diagnostics = await managerApi.getDiagnostics(); await navigator.clipboard.writeText(formatDiagnostics(diagnostics)); - setMgrMsg(t("about.diagnosticsCopied")); + setActionMsg(t("about.diagnosticsCopied")); } catch { - setMgrMsg(t("about.diagnosticsFailed")); + setActionMsg(t("about.diagnosticsFailed")); } }, [t]); @@ -90,8 +84,12 @@ export function About({ onBack }: { onBack: () => void }) { {/* Block leaving while a self-update is downloading/installing — it relaunches the manager process and could interrupt a Codex op started back on the home screen. */} - -
+ +
@@ -108,10 +106,11 @@ export function About({ onBack }: { onBack: () => void }) { {t("about.checkManager")} - {mgrMsg ? {mgrMsg} : null} + {managerStatusMessage ? {managerStatusMessage} : null} - {mgrBusy ? t("about.mgrChecking") : ""} + {managerStatusValue} + {actionMsg ?
{actionMsg}
: null}
- - -

- {pendingUpdate ? t("confirm.title", { version: pendingUpdate.version }) : ""} -

-

{t("about.mgrConfirmBody")}

-
- - -
-
); } diff --git a/src/app/views/Home.tsx b/src/app/views/Home.tsx index 67420ad..1a956a0 100644 --- a/src/app/views/Home.tsx +++ b/src/app/views/Home.tsx @@ -1,4 +1,12 @@ -import { useCallback, useEffect, useId, useMemo, useRef, useState } from "react"; +import { + useCallback, + useEffect, + useId, + useMemo, + useRef, + useState, + type ReactNode, +} from "react"; import { errorCode, @@ -35,11 +43,17 @@ import { useOperationReattach } from "./useOperationReattach"; type Kind = "loading" | "error" | "none" | "idle" | "update" | "external" | "uptodate"; /** Platform dispatcher — the backend command surface differs per OS. */ -export function Home(props: { onOpenSettings: () => void }) { +export function Home(props: { onOpenSettings: () => void; managerUpdateSlot?: ReactNode }) { return currentPlatform() === "windows" ? : ; } -function MacHome({ onOpenSettings }: { onOpenSettings: () => void }) { +function MacHome({ + onOpenSettings, + managerUpdateSlot, +}: { + onOpenSettings: () => void; + managerUpdateSlot?: ReactNode; +}) { const { t, lang } = useI18n(); const [report, setReport] = useState(null); const [status, setStatus] = useState(null); @@ -628,6 +642,7 @@ function MacHome({ onOpenSettings }: { onOpenSettings: () => void }) { ref={scopeRef} inert={confirmOpen || manualExistingOpen ? true : undefined} > + {managerUpdateSlot} {perform ? ( void }) { +export function WinHome({ + onOpenSettings, + managerUpdateSlot, +}: { + onOpenSettings: () => void; + managerUpdateSlot?: ReactNode; +}) { const { t, lang } = useI18n(); const [report, setReport] = useState(null); const [status, setStatus] = useState(null); @@ -640,6 +654,7 @@ export function WinHome({ onOpenSettings }: { onOpenSettings: () => void }) { ref={scopeRef} inert={confirmOpen || installDirOpen || manualExistingOpen ? true : undefined} > + {managerUpdateSlot} {perform ? ( { }); }); +describe("manager updater API", () => { + it("keeps check and confirmed install as separate Tauri commands", async () => { + window.__TAURI_INTERNALS__ = {}; + const metadata = { + version: "2.0.0", + currentVersion: "1.0.0", + body: "release notes", + }; + invokeMock.mockResolvedValueOnce(metadata).mockResolvedValueOnce(undefined); + + await expect(managerApi.checkManagerUpdate()).resolves.toEqual({ + kind: "available", + ...metadata, + }); + expect(invokeMock).toHaveBeenNthCalledWith(1, "manager_check_update"); + + await expect(managerApi.installManagerUpdate(metadata)).resolves.toBeUndefined(); + expect(invokeMock).toHaveBeenNthCalledWith(2, "manager_install_update", { + expectedVersion: "2.0.0", + expectedCurrentVersion: "1.0.0", + expectedBody: "release notes", + }); + }); + + it("exposes renderer-independent manager update runtime state", async () => { + window.__TAURI_INTERNALS__ = {}; + const snapshot = { + revision: 4, + version: "2.0.0", + currentVersion: "1.0.0", + body: "release notes", + phase: "downloading", + downloaded: 5, + total: 10, + failure: null, + } as const; + invokeMock.mockResolvedValueOnce(snapshot); + + await expect(managerApi.getManagerUpdateRuntime()).resolves.toEqual(snapshot); + expect(invokeMock).toHaveBeenCalledWith("manager_get_update_runtime"); + }); + + it("acknowledges terminal runtime state with revision and target CAS fields", async () => { + window.__TAURI_INTERNALS__ = {}; + invokeMock.mockResolvedValueOnce(true); + + await expect( + managerApi.acknowledgeManagerUpdateRuntime({ + revision: 7, + version: "2.0.0", + currentVersion: "1.0.0", + }), + ).resolves.toBe(true); + expect(invokeMock).toHaveBeenCalledWith("manager_ack_update_runtime", { + revision: 7, + version: "2.0.0", + currentVersion: "1.0.0", + }); + }); + + it("preserves updater command failures for structured recovery UI", async () => { + window.__TAURI_INTERNALS__ = {}; + const failure = { code: "network", message: "offline" }; + invokeMock.mockRejectedValueOnce(failure); + + await expect(managerApi.checkManagerUpdate()).rejects.toEqual(failure); + }); +}); + describe("diagnostics API", () => { it("returns browser fallbacks without invoking Tauri", async () => { const consoleError = vi.spyOn(console, "error").mockImplementation(() => {}); diff --git a/src/services/managerApi.ts b/src/services/managerApi.ts index c1662f7..2df6057 100644 --- a/src/services/managerApi.ts +++ b/src/services/managerApi.ts @@ -14,6 +14,8 @@ import type { MacPerformReport, MacUninstallReport, MacUpdateReport, + ManagerUpdateMetadata, + ManagerUpdateRuntimeSnapshot, OperationKind, OperationSnapshot, OperationToken, @@ -34,7 +36,6 @@ const MAX_PERIODIC_CHECK_INTERVAL_SECONDS = 7 * 24 * 60 * 60; export type ManagerUpdateCheck = | { kind: "development" } - | { kind: "unavailable" } | { kind: "none" } | ManagerUpdateAvailable; @@ -42,15 +43,7 @@ export interface ManagerUpdateAvailable { kind: "available"; version: string; currentVersion: string; - body?: string; - installAndRelaunch: () => Promise; - discard: () => Promise; -} - -interface ManagerUpdateMetadata { - version: string; - currentVersion: string; - body?: string; + body?: string | null; } export interface FrontendErrorPayload { @@ -554,19 +547,41 @@ export const managerApi = { if (!hasTauriRuntime()) { return { kind: "development" }; } - // A routine check shouldn't surface a scary error when the release feed - // isn't published yet or is unreachable. - const update = await invoke("manager_check_update").catch( - () => undefined, - ); - if (update === undefined) { - return { kind: "unavailable" }; - } + const update = await invoke("manager_check_update"); if (!update) { return { kind: "none" }; } return managerUpdateAvailable(update); }, + installManagerUpdate(update: ManagerUpdateMetadata): Promise { + if (!hasTauriRuntime()) return Promise.resolve(); + return invoke("manager_install_update", { + expectedVersion: update.version, + expectedCurrentVersion: update.currentVersion, + expectedBody: update.body ?? null, + }); + }, + getManagerUpdateRuntime(): Promise { + if (!hasTauriRuntime()) return Promise.resolve(null); + return invoke("manager_get_update_runtime"); + }, + acknowledgeManagerUpdateRuntime( + snapshot: Pick< + ManagerUpdateRuntimeSnapshot, + "revision" | "version" | "currentVersion" + >, + ): Promise { + if (!hasTauriRuntime()) return Promise.resolve(true); + return invoke("manager_ack_update_runtime", { + revision: snapshot.revision, + version: snapshot.version, + currentVersion: snapshot.currentVersion, + }); + }, + relaunchManager(): Promise { + if (!hasTauriRuntime()) return Promise.resolve(); + return relaunch(); + }, macStatus(): Promise { if (!hasTauriRuntime()) { return Promise.resolve({ installed: null, status: "none" }); @@ -959,13 +974,5 @@ function managerUpdateAvailable(update: ManagerUpdateMetadata): ManagerUpdateAva version: update.version, currentVersion: update.currentVersion, body: update.body, - installAndRelaunch: async () => { - await invoke("manager_install_update", { - expectedVersion: update.version, - expectedCurrentVersion: update.currentVersion, - }); - await relaunch(); - }, - discard: async () => {}, }; } diff --git a/src/shared/types.ts b/src/shared/types.ts index 87e4601..97a09e6 100644 --- a/src/shared/types.ts +++ b/src/shared/types.ts @@ -1,6 +1,12 @@ export type OperatingSystem = "windows" | "macos" | "linux" | "unknown"; export type Architecture = "x64" | "arm64" | "unknown"; -export type OperationKind = "install" | "update" | "uninstall" | "set-install-root" | "adopt"; +export type OperationKind = + | "install" + | "update" + | "manager-update" + | "uninstall" + | "set-install-root" + | "adopt"; export type OperationToken = string; /** Lifecycle phase of a backend operation lease (mirrors Rust `OperationPhase`). */ export type OperationPhase = @@ -26,6 +32,30 @@ export interface OperationSnapshot { interruptible: boolean; } +export interface ManagerUpdateMetadata { + version: string; + currentVersion: string; + body?: string | null; +} + +export interface ManagerUpdateProgress { + phase: "downloading" | "installing" | "installed"; + downloaded: number; + total: number | null; +} + +export interface ManagerUpdateRuntimeSnapshot { + revision: number; + version: string; + currentVersion: string; + body?: string | null; + phase: "downloading" | "installing" | "installed" | "error"; + downloaded: number; + total: number | null; + failure: CommandError | null; + handoffStartedAt?: number | null; +} + /** * Serialized error returned by failing Tauri commands. Mirrors the backend * `CommandError` struct (src-tauri/src/errors.rs), which serializes From b8f2e4769388e99fab403d9c916c5bb04ec7b6cf Mon Sep 17 00:00:00 2001 From: wangnov <48670012+Wangnov@users.noreply.github.com> Date: Sat, 11 Jul 2026 11:59:19 +0800 Subject: [PATCH 05/21] fix(release): serialize IHEP mirror promotion --- .github/workflows/release.yml | 44 +- cloudflare/manager-download-router/README.md | 13 +- docs/release.md | 55 +- scripts/mirror-release.mjs | 605 ++++++++++++++--- scripts/mirror-release.test.mjs | 644 ++++++++++++++++++- scripts/release-workflow.test.mjs | 22 + scripts/write-release-summary.mjs | 12 +- 7 files changed, 1232 insertions(+), 163 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d4ba4e6..295815f 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -20,13 +20,16 @@ name: Release # MANAGER_R2_S3_ENDPOINT / MANAGER_R2_PROMOTION_ACCESS_KEY_ID / # MANAGER_R2_PROMOTION_SECRET_ACCESS_KEY # R2 S3-compatible read/write access -# MANAGER_IHEP_S3_ENDPOINT / MANAGER_IHEP_S3_BUCKET / -# MANAGER_IHEP_S3_PROMOTION_ACCESS_KEY_ID / +# vars.MANAGER_IHEP_S3_ENDPOINT / vars.MANAGER_IHEP_S3_BUCKET / +# vars.MANAGER_IHEP_S3_REGION / vars.MANAGER_IHEP_S3_PREFIX +# MANAGER_IHEP_S3_PROMOTION_ACCESS_KEY_ID / # MANAGER_IHEP_S3_PROMOTION_SECRET_ACCESS_KEY # IHEP S3-compatible read/write access -# Both mirror backends are required for stable publication. They must already -# contain a valid latest.json baseline and support conditional PutObject -# (If-Match / If-None-Match) plus HeadObject user-metadata round trips. +# Both mirror backends are required for stable publication and must already +# contain a valid latest.json baseline. R2 is the sole CAS authority and must +# enforce conditional PutObject plus HeadObject metadata round trips. IHEP is an +# unconditional single-writer follower and only needs PutObject + metadata +# round trips; promotion never relies on its ignored conditional headers. # GitHub Immutable Releases must be enabled before any release starts; the # workflow verifies the repository setting with IMMUTABLE_RELEASES_READ_TOKEN. # Every reused asset is also pinned to the API-provided sha256 digest. @@ -66,9 +69,10 @@ permissions: env: RELEASE_TAG: ${{ inputs.target_tag || github.ref_name }} -# Serialize every tag in the repository through one release lane. The mirror -# promotion also uses per-object ETag conditions, so an external/manual writer -# cannot bypass monotonicity merely by racing this workflow. +# Serialize every credentialed mirror writer through one release lane. This is a +# correctness boundary for the unconditional IHEP follower, not an optimization. +# R2 CAS plus pre/post ownership fencing handles a losing or accidentally +# overlapping writer, but there is no cross-provider atomic transaction. concurrency: group: release-latest-${{ github.repository }} cancel-in-progress: false @@ -718,10 +722,10 @@ jobs: MANAGER_R2_BUCKET: ${{ vars.MANAGER_R2_BUCKET }} MANAGER_R2_ACCESS_KEY_ID: ${{ secrets.MANAGER_R2_PROMOTION_ACCESS_KEY_ID }} MANAGER_R2_SECRET_ACCESS_KEY: ${{ secrets.MANAGER_R2_PROMOTION_SECRET_ACCESS_KEY }} - MANAGER_IHEP_S3_ENDPOINT: ${{ secrets.MANAGER_IHEP_S3_ENDPOINT }} - MANAGER_IHEP_S3_BUCKET: ${{ secrets.MANAGER_IHEP_S3_BUCKET }} - MANAGER_IHEP_S3_REGION: ${{ secrets.MANAGER_IHEP_S3_REGION }} - MANAGER_IHEP_S3_PREFIX: ${{ secrets.MANAGER_IHEP_S3_PREFIX }} + MANAGER_IHEP_S3_ENDPOINT: ${{ vars.MANAGER_IHEP_S3_ENDPOINT }} + MANAGER_IHEP_S3_BUCKET: ${{ vars.MANAGER_IHEP_S3_BUCKET }} + MANAGER_IHEP_S3_REGION: ${{ vars.MANAGER_IHEP_S3_REGION }} + MANAGER_IHEP_S3_PREFIX: ${{ vars.MANAGER_IHEP_S3_PREFIX }} MANAGER_IHEP_S3_ACCESS_KEY_ID: ${{ secrets.MANAGER_IHEP_S3_PROMOTION_ACCESS_KEY_ID }} MANAGER_IHEP_S3_SECRET_ACCESS_KEY: ${{ secrets.MANAGER_IHEP_S3_PROMOTION_SECRET_ACCESS_KEY }} run: | @@ -751,10 +755,10 @@ jobs: MANAGER_R2_BUCKET: ${{ vars.MANAGER_R2_BUCKET }} MANAGER_R2_ACCESS_KEY_ID: ${{ secrets.MANAGER_R2_PROMOTION_ACCESS_KEY_ID }} MANAGER_R2_SECRET_ACCESS_KEY: ${{ secrets.MANAGER_R2_PROMOTION_SECRET_ACCESS_KEY }} - MANAGER_IHEP_S3_ENDPOINT: ${{ secrets.MANAGER_IHEP_S3_ENDPOINT }} - MANAGER_IHEP_S3_BUCKET: ${{ secrets.MANAGER_IHEP_S3_BUCKET }} - MANAGER_IHEP_S3_REGION: ${{ secrets.MANAGER_IHEP_S3_REGION }} - MANAGER_IHEP_S3_PREFIX: ${{ secrets.MANAGER_IHEP_S3_PREFIX }} + MANAGER_IHEP_S3_ENDPOINT: ${{ vars.MANAGER_IHEP_S3_ENDPOINT }} + MANAGER_IHEP_S3_BUCKET: ${{ vars.MANAGER_IHEP_S3_BUCKET }} + MANAGER_IHEP_S3_REGION: ${{ vars.MANAGER_IHEP_S3_REGION }} + MANAGER_IHEP_S3_PREFIX: ${{ vars.MANAGER_IHEP_S3_PREFIX }} MANAGER_IHEP_S3_ACCESS_KEY_ID: ${{ secrets.MANAGER_IHEP_S3_PROMOTION_ACCESS_KEY_ID }} MANAGER_IHEP_S3_SECRET_ACCESS_KEY: ${{ secrets.MANAGER_IHEP_S3_PROMOTION_SECRET_ACCESS_KEY }} run: | @@ -913,10 +917,10 @@ jobs: MANAGER_R2_BUCKET: ${{ vars.MANAGER_R2_BUCKET }} MANAGER_R2_ACCESS_KEY_ID: ${{ secrets.MANAGER_R2_PROMOTION_ACCESS_KEY_ID }} MANAGER_R2_SECRET_ACCESS_KEY: ${{ secrets.MANAGER_R2_PROMOTION_SECRET_ACCESS_KEY }} - MANAGER_IHEP_S3_ENDPOINT: ${{ secrets.MANAGER_IHEP_S3_ENDPOINT }} - MANAGER_IHEP_S3_BUCKET: ${{ secrets.MANAGER_IHEP_S3_BUCKET }} - MANAGER_IHEP_S3_REGION: ${{ secrets.MANAGER_IHEP_S3_REGION }} - MANAGER_IHEP_S3_PREFIX: ${{ secrets.MANAGER_IHEP_S3_PREFIX }} + MANAGER_IHEP_S3_ENDPOINT: ${{ vars.MANAGER_IHEP_S3_ENDPOINT }} + MANAGER_IHEP_S3_BUCKET: ${{ vars.MANAGER_IHEP_S3_BUCKET }} + MANAGER_IHEP_S3_REGION: ${{ vars.MANAGER_IHEP_S3_REGION }} + MANAGER_IHEP_S3_PREFIX: ${{ vars.MANAGER_IHEP_S3_PREFIX }} MANAGER_IHEP_S3_ACCESS_KEY_ID: ${{ secrets.MANAGER_IHEP_S3_PROMOTION_ACCESS_KEY_ID }} MANAGER_IHEP_S3_SECRET_ACCESS_KEY: ${{ secrets.MANAGER_IHEP_S3_PROMOTION_SECRET_ACCESS_KEY }} run: | diff --git a/cloudflare/manager-download-router/README.md b/cloudflare/manager-download-router/README.md index bb08eea..bdfd10f 100644 --- a/cloudflare/manager-download-router/README.md +++ b/cloudflare/manager-download-router/README.md @@ -64,14 +64,15 @@ So each release uploads to the mirror (`release.yml` → `scripts/sync-mirror.sh | --- | --- | | `MANAGER_R2_S3_ENDPOINT` | `https://d39dc6c92d1c4cfde580bf13e946b616.r2.cloudflarestorage.com` | | `MANAGER_R2_PROMOTION_ACCESS_KEY_ID` / `MANAGER_R2_PROMOTION_SECRET_ACCESS_KEY` | R2 S3 API token for the current protected release workflow | -| `MANAGER_IHEP_S3_ENDPOINT` / `_BUCKET` | IHEP endpoint and bucket (`_REGION`/`_PREFIX` optional) | +| `MANAGER_IHEP_S3_ENDPOINT` / `_BUCKET` environment variables | IHEP endpoint and bucket (`_REGION`/`_PREFIX` variables optional) | | `MANAGER_IHEP_S3_PROMOTION_ACCESS_KEY_ID` / `MANAGER_IHEP_S3_PROMOTION_SECRET_ACCESS_KEY` | IHEP token for the current protected release workflow | -Both backends must already contain the same valid `latest.json` baseline and must -support conditional `PutObject` (`If-Match` / `If-None-Match`) plus custom -user-metadata round trips through `HeadObject`. Delete the legacy access-key secret -names after migration so historical workflow revisions cannot perform their old -unconditional write. +Both backends must already contain the same valid `latest.json` baseline and +preserve custom user metadata through `HeadObject`. R2 is the sole CAS authority +and must enforce conditional `PutObject` (`If-Match` / `If-None-Match`). IHEP is +the serialized unconditional follower; its ignored conditional headers are not a +promotion prerequisite. Delete the legacy access-key secret names after migration +so historical workflow revisions cannot perform their old unconditional write. Deploy this Worker revision before enabling the protected release workflow. The release gate intentionally rejects an older Worker that cannot force and identify diff --git a/docs/release.md b/docs/release.md index ff9369a..3e3489e 100644 --- a/docs/release.md +++ b/docs/release.md @@ -94,21 +94,38 @@ Stable releases use a stage/verify/promote, dual-backend protocol implemented by immutable with canonical asset digests. 5. Repeat the complete direct-backend and public-route readback immediately before promotion, then read each backend's current `latest.json` and compare semantic - versions. Newer candidates advance, same-version reruns are - no-write/idempotent, and older tags fail closed. -6. Publish with ETag (`If-Match` / `If-None-Match`) conditions. If the second - backend or final verification fails, restore every backend already changed, - also using ETag conditions so rollback cannot overwrite a concurrent writer. + versions. Newer candidates advance, a fully converged same-version rerun is a + no-write success, and older tags fail closed. If a hard-killed run left R2 on + the candidate while IHEP still lags, the rerun first reclaims R2 with CAS. +6. Treat R2 as the only linearization authority. The workflow conditionally + writes R2, verifies the committed ETag and promotion token, then writes IHEP + unconditionally as a follower. A CAS loser never writes IHEP. The winner + checks R2 ownership immediately before and after the follower write. If it is + superseded during that window, it either preserves the newer follower or + repairs only its own IHEP value from the newer stable R2 snapshot. If another + repair already moved IHEP to the exact R2 candidate after the CAS, that + follower is accepted. A higher version or any identity that cannot be proven + canonical is preserved but fails closed; it cannot force the owned R2 CAS to + roll back and it is never overwritten by the older run. +7. If IHEP fails, roll R2 back only while its committed ETag and token are still + owned by this transaction. IHEP is restored only when it still contains this + transaction's token and bytes; an unchanged baseline or a concurrent value is + preserved rather than overwritten. The release workflow has one repository-wide `release-latest-*` concurrency lane with `queue: max`, so every pending tag remains queued instead of a third tag -replacing the second. The object-store conditions remain the independent backstop -for manual/external writes. `mirror-stage-summary.json`, +replacing the second. This single-writer lane and the promotion-only credential +names are a correctness boundary because IHEP does not enforce conditional +writes. Do not run another credentialed promotion workflow outside this lane. +R2 CAS and the before/after ownership checks are defense in depth for accidental +overlap; they are not a claim of an atomic transaction across providers. +`mirror-stage-summary.json`, `mirror-verification-summary.json`, and `mirror-promotion-summary.json` are shown in the job summary and retained as workflow artifacts for 90 days. If a runner is -hard-killed after only one -`latest.json` write, a fresh run recognizes the exact candidate identity, leaves -that backend untouched, and conditionally advances only the lagging backend. +hard-killed after the R2 CAS but before IHEP follows, rerun that release or a newer +one: the new run reclaims R2 with CAS and converges IHEP. A hard kill during an +out-of-policy concurrent follower race can still leave IHEP temporarily stale; +rerunning the release currently authoritative in R2 is the recovery procedure. Before `prepare` permits any build, and again at the start of every release-job attempt, the workflow queries the repository Immutable Releases setting with a @@ -171,10 +188,6 @@ used, and the run URL are written to the promotion audit and job summary. | `MANAGER_R2_S3_ENDPOINT` | R2 S3-compatible endpoint | | `MANAGER_R2_PROMOTION_ACCESS_KEY_ID` | R2 write/read credential used only by the protected workflow | | `MANAGER_R2_PROMOTION_SECRET_ACCESS_KEY` | R2 write/read secret used only by the protected workflow | -| `MANAGER_IHEP_S3_ENDPOINT` | IHEP S3-compatible endpoint | -| `MANAGER_IHEP_S3_BUCKET` | IHEP bucket | -| `MANAGER_IHEP_S3_REGION` | IHEP region; defaults to `auto` when empty | -| `MANAGER_IHEP_S3_PREFIX` | optional object-key prefix for IHEP | | `MANAGER_IHEP_S3_PROMOTION_ACCESS_KEY_ID` | IHEP write/read credential used only by the protected workflow | | `MANAGER_IHEP_S3_PROMOTION_SECRET_ACCESS_KEY` | IHEP write/read secret used only by the protected workflow | @@ -193,6 +206,10 @@ those exact names; leaving any of them available defeats old-run isolation. | `AUTHENTICODE_REQUIRED` (repo **variable**) | `true` → fail release when PE is not `Valid` | | `WINDOWS_TIMESTAMP_URL` (repo **variable**) | optional RFC3161 timestamp URL | | `MANAGER_R2_BUCKET` (repo **variable**) | R2 bucket; defaults to `codex-app-manager` | +| `MANAGER_IHEP_S3_ENDPOINT` (`release` environment **variable**) | IHEP S3-compatible endpoint | +| `MANAGER_IHEP_S3_BUCKET` (`release` environment **variable**) | IHEP bucket | +| `MANAGER_IHEP_S3_REGION` (`release` environment **variable**) | IHEP region; defaults to `auto` when empty | +| `MANAGER_IHEP_S3_PREFIX` (`release` environment **variable**) | optional object-key prefix for IHEP | Export your local .p12 / .p8 / .pfx to base64 with `base64 -i file -o -`. @@ -204,7 +221,9 @@ Export your local .p12 / .p8 / .pfx to base64 with `base64 -i file -o -`. > conceptually separate — see [`docs/windows-signing.md`](./windows-signing.md). > > Before enabling promotion, seed both S3-compatible endpoints with a valid -> `latest.json` baseline. Both endpoints must support conditional `PutObject` -> requests (`If-Match` / `If-None-Match`) and must preserve custom user metadata -> through `HeadObject`. Promotion fails closed if either baseline is absent or an -> endpoint cannot enforce those requirements. +> `latest.json` baseline. R2 must enforce conditional `PutObject` requests +> (`If-Match` / `If-None-Match`) and preserve custom user metadata through +> `HeadObject`. IHEP must preserve metadata and support ordinary read/write, but +> it is explicitly allowed to ignore conditional headers because the workflow +> uses it only as the serialized unconditional follower. Promotion fails closed +> if either baseline is absent. diff --git a/scripts/mirror-release.mjs b/scripts/mirror-release.mjs index c4bda1f..b7c5b9a 100755 --- a/scripts/mirror-release.mjs +++ b/scripts/mirror-release.mjs @@ -914,6 +914,16 @@ export class AwsObjectStore { singleAttempt: true, }); } + + async putLatestUnconditional(localPath, promotionToken = "") { + return await this.putObject(localPath, LATEST_KEY, { + contentType: "application/json", + ...(promotionToken + ? { metadata: { "cam-promotion-token": promotionToken } } + : {}), + singleAttempt: true, + }); + } } function contentType(name) { @@ -1178,7 +1188,7 @@ async function readCurrentState(backend, workDir, candidateManifest) { const snapshot = await backend.snapshot(LATEST_KEY, path); if (!snapshot.exists) { throw new Error( - `${backend.name}: latest.json is absent; seed both backends with the same valid baseline before enabling transactional promotion`, + `${backend.name}: latest.json is absent; seed both backends with the same valid baseline before enabling single-writer promotion`, ); } const manifest = await readJson(path, `${backend.name} current latest.json`); @@ -1246,54 +1256,305 @@ async function withRollbackIo(callback) { } } -async function rollbackTouched(touched, summaryByName, workDir) { +function promotionBackends(backends) { + const r2 = backends.filter((backend) => backend.name === "r2"); + const ihep = backends.filter((backend) => backend.name === "ihep"); + if (backends.length !== 2 || r2.length !== 1 || ihep.length !== 1) { + throw new Error("mirror promotion requires exactly one r2 authority and one ihep follower"); + } + return { ihep: ihep[0], r2: r2[0] }; +} + +async function assertSnapshotUnchanged(state) { + const current = await state.backend.head(LATEST_KEY); + if (!current || current.etag !== state.previous.etag) { + throw new ConditionalWriteError( + `${state.backend.name}: latest.json changed after the promotion snapshot`, + ); + } +} + +async function classifyFollowerCoverage(snapshot, candidateManifest, label) { + if (!snapshot.exists) throw new Error(`${label}: latest.json disappeared`); + const manifest = await readJson(snapshot.path, `${label} latest.json`); + const followerVersion = assertManifestShape(manifest, `${label} latest.json`); + const candidateVersion = assertManifestShape(candidateManifest, "candidate latest.json"); + const comparison = compareSemver(followerVersion, candidateVersion); + if (comparison > 0) { + return { coverage: "higher-version", manifest, version: followerVersion }; + } + if ( + comparison === 0 && + manifestReleaseIdentity(manifest) === manifestReleaseIdentity(candidateManifest) + ) { + return { coverage: "candidate", manifest, version: followerVersion }; + } + if (comparison === 0) { + throw new Error( + `${label}: latest.json has the candidate version but different artifact/signature identity`, + ); + } + return { coverage: "behind", manifest, version: followerVersion }; +} + +async function refreshFollowerAfterAuthorityCas(state, candidateManifest, workDir) { + const snapshot = await state.backend.snapshot( + LATEST_KEY, + join(workDir, "ihep-post-authority-cas.json"), + ); + if (!snapshot.exists) throw new Error("ihep: latest.json disappeared after the R2 CAS"); + if (snapshot.etag === state.previous.etag) { + return { coverage: "snapshot-unchanged", needsWrite: true, snapshot }; + } + const classified = await classifyFollowerCoverage( + snapshot, + candidateManifest, + "IHEP after R2 CAS", + ); + if (classified.coverage !== "candidate") { + throw new ConditionalWriteError( + `ihep: latest.json changed after the R2 CAS to ${classified.version}; exact candidate identity is required`, + ); + } + return { ...classified, needsWrite: false, snapshot }; +} + +async function ownedCandidateSnapshot({ + state, + candidatePath, + expectedEtag, + promotionToken, + workDir, + label, +}) { + const snapshot = await state.backend.snapshot( + LATEST_KEY, + join(workDir, `${state.backend.name}-${label}.json`), + ); + if ( + !snapshot.exists || + snapshot.etag !== expectedEtag || + snapshot.metadata?.["cam-promotion-token"] !== promotionToken || + !(await snapshotMatchesFile(snapshot, candidatePath)) + ) { + throw new ConditionalWriteError( + `${state.backend.name}: latest.json is no longer owned by this promotion`, + ); + } + return snapshot; +} + +async function rollbackAuthoritativePromotion({ + r2State, + ihepState, + r2Commit, + followerWriteAttempted, + candidatePath, + promotionToken, + summaryByName, + workDir, +}) { const failures = []; + const r2Summary = summaryByName.get("r2"); + const ihepSummary = summaryByName.get("ihep"); rollbackInProgress = true; try { - for (const item of [...touched].reverse()) { - const backendSummary = summaryByName.get(item.state.backend.name); + try { + await ownedCandidateSnapshot({ + state: r2State, + candidatePath, + expectedEtag: r2Commit.etag, + promotionToken, + workDir, + label: "rollback-ownership", + }); + } catch (error) { + r2Summary.rollback = "skipped-concurrent-change"; + r2Summary.rollbackError = safeSummaryError(error); + if (followerWriteAttempted) ihepSummary.rollback = "preserved-authority-lost"; + failures.push(`r2: ${errorText(error)}`); + return { failures, rolledBack: false }; + } + + try { + if (!r2State.previous.exists) { + throw new Error("authoritative promotion cannot roll back an unseeded R2 baseline"); + } + const restored = await r2State.backend.putLatestConditional( + r2State.previous.path, + r2Commit.etag, + `rollback-${randomUUID()}`, + ); + const check = await r2State.backend.snapshot( + LATEST_KEY, + join(workDir, "r2-rollback-check.json"), + ); + if ( + check.etag !== restored.etag || + !(await snapshotMatchesFile(check, r2State.previous.path)) + ) { + throw new Error("R2 rollback verification did not match the previous latest.json"); + } + r2Summary.rollback = "restored"; + } catch (error) { + r2Summary.rollback = "failed"; + r2Summary.rollbackError = safeSummaryError(error); + failures.push(`r2: ${errorText(error)}`); + if (followerWriteAttempted) ihepSummary.rollback = "preserved-authority-rollback-failed"; + return { failures, rolledBack: false }; + } + + if (followerWriteAttempted) { try { - const owned = await item.state.backend.snapshot( + const current = await ihepState.backend.snapshot( LATEST_KEY, - join(workDir, `${item.state.backend.name}-rollback-ownership.json`), + join(workDir, "ihep-rollback-current.json"), ); - if ( - !owned.exists || - owned.etag !== item.promotedEtag || - owned.metadata?.["cam-promotion-token"] !== item.promotionToken + if (await snapshotMatchesFile(current, ihepState.previous.path)) { + ihepSummary.rollback = "preserved-previous"; + } else if ( + current.exists && + current.metadata?.["cam-promotion-token"] === promotionToken && + (await snapshotMatchesFile(current, candidatePath)) ) { - throw new ConditionalWriteError( - `${item.state.backend.name}: latest.json is no longer owned by this promotion`, - ); - } - if (item.state.previous.exists) { - const restored = await item.state.backend.putLatestConditional( - item.state.previous.path, - item.promotedEtag, + const restored = await ihepState.backend.putLatestUnconditional( + ihepState.previous.path, `rollback-${randomUUID()}`, ); - const check = await item.state.backend.snapshot( + const check = await ihepState.backend.snapshot( LATEST_KEY, - join(workDir, `${item.state.backend.name}-rollback-check.json`), + join(workDir, "ihep-rollback-check.json"), ); - if (!(await snapshotMatchesFile(check, item.state.previous.path))) { - throw new Error("rollback verification did not match previous latest.json"); + if ( + check.etag !== restored.etag || + !(await snapshotMatchesFile(check, ihepState.previous.path)) + ) { + throw new Error("IHEP rollback verification did not match the previous latest.json"); } - item.promotedEtag = restored.etag; + ihepSummary.rollback = "restored-unconditionally"; } else { - throw new Error("transactional promotion cannot roll back an unseeded backend"); + // IHEP cannot enforce conditional writes. If its object is neither the + // snapshot nor this transaction's token+bytes, never overwrite it. + ihepSummary.rollback = "preserved-concurrent-change"; } - backendSummary.rollback = "restored"; } catch (error) { - backendSummary.rollback = "failed"; - backendSummary.rollbackError = safeSummaryError(error); - failures.push(`${item.state.backend.name}: ${errorText(error)}`); + ihepSummary.rollback = "failed"; + ihepSummary.rollbackError = safeSummaryError(error); + failures.push(`ihep: ${errorText(error)}`); } } } finally { rollbackInProgress = false; } - return failures; + return { failures, rolledBack: true }; +} + +async function reconcileFollowerToCurrentAuthority({ + r2State, + ihepState, + candidateManifest, + candidatePath, + promotionToken, + summaryByName, + workDir, +}) { + const authority = await r2State.backend.snapshot( + LATEST_KEY, + join(workDir, "r2-superseding-authority.json"), + ); + if (!authority.exists) throw new Error("r2: superseding latest.json disappeared"); + const authorityManifest = await readJson( + authority.path, + "R2 superseding authoritative latest.json", + ); + const authorityVersion = assertManifestShape( + authorityManifest, + "R2 superseding authoritative latest.json", + ); + const candidateVersion = assertManifestShape(candidateManifest, "candidate latest.json"); + const comparison = compareSemver(authorityVersion, candidateVersion); + if ( + comparison < 0 || + (comparison === 0 && + manifestReleaseIdentity(authorityManifest) !== + manifestReleaseIdentity(candidateManifest)) + ) { + throw new Error( + `r2: superseding authority ${authorityVersion} is not a safe monotonic successor of ${candidateVersion}`, + ); + } + + const currentFollower = await ihepState.backend.snapshot( + LATEST_KEY, + join(workDir, "ihep-supersession-current.json"), + ); + if (!currentFollower.exists) { + throw new Error("ihep: latest.json disappeared during supersession repair"); + } + if (await snapshotMatchesFile(currentFollower, authority.path)) { + summaryByName.get("ihep").supersession = "already-follows-r2"; + return authorityManifest; + } + + const followerManifest = await readJson( + currentFollower.path, + "IHEP latest.json during supersession repair", + ); + const followerVersion = assertManifestShape( + followerManifest, + "IHEP latest.json during supersession repair", + ); + if (compareSemver(followerVersion, authorityVersion) > 0) { + // Never let an older workflow overwrite a follower that has already moved + // beyond the R2 snapshot it observed. + summaryByName.get("ihep").supersession = "preserved-newer-follower"; + return followerManifest; + } + + const ownsFollower = + (currentFollower.metadata?.["cam-promotion-token"] === promotionToken && + (await snapshotMatchesFile(currentFollower, candidatePath))) || + (currentFollower.etag === ihepState.previous.etag && + (await snapshotMatchesFile(currentFollower, ihepState.previous.path))); + if (!ownsFollower) { + throw new ConditionalWriteError( + "ihep: cannot safely repair a follower object owned by another writer", + ); + } + + const repaired = await ihepState.backend.putLatestUnconditional( + authority.path, + `superseded-${randomUUID()}`, + ); + const check = await ihepState.backend.snapshot( + LATEST_KEY, + join(workDir, "ihep-supersession-check.json"), + ); + if ( + check.etag === repaired.etag && + (await snapshotMatchesFile(check, authority.path)) + ) { + summaryByName.get("ihep").supersession = "repaired-to-r2"; + return authorityManifest; + } + + if (check.exists) { + const racedManifest = await readJson( + check.path, + "IHEP latest.json after supersession repair race", + ); + const racedVersion = assertManifestShape( + racedManifest, + "IHEP latest.json after supersession repair race", + ); + if (compareSemver(racedVersion, authorityVersion) >= 0) { + summaryByName.get("ihep").supersession = "preserved-racing-successor"; + return racedManifest; + } + } + throw new ConditionalWriteError( + "ihep: follower changed to an older value during supersession repair", + ); } export async function promoteCandidateTransaction({ @@ -1306,9 +1567,10 @@ export async function promoteCandidateTransaction({ hooks = {}, promotionToken = randomUUID(), }) { + const { r2, ihep } = promotionBackends(backends); const summaryByName = new Map(summary.backends.map((entry) => [entry.name, entry])); const states = []; - for (const backend of backends) { + for (const backend of [r2, ihep]) { try { states.push(await readCurrentState(backend, workDir, candidateManifest)); } catch (error) { @@ -1348,8 +1610,11 @@ export async function promoteCandidateTransaction({ } } - const toPromote = states.filter((state) => state.decision !== "idempotent"); - if (toPromote.length === 0) { + const r2State = states.find((state) => state.backend === r2); + const ihepState = states.find((state) => state.backend === ihep); + let followerNeedsWrite = ihepState.decision !== "idempotent"; + const authorityNeedsWrite = r2State.decision !== "idempotent"; + if (!authorityNeedsWrite && !followerNeedsWrite) { for (const state of states) { const backendSummary = summaryByName.get(state.backend.name); try { @@ -1383,105 +1648,237 @@ export async function promoteCandidateTransaction({ return { outcome: "idempotent", states }; } - const touched = []; - let activeState = null; + if (!authorityNeedsWrite && followerNeedsWrite) { + r2State.decision = override.used + ? "claim-follower-downgrade-override" + : "claim-follower-reconciliation"; + summaryByName.get("r2").decision = r2State.decision; + } + + let activeState = r2State; + let r2Commit = null; + let followerWriteAttempted = false; + let followerCommit = null; + let supersededByAuthority = false; + let supersessionFailures = []; + let followerConflictAfterAuthority = false; try { - for (const state of toPromote) { - activeState = state; - const backendSummary = summaryByName.get(state.backend.name); - await hooks.beforeWrite?.(state); - let promoted; - try { - promoted = await state.backend.putLatestConditional( + // R2 is the only linearization authority. The follower snapshot must still + // be current before this workflow attempts the authoritative CAS. + await assertSnapshotUnchanged(ihepState); + await hooks.beforeWrite?.(r2State); + try { + r2Commit = await r2.putLatestConditional( + candidatePath, + r2State.previous.etag, + promotionToken, + ); + summaryByName.get("r2").promotion = "written-authoritative-cas"; + } catch (error) { + if (error instanceof ConditionalWriteError) throw error; + const ambiguous = await withRollbackIo(() => + observeAmbiguousWrite( + r2State, candidatePath, - state.previous.etag, + workDir, promotionToken, + ), + ); + if (!ambiguous) { + summaryByName.get("r2").promotion = "write-outcome-unresolved"; + summaryByName.get("r2").rollback = "uncertain"; + throw new WriteOutcomeUncertainError( + `r2: write failed and ownership could not be resolved after ${errorText(error)}`, + ); + } + r2Commit = ambiguous; + summaryByName.get("r2").promotion = "write-outcome-ambiguous"; + throw error; + } + + await ownedCandidateSnapshot({ + state: r2State, + candidatePath, + expectedEtag: r2Commit.etag, + promotionToken, + workDir, + label: "authoritative-check", + }); + summaryByName.get("r2").promotion = "verified-authoritative-cas"; + await hooks.afterWrite?.(r2State); + + if (followerNeedsWrite) { + await ownedCandidateSnapshot({ + state: r2State, + candidatePath, + expectedEtag: r2Commit.etag, + promotionToken, + workDir, + label: "pre-follower-ownership", + }); + activeState = ihepState; + let refreshedFollower; + try { + refreshedFollower = await refreshFollowerAfterAuthorityCas( + ihepState, + candidateManifest, + workDir, ); } catch (error) { - if (error instanceof ConditionalWriteError) { - throw error; - } - const ambiguous = await withRollbackIo(() => + followerConflictAfterAuthority = true; + summaryByName.get("r2").rollback = "preserved-authoritative-cas"; + summaryByName.get("ihep").promotion = "conflict-after-authority-cas"; + summaryByName.get("ihep").rollback = "preserved-unowned-follower"; + if (error instanceof ConditionalWriteError) throw error; + throw new ConditionalWriteError( + `ihep: cannot prove exact candidate identity after the R2 CAS: ${errorText(error)}`, + ); + } + if (!refreshedFollower.needsWrite) { + followerNeedsWrite = false; + summaryByName.get("ihep").promotion = "already-current-after-authority-cas"; + } + } + + if (followerNeedsWrite) { + activeState = ihepState; + await hooks.beforeWrite?.(ihepState); + followerWriteAttempted = true; + try { + followerCommit = await ihep.putLatestUnconditional(candidatePath, promotionToken); + summaryByName.get("ihep").promotion = "written-unconditional-follower"; + } catch (error) { + const observed = await withRollbackIo(() => observeAmbiguousWrite( - state, + ihepState, candidatePath, workDir, promotionToken, ), ); - if (ambiguous) { - touched.push({ - state, - promotedEtag: ambiguous.etag, - promotionToken, - }); - backendSummary.promotion = "write-outcome-ambiguous"; - } else { - backendSummary.promotion = "write-outcome-unresolved"; - backendSummary.rollback = "uncertain"; - throw new WriteOutcomeUncertainError( - `${state.backend.name}: write failed and ownership could not be resolved after ${errorText(error)}`, - ); + if (!observed) { + summaryByName.get("ihep").promotion = "write-outcome-unresolved"; + throw error; } - throw error; + followerCommit = observed; + summaryByName.get("ihep").promotion = "write-outcome-confirmed"; } - const touchedItem = { - state, - promotedEtag: promoted.etag, + await ownedCandidateSnapshot({ + state: ihepState, + candidatePath, + expectedEtag: followerCommit.etag, promotionToken, - }; - touched.push(touchedItem); - backendSummary.promotion = "written"; - const check = await state.backend.snapshot( - LATEST_KEY, - join(workDir, `${state.backend.name}-promoted-check.json`), - ); - if ( - check.etag !== promoted.etag || - check.metadata?.["cam-promotion-token"] !== promotionToken - ) { - touched.pop(); - backendSummary.promotion = "ownership-lost"; - backendSummary.rollback = "skipped-concurrent-change"; - throw new ConditionalWriteError( - `${state.backend.name}: latest.json changed after the conditional write`, + workDir, + label: "follower-check", + }); + summaryByName.get("ihep").promotion = "verified-unconditional-follower"; + await hooks.afterWrite?.(ihepState); + } else if (summaryByName.get("ihep").promotion === "not-started") { + summaryByName.get("ihep").promotion = "already-current"; + } + + activeState = r2State; + try { + await ownedCandidateSnapshot({ + state: r2State, + candidatePath, + expectedEtag: r2Commit.etag, + promotionToken, + workDir, + label: "final-authority", + }); + } catch (ownershipError) { + // The protected release workflow is serialized, but keep a fencing repair + // for accidental/manual overlap. An older writer that was superseded + // between its pre-IHEP check and its unconditional IHEP write repairs only + // an object it still owns, using the newer stable R2 snapshot. + supersededByAuthority = true; + summaryByName.get("r2").rollback = "skipped-superseded"; + try { + await withRollbackIo(() => + reconcileFollowerToCurrentAuthority({ + r2State, + ihepState, + candidateManifest, + candidatePath, + promotionToken, + summaryByName, + workDir, + }), ); + } catch (repairError) { + supersessionFailures = [`ihep: ${errorText(repairError)}`]; } - if (!(await snapshotMatchesFile(check, candidatePath))) { - throw new Error(`${state.backend.name}: promoted latest.json failed byte verification`); - } - backendSummary.promotion = "verified"; - await hooks.afterWrite?.(state); + throw ownershipError; } + summaryByName.get("r2").finalVersion = candidateManifest.version; - for (const state of states) { - activeState = state; - const finalSnapshot = await state.backend.snapshot( + activeState = ihepState; + let finalFollower; + let finalFollowerCoverage; + try { + finalFollower = await ihep.snapshot( LATEST_KEY, - join(workDir, `${state.backend.name}-final-latest.json`), + join(workDir, "ihep-final-latest.json"), + ); + finalFollowerCoverage = await classifyFollowerCoverage( + finalFollower, + candidateManifest, + "IHEP final", ); - if (!finalSnapshot.exists) throw new Error(`${state.backend.name}: latest.json disappeared`); - const finalManifest = await readJson( - finalSnapshot.path, - `${state.backend.name} final latest.json`, + } catch (error) { + followerConflictAfterAuthority = true; + summaryByName.get("r2").rollback = "preserved-authoritative-cas"; + summaryByName.get("ihep").rollback = "preserved-unowned-follower"; + throw new ConditionalWriteError( + `ihep: cannot prove exact final candidate identity: ${errorText(error)}`, ); - if (manifestReleaseIdentity(finalManifest) !== manifestReleaseIdentity(candidateManifest)) { - throw new Error(`${state.backend.name}: final latest.json does not expose the candidate release`); - } - summaryByName.get(state.backend.name).finalVersion = finalManifest.version; } + if (finalFollowerCoverage.coverage !== "candidate") { + followerConflictAfterAuthority = true; + summaryByName.get("r2").rollback = "preserved-authoritative-cas"; + summaryByName.get("ihep").rollback = "preserved-unowned-follower"; + throw new ConditionalWriteError( + `ihep: final latest.json is ${finalFollowerCoverage.version}; exact candidate identity is required`, + ); + } + if ( + followerCommit && + (finalFollower.etag !== followerCommit.etag || + finalFollower.metadata?.["cam-promotion-token"] !== promotionToken) + ) { + summaryByName.get("ihep").supersession = + "already-follows-r2"; + } + summaryByName.get("ihep").finalVersion = finalFollowerCoverage.manifest.version; return { outcome: override.used ? "downgrade-override-promoted" : "promoted", states }; } catch (error) { if (activeState) { summaryByName.get(activeState.backend.name).error = safeSummaryError(error); } - const rollbackFailures = await rollbackTouched(touched, summaryByName, workDir); - const ownershipUncertain = error instanceof WriteOutcomeUncertainError; - const failures = ownershipUncertain - ? [...rollbackFailures, `${activeState?.backend.name || "backend"}: write ownership unresolved`] - : rollbackFailures; + let failures = []; + let rolledBack = false; + if (followerConflictAfterAuthority) { + summary.authorityPreserved = true; + } else if (supersededByAuthority) { + failures = supersessionFailures; + } else if (r2Commit) { + ({ failures, rolledBack } = await rollbackAuthoritativePromotion({ + r2State, + ihepState, + r2Commit, + followerWriteAttempted, + candidatePath, + promotionToken, + summaryByName, + workDir, + })); + } else if (error instanceof WriteOutcomeUncertainError) { + failures = ["r2: write ownership unresolved"]; + } summary.rollback = { - attempted: touched.length > 0, + attempted: + Boolean(r2Commit) && !supersededByAuthority && !followerConflictAfterAuthority, complete: failures.length === 0, failures, }; @@ -1490,7 +1887,7 @@ export async function promoteCandidateTransaction({ `${errorText(error)}; rollback incomplete: ${failures.join("; ")}`, ); } - if (touched.length > 0) summary.outcome = "rolled-back"; + if (rolledBack) summary.outcome = "rolled-back"; throw error; } } diff --git a/scripts/mirror-release.test.mjs b/scripts/mirror-release.test.mjs index 3039574..a600896 100644 --- a/scripts/mirror-release.test.mjs +++ b/scripts/mirror-release.test.mjs @@ -143,6 +143,8 @@ class MemoryBackend { this.objects = new Map(); this.counter = 0; this.latestPutAttempts = 0; + this.conditionalLatestPutAttempts = 0; + this.unconditionalLatestPutAttempts = 0; for (const [key, body] of Object.entries(objects)) this.set(key, body); } @@ -196,6 +198,7 @@ class MemoryBackend { async putLatestConditional(localPath, expectedEtag, promotionToken = "") { this.latestPutAttempts += 1; + this.conditionalLatestPutAttempts += 1; const current = this.objects.get("latest.json"); const matches = expectedEtag ? current?.etag === expectedEtag : !current; if (!matches) throw new ConditionalWriteError(`${this.name}: stale latest ETag`); @@ -209,6 +212,19 @@ class MemoryBackend { return { etag: stored.etag, size: stored.body.length }; } + async putLatestUnconditional(localPath, promotionToken = "") { + this.latestPutAttempts += 1; + this.unconditionalLatestPutAttempts += 1; + if (this.failLatestPut) throw new Error(`${this.name}: simulated write failure`); + this.set( + "latest.json", + await readFile(localPath), + promotionToken ? { "cam-promotion-token": promotionToken } : {}, + ); + const stored = this.objects.get("latest.json"); + return { etag: stored.etag, size: stored.body.length }; + } + async deleteLatestConditional(expectedEtag) { const current = this.objects.get("latest.json"); if (!current || current.etag !== expectedEtag) { @@ -218,6 +234,22 @@ class MemoryBackend { } } +class ConditionIgnoringMemoryBackend extends MemoryBackend { + async putLatestConditional(localPath, _expectedEtag, promotionToken = "") { + // Model the real IHEP behavior: the request accepts If-Match but overwrites + // regardless. Production promotion must therefore never call this method. + this.latestPutAttempts += 1; + this.conditionalLatestPutAttempts += 1; + this.set( + "latest.json", + await readFile(localPath), + promotionToken ? { "cam-promotion-token": promotionToken } : {}, + ); + const stored = this.objects.get("latest.json"); + return { etag: stored.etag, size: stored.body.length }; + } +} + function encodedUpdaterSignature(privateKey, keyId, artifact) { const digest = createHash("blake2b512").update(artifact).digest(); const signature = cryptoSign(null, digest, privateKey); @@ -478,7 +510,7 @@ describe("public mirror route verification", () => { }); }); -describe("AWS conditional writes", () => { +describe("AWS latest writes", () => { function objectStore() { return new AwsObjectStore({ name: "r2", @@ -536,6 +568,30 @@ describe("AWS conditional writes", () => { backend.putLatestConditional(candidatePath, '"stale-etag"', "promotion-token"), ).rejects.toBeInstanceOf(ConditionalWriteError); }); + + it("omits conditional headers for the serialized IHEP follower write", async () => { + const root = await tempRoot("unconditional-follower-put"); + const candidatePath = await writeManifest(root, "candidate.json", manifest("1.2.3")); + const backend = objectStore(); + let call; + backend.aws = async (args, options) => { + call = { args, options }; + return { code: 0, stderr: "", stdout: '{"ETag":"\\"follower-etag\\""}' }; + }; + + const result = await backend.putLatestUnconditional(candidatePath, "promotion-token"); + + expect(result.etag).toBe('"follower-etag"'); + expect(call.options.env).toEqual({ AWS_MAX_ATTEMPTS: "1" }); + expect(call.args).toEqual( + expect.arrayContaining([ + "--metadata", + "cam-promotion-token=promotion-token", + ]), + ); + expect(call.args).not.toContain("--if-match"); + expect(call.args).not.toContain("--if-none-match"); + }); }); describe("backend candidate verification", () => { @@ -772,6 +828,101 @@ describe("monotonic mirror promotion", () => { ]); }); + it("never lets an old rerun fill a lagging IHEP follower behind newer R2", async () => { + const root = await tempRoot("old-rerun-lagging-follower"); + const candidate = manifest("1.9.0"); + const candidatePath = await writeManifest(root, "candidate.json", candidate); + const r2 = new MemoryBackend("r2", { + "latest.json": `${JSON.stringify(manifest("2.0.0"))}\n`, + }); + const ihep = new ConditionIgnoringMemoryBackend("ihep", { + "latest.json": `${JSON.stringify(manifest("1.0.0"))}\n`, + }); + const backends = [r2, ihep]; + + await expect( + promoteCandidateTransaction({ + backends, + candidateManifest: candidate, + candidatePath, + override: overrideOff(), + summary: summaryFor(backends), + workDir: join(root, "transaction"), + }), + ).rejects.toBeInstanceOf(DowngradeBlockedError); + + expect(r2.latestPutAttempts).toBe(0); + expect(ihep.latestPutAttempts).toBe(0); + expect(JSON.parse(r2.body("latest.json")).version).toBe("2.0.0"); + expect(JSON.parse(ihep.body("latest.json")).version).toBe("1.0.0"); + }); + + it("uses IHEP only as an unconditional follower even when it ignores conditions", async () => { + const root = await tempRoot("ihep-ignores-conditions"); + const candidate = manifest("1.1.0"); + const candidatePath = await writeManifest(root, "candidate.json", candidate); + const initial = `${JSON.stringify(manifest("1.0.0"))}\n`; + const r2 = new MemoryBackend("r2", { "latest.json": initial }); + const ihep = new ConditionIgnoringMemoryBackend("ihep", { "latest.json": initial }); + const backends = [r2, ihep]; + + await expect( + promoteCandidateTransaction({ + backends, + candidateManifest: candidate, + candidatePath, + override: overrideOff(), + promotionToken: "single-writer", + summary: summaryFor(backends), + workDir: join(root, "transaction"), + }), + ).resolves.toEqual(expect.objectContaining({ outcome: "promoted" })); + + expect(r2.conditionalLatestPutAttempts).toBe(1); + expect(ihep.conditionalLatestPutAttempts).toBe(0); + expect(ihep.unconditionalLatestPutAttempts).toBe(1); + expect(JSON.parse(ihep.body("latest.json")).version).toBe("1.1.0"); + }); + + it("does not let an R2 CAS loser touch condition-ignoring IHEP", async () => { + const root = await tempRoot("r2-cas-loser"); + const candidate = manifest("1.1.0"); + const candidatePath = await writeManifest(root, "candidate.json", candidate); + const initial = `${JSON.stringify(manifest("1.0.0"))}\n`; + const r2 = new MemoryBackend("r2", { "latest.json": initial }); + const ihep = new ConditionIgnoringMemoryBackend("ihep", { "latest.json": initial }); + const realPut = r2.putLatestConditional.bind(r2); + let raced = false; + r2.putLatestConditional = async (...args) => { + if (!raced) { + raced = true; + r2.set( + "latest.json", + `${JSON.stringify(manifest("1.2.0"))}\n`, + { "cam-promotion-token": "newer-winner" }, + ); + } + return await realPut(...args); + }; + const backends = [r2, ihep]; + + await expect( + promoteCandidateTransaction({ + backends, + candidateManifest: candidate, + candidatePath, + override: overrideOff(), + summary: summaryFor(backends), + workDir: join(root, "transaction"), + }), + ).rejects.toBeInstanceOf(ConditionalWriteError); + + expect(ihep.conditionalLatestPutAttempts).toBe(0); + expect(ihep.unconditionalLatestPutAttempts).toBe(0); + expect(JSON.parse(r2.body("latest.json")).version).toBe("1.2.0"); + expect(JSON.parse(ihep.body("latest.json")).version).toBe("1.0.0"); + }); + it("treats a same-version rerun as a no-write idempotent success", async () => { const root = await tempRoot("same-version"); const current = manifest("2.0.0"); @@ -829,7 +980,7 @@ describe("monotonic mirror promotion", () => { expect(JSON.parse(ihep.body("latest.json")).version).toBe("2.1.0"); }); - it("uses conditional writes so a concurrent newer release wins without mixed latest pointers", async () => { + it("uses R2 CAS so a concurrent newer release wins without mixed latest pointers", async () => { const root = await tempRoot("concurrent"); const initial = `${JSON.stringify(manifest("1.0.0"))}\n`; const backends = [ @@ -882,7 +1033,288 @@ describe("monotonic mirror promotion", () => { ]); }); - it("heals a hard-terminated partial promotion without rewriting the committed backend", async () => { + it("repairs IHEP when an older writer is superseded after its pre-write ownership check", async () => { + const root = await tempRoot("cross-version-follower-race"); + const initial = `${JSON.stringify(manifest("1.0.0"))}\n`; + const r2 = new MemoryBackend("r2", { "latest.json": initial }); + const ihep = new ConditionIgnoringMemoryBackend("ihep", { "latest.json": initial }); + const backends = [r2, ihep]; + const older = manifest("2.0.0"); + const newer = manifest("3.0.0"); + const olderPath = await writeManifest(root, "older.json", older); + const newerPath = await writeManifest(root, "newer.json", newer); + const olderSummary = summaryFor(backends); + let releaseOlderFollower; + let olderAtFollower; + const holdOlderFollower = new Promise((resolvePromise) => { + releaseOlderFollower = resolvePromise; + }); + const olderFollowerReady = new Promise((resolvePromise) => { + olderAtFollower = resolvePromise; + }); + + const olderRun = promoteCandidateTransaction({ + backends, + candidateManifest: older, + candidatePath: olderPath, + override: overrideOff(), + promotionToken: "older-writer", + summary: olderSummary, + workDir: join(root, "older-transaction"), + hooks: { + beforeWrite: async (state) => { + if (state.backend.name === "ihep") { + olderAtFollower(); + await holdOlderFollower; + } + }, + }, + }); + await olderFollowerReady; + + await promoteCandidateTransaction({ + backends, + candidateManifest: newer, + candidatePath: newerPath, + override: overrideOff(), + promotionToken: "newer-writer", + summary: summaryFor(backends), + workDir: join(root, "newer-transaction"), + }); + releaseOlderFollower(); + + await expect(olderRun).rejects.toBeInstanceOf(ConditionalWriteError); + expect(JSON.parse(r2.body("latest.json")).version).toBe("3.0.0"); + expect(JSON.parse(ihep.body("latest.json")).version).toBe("3.0.0"); + expect(ihep.conditionalLatestPutAttempts).toBe(0); + expect(ihep.unconditionalLatestPutAttempts).toBe(3); + expect(olderSummary.backends.find((backend) => backend.name === "ihep").supersession).toBe( + "repaired-to-r2", + ); + }); + + it("keeps B's R2 v3 CAS when A repairs B's changed follower before B resumes", async () => { + const root = await tempRoot("post-cas-follower-repaired-by-older-writer"); + const initial = `${JSON.stringify(manifest("1.0.0"))}\n`; + const r2 = new MemoryBackend("r2", { "latest.json": initial }); + const ihep = new ConditionIgnoringMemoryBackend("ihep", { "latest.json": initial }); + const backends = [r2, ihep]; + const aManifest = manifest("2.0.0"); + const bManifest = manifest("3.0.0"); + const aPath = await writeManifest(root, "a-v2.json", aManifest); + const bPath = await writeManifest(root, "b-v3.json", bManifest); + const bSummary = summaryFor(backends); + + let releaseA; + let signalAReady; + const holdA = new Promise((resolvePromise) => { + releaseA = resolvePromise; + }); + const aReady = new Promise((resolvePromise) => { + signalAReady = resolvePromise; + }); + const aRun = promoteCandidateTransaction({ + backends, + candidateManifest: aManifest, + candidatePath: aPath, + override: overrideOff(), + promotionToken: "writer-a-v2", + summary: summaryFor(backends), + workDir: join(root, "a-transaction"), + hooks: { + beforeWrite: async (state) => { + if (state.backend.name === "ihep") { + signalAReady(); + await holdA; + } + }, + }, + }); + await aReady; + + let releaseB; + let signalBCasCommitted; + const holdB = new Promise((resolvePromise) => { + releaseB = resolvePromise; + }); + const bCasCommitted = new Promise((resolvePromise) => { + signalBCasCommitted = resolvePromise; + }); + const bRun = promoteCandidateTransaction({ + backends, + candidateManifest: bManifest, + candidatePath: bPath, + override: overrideOff(), + promotionToken: "writer-b-v3", + summary: bSummary, + workDir: join(root, "b-transaction"), + hooks: { + afterWrite: async (state) => { + if (state.backend.name === "r2") { + signalBCasCommitted(); + await holdB; + } + }, + }, + }); + await bCasCommitted; + + releaseA(); + await expect(aRun).rejects.toBeInstanceOf(ConditionalWriteError); + expect(JSON.parse(ihep.body("latest.json")).version).toBe("3.0.0"); + + releaseB(); + await expect(bRun).resolves.toEqual(expect.objectContaining({ outcome: "promoted" })); + + expect(JSON.parse(r2.body("latest.json")).version).toBe("3.0.0"); + expect(JSON.parse(ihep.body("latest.json")).version).toBe("3.0.0"); + expect(r2.conditionalLatestPutAttempts).toBe(2); + expect(ihep.conditionalLatestPutAttempts).toBe(0); + expect(ihep.unconditionalLatestPutAttempts).toBe(2); + expect(bSummary.backends.find((backend) => backend.name === "r2").rollback).toBe( + "not-needed", + ); + expect(bSummary.backends.find((backend) => backend.name === "ihep").promotion).toBe( + "already-current-after-authority-cas", + ); + }); + + it("fails closed on a higher post-CAS follower without rolling R2 back", async () => { + const root = await tempRoot("post-cas-safe-successor"); + const candidate = manifest("2.0.0"); + const successor = manifest("3.0.0"); + const candidatePath = await writeManifest(root, "candidate.json", candidate); + const initial = `${JSON.stringify(manifest("1.0.0"))}\n`; + const r2 = new MemoryBackend("r2", { "latest.json": initial }); + const ihep = new ConditionIgnoringMemoryBackend("ihep", { "latest.json": initial }); + const backends = [r2, ihep]; + const summary = summaryFor(backends); + + await expect( + promoteCandidateTransaction({ + backends, + candidateManifest: candidate, + candidatePath, + override: overrideOff(), + promotionToken: "candidate-v2", + summary, + workDir: join(root, "transaction"), + hooks: { + afterWrite: (state) => { + if (state.backend.name === "r2") { + ihep.set( + "latest.json", + `${JSON.stringify(successor)}\n`, + { "cam-promotion-token": "successor-v3" }, + ); + } + }, + }, + }), + ).rejects.toBeInstanceOf(ConditionalWriteError); + + expect(JSON.parse(r2.body("latest.json")).version).toBe("2.0.0"); + expect(JSON.parse(ihep.body("latest.json")).version).toBe("3.0.0"); + expect(r2.conditionalLatestPutAttempts).toBe(1); + expect(ihep.unconditionalLatestPutAttempts).toBe(0); + expect(summary.authorityPreserved).toBe(true); + expect(summary.backends.find((backend) => backend.name === "r2").rollback).toBe( + "preserved-authoritative-cas", + ); + expect(summary.backends.find((backend) => backend.name === "ihep").promotion).toBe( + "conflict-after-authority-cas", + ); + }); + + it("fails closed on an unknown post-CAS identity without rolling R2 back", async () => { + const root = await tempRoot("post-cas-unknown-identity"); + const candidate = manifest("2.0.0"); + const unknown = structuredClone(candidate); + unknown.platforms["windows-x86_64"].signature = "unknown-signature"; + const candidatePath = await writeManifest(root, "candidate.json", candidate); + const initial = `${JSON.stringify(manifest("1.0.0"))}\n`; + const r2 = new MemoryBackend("r2", { "latest.json": initial }); + const ihep = new ConditionIgnoringMemoryBackend("ihep", { "latest.json": initial }); + const backends = [r2, ihep]; + const summary = summaryFor(backends); + + await expect( + promoteCandidateTransaction({ + backends, + candidateManifest: candidate, + candidatePath, + override: overrideOff(), + promotionToken: "candidate-v2", + summary, + workDir: join(root, "transaction"), + hooks: { + afterWrite: (state) => { + if (state.backend.name === "r2") { + ihep.set( + "latest.json", + `${JSON.stringify(unknown)}\n`, + { "cam-promotion-token": "unknown-v2" }, + ); + } + }, + }, + }), + ).rejects.toBeInstanceOf(ConditionalWriteError); + + expect(JSON.parse(r2.body("latest.json")).version).toBe("2.0.0"); + expect(JSON.parse(ihep.body("latest.json")).platforms["windows-x86_64"].signature).toBe( + "unknown-signature", + ); + expect(r2.conditionalLatestPutAttempts).toBe(1); + expect(ihep.unconditionalLatestPutAttempts).toBe(0); + expect(summary.authorityPreserved).toBe(true); + }); + + it("fails closed when the final follower becomes higher after this run writes it", async () => { + const root = await tempRoot("final-follower-safe-successor"); + const candidate = manifest("2.0.0"); + const successor = manifest("3.0.0"); + const candidatePath = await writeManifest(root, "candidate.json", candidate); + const initial = `${JSON.stringify(manifest("1.0.0"))}\n`; + const r2 = new MemoryBackend("r2", { "latest.json": initial }); + const ihep = new ConditionIgnoringMemoryBackend("ihep", { "latest.json": initial }); + const backends = [r2, ihep]; + const summary = summaryFor(backends); + + await expect( + promoteCandidateTransaction({ + backends, + candidateManifest: candidate, + candidatePath, + override: overrideOff(), + promotionToken: "candidate-v2", + summary, + workDir: join(root, "transaction"), + hooks: { + afterWrite: (state) => { + if (state.backend.name === "ihep") { + ihep.set( + "latest.json", + `${JSON.stringify(successor)}\n`, + { "cam-promotion-token": "successor-v3" }, + ); + } + }, + }, + }), + ).rejects.toBeInstanceOf(ConditionalWriteError); + + expect(JSON.parse(r2.body("latest.json")).version).toBe("2.0.0"); + expect(JSON.parse(ihep.body("latest.json")).version).toBe("3.0.0"); + expect(r2.conditionalLatestPutAttempts).toBe(1); + expect(ihep.unconditionalLatestPutAttempts).toBe(1); + expect(summary.authorityPreserved).toBe(true); + expect(summary.backends.find((backend) => backend.name === "r2").rollback).toBe( + "preserved-authoritative-cas", + ); + }); + + it("reclaims R2 CAS and heals a hard-terminated R2-only promotion", async () => { const root = await tempRoot("partial-terminated-transaction"); const current = manifest("1.0.0"); const candidate = manifest("1.1.0"); @@ -897,13 +1329,14 @@ describe("monotonic mirror promotion", () => { const r2AttemptsAfterTermination = r2.latestPutAttempts; const backends = [r2, ihep]; const failedResumeSummary = summaryFor(backends); - const realIhepPut = ihep.putLatestConditional.bind(ihep); + const realIhepPut = ihep.putLatestUnconditional.bind(ihep); let failFirstResume = true; - ihep.putLatestConditional = async (...args) => { + ihep.putLatestUnconditional = async (...args) => { if (failFirstResume) { failFirstResume = false; ihep.latestPutAttempts += 1; - throw new ConditionalWriteError("ihep: simulated conditional outage"); + ihep.unconditionalLatestPutAttempts += 1; + throw new Error("ihep: simulated follower outage"); } return await realIhepPut(...args); }; @@ -918,15 +1351,15 @@ describe("monotonic mirror promotion", () => { summary: failedResumeSummary, workDir: join(root, "failed-resume"), }), - ).rejects.toBeInstanceOf(ConditionalWriteError); + ).rejects.toThrow("simulated follower outage"); - expect(r2.latestPutAttempts).toBe(r2AttemptsAfterTermination); + expect(r2.latestPutAttempts).toBe(r2AttemptsAfterTermination + 2); expect(backends.map((backend) => JSON.parse(backend.body("latest.json")).version)).toEqual([ "1.1.0", "1.0.0", ]); expect(failedResumeSummary.rollback).toEqual( - expect.objectContaining({ attempted: false, complete: true }), + expect.objectContaining({ attempted: true, complete: true }), ); await expect( @@ -941,18 +1374,50 @@ describe("monotonic mirror promotion", () => { }), ).resolves.toEqual(expect.objectContaining({ outcome: "promoted" })); - expect(r2.latestPutAttempts).toBe(r2AttemptsAfterTermination); + expect(r2.latestPutAttempts).toBe(r2AttemptsAfterTermination + 3); expect(ihep.latestPutAttempts).toBe(2); expect(backends.map((backend) => JSON.parse(backend.body("latest.json")).version)).toEqual([ "1.1.0", "1.1.0", ]); expect(r2.objects.get("latest.json").metadata["cam-promotion-token"]).toBe( - "terminated-run", + "fresh-run", ); expect(ihep.objects.get("latest.json").metadata["cam-promotion-token"]).toBe("fresh-run"); }); + it("lets a newer rerun converge after a hard-terminated R2-only promotion", async () => { + const root = await tempRoot("newer-after-hard-termination"); + const previous = manifest("1.0.0"); + const interrupted = manifest("1.1.0"); + const newer = manifest("1.2.0"); + const interruptedPath = await writeManifest(root, "interrupted.json", interrupted); + const newerPath = await writeManifest(root, "newer.json", newer); + const initial = `${JSON.stringify(previous)}\n`; + const r2 = new MemoryBackend("r2", { "latest.json": initial }); + const ihep = new ConditionIgnoringMemoryBackend("ihep", { "latest.json": initial }); + const before = await r2.head("latest.json"); + await r2.putLatestConditional(interruptedPath, before.etag, "terminated-run"); + const backends = [r2, ihep]; + + await expect( + promoteCandidateTransaction({ + backends, + candidateManifest: newer, + candidatePath: newerPath, + override: overrideOff(), + promotionToken: "newer-rerun", + summary: summaryFor(backends), + workDir: join(root, "transaction"), + }), + ).resolves.toEqual(expect.objectContaining({ outcome: "promoted" })); + + expect(JSON.parse(r2.body("latest.json")).version).toBe("1.2.0"); + expect(JSON.parse(ihep.body("latest.json")).version).toBe("1.2.0"); + expect(ihep.conditionalLatestPutAttempts).toBe(0); + expect(ihep.unconditionalLatestPutAttempts).toBe(1); + }); + it("fails closed before writing when either backend has no baseline latest.json", async () => { const root = await tempRoot("unseeded-backend"); const candidate = manifest("1.1.0"); @@ -978,6 +1443,161 @@ describe("monotonic mirror promotion", () => { expect(ihep.body("latest.json")).toBeUndefined(); }); + it("CAS-rolls R2 back and preserves IHEP when the follower fails before writing", async () => { + const root = await tempRoot("follower-failure-before-write"); + const candidate = manifest("1.1.0"); + const candidatePath = await writeManifest(root, "candidate.json", candidate); + const initial = Buffer.from(`${JSON.stringify(manifest("1.0.0"))}\n`); + const r2 = new MemoryBackend("r2", { "latest.json": initial }); + const ihep = new ConditionIgnoringMemoryBackend("ihep", { "latest.json": initial }); + ihep.failLatestPut = true; + const backends = [r2, ihep]; + const summary = summaryFor(backends); + + await expect( + promoteCandidateTransaction({ + backends, + candidateManifest: candidate, + candidatePath, + override: overrideOff(), + promotionToken: "failed-follower", + summary, + workDir: join(root, "transaction"), + }), + ).rejects.toThrow("simulated write failure"); + + expect(r2.body("latest.json").equals(initial)).toBe(true); + expect(ihep.body("latest.json").equals(initial)).toBe(true); + expect(r2.conditionalLatestPutAttempts).toBe(2); + expect(ihep.conditionalLatestPutAttempts).toBe(0); + expect(ihep.unconditionalLatestPutAttempts).toBe(1); + expect(summary.backends.find((backend) => backend.name === "r2").rollback).toBe("restored"); + expect(summary.backends.find((backend) => backend.name === "ihep").rollback).toBe( + "preserved-previous", + ); + }); + + it("restores only its own IHEP follower write after a later local failure", async () => { + const root = await tempRoot("follower-failure-after-write"); + const candidate = manifest("1.1.0"); + const candidatePath = await writeManifest(root, "candidate.json", candidate); + const initial = Buffer.from(`${JSON.stringify(manifest("1.0.0"))}\n`); + const r2 = new MemoryBackend("r2", { "latest.json": initial }); + const ihep = new ConditionIgnoringMemoryBackend("ihep", { "latest.json": initial }); + const backends = [r2, ihep]; + const summary = summaryFor(backends); + + await expect( + promoteCandidateTransaction({ + backends, + candidateManifest: candidate, + candidatePath, + override: overrideOff(), + promotionToken: "restore-follower", + summary, + workDir: join(root, "transaction"), + hooks: { + afterWrite: (state) => { + if (state.backend.name === "ihep") throw new Error("simulated post-write failure"); + }, + }, + }), + ).rejects.toThrow("simulated post-write failure"); + + expect(r2.body("latest.json").equals(initial)).toBe(true); + expect(ihep.body("latest.json").equals(initial)).toBe(true); + expect(ihep.conditionalLatestPutAttempts).toBe(0); + expect(ihep.unconditionalLatestPutAttempts).toBe(2); + expect(summary.backends.find((backend) => backend.name === "ihep").rollback).toBe( + "restored-unconditionally", + ); + }); + + it("does not roll R2 back when IHEP fails after a newer authority takes ownership", async () => { + const root = await tempRoot("follower-failure-authority-lost"); + const candidate = manifest("1.1.0"); + const successor = manifest("1.2.0"); + const candidatePath = await writeManifest(root, "candidate.json", candidate); + const initial = `${JSON.stringify(manifest("1.0.0"))}\n`; + const r2 = new MemoryBackend("r2", { "latest.json": initial }); + const ihep = new ConditionIgnoringMemoryBackend("ihep", { "latest.json": initial }); + ihep.putLatestUnconditional = async () => { + ihep.latestPutAttempts += 1; + ihep.unconditionalLatestPutAttempts += 1; + r2.set( + "latest.json", + `${JSON.stringify(successor)}\n`, + { "cam-promotion-token": "newer-authority" }, + ); + throw new Error("simulated IHEP outage after R2 supersession"); + }; + const backends = [r2, ihep]; + const summary = summaryFor(backends); + + await expect( + promoteCandidateTransaction({ + backends, + candidateManifest: candidate, + candidatePath, + override: overrideOff(), + promotionToken: "older-authority", + summary, + workDir: join(root, "transaction"), + }), + ).rejects.toThrow("rollback incomplete"); + + expect(JSON.parse(r2.body("latest.json")).version).toBe("1.2.0"); + expect(JSON.parse(ihep.body("latest.json")).version).toBe("1.0.0"); + expect(r2.conditionalLatestPutAttempts).toBe(1); + expect(ihep.conditionalLatestPutAttempts).toBe(0); + expect(summary.backends.find((backend) => backend.name === "r2").rollback).toBe( + "skipped-concurrent-change", + ); + }); + + it("preserves a concurrent newer IHEP value while rolling back owned R2", async () => { + const root = await tempRoot("preserve-concurrent-follower"); + const candidate = manifest("1.1.0"); + const followerSuccessor = manifest("1.2.0"); + const candidatePath = await writeManifest(root, "candidate.json", candidate); + const initial = `${JSON.stringify(manifest("1.0.0"))}\n`; + const r2 = new MemoryBackend("r2", { "latest.json": initial }); + const ihep = new ConditionIgnoringMemoryBackend("ihep", { "latest.json": initial }); + const backends = [r2, ihep]; + const summary = summaryFor(backends); + + await expect( + promoteCandidateTransaction({ + backends, + candidateManifest: candidate, + candidatePath, + override: overrideOff(), + promotionToken: "owned-follower", + summary, + workDir: join(root, "transaction"), + hooks: { + afterWrite: (state) => { + if (state.backend.name === "ihep") { + ihep.set( + "latest.json", + `${JSON.stringify(followerSuccessor)}\n`, + { "cam-promotion-token": "newer-follower" }, + ); + throw new Error("simulated failure after concurrent IHEP advance"); + } + }, + }, + }), + ).rejects.toThrow("simulated failure after concurrent IHEP advance"); + + expect(JSON.parse(r2.body("latest.json")).version).toBe("1.0.0"); + expect(JSON.parse(ihep.body("latest.json")).version).toBe("1.2.0"); + expect(summary.backends.find((backend) => backend.name === "r2").rollback).toBe("restored"); + expect(summary.backends.find((backend) => backend.name === "ihep").rollback).toBe( + "preserved-concurrent-change", + ); + }); + it("never rolls back an ETag that a concurrent writer owns", async () => { const root = await tempRoot("etag-ownership"); const current = manifest("1.0.0"); @@ -1013,7 +1633,7 @@ describe("monotonic mirror promotion", () => { summary, workDir: join(root, "transaction"), }), - ).rejects.toBeInstanceOf(ConditionalWriteError); + ).rejects.toThrow("rollback incomplete"); expect(JSON.parse(r2.body("latest.json")).version).toBe("1.2.0"); expect(JSON.parse(ihep.body("latest.json")).version).toBe("1.0.0"); diff --git a/scripts/release-workflow.test.mjs b/scripts/release-workflow.test.mjs index 7f919f6..d223a6f 100644 --- a/scripts/release-workflow.test.mjs +++ b/scripts/release-workflow.test.mjs @@ -21,6 +21,28 @@ describe("release workflow recovery invariants", () => { ); }); + it("enforces the single-writer boundary for the unconditional IHEP follower", () => { + expect(workflow).toContain( + "correctness boundary for the unconditional IHEP follower", + ); + expect(releaseJob).toContain("Enforce legacy mirror credential revocation"); + expect(releaseJob).toContain("MANAGER_R2_PROMOTION_ACCESS_KEY_ID"); + expect(releaseJob).toContain("MANAGER_IHEP_S3_PROMOTION_ACCESS_KEY_ID"); + expect(releaseJob).toContain( + "MANAGER_IHEP_S3_ENDPOINT: ${{ vars.MANAGER_IHEP_S3_ENDPOINT }}", + ); + expect(releaseJob).toContain( + "MANAGER_IHEP_S3_BUCKET: ${{ vars.MANAGER_IHEP_S3_BUCKET }}", + ); + expect(releaseJob).not.toContain( + "MANAGER_IHEP_S3_ENDPOINT: ${{ secrets.MANAGER_IHEP_S3_ENDPOINT }}", + ); + expect(mirrorRelease).toContain( + "followerCommit = await ihep.putLatestUnconditional(candidatePath, promotionToken)", + ); + expect(mirrorRelease).not.toContain("await ihep.putLatestConditional("); + }); + it("refreshes immutable Release state inside the release job on failed-job reruns", () => { expect(releaseJob).toContain("id: live_release"); expect(releaseJob).toContain( diff --git a/scripts/write-release-summary.mjs b/scripts/write-release-summary.mjs index 22f11bf..0c14802 100644 --- a/scripts/write-release-summary.mjs +++ b/scripts/write-release-summary.mjs @@ -114,8 +114,8 @@ if (mirrorStage || mirrorVerification || mirrorPromotion) { ); } rows.push(""); - rows.push("| Backend | Candidate verification | Previous | Decision | Promotion | Rollback | Final | Error |"); - rows.push("| --- | --- | --- | --- | --- | --- | --- | --- |"); + rows.push("| Backend | Candidate verification | Previous | Decision | Promotion | Supersession | Rollback | Final | Error |"); + rows.push("| --- | --- | --- | --- | --- | --- | --- | --- | --- |"); const backendRows = mirrorPromotion?.backends || mirrorVerification?.backends || mirrorStage?.backends || []; for (const backend of backendRows) { @@ -123,6 +123,8 @@ if (mirrorStage || mirrorVerification || mirrorPromotion) { `| ${cell(backend.name)} | ${cell(backend.candidateVerification || backend.status)} | ${cell( backend.currentVersion || "absent", )} | ${cell(backend.decision)} | ${cell(backend.promotion)} | ${cell( + backend.supersession, + )} | ${cell( backend.rollback, )} | ${cell(backend.finalVersion)} | ${cell( backend.error || backend.rollbackError, @@ -146,7 +148,11 @@ if (mirrorStage || mirrorVerification || mirrorPromotion) { } else { rows.push("Emergency downgrade override: not requested."); } - if (mirrorPromotion?.rollback?.complete === false) { + if (mirrorPromotion?.authorityPreserved) { + rows.push( + "**Authority preserved:** R2 kept its verified CAS commit, but IHEP did not expose the exact canonical candidate identity. The follower was not overwritten and this run failed closed.", + ); + } else if (mirrorPromotion?.rollback?.complete === false) { rows.push( "**Manual intervention required:** promotion rollback was incomplete; inspect the per-backend errors before another release.", ); From 47ee1e7bac801b80a3edde0db542952408cef88e Mon Sep 17 00:00:00 2001 From: wangnov <48670012+Wangnov@users.noreply.github.com> Date: Sat, 11 Jul 2026 12:36:46 +0800 Subject: [PATCH 06/21] fix(release): validate immutable publication provenance --- .github/workflows/release.yml | 213 ++++++++++++++++++++++++------ scripts/check-release-version.mjs | 177 +++++++++++++++++++++++++ scripts/release-workflow.test.mjs | 155 +++++++++++++++++++--- scripts/write-release-summary.mjs | 3 +- 4 files changed, 488 insertions(+), 60 deletions(-) create mode 100644 scripts/check-release-version.mjs diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 295815f..1b46d7e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -49,8 +49,7 @@ on: inputs: target_tag: description: "Existing vX.Y.Z release to republish through the current protected workflow" - required: false - default: "" + required: true type: string allow_mirror_downgrade: description: "Emergency only: allow this tag to replace a newer mirror latest.json" @@ -79,8 +78,55 @@ concurrency: queue: max jobs: + # A manual dispatch may execute only from the protected default branch and + # must name an existing target_tag. This also rejects an empty-input dispatch + # from an attacker-controlled branch named like a release tag. + # Keep the rejecting path free of checkout, environments, permissions, and + # secrets so an untrusted ref cannot reach any credential-bearing job. Compare + # the complete ref, not ref_name: a tag named like the default branch must fail. + reject_untrusted_target_dispatch: + if: ${{ github.event_name == 'workflow_dispatch' && github.ref != format('refs/heads/{0}', github.event.repository.default_branch) }} + runs-on: ubuntu-latest + permissions: {} + steps: + - name: Reject manual dispatch outside the default branch + env: + DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} + DISPATCH_REF: ${{ github.ref }} + run: | + echo "::error::target_tag must be dispatched from refs/heads/$DEFAULT_BRANCH, not $DISPATCH_REF" + exit 1 + + preflight: + if: ${{ github.event_name != 'workflow_dispatch' || github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }} + runs-on: ubuntu-latest + permissions: {} + steps: + - name: Validate release invocation without secrets + shell: bash + env: + DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} + DISPATCH_REF: ${{ github.ref }} + EVENT_NAME: ${{ github.event_name }} + REQUESTED_TARGET_TAG: ${{ inputs.target_tag || '' }} + run: | + set -euo pipefail + if [[ "$EVENT_NAME" == "workflow_dispatch" && "$DISPATCH_REF" != "refs/heads/$DEFAULT_BRANCH" ]]; then + echo "::error::workflow_dispatch must run from refs/heads/$DEFAULT_BRANCH, not $DISPATCH_REF" + exit 1 + fi + if [[ "$EVENT_NAME" == "workflow_dispatch" && -z "$REQUESTED_TARGET_TAG" ]]; then + echo "::error::workflow_dispatch requires a non-empty target_tag" + exit 1 + fi + if [[ ! "$RELEASE_TAG" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$ ]]; then + echo "::error::release tag must be a semantic vX.Y.Z tag: $RELEASE_TAG" + exit 1 + fi + prepare: - if: ${{ startsWith(inputs.target_tag || github.ref_name, 'v') }} + needs: preflight + if: ${{ needs.preflight.result == 'success' }} runs-on: ubuntu-latest environment: release permissions: @@ -97,6 +143,26 @@ jobs: with: node-version: 20 + # Verify the release source rather than the workflow source. For a + # target_tag recovery the workflow itself comes from the protected default + # branch, while the six application version declarations come from the tag. + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + ref: ${{ env.RELEASE_TAG }} + path: release-source + persist-credentials: false + + - name: Match release tag to every application version declaration + shell: bash + run: | + set -euo pipefail + node scripts/check-release-version.mjs source "$RELEASE_TAG" release-source + release_source_sha="$(git -C release-source rev-parse HEAD)" + if [[ "$GITHUB_EVENT_NAME" == "push" && "$release_source_sha" != "$GITHUB_SHA" ]]; then + echo "::error::release tag $RELEASE_TAG moved away from triggering commit $GITHUB_SHA" + exit 1 + fi + - name: Require GitHub Immutable Releases env: GH_TOKEN: ${{ secrets.IMMUTABLE_RELEASES_READ_TOKEN }} @@ -106,16 +172,10 @@ jobs: id: lookup shell: bash env: - DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} - DISPATCH_REF_NAME: ${{ github.ref_name }} GH_TOKEN: ${{ github.token }} REQUESTED_TARGET_TAG: ${{ inputs.target_tag || '' }} run: | set -euo pipefail - if [[ -n "$REQUESTED_TARGET_TAG" && "$DISPATCH_REF_NAME" != "$DEFAULT_BRANCH" ]]; then - echo "::error::target_tag must be dispatched from the default branch ($DEFAULT_BRANCH), not $DISPATCH_REF_NAME" - exit 1 - fi if [[ ! "$RELEASE_TAG" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$ ]]; then echo "::error::release tag must be a semantic vX.Y.Z tag: $RELEASE_TAG" exit 1 @@ -492,6 +552,27 @@ jobs: with: node-version: 20 + # Re-run this gate inside every release-job attempt. GitHub's "Re-run + # failed jobs" does not re-run prepare, and no immutable publication may + # rely only on a previous attempt's version decision. + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + ref: ${{ env.RELEASE_TAG }} + path: release-source + persist-credentials: false + + - name: Re-check release tag against application versions + shell: bash + run: | + set -euo pipefail + node scripts/check-release-version.mjs source "$RELEASE_TAG" release-source + release_source_sha="$(git -C release-source rev-parse HEAD)" + if [[ "$GITHUB_EVENT_NAME" == "push" && "$release_source_sha" != "$GITHUB_SHA" ]]; then + echo "::error::release tag $RELEASE_TAG moved away from triggering commit $GITHUB_SHA" + exit 1 + fi + echo "RELEASE_SOURCE_SHA=$release_source_sha" >> "$GITHUB_ENV" + # Re-check on every release-job attempt. `prepare` is not rerun by # "Re-run failed jobs", and publishing a resumed draft while the setting is # disabled would create a mutable canonical source. @@ -640,6 +721,7 @@ jobs: run: | echo "::group::[build] validate final publishable artifacts" set -euo pipefail + node scripts/check-release-version.mjs artifacts "$RELEASE_TAG" dist ls -la dist missing=0 require() { @@ -686,12 +768,10 @@ jobs: if [[ "${{ steps.release_source.outputs.existing }}" == "true" ]]; then cp "$RUNNER_TEMP/published-latest.json" latest.json fi - if [[ "$RELEASE_TAG" != *-* ]]; then - node scripts/validate-release-manifest.mjs \ - "$RELEASE_TAG" \ - latest.json \ - "$RUNNER_TEMP/artifact-derived-latest.json" - fi + node scripts/validate-release-manifest.mjs \ + "$RELEASE_TAG" \ + latest.json \ + "$RUNNER_TEMP/artifact-derived-latest.json" # A wrong private/public updater-key pairing cannot be repaired after an # immutable GitHub Release is published. Verify the exact local payloads @@ -704,12 +784,68 @@ jobs: dist \ "$RELEASE_TAURI_CONFIG" + # Create provenance only for bytes produced by this release run, before a + # draft can become immutable. A later failed-job rerun must never mint a + # new statement that falsely attributes already-published bytes to the + # rerun's OIDC identity. + - name: Attest fresh build provenance + id: attest_fresh + if: ${{ steps.release_source.outputs.existing != 'true' }} + uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1 + with: + subject-path: | + dist/* + latest.json + + # Existing immutable releases are accepted only when their downloaded, + # API-digest-pinned bytes already carry provenance from this repository's + # release workflow and exact tag ref. This is verification, not a new OIDC + # statement; missing historical provenance fails closed. + - name: Verify existing immutable release provenance + id: verify_existing_provenance + if: ${{ steps.release_source.outputs.existing == 'true' }} + shell: bash + env: + GH_TOKEN: ${{ github.token }} + run: | + set -euo pipefail + signer_workflow="$GITHUB_REPOSITORY/.github/workflows/release.yml" + for file in dist/* latest.json; do + gh attestation verify "$file" \ + --repo "$GITHUB_REPOSITORY" \ + --signer-workflow "$signer_workflow" \ + --source-ref "refs/tags/$RELEASE_TAG" \ + --source-digest "$RELEASE_SOURCE_SHA" \ + --deny-self-hosted-runners >/dev/null + echo "Verified existing provenance: $(basename "$file")" + done + + - name: Resolve provenance gate + id: provenance + shell: bash + env: + FRESH_ATTESTATION_OUTCOME: ${{ steps.attest_fresh.outcome }} + EXISTING_PROVENANCE_OUTCOME: ${{ steps.verify_existing_provenance.outcome }} + RELEASE_REUSED: ${{ steps.release_source.outputs.existing }} + run: | + set -euo pipefail + if [[ "$RELEASE_REUSED" == "true" ]]; then + [[ "$FRESH_ATTESTATION_OUTCOME" == "skipped" ]] + [[ "$EXISTING_PROVENANCE_OUTCOME" == "success" ]] + echo "mode=verified-existing-immutable-release" >> "$GITHUB_OUTPUT" + else + [[ "$FRESH_ATTESTATION_OUTCOME" == "success" ]] + [[ "$EXISTING_PROVENANCE_OUTCOME" == "skipped" ]] + echo "mode=fresh-build-attested-before-publication" >> "$GITHUB_OUTPUT" + fi + echo "ready=true" >> "$GITHUB_OUTPUT" + # Stable releases stage immutable versioned assets before GitHub Release # publication, verify them separately, then promote latest.json only after # the GitHub Release succeeds. Pre-releases still skip the mirror entirely. - name: Stage CDN mirror candidate (R2 + IHEP S3) id: mirror_stage - if: ${{ !contains(env.RELEASE_TAG, '-') }} + if: ${{ steps.provenance.outputs.ready == 'true' && !contains(env.RELEASE_TAG, '-') }} env: MIRROR_PHASE: stage MIRROR_REQUIRED_BACKENDS: r2,ihep @@ -742,7 +878,7 @@ jobs: # branches must pass before GitHub publication becomes immutable. - name: Verify staged CDN mirror before immutable publication id: mirror_verify - if: ${{ !contains(env.RELEASE_TAG, '-') }} + if: ${{ steps.provenance.outputs.ready == 'true' && !contains(env.RELEASE_TAG, '-') }} env: MIRROR_PHASE: verify MIRROR_REQUIRED_BACKENDS: r2,ihep @@ -829,7 +965,7 @@ jobs: # releases are enabled: a published release can no longer accept assets. - name: Upload GitHub Release draft id: upload_release_draft - if: ${{ steps.release_source.outputs.existing != 'true' }} + if: ${{ steps.provenance.outputs.ready == 'true' && steps.release_source.outputs.existing != 'true' }} uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3 with: tag_name: ${{ env.RELEASE_TAG }} @@ -851,7 +987,7 @@ jobs: # after all uploads succeeded while retaining its stable/prerelease metadata. - name: Publish GitHub Release id: publish_release - if: ${{ steps.release_source.outputs.existing != 'true' }} + if: ${{ steps.provenance.outputs.ready == 'true' && steps.release_source.outputs.existing != 'true' }} uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3 with: tag_name: ${{ env.RELEASE_TAG }} @@ -884,27 +1020,25 @@ jobs: exit 1 fi cat "$verification_log" - - # Attest immediately after GitHub confirms the canonical immutable bytes, - # before mirror promotion can fail the job. Keep the subjects limited to - # updater payloads and latest.json: on a failed-job rerun those are fetched - # from the immutable Release and checked against GitHub's canonical SHA-256 - # digests. SHA256SUMS and SBOMs are intentionally excluded because they are - # regenerated locally and are not necessarily the bytes already published. - # A failed attestation must fail the job so the release stays retryable and - # neither mirror promotion nor winget dispatch can proceed without proof. - - name: Attest build provenance - id: attest - if: ${{ steps.publish_release.outcome == 'success' || steps.release_source.outputs.existing == 'true' }} - uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1 - with: - subject-path: | - dist/* - latest.json + release_asset_digests="$(sed -n 's/^release_asset_digests=//p' "$verification_output")" + jq -e 'type == "object" and length > 0' <<<"$release_asset_digests" >/dev/null || { + echo "::error::published immutable digest evidence is missing" + exit 1 + } + for file in dist/* latest.json; do + name="$(basename "$file")" + expected_digest="$(jq -er --arg name "$name" '.[$name]' <<<"$release_asset_digests")" + actual_digest="sha256:$(sha256sum "$file" | cut -d' ' -f1)" + if [[ "$actual_digest" != "$expected_digest" ]]; then + echo "::error::published immutable digest does not match attested local bytes: $name" + exit 1 + fi + echo "Verified published attested digest: $name" + done - name: Promote CDN mirror latest (R2 + IHEP S3) id: mirror_promote - if: ${{ success() && steps.attest.outcome == 'success' && !contains(env.RELEASE_TAG, '-') }} + if: ${{ success() && steps.provenance.outputs.ready == 'true' && !contains(env.RELEASE_TAG, '-') }} env: MIRROR_PHASE: promote MIRROR_REQUIRED_BACKENDS: r2,ihep @@ -934,7 +1068,7 @@ jobs: # so a re-run is harmless. - name: Trigger winget submission id: winget - if: ${{ success() && steps.attest.outcome == 'success' && !contains(env.RELEASE_TAG, '-') }} + if: ${{ success() && steps.provenance.outputs.ready == 'true' && !contains(env.RELEASE_TAG, '-') }} env: GH_TOKEN: ${{ github.token }} run: | @@ -954,7 +1088,8 @@ jobs: MIRROR_PROMOTE_OUTCOME: ${{ steps.mirror_promote.outcome }} WINGET_OUTCOME: ${{ steps.winget.outputs.status || steps.winget.outcome }} SBOM_OUTCOME: ${{ steps.sbom.outcome }} - ATTESTATION_OUTCOME: ${{ steps.attest.outcome }} + ATTESTATION_OUTCOME: ${{ steps.attest_fresh.outcome }} + PROVENANCE_MODE: ${{ steps.provenance.outputs.mode }} run: node scripts/write-release-summary.mjs - name: Upload release audit records diff --git a/scripts/check-release-version.mjs b/scripts/check-release-version.mjs new file mode 100644 index 0000000..30a8441 --- /dev/null +++ b/scripts/check-release-version.mjs @@ -0,0 +1,177 @@ +#!/usr/bin/env node + +import { existsSync, readFileSync, readdirSync, statSync } from "node:fs"; +import { join, resolve } from "node:path"; +import { fileURLToPath } from "node:url"; + +import { requiredReleaseAssetNames } from "./check-release-reuse.mjs"; + +const RELEASE_TAG_PATTERN = + /^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/; + +export function releaseVersionFromTag(releaseTag) { + const tag = String(releaseTag); + if (!RELEASE_TAG_PATTERN.test(tag)) { + throw new Error(`release tag must be a semantic vX.Y.Z tag: ${releaseTag}`); + } + return tag.slice(1); +} + +function readJson(path, label) { + try { + return JSON.parse(readFileSync(path, "utf8")); + } catch (error) { + const detail = error instanceof Error ? error.message : String(error); + throw new Error(`cannot read ${label}: ${detail}`); + } +} + +function quotedTomlValue(block, key, label) { + const matches = [...block.matchAll(new RegExp(`^${key}\\s*=\\s*"([^"]+)"\\s*(?:#.*)?$`, "gm"))]; + if (matches.length !== 1) { + throw new Error(`${label} must contain exactly one quoted ${key}`); + } + return matches[0][1]; +} + +function cargoPackageBlock(cargoToml, label) { + const match = /^\[package\]\s*$/m.exec(cargoToml); + if (!match) { + throw new Error(`${label} has no [package] table`); + } + const start = match.index + match[0].length; + const rest = cargoToml.slice(start); + const nextTable = /^\s*\[/m.exec(rest); + return nextTable ? rest.slice(0, nextTable.index) : rest; +} + +function cargoLockPackageVersion(cargoLock, packageName) { + const blocks = cargoLock.split(/^\[\[package\]\]\s*$/m).slice(1); + const matches = blocks.filter((block) => { + try { + return quotedTomlValue(block, "name", "Cargo.lock package") === packageName; + } catch { + return false; + } + }); + if (matches.length !== 1) { + throw new Error(`Cargo.lock must contain exactly one ${packageName} package block`); + } + return quotedTomlValue(matches[0], "version", `Cargo.lock ${packageName} package`); +} + +export function readReleaseSourceVersions(sourceRoot) { + const root = resolve(sourceRoot); + const packageJson = readJson(join(root, "package.json"), "package.json"); + const packageLock = readJson(join(root, "package-lock.json"), "package-lock.json"); + const tauriConfig = readJson( + join(root, "src-tauri", "tauri.conf.json"), + "src-tauri/tauri.conf.json", + ); + const cargoTomlPath = join(root, "src-tauri", "Cargo.toml"); + const cargoLockPath = join(root, "src-tauri", "Cargo.lock"); + const cargoToml = readFileSync(cargoTomlPath, "utf8"); + const cargoLock = readFileSync(cargoLockPath, "utf8"); + + return [ + ["package.json#version", packageJson.version], + ["package-lock.json#version", packageLock.version], + ['package-lock.json#packages[""].version', packageLock.packages?.[""]?.version], + ["src-tauri/tauri.conf.json#version", tauriConfig.version], + [ + "src-tauri/Cargo.toml#[package].version", + quotedTomlValue( + cargoPackageBlock(cargoToml, "src-tauri/Cargo.toml"), + "version", + "src-tauri/Cargo.toml [package]", + ), + ], + [ + 'src-tauri/Cargo.lock#[[package]] name="codex-app-manager".version', + cargoLockPackageVersion(cargoLock, "codex-app-manager"), + ], + ]; +} + +export function assertReleaseSourceVersions(releaseTag, sourceRoot) { + const expected = releaseVersionFromTag(releaseTag); + const entries = readReleaseSourceVersions(sourceRoot); + const mismatches = entries.filter(([, version]) => version !== expected); + if (mismatches.length > 0) { + const detail = mismatches + .map(([label, version]) => `${label}=${JSON.stringify(version)}`) + .join(", "); + throw new Error( + `release tag ${releaseTag} requires application version ${expected}; mismatched source versions: ${detail}`, + ); + } + return { entries, version: expected }; +} + +export function assertLocalReleaseArtifactNames(releaseTag, artifactsDir) { + const version = releaseVersionFromTag(releaseTag); + const expected = requiredReleaseAssetNames(releaseTag).filter((name) => name !== "latest.json"); + const dir = resolve(artifactsDir); + const files = readdirSync(dir, { withFileTypes: true }) + .filter((entry) => entry.isFile()) + .map((entry) => entry.name); + const missing = expected.filter((name) => { + const path = join(dir, name); + return !existsSync(path) || !statSync(path).isFile() || statSync(path).size <= 0; + }); + if (missing.length > 0) { + throw new Error( + `release ${releaseTag} is missing exact local artifact names: ${missing.join(", ")}`, + ); + } + + const updaterInstallers = files.filter((name) => + /_(?:x64|arm64)-setup\.(?:exe|nsis\.zip)(?:\.sig)?$/.test(name), + ); + const wrongVersion = updaterInstallers.filter( + (name) => !name.startsWith(`CodexAppManager_${version}_`), + ); + if (wrongVersion.length > 0) { + throw new Error( + `release ${releaseTag} contains installer artifacts for another version: ${wrongVersion.join(", ")}`, + ); + } + + const unexpected = files.filter( + (name) => name.startsWith("CodexAppManager") && !expected.includes(name), + ); + if (unexpected.length > 0) { + throw new Error( + `release ${releaseTag} contains unexpected local artifact names: ${unexpected.join(", ")}`, + ); + } + + return { expected, version }; +} + +const isCli = process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url); +if (isCli) { + const [, , mode, releaseTag, path] = process.argv; + try { + if (!mode || !releaseTag || !path || !["source", "artifacts"].includes(mode)) { + throw new Error( + "usage: check-release-version.mjs ", + ); + } + if (mode === "source") { + const result = assertReleaseSourceVersions(releaseTag, path); + console.log( + `[version] ${releaseTag} matches all ${result.entries.length} application version declarations`, + ); + } else { + const result = assertLocalReleaseArtifactNames(releaseTag, path); + console.log( + `[version] ${releaseTag} matches all ${result.expected.length} exact local release artifact names`, + ); + } + } catch (error) { + const detail = error instanceof Error ? error.message : String(error); + console.error(`::error::[version] ${detail}`); + process.exitCode = 1; + } +} diff --git a/scripts/release-workflow.test.mjs b/scripts/release-workflow.test.mjs index d223a6f..113f341 100644 --- a/scripts/release-workflow.test.mjs +++ b/scripts/release-workflow.test.mjs @@ -1,4 +1,5 @@ -import { readFile } from "node:fs/promises"; +import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises"; +import { tmpdir } from "node:os"; import { dirname, join } from "node:path"; import { fileURLToPath } from "node:url"; @@ -8,6 +9,11 @@ import { assertImmutableReleasesEnabled, verifyImmutableReleases, } from "./check-immutable-releases.mjs"; +import { requiredReleaseAssetNames } from "./check-release-reuse.mjs"; +import { + assertLocalReleaseArtifactNames, + assertReleaseSourceVersions, +} from "./check-release-version.mjs"; const repoRoot = join(dirname(fileURLToPath(import.meta.url)), ".."); const workflow = await readFile(join(repoRoot, ".github/workflows/release.yml"), "utf8"); @@ -21,6 +27,93 @@ describe("release workflow recovery invariants", () => { ); }); + it("rejects every manual dispatch outside the full default-branch ref before checkout or secrets", () => { + const dispatchInputs = workflow.slice( + workflow.indexOf(" workflow_dispatch:\n"), + workflow.indexOf("\npermissions:\n"), + ); + const reject = workflow.slice( + workflow.indexOf(" reject_untrusted_target_dispatch:\n"), + workflow.indexOf(" preflight:\n"), + ); + const preflight = workflow.slice( + workflow.indexOf(" preflight:\n"), + workflow.indexOf(" prepare:\n"), + ); + const prepare = workflow.slice( + workflow.indexOf(" prepare:\n"), + workflow.indexOf(" build:\n"), + ); + + expect(reject).toContain("github.event_name == 'workflow_dispatch'"); + expect(reject).toContain( + "github.ref != format('refs/heads/{0}', github.event.repository.default_branch)", + ); + expect(reject).not.toContain("inputs.target_tag != ''"); + expect(reject).not.toContain("actions/checkout@"); + expect(reject).not.toContain("environment:"); + expect(reject).not.toContain("${{ secrets."); + expect(dispatchInputs).toMatch(/target_tag:\n\s+description:.*\n\s+required: true/); + + expect(preflight).toContain( + "github.ref == format('refs/heads/{0}', github.event.repository.default_branch)", + ); + expect(preflight).toContain("workflow_dispatch requires a non-empty target_tag"); + expect(preflight).not.toContain("actions/checkout@"); + expect(preflight).not.toContain("environment:"); + expect(preflight).not.toContain("${{ secrets."); + expect(prepare).toContain("needs: preflight"); + expect(prepare).toContain("needs.preflight.result == 'success'"); + }); + + it("binds the release tag to all six source versions and exact local artifact names", async () => { + const packageJson = JSON.parse(await readFile(join(repoRoot, "package.json"), "utf8")); + const releaseTag = `v${packageJson.version}`; + const source = assertReleaseSourceVersions(releaseTag, repoRoot); + expect(source.entries).toHaveLength(6); + expect(() => assertReleaseSourceVersions("v9.9.9", repoRoot)).toThrow( + "mismatched source versions", + ); + + const artifactsDir = await mkdtemp(join(tmpdir(), "cam-release-artifacts-")); + try { + const expected = requiredReleaseAssetNames(releaseTag).filter( + (name) => name !== "latest.json", + ); + await Promise.all(expected.map((name) => writeFile(join(artifactsDir, name), "x"))); + expect(assertLocalReleaseArtifactNames(releaseTag, artifactsDir).expected).toEqual( + expected, + ); + + await writeFile(join(artifactsDir, "CodexAppManager_9.9.9_x64-setup.exe"), "x"); + expect(() => assertLocalReleaseArtifactNames(releaseTag, artifactsDir)).toThrow( + "installer artifacts for another version", + ); + } finally { + await rm(artifactsDir, { force: true, recursive: true }); + } + + const prepare = workflow.slice( + workflow.indexOf(" prepare:\n"), + workflow.indexOf(" build:\n"), + ); + expect(prepare).toContain('ref: ${{ env.RELEASE_TAG }}'); + expect(prepare).toContain( + 'node scripts/check-release-version.mjs source "$RELEASE_TAG" release-source', + ); + expect(releaseJob).toContain( + 'node scripts/check-release-version.mjs artifacts "$RELEASE_TAG" dist', + ); + const manifestStep = releaseJob.slice( + releaseJob.indexOf("- name: Generate updater manifest (latest.json)"), + releaseJob.indexOf( + "- name: Verify local updater signatures before immutable publication", + ), + ); + expect(manifestStep).toContain("node scripts/validate-release-manifest.mjs"); + expect(manifestStep).not.toContain('if [[ "$RELEASE_TAG" != *-* ]]'); + }); + it("enforces the single-writer boundary for the unconditional IHEP follower", () => { expect(workflow).toContain( "correctness boundary for the unconditional IHEP follower", @@ -112,6 +205,11 @@ describe("release workflow recovery invariants", () => { const localVerify = releaseJob.indexOf( "- name: Verify local updater signatures before immutable publication", ); + const attest = releaseJob.indexOf("- name: Attest fresh build provenance"); + const verifyExisting = releaseJob.indexOf( + "- name: Verify existing immutable release provenance", + ); + const provenance = releaseJob.indexOf("- name: Resolve provenance gate"); const stage = releaseJob.indexOf("- name: Stage CDN mirror candidate"); const mirrorVerify = releaseJob.indexOf( "- name: Verify staged CDN mirror before immutable publication", @@ -121,24 +219,27 @@ describe("release workflow recovery invariants", () => { const publishedVerify = releaseJob.indexOf( "- name: Verify published immutable Release and asset digests", ); - const attest = releaseJob.indexOf("- name: Attest build provenance"); const promote = releaseJob.indexOf("- name: Promote CDN mirror latest"); const winget = releaseJob.indexOf("- name: Trigger winget submission"); const summary = releaseJob.indexOf("- name: Write release summary"); expect(localVerify).toBeGreaterThan(-1); - expect(stage).toBeGreaterThan(localVerify); + expect(attest).toBeGreaterThan(localVerify); + expect(verifyExisting).toBeGreaterThan(attest); + expect(provenance).toBeGreaterThan(verifyExisting); + expect(stage).toBeGreaterThan(provenance); expect(mirrorVerify).toBeGreaterThan(stage); expect(upload).toBeGreaterThan(mirrorVerify); expect(upload).toBeGreaterThan(-1); expect(publish).toBeGreaterThan(upload); expect(publishedVerify).toBeGreaterThan(publish); - expect(attest).toBeGreaterThan(publishedVerify); - expect(promote).toBeGreaterThan(attest); + expect(promote).toBeGreaterThan(publishedVerify); const uploadStep = releaseJob.slice(upload, publish); const publishStep = releaseJob.slice(publish, publishedVerify); - const verifyStep = releaseJob.slice(publishedVerify, attest); - const attestStep = releaseJob.slice(attest, promote); + const verifyStep = releaseJob.slice(publishedVerify, promote); + const attestStep = releaseJob.slice(attest, verifyExisting); + const existingStep = releaseJob.slice(verifyExisting, provenance); + const provenanceStep = releaseJob.slice(provenance, stage); const promoteStep = releaseJob.slice(promote, winget); const wingetStep = releaseJob.slice(winget, summary); const localVerifyStep = releaseJob.slice(localVerify, stage); @@ -147,40 +248,54 @@ describe("release workflow recovery invariants", () => { expect(mirrorVerifyStep).toContain("MIRROR_PHASE: verify"); expect(mirrorVerifyStep).toContain("bash scripts/sync-mirror.sh dist"); expect(uploadStep).toContain("draft: true"); + expect(uploadStep).toContain("steps.provenance.outputs.ready == 'true'"); expect(uploadStep).toContain("prerelease: ${{ contains(env.RELEASE_TAG, '-') }}"); expect(uploadStep).toContain("files: |"); expect(publishStep).not.toMatch(/^\s+draft:/m); expect(publishStep).not.toContain("files: |"); + expect(publishStep).toContain("steps.provenance.outputs.ready == 'true'"); expect(verifyStep).toContain("node scripts/check-release-reuse.mjs"); expect(verifyStep).toContain("did not become immutable with canonical asset digests"); - expect(attestStep).toContain( - "steps.publish_release.outcome == 'success' || steps.release_source.outputs.existing == 'true'", - ); + expect(verifyStep).toContain("published immutable digest does not match attested local bytes"); + expect(attestStep).toContain("steps.release_source.outputs.existing != 'true'"); expect(attestStep).toContain("actions/attest-build-provenance@"); expect(attestStep).not.toContain("continue-on-error: true"); - expect(promoteStep).toContain("steps.attest.outcome == 'success'"); - expect(wingetStep).toContain("steps.attest.outcome == 'success'"); + expect(existingStep).toContain("gh attestation verify"); + expect(existingStep).toContain('--signer-workflow "$signer_workflow"'); + expect(existingStep).toContain('--source-ref "refs/tags/$RELEASE_TAG"'); + expect(existingStep).toContain('--source-digest "$RELEASE_SOURCE_SHA"'); + expect(provenanceStep).toContain('echo "ready=true" >> "$GITHUB_OUTPUT"'); + expect(promoteStep).toContain("steps.provenance.outputs.ready == 'true'"); + expect(promoteStep).not.toContain("steps.attest_fresh.outcome"); + expect(wingetStep).toContain("steps.provenance.outputs.ready == 'true'"); + expect(wingetStep).not.toContain("steps.attest_fresh.outcome"); expect(releaseJob.slice(0, upload)).toContain( "rm -f dist/latest.mirror.json dist/latest.json", ); }); - it("attests only immutable Release bytes on a failed-job reuse", () => { + it("verifies existing immutable provenance without minting a rerun attestation", () => { const source = releaseJob.indexOf("- name: Resolve immutable release artifact source"); const validate = releaseJob.indexOf("- name: Validate final release artifacts"); - const attest = releaseJob.indexOf("- name: Attest build provenance"); - const promote = releaseJob.indexOf("- name: Promote CDN mirror latest"); + const attest = releaseJob.indexOf("- name: Attest fresh build provenance"); + const verifyExisting = releaseJob.indexOf( + "- name: Verify existing immutable release provenance", + ); + const provenance = releaseJob.indexOf("- name: Resolve provenance gate"); const sourceStep = releaseJob.slice(source, validate); - const attestStep = releaseJob.slice(attest, promote); + const attestStep = releaseJob.slice(attest, verifyExisting); + const existingStep = releaseJob.slice(verifyExisting, provenance); expect(sourceStep).toContain("gh release download"); expect(sourceStep).toContain("--pattern 'CodexAppManager*'"); expect(sourceStep).toContain("--pattern 'latest.json'"); expect(sourceStep).toContain('actual_digest="sha256:$(sha256sum "$file"'); expect(sourceStep).toContain('if [[ "$actual_digest" != "$expected_digest" ]]'); - expect(attestStep).toContain("dist/*"); - expect(attestStep).toContain("latest.json"); - expect(attestStep).not.toContain("SHA256SUMS"); - expect(attestStep).not.toContain("release-assets/*"); + expect(attestStep).toContain("steps.release_source.outputs.existing != 'true'"); + expect(attestStep).not.toContain("steps.release_source.outputs.existing == 'true'"); + expect(existingStep).toContain("steps.release_source.outputs.existing == 'true'"); + expect(existingStep).toContain("for file in dist/* latest.json"); + expect(existingStep).toContain("gh attestation verify"); + expect(existingStep).toContain("--deny-self-hosted-runners"); }); }); diff --git a/scripts/write-release-summary.mjs b/scripts/write-release-summary.mjs index 0c14802..8785983 100644 --- a/scripts/write-release-summary.mjs +++ b/scripts/write-release-summary.mjs @@ -176,7 +176,8 @@ rows.push(`| Mirror pre-publish verify | ${env.MIRROR_VERIFY_OUTCOME || "skipped rows.push(`| Mirror promote | ${env.MIRROR_PROMOTE_OUTCOME || "skipped"} |`); rows.push(`| winget dispatch | ${env.WINGET_OUTCOME || "skipped"} |`); rows.push(`| SBOM | ${env.SBOM_OUTCOME || "skipped"} |`); -rows.push(`| provenance attestation | ${env.ATTESTATION_OUTCOME || "skipped"} |`); +rows.push(`| fresh provenance attestation | ${env.ATTESTATION_OUTCOME || "skipped"} |`); +rows.push(`| provenance mode | ${env.PROVENANCE_MODE || "blocked"} |`); rows.push(""); rows.push( "winget dispatch only starts the downstream submission workflow; until the first package is accepted in microsoft/winget-pkgs, downstream failures are expected noise.", From dcfdfee84e5e3adbb27d1780ce0d56de99271d94 Mon Sep 17 00:00:00 2001 From: wangnov <48670012+Wangnov@users.noreply.github.com> Date: Sat, 11 Jul 2026 12:48:50 +0800 Subject: [PATCH 07/21] fix(delivery): harden signed update boundaries --- .github/workflows/ci.yml | 4 + .github/workflows/release.yml | 129 +- .github/workflows/win-installer-check.yml | 13 +- README.md | 20 +- cloudflare/manager-download-router/README.md | 14 +- crates/codex-mac-engine/Cargo.lock | 279 + crates/codex-mac-engine/Cargo.toml | 1 + crates/codex-mac-engine/src/download.rs | 68 +- crates/codex-mac-engine/src/network.rs | 34 +- crates/codex-mac-engine/src/sys.rs | 60 +- crates/codex-win-engine/Cargo.lock | 268 + crates/codex-win-engine/Cargo.toml | 1 + crates/codex-win-engine/src/download.rs | 57 +- crates/codex-win-engine/src/network.rs | 91 +- crates/codex-win-engine/src/sys.rs | 84 +- docs/code-signing-policy.md | 182 + docs/privacy.md | 140 + docs/release.md | 94 +- docs/releases/FALLBACK.md | 6 +- docs/releases/TEMPLATE.md | 6 +- docs/releases/v0.3.1.md | 6 +- docs/windows-signing.md | 269 +- eslint.config.js | 1 + scripts/assert-signpath-foundation-ready.ps1 | 24 + scripts/gen-updater-manifest.mjs | 24 + scripts/gen-updater-manifest.test.mjs | 57 + scripts/minisign-verify.mjs | 108 + scripts/minisign-verify.test.mjs | 110 + scripts/prepare-windows-authenticode.ps1 | 103 - scripts/release-identity-workflow.test.mjs | 16 + scripts/reuse-release-identity-signature.mjs | 172 + scripts/sign-windows-authenticode.ps1 | 129 - scripts/sync-mirror-identity.test.mjs | 92 + scripts/sync-mirror.sh | 69 +- scripts/verify-windows-authenticode.ps1 | 37 +- scripts/windows-packaged-smoke.ps1 | 12 +- src-tauri/Cargo.lock | 6 +- src-tauri/Cargo.toml | 10 +- src-tauri/installer/installer.nsi | 8 - src-tauri/src/app/logging.rs | 18 +- src-tauri/src/app/mac_update.rs | 84 +- src-tauri/src/app/staging.rs | 14 +- src-tauri/src/app/url_guard.rs | 21 + src-tauri/src/app/win_update.rs | 84 +- src-tauri/src/commands.rs | 555 +- src-tauri/src/errors.rs | 76 +- src/app/signingPolicyFiles.test.ts | 67 + .../tauri-plugin-updater-2.10.1/CHANGELOG.md | 210 + vendor/tauri-plugin-updater-2.10.1/Cargo.lock | 4580 +++++++++++++++++ vendor/tauri-plugin-updater-2.10.1/Cargo.toml | 185 + .../Cargo.toml.orig | 74 + .../tauri-plugin-updater-2.10.1/LICENSE.spdx | 20 + .../LICENSE_APACHE-2.0 | 177 + .../tauri-plugin-updater-2.10.1/LICENSE_MIT | 21 + vendor/tauri-plugin-updater-2.10.1/README.md | 102 + .../tauri-plugin-updater-2.10.1/SECURITY.md | 23 + .../tauri-plugin-updater-2.10.1/VENDORED.md | 48 + .../tauri-plugin-updater-2.10.1/api-iife.js | 1 + vendor/tauri-plugin-updater-2.10.1/banner.png | Bin 0 -> 57959 bytes vendor/tauri-plugin-updater-2.10.1/build.rs | 25 + .../guest-js/index.ts | 155 + .../tauri-plugin-updater-2.10.1/package.json | 29 + .../autogenerated/commands/check.toml | 13 + .../autogenerated/commands/download.toml | 13 + .../commands/download_and_install.toml | 13 + .../autogenerated/commands/install.toml | 13 + .../permissions/autogenerated/reference.md | 130 + .../permissions/default.toml | 18 + .../permissions/schemas/schema.json | 354 ++ .../rollup.config.js | 7 + .../src/commands.rs | 197 + .../tauri-plugin-updater-2.10.1/src/config.rs | 164 + .../tauri-plugin-updater-2.10.1/src/error.rs | 114 + vendor/tauri-plugin-updater-2.10.1/src/lib.rs | 240 + .../src/updater.rs | 1894 +++++++ .../tauri-plugin-updater-2.10.1/tsconfig.json | 4 + website/index.html | 11 + website/public/fonts/shs-bold.woff2 | Bin 242788 -> 247880 bytes website/public/fonts/shs-heavy.woff2 | Bin 237856 -> 243916 bytes website/scripts/subset-fonts.mjs | 7 +- website/src/locales/en.ts | 12 +- website/src/locales/zh.ts | 10 +- website/src/styles/sections.css | 20 + 83 files changed, 11860 insertions(+), 747 deletions(-) create mode 100644 docs/code-signing-policy.md create mode 100644 docs/privacy.md create mode 100644 scripts/assert-signpath-foundation-ready.ps1 create mode 100644 scripts/gen-updater-manifest.test.mjs create mode 100644 scripts/minisign-verify.mjs create mode 100644 scripts/minisign-verify.test.mjs delete mode 100644 scripts/prepare-windows-authenticode.ps1 create mode 100644 scripts/release-identity-workflow.test.mjs create mode 100644 scripts/reuse-release-identity-signature.mjs delete mode 100644 scripts/sign-windows-authenticode.ps1 create mode 100644 scripts/sync-mirror-identity.test.mjs create mode 100644 src/app/signingPolicyFiles.test.ts create mode 100644 vendor/tauri-plugin-updater-2.10.1/CHANGELOG.md create mode 100644 vendor/tauri-plugin-updater-2.10.1/Cargo.lock create mode 100644 vendor/tauri-plugin-updater-2.10.1/Cargo.toml create mode 100644 vendor/tauri-plugin-updater-2.10.1/Cargo.toml.orig create mode 100644 vendor/tauri-plugin-updater-2.10.1/LICENSE.spdx create mode 100644 vendor/tauri-plugin-updater-2.10.1/LICENSE_APACHE-2.0 create mode 100644 vendor/tauri-plugin-updater-2.10.1/LICENSE_MIT create mode 100644 vendor/tauri-plugin-updater-2.10.1/README.md create mode 100644 vendor/tauri-plugin-updater-2.10.1/SECURITY.md create mode 100644 vendor/tauri-plugin-updater-2.10.1/VENDORED.md create mode 100644 vendor/tauri-plugin-updater-2.10.1/api-iife.js create mode 100644 vendor/tauri-plugin-updater-2.10.1/banner.png create mode 100644 vendor/tauri-plugin-updater-2.10.1/build.rs create mode 100644 vendor/tauri-plugin-updater-2.10.1/guest-js/index.ts create mode 100644 vendor/tauri-plugin-updater-2.10.1/package.json create mode 100644 vendor/tauri-plugin-updater-2.10.1/permissions/autogenerated/commands/check.toml create mode 100644 vendor/tauri-plugin-updater-2.10.1/permissions/autogenerated/commands/download.toml create mode 100644 vendor/tauri-plugin-updater-2.10.1/permissions/autogenerated/commands/download_and_install.toml create mode 100644 vendor/tauri-plugin-updater-2.10.1/permissions/autogenerated/commands/install.toml create mode 100644 vendor/tauri-plugin-updater-2.10.1/permissions/autogenerated/reference.md create mode 100644 vendor/tauri-plugin-updater-2.10.1/permissions/default.toml create mode 100644 vendor/tauri-plugin-updater-2.10.1/permissions/schemas/schema.json create mode 100644 vendor/tauri-plugin-updater-2.10.1/rollup.config.js create mode 100644 vendor/tauri-plugin-updater-2.10.1/src/commands.rs create mode 100644 vendor/tauri-plugin-updater-2.10.1/src/config.rs create mode 100644 vendor/tauri-plugin-updater-2.10.1/src/error.rs create mode 100644 vendor/tauri-plugin-updater-2.10.1/src/lib.rs create mode 100644 vendor/tauri-plugin-updater-2.10.1/src/updater.rs create mode 100644 vendor/tauri-plugin-updater-2.10.1/tsconfig.json diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index da040fe..8f7224c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -65,6 +65,10 @@ jobs: run: cargo clippy --manifest-path src-tauri/Cargo.toml --workspace --all-targets -- -D warnings - name: Test (src-tauri) run: cargo test --manifest-path src-tauri/Cargo.toml --workspace + # The updater is a path-patched dependency, so its response-limit tests + # are not included in the application workspace test command above. + - name: Test vendored tauri updater bounds + run: cargo test --locked --manifest-path vendor/tauri-plugin-updater-2.10.1/Cargo.toml --lib # Path deps are not workspace members, so their unit/integration tests are # not covered by the step above. Run each engine crate explicitly so # mac/win pure-logic regressions fail required CI on every PR. diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f2b1185..91c8924 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,9 +1,9 @@ name: Release -# Tag-driven cross-platform release: -# build (Windows inside-out Authenticode; macOS unsigned) → macOS finalize -# (adaptive icon + inside-out Developer ID sign + notarize + staple + repackage) → collect → publish a -# GitHub Release with the Tauri updater manifest (latest.json). +# Tag-driven cross-platform release. Windows tag jobs currently fail closed at +# the SignPath readiness gate; therefore no release is published until the +# approved trusted-build integration replaces that gate. macOS continues to be +# built/finalized in the matrix, but the publish job requires every build job. # # Required repo secrets (Settings ▸ Secrets and variables ▸ Actions / release env): # APPLE_CERTIFICATE base64 of your "Developer ID Application" .p12 @@ -16,10 +16,11 @@ name: Release # TAURI_SIGNING_PRIVATE_KEY updater private key (string) # TAURI_SIGNING_PRIVATE_KEY_PASSWORD its password (empty if none) # -# Required Windows Authenticode (release environment; see docs/windows-signing.md): -# WINDOWS_CERTIFICATE base64 of OV/EV code-signing .pfx -# WINDOWS_CERTIFICATE_PASSWORD password for that .pfx -# vars.WINDOWS_TIMESTAMP_URL optional RFC3161 timestamp URL override +# Windows Authenticode status and migration contract: +# docs/code-signing-policy.md + docs/windows-signing.md +# Do not add PFX secrets. SignPath Foundation approval and trusted-build +# integration are pending; scripts/assert-signpath-foundation-ready.ps1 blocks +# Windows tag jobs until a separately reviewed implementation replaces it. on: push: @@ -29,6 +30,13 @@ on: permissions: contents: read +# A rerun for the same tag must observe any first attempt before touching the +# immutable per-version mirror keys (especially release-identity.json.sig, +# whose trusted-comment timestamp makes a fresh signature byte-different). +concurrency: + group: release-${{ github.ref }} + cancel-in-progress: false + jobs: build: if: ${{ github.ref_type == 'tag' && startsWith(github.ref_name, 'v') }} @@ -53,6 +61,17 @@ jobs: with: persist-credentials: false + # Intentionally has no bypass or success path. The Windows matrix failure + # prevents the dependent publish job from releasing a partial macOS-only + # set or silently shipping unsigned Windows artifacts. A future reviewed + # change must replace this step with the approved SignPath trusted-build + # request, manual approval, download, and verification flow. + - name: Assert SignPath Foundation readiness (fail closed) + if: matrix.os == 'windows' + shell: pwsh + run: | + & .\scripts\assert-signpath-foundation-ready.ps1 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 with: node-version: 20 @@ -94,38 +113,19 @@ jobs: security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" "$KC" security list-keychains -d user -s "$KC" $(security list-keychains -d user | sed s/\"//g) - # ── Windows: import the release PFX and generate a private, per-job Tauri - # config. certificateThumbprint signs the main PE; NSIS receives the - # same RFC3161 command via !uninstfinalize, then Tauri signs the outer - # installer. A missing certificate is a hard release failure. - - name: Prepare Windows Authenticode (required) - id: windows_signing - if: matrix.os == 'windows' - shell: pwsh - env: - WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }} - WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }} - WINDOWS_TIMESTAMP_URL: ${{ vars.WINDOWS_TIMESTAMP_URL }} - run: | - & .\scripts\prepare-windows-authenticode.ps1 ` - -ConfigPath ".tauri-authenticode.conf.json" - - # macOS remains unsigned here and is finalized below. Windows consumes the - # generated config so all three PE layers are signed during bundling. - - name: Build (Tauri) + # Build without an Authenticode configuration. The fail-closed readiness + # step above makes this unreachable for Windows today; even if that guard + # were removed alone, the required signature gates below would reject the + # unsigned output. Do not infer a two-pass SignPath design from this order. + - name: Build (Tauri, unsigned before platform finalization) shell: bash # Bundling downloads toolchains on the fly (e.g. the NSIS archive from # GitHub) which occasionally 504s and fails the whole release. Retry a # few times so a transient download hiccup doesn't sink the run — cargo # output is cached, so a retry mostly just re-runs the bundling step. run: | - args=(--target "${{ matrix.target }}") - if [ "${{ matrix.os }}" = "windows" ]; then - [ -f "$TAURI_AUTHENTICODE_CONFIG" ] || { echo "::error::missing generated Authenticode config"; exit 1; } - args+=(--config "$TAURI_AUTHENTICODE_CONFIG") - fi for attempt in 1 2 3; do - npm run tauri build -- "${args[@]}" && exit 0 + npm run tauri build -- --target "${{ matrix.target }}" && exit 0 echo "::warning::tauri build attempt ${attempt} failed (often a transient NSIS/toolchain download, e.g. HTTP 504) — retrying in 20s" sleep 20 done @@ -192,11 +192,13 @@ jobs: Write-Host "::notice::ARM64 main PE asserted machine=0xAA64 (cross-build on x64). Install/signature/upgrade/uninstall smoke runs below; only native ARM64 app launch still needs ARM64 hardware or trusted virtualization." } - # ── Windows: mandatory Authenticode + RFC3161 gate ──────────────────── + # ── Windows: future SignPath Authenticode verification contract ────── # Tauri restores target/.../release/codex-app-manager.exe to its # unsigned, unpatched build input after bundling, so only the outer # installer is inspectable here. Packaged smoke installs each target and - # verifies the signed embedded main executable and uninstall.exe. + # verifies the signed embedded main executable and uninstall.exe. These + # steps are intentionally unreachable until the readiness blocker is + # replaced by an approved integration; unsigned output still fails. - name: Verify Windows installer Authenticode (required) if: matrix.os == 'windows' shell: pwsh @@ -206,9 +208,8 @@ jobs: & .\scripts\verify-windows-authenticode.ps1 ` -Path $setup.FullName ` -Mode required ` - -ExpectedThumbprint $env:WINDOWS_CERTIFICATE_THUMBPRINT ` + -ExpectedSubject "SignPath Foundation" ` -RequireTimestamp ` - -SigningConfigPath $env:TAURI_AUTHENTICODE_CONFIG ` -Stage "sign-verify" - name: Verify signed installed app and uninstaller (all Windows targets) @@ -220,9 +221,8 @@ jobs: & .\scripts\windows-packaged-smoke.ps1 ` -Installer $setup.FullName ` -AuthenticodeMode required ` - -ExpectedThumbprint $env:WINDOWS_CERTIFICATE_THUMBPRINT ` + -ExpectedSubject "SignPath Foundation" ` -RequireTimestamp ` - -SigningConfigPath $env:TAURI_AUTHENTICODE_CONFIG ` -SkipLaunch:$skipLaunch # ── Windows: sign the NSIS installer for the updater ────────────────── @@ -311,25 +311,10 @@ jobs: & .\scripts\verify-windows-authenticode.ps1 ` -Path $setup.FullName ` -Mode required ` - -ExpectedThumbprint $env:WINDOWS_CERTIFICATE_THUMBPRINT ` + -ExpectedSubject "SignPath Foundation" ` -RequireTimestamp ` - -SigningConfigPath $env:TAURI_AUTHENTICODE_CONFIG ` -Stage "publish-sign-verify" - - name: Remove temporary Windows signing material - if: always() && matrix.os == 'windows' - shell: pwsh - run: | - if ($env:WINDOWS_CERTIFICATE_THUMBPRINT) { - Remove-Item -LiteralPath "Cert:\CurrentUser\My\$env:WINDOWS_CERTIFICATE_THUMBPRINT" -ErrorAction SilentlyContinue - } - if ($env:WINDOWS_CERTIFICATE_TEMP_DIR -and (Test-Path -LiteralPath $env:WINDOWS_CERTIFICATE_TEMP_DIR)) { - Remove-Item -LiteralPath $env:WINDOWS_CERTIFICATE_TEMP_DIR -Recurse -Force -ErrorAction SilentlyContinue - } - if ($env:TAURI_AUTHENTICODE_CONFIG -and (Test-Path -LiteralPath $env:TAURI_AUTHENTICODE_CONFIG)) { - Remove-Item -LiteralPath $env:TAURI_AUTHENTICODE_CONFIG -Force -ErrorAction SilentlyContinue - } - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: bundle-${{ matrix.target }} @@ -356,6 +341,10 @@ jobs: - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 with: node-version: 20 + cache: npm + + - name: Install release tooling + run: npm ci - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 with: @@ -403,6 +392,31 @@ jobs: ALLOW_PARTIAL_RELEASE: ${{ vars.ALLOW_PARTIAL_RELEASE }} run: node scripts/gen-updater-manifest.mjs "${{ github.ref_name }}" dist + - name: Prepare signed canonical release identity + env: + GITHUB_TOKEN: ${{ github.token }} + TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }} + TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }} + shell: bash + run: | + set -euo pipefail + status=0 + node scripts/reuse-release-identity-signature.mjs \ + release-identity.json release-identity.json.sig \ + src-tauri/tauri.conf.json || status=$? + if [ "$status" -eq 3 ]; then + echo "No reusable immutable identity signature; signing canonical identity." + npx tauri signer sign release-identity.json + elif [ "$status" -ne 0 ]; then + echo "::error::prior immutable release identity/signature is invalid or inconsistent" >&2 + exit "$status" + fi + test -s release-identity.json.sig + node scripts/minisign-verify.mjs \ + release-identity.json release-identity.json.sig \ + src-tauri/tauri.conf.json + cp release-identity.json release-identity.json.sig dist/ + # Stable releases mirror in two phases: stage immutable versioned assets # before GitHub Release publication, then promote latest.json only after # the GitHub Release succeeds. Pre-releases still skip the mirror entirely. @@ -423,7 +437,9 @@ jobs: run: | [ -f dist/latest.json ] || cp latest.json dist/latest.json bash scripts/sync-mirror.sh dist - rm -f dist/latest.mirror.json + # GitHub publishes root latest.json explicitly below. Keeping the + # staging copy under dist/* would submit the same immutable asset twice. + rm -f dist/latest.json dist/latest.mirror.json # ── release notes: the hand-written file from the version-bump PR # (docs/releases/.md, see docs/releases/TEMPLATE.md) wins; @@ -519,6 +535,7 @@ jobs: run: | [ -f dist/latest.json ] || cp latest.json dist/latest.json bash scripts/sync-mirror.sh dist + rm -f dist/latest.json dist/latest.mirror.json - name: Attest build provenance id: attest diff --git a/.github/workflows/win-installer-check.yml b/.github/workflows/win-installer-check.yml index 00dda68..c43e139 100644 --- a/.github/workflows/win-installer-check.yml +++ b/.github/workflows/win-installer-check.yml @@ -6,7 +6,8 @@ name: Windows installer check # install → first launch → upgrade → uninstall. # # Also probes Authenticode on the installer and installed PE files in -# non-blocking (optional) mode because pull requests never receive the PFX. +# non-blocking (optional) mode. Pull requests intentionally build unsigned; +# production signing remains blocked pending the SignPath Foundation migration. # # ARM64 is NOT smoke-tested here: GitHub-hosted runners are x64, and a # cross-built ARM64 PE is not runtime verification. See docs/windows-signing.md. @@ -27,8 +28,6 @@ on: - "package.json" - "package-lock.json" - "scripts/windows-*.ps1" - - "scripts/sign-windows-authenticode.ps1" - - "scripts/prepare-windows-authenticode.ps1" - "scripts/verify-windows-authenticode.ps1" - ".github/workflows/win-installer-check.yml" workflow_dispatch: @@ -64,9 +63,9 @@ jobs: # NSIS only — just needs to compile the template, resolve the brand images, # and link all languages. NO signing secrets here on purpose: this is a # pull_request trigger running PR-authored code (config/template/hooks), so - # exposing TAURI_SIGNING_PRIVATE_KEY / WINDOWS_CERTIFICATE would let a PR - # exfiltrate keys. createUpdaterArtifacts is off; Authenticode remains a - # release-time concern (release.yml) with mandatory inside-out signing. + # exposing TAURI_SIGNING_PRIVATE_KEY or any future SignPath credential + # would let a PR exfiltrate it. createUpdaterArtifacts is off; + # Authenticode remains a release-time concern (release.yml). - name: Build NSIS installer id: build shell: bash @@ -102,7 +101,7 @@ jobs: - name: Authenticode probe (optional / non-blocking) shell: pwsh env: - # Pull requests never receive the release PFX secret. + # Pull requests do not receive release-signing credentials. AUTHENTICODE_MODE: optional run: | & .\scripts\verify-windows-authenticode.ps1 ` diff --git a/README.md b/README.md index 0ac8d7d..cba16f5 100644 --- a/README.md +++ b/README.md @@ -28,7 +28,7 @@

- 官网 · Official Website · 中文 · English + 官网 · Official Website · 代码签名政策 · Code signing policy · 隐私政策 · Privacy policy · 中文 · English

--- @@ -89,7 +89,7 @@ brew install --cask wangnov/tap/codex-app-manager | Windows x64 | `CodexAppManager_x64-setup.exe` | [⤓ 镜像下载](https://codexapp.agentsmirror.com/manager/latest/CodexAppManager_x64-setup.exe) | | Windows ARM64 | `CodexAppManager_arm64-setup.exe` | [⤓ 镜像下载](https://codexapp.agentsmirror.com/manager/latest/CodexAppManager_arm64-setup.exe) | -macOS 版本经 **Developer ID 签名 + Apple 公证**,首次打开不会被 Gatekeeper 拦截。Windows 安装器(`CodexAppManager_x64-setup.exe` / `CodexAppManager_arm64-setup.exe`)当前**没有 Authenticode 代码签名**,首次运行可能出现 SmartScreen 提示;应用内自更新使用的 Tauri updater 签名只校验下载字节,不代表 Windows 发行者信任。详情见 [Windows signing and verification](docs/windows-signing.md)。 +macOS 版本经 **Developer ID 签名 + Apple 公证**,首次打开不会被 Gatekeeper 拦截。Windows 安装器(`CodexAppManager_x64-setup.exe` / `CodexAppManager_arm64-setup.exe`)当前**没有 Authenticode 代码签名**,首次运行可能出现 SmartScreen 提示;应用内自更新使用的 Tauri updater 签名只校验下载字节,不代表 Windows 发行者信任。SignPath Foundation 仍在申请/迁移中,新的 Windows tag 发布在集成验证完成前保持 fail-closed。详情见 [代码签名政策](docs/code-signing-policy.md)与 [Windows signing and verification](docs/windows-signing.md)。 下载后建议用同一 GitHub Release 的 `SHA256SUMS` 核验文件。Windows 可用 PowerShell,macOS 可用 `shasum`: @@ -135,7 +135,7 @@ Manager 通过上游镜像管理 Codex 桌面应用本体: ### 发布流水线 -打 `v*` tag 触发 `release.yml`:四平台构建(瞬时下载失败自动重试)→ macOS inside-out Developer ID 签名 + 公证 + 重打 updater 包 → Windows updater 产物签名 → 发布 GitHub Release → 自动同步到 R2 + IHEP 镜像。 +打 `v*` tag 触发 `release.yml`。当前 Windows job 会在构建前由 SignPath Foundation readiness gate 主动失败,因此整个发布不会继续,也不会悄悄发布 unsigned Windows 或仅 macOS 的不完整版本。待申请获批并以真实工件验证 trusted-build、人工审批、NSIS 边界和最终签名后,再由独立 PR 接回四平台发布链路。 ### 生态:codex-app-mirror @@ -161,6 +161,11 @@ npm run tauri:build # 本地构建(未签名) - 不伪造或重算 Sparkle 签名(只字节级复制官方签名) - 不替代 OpenAI、Microsoft Store 的官方分发渠道 +## 政策与隐私 + +- [代码签名政策](docs/code-signing-policy.md):SignPath Foundation 申请状态、项目角色、逐次人工审批、可签工件边界与发布硬门。 +- [隐私政策](docs/privacy.md):Manager 自身与 Codex 的更新检查、镜像/代理网络行为、本地数据和第三方连接元数据。 + ## 致谢 - **[LINUX DO](https://linux.do/)** 社区 —— 安装体验、更新链路、问题反馈的讨论都汇聚于此。 @@ -221,7 +226,7 @@ Grab your platform's file from the [latest GitHub Release](https://github.com/Wa | Windows x64 | `CodexAppManager_x64-setup.exe` | [⤓ mirror](https://codexapp.agentsmirror.com/manager/latest/CodexAppManager_x64-setup.exe) | | Windows ARM64 | `CodexAppManager_arm64-setup.exe` | [⤓ mirror](https://codexapp.agentsmirror.com/manager/latest/CodexAppManager_arm64-setup.exe) | -The macOS builds are **Developer ID signed + Apple notarized**, so Gatekeeper won't block first launch. The Windows installers (`CodexAppManager_x64-setup.exe` / `CodexAppManager_arm64-setup.exe`) are **not Authenticode-signed** yet, so SmartScreen may warn on first run; the Tauri updater signature used for in-app updates verifies bytes only and is not Windows publisher trust. See [Windows signing and verification](docs/windows-signing.md). +The macOS builds are **Developer ID signed + Apple notarized**, so Gatekeeper won't block first launch. The Windows installers (`CodexAppManager_x64-setup.exe` / `CodexAppManager_arm64-setup.exe`) are **not Authenticode-signed** yet, so SmartScreen may warn on first run; the Tauri updater signature used for in-app updates verifies bytes only and is not Windows publisher trust. The SignPath Foundation application/migration is pending, and new Windows tag publication remains fail-closed until the integration is proven. See the [code signing policy](docs/code-signing-policy.md) and [Windows signing and verification](docs/windows-signing.md). After downloading, compare the file with `SHA256SUMS` from the same GitHub Release. Use PowerShell on Windows or `shasum` on macOS: @@ -267,7 +272,7 @@ Self-update and payload downloads share the `codexapp.agentsmirror.com` link, fr ### Release pipeline -Pushing a `v*` tag triggers `release.yml`: four-platform build (with automatic retry on transient download hiccups) → macOS inside-out Developer ID signing + notarization + updater repackage → Windows updater artifact signing → publish the GitHub Release → auto-sync to the R2 + IHEP mirror. +Pushing a `v*` tag triggers `release.yml`. Today the Windows jobs deliberately fail at the SignPath Foundation readiness gate before building, so the full release cannot proceed and cannot silently publish unsigned Windows or a macOS-only partial set. A separate reviewed PR will restore the four-platform path only after real artifacts prove the trusted build, manual approval, NSIS boundary, and final signatures. ### Ecosystem: codex-app-mirror @@ -293,6 +298,11 @@ npm run tauri:build # local (unsigned) build - Does not forge or recompute Sparkle signatures (official signatures are copied verbatim) - Is not a replacement for official OpenAI / Microsoft Store distribution +## Policies & privacy + +- [Code signing policy](docs/code-signing-policy.md):SignPath Foundation application state, project roles, per-release human approval, eligible-artifact boundaries, and release gates. +- [Privacy policy](docs/privacy.md):Manager/Codex update checks, mirror and proxy behavior, local data, and ordinary third-party connection metadata. + ## Acknowledgements - **[LINUX DO](https://linux.do/)** community — the home for feedback on install experience, update links, and bug reports. diff --git a/cloudflare/manager-download-router/README.md b/cloudflare/manager-download-router/README.md index 920e514..0e72b28 100644 --- a/cloudflare/manager-download-router/README.md +++ b/cloudflare/manager-download-router/README.md @@ -12,8 +12,13 @@ the manager's **own** bucket so the two never mix: a presigned **IHEP S3** URL, once the `SECONDARY_S3_*` secrets are set. Until then CN also falls back to R2 (still far better than GitHub). -The updater (`src-tauri/tauri.conf.json`) already checks -`…/manager/latest.json` first, GitHub second — no app change needed. +The updater (`src-tauri/tauri.conf.json`) checks `…/manager/latest.json` first +and GitHub second. A mirror manifest is accepted only after its version, +platform, artifact basename, release-note hash, updater signature, and SHA-256 +match the pinned-key-signed `/release-identity.json(.sig)` from the same +source. This keeps mainland-China discovery/download on the mirror without +letting the URL-rewritten (and therefore unsigned) `latest.json` invent a +candidate or replay an older signed package as a higher version. ## Why a separate latest.json on the mirror `latest.json`'s embedded signatures sign the artifact **bytes**, not the URL, so @@ -29,6 +34,11 @@ could serve a previous version's bytes against the new signature. (The seeded v0.1.8 predates this and lives at flat `…/manager/` keys — still self-consistent; v0.1.9+ use the versioned layout.) +`release-identity.json` and `release-identity.json.sig` are also immutable +per-version objects. Release reruns reuse a previously verified signature, and +the sync script rejects a byte-different overwrite (the minisign trusted-comment +timestamp otherwise makes a freshly generated signature differ on every run). + > ⚠️ The mirror's `latest.json` MUST be refreshed on every stable release, or the > first endpoint serves a stale version and **blocks** updates. That's why the > `release.yml` "Sync to CDN mirror" step exists. diff --git a/crates/codex-mac-engine/Cargo.lock b/crates/codex-mac-engine/Cargo.lock index 3f55b8c..f17dde6 100644 --- a/crates/codex-mac-engine/Cargo.lock +++ b/crates/codex-mac-engine/Cargo.lock @@ -58,6 +58,7 @@ dependencies = [ "roxmltree", "serde", "thiserror", + "url", "uuid", ] @@ -133,6 +134,17 @@ dependencies = [ "crypto-common", ] +[[package]] +name = "displaydoc" +version = "0.2.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1ac70aa55017e108007fbaf5aa0f54b021c98f92ff8af59d42eda9da96e3dd4f" +dependencies = [ + "proc-macro2", + "quote", + "syn", +] + [[package]] name = "ed25519" version = "2.2.3" @@ -175,6 +187,15 @@ version = "0.1.5" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2" +[[package]] +name = "form_urlencoded" +version = "1.2.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf" +dependencies = [ + "percent-encoding", +] + [[package]] name = "futures-core" version = "0.3.32" @@ -254,12 +275,115 @@ version = "0.5.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea" +[[package]] +name = "icu_collections" +version = "2.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2984d1cd16c883d7935b9e07e44071dca8d917fd52ecc02c04d5fa0b5a3f191c" +dependencies = [ + "displaydoc", + "potential_utf", + "utf8_iter", + "yoke", + "zerofrom", + "zerovec", +] + +[[package]] +name = "icu_locale_core" +version = "2.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "92219b62b3e2b4d88ac5119f8904c10f8f61bf7e95b640d25ba3075e6cac2c29" +dependencies = [ + "displaydoc", + "litemap", + "tinystr", + "writeable", + "zerovec", +] + +[[package]] +name = "icu_normalizer" +version = "2.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c56e5ee99d6e3d33bd91c5d85458b6005a22140021cc324cea84dd0e72cff3b4" +dependencies = [ + "icu_collections", + "icu_normalizer_data", + "icu_properties", + "icu_provider", + "smallvec", + "zerovec", +] + +[[package]] +name = "icu_normalizer_data" +version = "2.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "da3be0ae77ea334f4da67c12f149704f19f81d1adf7c51cf482943e84a2bad38" + +[[package]] +name = "icu_properties" +version = "2.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bee3b67d0ea5c2cca5003417989af8996f8604e34fb9ddf96208a033901e70de" +dependencies = [ + "icu_collections", + "icu_locale_core", + "icu_properties_data", + "icu_provider", + "zerotrie", + "zerovec", +] + +[[package]] +name = "icu_properties_data" +version = "2.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8e2bbb201e0c04f7b4b3e14382af113e17ba4f63e2c9d2ee626b720cbce54a14" + +[[package]] +name = "icu_provider" +version = "2.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "139c4cf31c8b5f33d7e199446eff9c1e02decfc2f0eec2c8d71f65befa45b421" +dependencies = [ + "displaydoc", + "icu_locale_core", + "writeable", + "yoke", + "zerofrom", + "zerotrie", + "zerovec", +] + [[package]] name = "id-arena" version = "2.3.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954" +[[package]] +name = "idna" +version = "1.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de" +dependencies = [ + "idna_adapter", + "smallvec", + "utf8_iter", +] + +[[package]] +name = "idna_adapter" +version = "1.2.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714" +dependencies = [ + "icu_normalizer", + "icu_properties", +] + [[package]] name = "indexmap" version = "2.14.0" @@ -301,6 +425,12 @@ version = "0.2.186" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66" +[[package]] +name = "litemap" +version = "0.8.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0" + [[package]] name = "log" version = "0.4.32" @@ -319,6 +449,12 @@ version = "1.21.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50" +[[package]] +name = "percent-encoding" +version = "2.3.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220" + [[package]] name = "pin-project-lite" version = "0.2.17" @@ -335,6 +471,15 @@ dependencies = [ "spki", ] +[[package]] +name = "potential_utf" +version = "0.1.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0103b1cef7ec0cf76490e969665504990193874ea05c85ff9bab8b911d0a0564" +dependencies = [ + "zerovec", +] + [[package]] name = "prettyplease" version = "0.2.37" @@ -474,6 +619,12 @@ version = "0.4.12" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5" +[[package]] +name = "smallvec" +version = "1.15.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90" + [[package]] name = "spki" version = "0.7.3" @@ -484,6 +635,12 @@ dependencies = [ "der", ] +[[package]] +name = "stable_deref_trait" +version = "1.2.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596" + [[package]] name = "subtle" version = "2.6.1" @@ -501,6 +658,17 @@ dependencies = [ "unicode-ident", ] +[[package]] +name = "synstructure" +version = "0.13.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2" +dependencies = [ + "proc-macro2", + "quote", + "syn", +] + [[package]] name = "thiserror" version = "2.0.18" @@ -521,6 +689,16 @@ dependencies = [ "syn", ] +[[package]] +name = "tinystr" +version = "0.8.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c8323304221c2a851516f22236c5722a72eaa19749016521d6dff0824447d96d" +dependencies = [ + "displaydoc", + "zerovec", +] + [[package]] name = "typenum" version = "1.20.1" @@ -539,6 +717,24 @@ version = "0.2.6" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853" +[[package]] +name = "url" +version = "2.5.8" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed" +dependencies = [ + "form_urlencoded", + "idna", + "percent-encoding", + "serde", +] + +[[package]] +name = "utf8_iter" +version = "1.0.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be" + [[package]] name = "uuid" version = "1.23.3" @@ -753,12 +949,95 @@ dependencies = [ "wasmparser", ] +[[package]] +name = "writeable" +version = "0.6.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4" + +[[package]] +name = "yoke" +version = "0.8.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5" +dependencies = [ + "stable_deref_trait", + "yoke-derive", + "zerofrom", +] + +[[package]] +name = "yoke-derive" +version = "0.8.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e" +dependencies = [ + "proc-macro2", + "quote", + "syn", + "synstructure", +] + +[[package]] +name = "zerofrom" +version = "0.1.8" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272" +dependencies = [ + "zerofrom-derive", +] + +[[package]] +name = "zerofrom-derive" +version = "0.1.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1" +dependencies = [ + "proc-macro2", + "quote", + "syn", + "synstructure", +] + [[package]] name = "zeroize" version = "1.8.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0" +[[package]] +name = "zerotrie" +version = "0.2.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf" +dependencies = [ + "displaydoc", + "yoke", + "zerofrom", +] + +[[package]] +name = "zerovec" +version = "0.11.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239" +dependencies = [ + "yoke", + "zerofrom", + "zerovec-derive", +] + +[[package]] +name = "zerovec-derive" +version = "0.11.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555" +dependencies = [ + "proc-macro2", + "quote", + "syn", +] + [[package]] name = "zmij" version = "1.0.21" diff --git a/crates/codex-mac-engine/Cargo.toml b/crates/codex-mac-engine/Cargo.toml index 80d1acf..dfa917e 100644 --- a/crates/codex-mac-engine/Cargo.toml +++ b/crates/codex-mac-engine/Cargo.toml @@ -14,6 +14,7 @@ base64 = "0.22" log = "0.4" uuid = { version = "1", features = ["v4"] } libc = "0.2" +url = "2.5" [[bin]] name = "mac_plan" diff --git a/crates/codex-mac-engine/src/download.rs b/crates/codex-mac-engine/src/download.rs index 745a914..94c4246 100644 --- a/crates/codex-mac-engine/src/download.rs +++ b/crates/codex-mac-engine/src/download.rs @@ -11,7 +11,7 @@ use std::sync::atomic::{AtomicBool, Ordering}; use std::time::{Duration, Instant}; use crate::limits::MAX_PACKAGE_BYTES; -use crate::network::NetworkConfig; +use crate::network::{safe_url_origin, NetworkConfig}; use crate::EngineError; const CURL: &str = "/usr/bin/curl"; @@ -113,11 +113,17 @@ fn partial_path(dest: &Path) -> PathBuf { dest.with_file_name(format!("{file_name}.part")) } -fn url_host(url: &str) -> &str { - url.split("://") - .nth(1) - .and_then(|rest| rest.split('/').next()) - .unwrap_or("") +fn curl_download_failure(url: &str, exit: &str) -> EngineError { + let source = safe_url_origin(url); + EngineError::Io(format!("curl download failed exit={exit} source={source}")) +} + +fn curl_download_stalled(url: &str) -> EngineError { + let source = safe_url_origin(url); + EngineError::Io(format!( + "curl download stalled for {} seconds source={source}", + STALL_TIMEOUT.as_secs() + )) } fn is_cancelled_error(err: &EngineError) -> bool { @@ -132,7 +138,7 @@ fn run_curl( on_progress: &dyn Fn(u64), network: &NetworkConfig, ) -> Result<(), EngineError> { - let source = url_host(url); + let source = safe_url_origin(url); let dest_arg = dest.to_string_lossy().into_owned(); let max_bytes = max_bytes.to_string(); let mut args = vec![ @@ -189,13 +195,11 @@ fn run_curl( // Carry the curl exit code so the app-layer classifier can // tell a connect / timeout / write failure apart (stderr is // not piped for the streamed download). - return Err(EngineError::Io(format!( - "curl download failed exit={} url={url}", - status - .code() - .map(|c| c.to_string()) - .unwrap_or_else(|| "signal".to_string()), - ))); + let exit = status + .code() + .map(|c| c.to_string()) + .unwrap_or_else(|| "signal".to_string()); + return Err(curl_download_failure(url, &exit)); } break; } @@ -211,10 +215,7 @@ fn run_curl( log::warn!( "macOS download stalled source={source} downloaded={downloaded} stall_secs={stall_secs}" ); - return Err(EngineError::Io(format!( - "curl download stalled for {} seconds: {url}", - STALL_TIMEOUT.as_secs() - ))); + return Err(curl_download_stalled(url)); } on_progress(downloaded); std::thread::sleep(Duration::from_millis(300)); @@ -258,7 +259,7 @@ pub fn download_to_with_progress_bounded_with_network( let part = partial_path(dest); let should_resume = part.metadata().map(|m| m.len() > 0).unwrap_or(false); - let source = url_host(url); + let source = safe_url_origin(url); let dest_name = dest .file_name() .and_then(|name| name.to_str()) @@ -312,6 +313,35 @@ pub fn read_file(path: &Path) -> Result, EngineError> { mod tests { use super::*; + #[test] + fn failure_diagnostics_omit_url_credentials_path_query_and_fragment() { + let raw = "https://basic-user:basic-pass@downloads.example:8443/private/file.zip?X-Amz-Credential=secret#fragment-secret"; + let failed = curl_download_failure(raw, "22").to_string(); + let stalled = curl_download_stalled(raw).to_string(); + + assert_eq!( + failed, + "io error: curl download failed exit=22 source=https://downloads.example:8443" + ); + assert_eq!( + stalled, + format!( + "io error: curl download stalled for {} seconds source=https://downloads.example:8443", + STALL_TIMEOUT.as_secs() + ) + ); + for secret in [ + "basic-user", + "basic-pass", + "/private/file.zip", + "X-Amz-Credential", + "fragment-secret", + ] { + assert!(!failed.contains(secret), "failure leaked {secret}"); + assert!(!stalled.contains(secret), "stall leaked {secret}"); + } + } + // Mirrors the Windows engine's guard test: the guard serializes downloads, // pause vs cancel set the discard flag correctly, and dropping the guard // clears every flag so the next download starts clean. No network/curl is diff --git a/crates/codex-mac-engine/src/network.rs b/crates/codex-mac-engine/src/network.rs index f9424f9..db6df04 100644 --- a/crates/codex-mac-engine/src/network.rs +++ b/crates/codex-mac-engine/src/network.rs @@ -1,5 +1,22 @@ use std::process::Command; +use url::Url; + +/// Return only a URL's parsed origin for diagnostics. The original URL still +/// goes to curl, but credentials, path, query, and fragment must never cross +/// into persisted errors or logs. +pub(crate) fn safe_url_origin(raw: &str) -> String { + let Ok(url) = Url::parse(raw.trim()) else { + return "".to_string(); + }; + let origin = url.origin().ascii_serialization(); + if origin == "null" { + "".to_string() + } else { + origin + } +} + #[derive(Debug, Clone, PartialEq, Eq)] pub enum ProxyMode { System, @@ -65,7 +82,22 @@ impl Default for NetworkConfig { #[cfg(test)] mod tests { - use super::NetworkConfig; + use super::{safe_url_origin, NetworkConfig}; + + #[test] + fn diagnostic_origin_strips_all_sensitive_url_components() { + assert_eq!( + safe_url_origin( + "https://basic-user:basic-pass@downloads.example:8443/private/file.zip?X-Amz-Credential=secret#fragment-secret", + ), + "https://downloads.example:8443" + ); + assert_eq!( + safe_url_origin("https://downloads.example/public/file.zip"), + "https://downloads.example" + ); + assert_eq!(safe_url_origin("not a URL secret-token"), ""); + } #[test] fn direct_proxy_mode_disables_curl_proxy_resolution() { diff --git a/crates/codex-mac-engine/src/sys.rs b/crates/codex-mac-engine/src/sys.rs index 533c11b..dde70aa 100644 --- a/crates/codex-mac-engine/src/sys.rs +++ b/crates/codex-mac-engine/src/sys.rs @@ -10,7 +10,7 @@ use std::path::Path; use std::process::Command; use crate::limits::MAX_TEXT_BYTES; -use crate::network::NetworkConfig; +use crate::network::{safe_url_origin, NetworkConfig}; use crate::EngineError; const CURL: &str = "/usr/bin/curl"; @@ -20,15 +20,12 @@ fn text_from_curl(url: &str, output: std::process::Output) -> Result MAX_TEXT_BYTES as usize { return Err(EngineError::Io(format!( @@ -38,6 +35,14 @@ fn text_from_curl(url: &str, output: std::process::Output) -> Result EngineError { + let source = safe_url_origin(url); + // Do not carry curl stderr across the persisted-log boundary: curl may + // repeat or normalize a credentialed/presigned URL there. Exit code plus + // safe origin preserve the classifier and actionable source diagnostics. + EngineError::Io(format!("curl failed for source={source} exit={exit}")) +} + /// Fetch a small text resource (the appcast) over HTTPS via system `curl`. pub fn fetch_text(url: &str) -> Result { fetch_text_with_network(url, &NetworkConfig::system()) @@ -296,9 +301,7 @@ fn quarantine_flags_indicate_translocation(value: &str) -> bool { const QTN_FLAG_DO_NOT_TRANSLOCATE: u32 = 0x0100; let flags_hex = value.split(';').next().unwrap_or("").trim(); match u32::from_str_radix(flags_hex, 16) { - Ok(flags) => { - flags & QTN_FLAG_TRANSLOCATE != 0 && flags & QTN_FLAG_DO_NOT_TRANSLOCATE == 0 - } + Ok(flags) => flags & QTN_FLAG_TRANSLOCATE != 0 && flags & QTN_FLAG_DO_NOT_TRANSLOCATE == 0, Err(_) => true, } } @@ -373,6 +376,32 @@ pub fn read_bundle_short_version(app: &str) -> Option { } } +#[cfg(test)] +mod url_diagnostic_tests { + use super::text_curl_failure; + + #[test] + fn text_fetch_failure_keeps_only_safe_origin_and_exit_code() { + let raw = "https://basic-user:basic-pass@appcast.example/feed.xml?token=presigned#private"; + let error = text_curl_failure(raw, "22"); + let diagnostic = error.to_string(); + + assert_eq!( + diagnostic, + "io error: curl failed for source=https://appcast.example exit=22" + ); + for secret in [ + "basic-user", + "basic-pass", + "/feed.xml", + "presigned", + "private", + ] { + assert!(!diagnostic.contains(secret), "diagnostic leaked {secret}"); + } + } +} + #[cfg(test)] mod quarantine_tests { use super::quarantine_flags_indicate_translocation; @@ -442,7 +471,10 @@ mod tests { installed_codex_build_at_path(&renamed), Some((renamed.clone(), 5059)) ); - assert_eq!(read_bundle_identifier(&renamed).as_deref(), Some(CODEX_BUNDLE_ID)); + assert_eq!( + read_bundle_identifier(&renamed).as_deref(), + Some(CODEX_BUNDLE_ID) + ); let _ = fs::remove_dir_all(&root); } diff --git a/crates/codex-win-engine/Cargo.lock b/crates/codex-win-engine/Cargo.lock index 5d3728c..96d0a0f 100644 --- a/crates/codex-win-engine/Cargo.lock +++ b/crates/codex-win-engine/Cargo.lock @@ -60,6 +60,7 @@ dependencies = [ "serde_json", "sha2", "thiserror", + "url", "uuid", "windows-sys", "zip", @@ -153,6 +154,15 @@ version = "0.1.5" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2" +[[package]] +name = "form_urlencoded" +version = "1.2.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf" +dependencies = [ + "percent-encoding", +] + [[package]] name = "futures-core" version = "0.3.32" @@ -221,12 +231,115 @@ version = "0.5.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea" +[[package]] +name = "icu_collections" +version = "2.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2984d1cd16c883d7935b9e07e44071dca8d917fd52ecc02c04d5fa0b5a3f191c" +dependencies = [ + "displaydoc", + "potential_utf", + "utf8_iter", + "yoke", + "zerofrom", + "zerovec", +] + +[[package]] +name = "icu_locale_core" +version = "2.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "92219b62b3e2b4d88ac5119f8904c10f8f61bf7e95b640d25ba3075e6cac2c29" +dependencies = [ + "displaydoc", + "litemap", + "tinystr", + "writeable", + "zerovec", +] + +[[package]] +name = "icu_normalizer" +version = "2.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c56e5ee99d6e3d33bd91c5d85458b6005a22140021cc324cea84dd0e72cff3b4" +dependencies = [ + "icu_collections", + "icu_normalizer_data", + "icu_properties", + "icu_provider", + "smallvec", + "zerovec", +] + +[[package]] +name = "icu_normalizer_data" +version = "2.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "da3be0ae77ea334f4da67c12f149704f19f81d1adf7c51cf482943e84a2bad38" + +[[package]] +name = "icu_properties" +version = "2.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bee3b67d0ea5c2cca5003417989af8996f8604e34fb9ddf96208a033901e70de" +dependencies = [ + "icu_collections", + "icu_locale_core", + "icu_properties_data", + "icu_provider", + "zerotrie", + "zerovec", +] + +[[package]] +name = "icu_properties_data" +version = "2.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8e2bbb201e0c04f7b4b3e14382af113e17ba4f63e2c9d2ee626b720cbce54a14" + +[[package]] +name = "icu_provider" +version = "2.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "139c4cf31c8b5f33d7e199446eff9c1e02decfc2f0eec2c8d71f65befa45b421" +dependencies = [ + "displaydoc", + "icu_locale_core", + "writeable", + "yoke", + "zerofrom", + "zerotrie", + "zerovec", +] + [[package]] name = "id-arena" version = "2.3.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954" +[[package]] +name = "idna" +version = "1.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de" +dependencies = [ + "idna_adapter", + "smallvec", + "utf8_iter", +] + +[[package]] +name = "idna_adapter" +version = "1.2.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714" +dependencies = [ + "icu_normalizer", + "icu_properties", +] + [[package]] name = "indexmap" version = "2.14.0" @@ -268,6 +381,12 @@ version = "0.2.186" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66" +[[package]] +name = "litemap" +version = "0.8.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0" + [[package]] name = "log" version = "0.4.32" @@ -296,12 +415,27 @@ version = "1.21.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50" +[[package]] +name = "percent-encoding" +version = "2.3.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220" + [[package]] name = "pin-project-lite" version = "0.2.17" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd" +[[package]] +name = "potential_utf" +version = "0.1.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0103b1cef7ec0cf76490e969665504990193874ea05c85ff9bab8b911d0a0564" +dependencies = [ + "zerovec", +] + [[package]] name = "prettyplease" version = "0.2.37" @@ -420,6 +554,18 @@ version = "0.4.12" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5" +[[package]] +name = "smallvec" +version = "1.15.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90" + +[[package]] +name = "stable_deref_trait" +version = "1.2.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596" + [[package]] name = "syn" version = "2.0.117" @@ -431,6 +577,17 @@ dependencies = [ "unicode-ident", ] +[[package]] +name = "synstructure" +version = "0.13.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2" +dependencies = [ + "proc-macro2", + "quote", + "syn", +] + [[package]] name = "thiserror" version = "2.0.18" @@ -451,6 +608,16 @@ dependencies = [ "syn", ] +[[package]] +name = "tinystr" +version = "0.8.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c8323304221c2a851516f22236c5722a72eaa19749016521d6dff0824447d96d" +dependencies = [ + "displaydoc", + "zerovec", +] + [[package]] name = "typenum" version = "1.20.1" @@ -469,6 +636,24 @@ version = "0.2.6" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853" +[[package]] +name = "url" +version = "2.5.8" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed" +dependencies = [ + "form_urlencoded", + "idna", + "percent-encoding", + "serde", +] + +[[package]] +name = "utf8_iter" +version = "1.0.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be" + [[package]] name = "uuid" version = "1.23.3" @@ -692,6 +877,89 @@ dependencies = [ "wasmparser", ] +[[package]] +name = "writeable" +version = "0.6.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4" + +[[package]] +name = "yoke" +version = "0.8.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5" +dependencies = [ + "stable_deref_trait", + "yoke-derive", + "zerofrom", +] + +[[package]] +name = "yoke-derive" +version = "0.8.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e" +dependencies = [ + "proc-macro2", + "quote", + "syn", + "synstructure", +] + +[[package]] +name = "zerofrom" +version = "0.1.8" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272" +dependencies = [ + "zerofrom-derive", +] + +[[package]] +name = "zerofrom-derive" +version = "0.1.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1" +dependencies = [ + "proc-macro2", + "quote", + "syn", + "synstructure", +] + +[[package]] +name = "zerotrie" +version = "0.2.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf" +dependencies = [ + "displaydoc", + "yoke", + "zerofrom", +] + +[[package]] +name = "zerovec" +version = "0.11.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239" +dependencies = [ + "yoke", + "zerofrom", + "zerovec-derive", +] + +[[package]] +name = "zerovec-derive" +version = "0.11.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555" +dependencies = [ + "proc-macro2", + "quote", + "syn", +] + [[package]] name = "zip" version = "2.4.2" diff --git a/crates/codex-win-engine/Cargo.toml b/crates/codex-win-engine/Cargo.toml index a535194..1a64c2d 100644 --- a/crates/codex-win-engine/Cargo.toml +++ b/crates/codex-win-engine/Cargo.toml @@ -14,6 +14,7 @@ sha2 = "0.10" thiserror = "2.0" uuid = { version = "1", features = ["v4"] } zip = { version = "2", default-features = false, features = ["deflate"] } +url = "2.5" [target.'cfg(windows)'.dependencies] windows-sys = { version = "0.61.2", features = ["Win32_Foundation", "Win32_System_SystemInformation", "Win32_System_Threading"] } diff --git a/crates/codex-win-engine/src/download.rs b/crates/codex-win-engine/src/download.rs index bf98031..ebfc50b 100644 --- a/crates/codex-win-engine/src/download.rs +++ b/crates/codex-win-engine/src/download.rs @@ -5,7 +5,10 @@ use std::sync::atomic::{AtomicBool, Ordering}; use sha2::{Digest, Sha256}; use crate::limits::MAX_PACKAGE_BYTES; -use crate::network::{is_schannel_revocation_offline, NetworkConfig, SchannelRevocationCheck}; +use crate::network::{ + is_schannel_revocation_offline, safe_curl_failure_message, safe_url_host, NetworkConfig, + SchannelRevocationCheck, +}; use crate::process::{ curl_exe, hidden_command, run_with_progress, RunError, RunLimits, TimeoutKind, }; @@ -91,13 +94,6 @@ fn partial_path(dest: &Path) -> PathBuf { dest.with_file_name(format!("{file_name}.part")) } -fn url_host(url: &str) -> &str { - url.split("://") - .nth(1) - .and_then(|rest| rest.split('/').next()) - .unwrap_or("") -} - fn proxy_env_summary() -> String { let vars = ["HTTPS_PROXY", "HTTP_PROXY", "ALL_PROXY", "NO_PROXY"]; let configured = vars @@ -116,14 +112,7 @@ fn proxy_env_summary() -> String { } fn curl_failure_message(url: &str, exit_code: Option, stderr: &str) -> String { - let base = format!( - "curl failed for host={} exit={}: stderr='{}'", - url_host(url), - exit_code - .map(|code| code.to_string()) - .unwrap_or_else(|| "signal".to_string()), - stderr.trim(), - ); + let base = safe_curl_failure_message(url, exit_code, stderr); // Append the proxy diagnostic only for connectivity failures — pasting it // onto write / disk / HTTP errors (e.g. exit 23) only misleads. if is_connectivity_exit(exit_code) { @@ -230,9 +219,7 @@ fn run_curl_once( let downloaded = std::fs::metadata(dest).map(|m| m.len()).unwrap_or(0); return match kind { TimeoutKind::Stall => { - log::warn!( - "Windows download stalled source={source} downloaded={downloaded}" - ); + log::warn!("Windows download stalled source={source} downloaded={downloaded}"); Err(CurlAttemptError::Other(format!( "curl download stalled (no progress) source={source} downloaded={downloaded}" ))) @@ -274,8 +261,8 @@ struct CurlRun<'a> { } impl CurlRun<'_> { - fn source(&self) -> &str { - url_host(self.url) + fn source(&self) -> String { + safe_url_host(self.url) } } @@ -293,7 +280,7 @@ fn run_curl_with_mode( run.network, revocation_check, ); - run_curl_once(run.source(), run.dest, args, run.on_progress) + run_curl_once(&run.source(), run.dest, args, run.on_progress) } fn retry_with_schannel_no_revoke( @@ -326,7 +313,7 @@ fn run_curl( on_progress: &dyn Fn(u64), network: &NetworkConfig, ) -> Result<(), String> { - let source = url_host(url); + let source = safe_url_host(url); let dest = dest.to_string_lossy().into_owned(); let max_bytes = max_bytes.to_string(); let run = CurlRun { @@ -440,7 +427,7 @@ pub fn download_to_with_progress_bounded_with_network( let part = partial_path(dest); let should_resume = part.metadata().map(|m| m.len() > 0).unwrap_or(false); - let source = url_host(url); + let source = safe_url_host(url); let dest_name = dest .file_name() .and_then(|name| name.to_str()) @@ -532,6 +519,26 @@ mod tests { assert!(!cancel_active_download()); } + #[test] + fn persisted_download_failure_uses_safe_host_and_reason_only() { + let raw = "https://basic-user:basic-pass@downloads.example/private/Codex.msix?token=presigned-secret#fragment-secret"; + let stderr = format!("curl: (6) Could not resolve host while requesting {raw}"); + let message = curl_failure_message(raw, Some(6), &stderr); + + assert!(message.starts_with( + "curl failed for host=downloads.example exit=6 reason='DNS resolution failed'" + )); + for secret in [ + "basic-user", + "basic-pass", + "/private/Codex.msix", + "presigned-secret", + "fragment-secret", + ] { + assert!(!message.contains(secret), "download error leaked {secret}"); + } + } + #[test] fn curl_args_keep_modern_progress_flag_by_default() { let args = curl_args( @@ -620,7 +627,7 @@ mod tests { seen.lock().unwrap().push(downloaded); }); if let Err(EngineError::Io(message)) = &result { - if message.contains("Protocol \"file\" disabled") { + if message.contains("reason='protocol disabled'") { let _ = std::fs::remove_dir_all(&root); return; } diff --git a/crates/codex-win-engine/src/network.rs b/crates/codex-win-engine/src/network.rs index f898860..a4ceeaf 100644 --- a/crates/codex-win-engine/src/network.rs +++ b/crates/codex-win-engine/src/network.rs @@ -1,5 +1,66 @@ use std::process::Command; +use url::Url; + +/// Parsed host (plus explicit port) for diagnostics. The original URL remains +/// available to curl, but credentials, path, query, and fragment never cross +/// into progress events, errors, or persisted logs. +pub(crate) fn safe_url_host(raw: &str) -> String { + let Ok(url) = Url::parse(raw.trim()) else { + return "".to_string(); + }; + let origin = url.origin().ascii_serialization(); + if origin == "null" { + return "".to_string(); + } + origin + .split_once("://") + .map(|(_, host)| host.to_string()) + .unwrap_or_else(|| "".to_string()) +} + +/// Convert curl stderr into a fixed diagnostic category. Raw stderr is used +/// transiently for retry decisions, but must not be persisted because curl can +/// repeat or normalize a credentialed/presigned URL in its message. +pub(crate) fn safe_curl_failure_message(url: &str, exit_code: Option, stderr: &str) -> String { + let host = safe_url_host(url); + let exit = exit_code + .map(|code| code.to_string()) + .unwrap_or_else(|| "signal".to_string()); + let lower = stderr.to_ascii_lowercase(); + let reason = if lower.contains("no space left") + || lower.contains("not enough space") + || lower.contains("disk is full") + { + Some("disk is full") + } else if lower.contains("access is denied") || lower.contains("permission denied") { + Some("permission denied") + } else if lower.contains("failure writing output") || lower.contains("write error") { + Some("write error") + } else if lower.contains("protocol") && lower.contains("disabled") { + Some("protocol disabled") + } else if lower.contains("could not resolve") { + Some("DNS resolution failed") + } else if lower.contains("failed to connect") || lower.contains("connection refused") { + Some("connection failed") + } else if lower.contains("timed out") || lower.contains("timeout") { + Some("timeout") + } else if lower.contains("schannel") + || lower.contains("ssl") + || lower.contains("tls") + || lower.contains("certificate") + { + Some("TLS failure") + } else { + None + }; + + match reason { + Some(reason) => format!("curl failed for host={host} exit={exit} reason='{reason}'"), + None => format!("curl failed for host={host} exit={exit}"), + } +} + #[derive(Debug, Clone, Copy, PartialEq, Eq)] pub(crate) enum SchannelRevocationCheck { Strict, @@ -101,7 +162,35 @@ fn push_schannel_no_revoke(_args: &mut Vec) {} #[cfg(test)] mod tests { - use super::{is_schannel_revocation_offline, NetworkConfig, SchannelRevocationCheck}; + #[cfg(windows)] + use super::SchannelRevocationCheck; + use super::{ + is_schannel_revocation_offline, safe_curl_failure_message, safe_url_host, NetworkConfig, + }; + + #[test] + fn diagnostic_host_and_curl_error_strip_sensitive_url_components() { + let raw = "https://basic-user:basic-pass@downloads.example:8443/private/Codex.msix?X-Amz-Signature=presigned-secret#fragment-secret"; + assert_eq!(safe_url_host(raw), "downloads.example:8443"); + + let stderr = format!("curl: (23) No space left while requesting {raw}"); + let message = safe_curl_failure_message(raw, Some(23), &stderr); + assert_eq!( + message, + "curl failed for host=downloads.example:8443 exit=23 reason='disk is full'" + ); + for secret in [ + "basic-user", + "basic-pass", + "/private/Codex.msix", + "X-Amz-Signature", + "presigned-secret", + "fragment-secret", + ] { + assert!(!message.contains(secret), "diagnostic leaked {secret}"); + } + assert_eq!(safe_url_host("not a URL with-secret"), ""); + } #[test] fn direct_proxy_mode_disables_curl_proxy_resolution() { diff --git a/crates/codex-win-engine/src/sys.rs b/crates/codex-win-engine/src/sys.rs index b09f043..7b36482 100644 --- a/crates/codex-win-engine/src/sys.rs +++ b/crates/codex-win-engine/src/sys.rs @@ -10,10 +10,13 @@ use crate::capability::WinCapabilityReport; use crate::capability::{CapabilityCheck, CapabilityState}; use crate::limits::MAX_TEXT_BYTES; use crate::msix::parse_appx_manifest_xml; -use crate::network::{is_schannel_revocation_offline, NetworkConfig, SchannelRevocationCheck}; +use crate::network::{ + is_schannel_revocation_offline, safe_curl_failure_message, safe_url_host, NetworkConfig, + SchannelRevocationCheck, +}; use crate::process::{ - curl_exe, hidden_command, run_capturing, spawn_and_require_liveness, LivenessResult, - RunError, RunLimits, TimeoutKind, MSIX_ACTIVATION_WINDOW_SECS, MSIX_LIVENESS_WINDOW_SECS, + curl_exe, hidden_command, run_capturing, spawn_and_require_liveness, LivenessResult, RunError, + RunLimits, TimeoutKind, MSIX_ACTIVATION_WINDOW_SECS, MSIX_LIVENESS_WINDOW_SECS, PORTABLE_LIVENESS_WINDOW, }; use crate::EngineError; @@ -190,12 +193,16 @@ fn fetch_text_output( ]); // curl's own --max-time is the primary budget; the outer deadline is a // backstop that also kills a hung curl that ignored max-time. - run_capturing(command, RunLimits::total(std::time::Duration::from_secs(75)), None) - .map_err(|e| EngineError::Io(format!("curl: {}", e.message()))) + run_capturing( + command, + RunLimits::total(std::time::Duration::from_secs(75)), + None, + ) + .map_err(|e| EngineError::Io(format!("curl: {}", e.message()))) } pub fn fetch_text_with_network(url: &str, network: &NetworkConfig) -> Result { - let source = url_host(url); + let source = safe_url_host(url); log::debug!("fetch Windows text source={source}"); let mut output = fetch_text_output(url, network, SchannelRevocationCheck::Strict)?; let should_retry_without_revocation = { @@ -233,14 +240,7 @@ pub fn fetch_text_with_network(url: &str, network: &NetworkConfig) -> Result, stderr: &str) -> String { - let base = format!( - "curl failed for host={} exit={}: stderr='{}'", - url_host(url), - exit_code - .map(|code| code.to_string()) - .unwrap_or_else(|| "signal".to_string()), - stderr.trim(), - ); + let base = safe_curl_failure_message(url, exit_code, stderr); // Append the proxy diagnostic only for connectivity failures — pasting it // onto write / disk / HTTP errors (e.g. exit 23) only misleads. if is_connectivity_exit(exit_code) { @@ -276,13 +276,6 @@ fn is_connectivity_exit(exit_code: Option) -> bool { ) } -fn url_host(url: &str) -> &str { - url.split("://") - .nth(1) - .and_then(|rest| rest.split('/').next()) - .unwrap_or("") -} - fn proxy_env_summary() -> String { let vars = ["HTTPS_PROXY", "HTTP_PROXY", "ALL_PROXY", "NO_PROXY"]; let configured = vars @@ -300,6 +293,30 @@ fn proxy_env_summary() -> String { } } +#[cfg(test)] +mod curl_diagnostic_tests { + use super::curl_failure_message; + + #[test] + fn text_fetch_failure_never_persists_url_or_raw_stderr_secrets() { + let raw = "https://basic-user:basic-pass@manifest.example/latest/manifest?token=presigned-secret#fragment-secret"; + let stderr = format!("curl: (35) TLS failed while requesting {raw}"); + let message = curl_failure_message(raw, Some(35), &stderr); + + assert!(message + .starts_with("curl failed for host=manifest.example exit=35 reason='TLS failure'")); + for secret in [ + "basic-user", + "basic-pass", + "/latest/manifest", + "presigned-secret", + "fragment-secret", + ] { + assert!(!message.contains(secret), "text error leaked {secret}"); + } + } +} + pub fn detect_installed_codex(portable_root: &Path) -> Option { detect_msix_install().or_else(|| detect_portable_install(portable_root)) } @@ -1016,9 +1033,7 @@ if ($statusOk -and $aumidResolved -and $missing.Count -eq 0) {{ let parsed = match &run_result { Ok(json) => serde_json::from_str::(json).ok(), Err(PowerShellRunError::Timeout(kind)) => { - log::info!( - "MSIX health check result healthy=false status=timeout kind={kind:?}" - ); + log::info!("MSIX health check result healthy=false status=timeout kind={kind:?}"); // Start-Process detaches; kill any process the timed-out probe left running. best_effort_close_msix_after_probe(); return MsixHealthReport { @@ -1252,7 +1267,8 @@ pub fn detect_portable_install(portable_root: &Path) -> Option { - let asar_name = crate::app_version::read_asar_package_name_from_install_root(portable_root); + let asar_name = + crate::app_version::read_asar_package_name_from_install_root(portable_root); if asar_name.as_deref() != Some(crate::app_version::CODEX_ASAR_PACKAGE_NAME) { log::debug!( "portable root at {} has no manifest and its app payload name is {:?} (expected {}); not a Codex install", @@ -1297,13 +1313,12 @@ pub fn launch_codex_with_options( ) -> Result<(), EngineError> { if installed.source == "portable" { let root = Path::new(&installed.path); - let exe = crate::portable::installed_app_exe(root) - .ok_or_else(|| { - EngineError::Io(format!( - "no app entry executable (ChatGPT.exe / Codex.exe) in {}", - root.display() - )) - })?; + let exe = crate::portable::installed_app_exe(root).ok_or_else(|| { + EngineError::Io(format!( + "no app entry executable (ChatGPT.exe / Codex.exe) in {}", + root.display() + )) + })?; // CREATE_NO_WINDOW only suppresses a console flash; the GUI still shows. // Require a short liveness window so an immediate crash is reported as a // launch failure instead of a silent no-op. @@ -1321,10 +1336,7 @@ pub fn launch_codex_with_options( code.map(|c| c.to_string()) .unwrap_or_else(|| "signal".to_string()) ))), - Err(err) => Err(EngineError::Io(format!( - "launch Codex: {}", - err.message() - ))), + Err(err) => Err(EngineError::Io(format!("launch Codex: {}", err.message()))), } } else { if options.disable_codex_self_updates { diff --git a/docs/code-signing-policy.md b/docs/code-signing-policy.md new file mode 100644 index 0000000..670ef6b --- /dev/null +++ b/docs/code-signing-policy.md @@ -0,0 +1,182 @@ +# Code signing policy · 代码签名政策 + +Last updated / 最后更新：2026-07-11 + +## 当前状态 · Current status + +Codex App Manager 正在申请 SignPath Foundation，并评估从 GitHub Actions trusted build +接入 Windows Authenticode 的可行方案。**申请尚未获批，证书尚未签发，SignPath 签名流水线 +尚未启用；当前 Windows 安装器仍未带 Authenticode 发行者签名。** 在下列构建、审批和验证 +条件全部满足前，tag 驱动的 Windows 正式发布会 fail closed，不会悄悄回退为 unsigned 发布。 + +Codex App Manager is applying to SignPath Foundation and evaluating a GitHub +Actions trusted-build integration for Windows Authenticode. **The application +has not yet been approved, no certificate has been issued, and no SignPath +signing pipeline is active. Current Windows installers remain unsigned.** The +tag-driven Windows release path fails closed until all build, approval, and +verification requirements below are met; it must never silently fall back to +publishing unsigned artifacts. + +If the application is approved and the integration is activated, the required +provider attribution will be: + +> Free code signing provided by [SignPath.io](https://signpath.io/), certificate by [SignPath Foundation](https://signpath.org/) + +This sentence records the intended attribution and does not claim that the +current downloads are signed by SignPath. + +## 适用范围 · Scope + +- 本政策只适用于本仓库以 MIT 许可证发布、由本项目构建的 Codex App Manager 工件。 +- Foundation 证书只会签署项目自身拥有和维护的可执行文件或安装器，不会用于其他项目、 + 私有软件、商业软件或个人文件。 +- OpenAI Codex 桌面应用不会被嵌入或重新打包进 Manager 安装器；Manager 运行后按用户选择 + 下载官方 Codex 工件。 +- 第三方依赖（包括 NSIS/Tauri 随附插件）可以作为开源依赖被打包，但不得被当作本项目 + 自有二进制直接使用 Foundation 证书签名。接入方案必须证明这一边界。 + +- This policy covers only Codex App Manager artifacts built from this MIT- + licensed public repository. +- A Foundation certificate will be used only for executables or installers + owned and maintained by this project. It will not be used for other projects, + private or commercial software, or personal files. +- The OpenAI Codex desktop app is not embedded or repackaged in the Manager + installer. The Manager downloads official Codex artifacts after launch when + the user requests an operation. +- Third-party dependencies, including plugins supplied with NSIS or Tauri, may + be bundled as open-source dependencies but must not be directly signed as + project-owned binaries with the Foundation certificate. The final integration + must prove this boundary. + +## 角色与人工审批 · Roles and manual approval + +签名发布采用职责明确、逐次人工批准的流程： + +1. **Author**：常规源码、依赖或发布配置变更必须通过 pull request 和 required checks + 进入 `main`。仓库管理员技术上拥有紧急 bypass；若确需使用，必须保留审计记录，并在 + 发起任何签名请求前由 Reviewer 重新核对 bypass diff、commit 与 CI。 +2. **Reviewer**：在合并前审查变更和必需 CI；不得用自动化结果替代代码审查。 +3. **Release approver**：核对 tag、公开源码、构建来源、目标版本和待签工件后，在 + SignPath 中对**每一次**签名请求进行人工批准。不得自动批准、批量预批准或复用旧请求。 +4. 角色成员及权限会在 SignPath 项目获批后按最小权限配置；GitHub 与 SignPath 账户必须 + 启用双因素认证。角色或权限变化必须可审计。 + +当前团队成员（公开 GitHub 身份）： + +| Role | Member | 说明 | +|---|---|---| +| Committer / Author | [@Wangnov](https://github.com/Wangnov) | 维护仓库、准备 maintainer PR 与 release tag；外部贡献者只通过 PR 提交，不自动取得此角色。 | +| Reviewer | [@Wangnov](https://github.com/Wangnov) | 审查外部 PR；对维护者自己的变更逐项复核 diff 与必需 CI。 | +| SignPath Approver | [@Wangnov](https://github.com/Wangnov) | 申请获批后，对每次签名请求执行单独的人工审批。 | + +本项目目前是单维护者项目，因此同一人会兼任多个角色；这不会把签名批准自动化，也不会 +省略每次请求的人工作业。如果 SignPath 的最终配置要求不同人员之间的职责分离，项目会在 +启用生产签名前公开增补成员并更新本表。 + +The signing release process uses explicit responsibilities and per-request +human approval: + +1. **Author** — normal source, dependency, and release-configuration changes + must enter `main` through a pull request and required checks. Repository + administrators technically retain an emergency bypass; if it is ever used, + the action must remain auditable and the Reviewer must re-check the bypassed + diff, commit, and CI before any signing request is submitted. +2. **Reviewer** — reviews the change and required CI before merge; automated + checks do not replace code review. +3. **Release approver** — checks the tag, public source, build origin, target + version, and candidate artifacts, then manually approves **each** SignPath + signing request. Automatic approval, advance bulk approval, and reuse of an + old request are prohibited. +4. Named role assignments and least-privilege access will be configured after + the SignPath project is approved. GitHub and SignPath accounts must use + two-factor authentication, and role changes must remain auditable. + +Current team members (public GitHub identities): + +| Role | Member | Responsibility | +|---|---|---| +| Committer / Author | [@Wangnov](https://github.com/Wangnov) | Maintains the repository and prepares maintainer PRs and release tags. External contributors submit PRs and do not automatically receive this role. | +| Reviewer | [@Wangnov](https://github.com/Wangnov) | Reviews external PRs and explicitly re-checks the diff and required CI for maintainer-authored changes. | +| SignPath Approver | [@Wangnov](https://github.com/Wangnov) | After approval, manually approves each individual signing request. | + +This is currently a single-maintainer project, so one person holds multiple +roles. That does not automate signing approval or remove the manual action for +each request. If the final SignPath configuration requires separation between +different people, the project will add members publicly and update this table +before production signing is enabled. + +## Trusted build 与发布门 · Trusted build and release gates + +未来的 SignPath 接入必须使用 SignPath 验证过的 GitHub Actions trusted build/origin，且只 +接受来自本公开仓库受保护 tag 的工件。正式启用前必须通过一次可复现的试签与审查，证明： + +- 签名请求绑定准确的仓库、commit、tag、版本和 GitHub Actions run； +- 待签文件的产品名和版本资源与 tag 一致； +- x64 与 ARM64 的最终安装器、安装后的主程序和卸载器均满足设计的 Authenticode 边界， + 且没有把 Foundation 证书直接用于第三方插件； +- 每个要求签名的 PE 都显示预期的 SignPath Foundation 发行者并带有效时间戳； +- Tauri updater `.sig` 在 Authenticode 之后覆盖最终发布字节；它与 Authenticode 是两套 + 独立的信任机制； +- 最终上传到 GitHub Release 和镜像的文件与已验证文件逐字节一致。 + +Until that review is complete, [`release.yml`](../.github/workflows/release.yml) +intentionally blocks Windows tag jobs before building. Removing the blocker +alone cannot make a release valid: unsigned artifacts must still fail the +required post-build verification gates. See +[`Windows signing and verification`](./windows-signing.md) for the operational +status and unresolved integration boundary. + +## 隐私与网络行为 · Privacy and network behavior + +完整、可稳定链接的隐私政策见 [`docs/privacy.md`](./privacy.md)。以下为与代码签名申请 +直接相关的网络行为摘要。 + +See the stable, standalone [`privacy policy`](./privacy.md) for the complete +disclosure. The following is the network-behavior summary relevant to the code +signing application. + +Codex App Manager 不提供账户系统，也不包含遥测、广告或行为分析 SDK，不会主动上传用户 +身份、文件内容或使用画像。应用仍会为完成其公开功能发起网络请求： + +- Manager 启动后以及保持打开期间会检查自身更新；发现更新后由用户决定是否安装。 +- Codex 的更新检查可在设置中关闭启动检查和定时检查；安装或更新操作会按用户选择访问 + 镜像、GitHub、OpenAI 官方源或用户配置的自定义源。 +- 下载可使用系统代理、直连或用户配置的代理。所选服务会像任何 HTTPS 服务一样看到 + 正常的连接元数据，例如来源 IP、时间、请求路径和 User-Agent；其日志受各服务自己的 + 隐私政策和保留规则约束。 +- 中国大陆的 `codexapp.agentsmirror.com` 请求可能由 Cloudflare 按地区路由到 IHEP S3； + 其他地区通常由 Cloudflare R2 提供。GitHub 是 Manager 自更新的后备源。 +- 本地诊断日志可能记录版本、平台、更新源 host 和错误信息，但不应记录私钥、密码、 + SignPath token 或下载 URL 中的临时签名参数。用户只有在主动提交 Issue/诊断信息时才会 + 把这些本地内容发送给项目维护者。 + +Codex App Manager has no account system and includes no telemetry, advertising, +or behavioral analytics SDK. It does not intentionally upload user identity, +file contents, or usage profiles. It still makes network requests to provide +its documented functionality: + +- The Manager checks for its own updates after startup and periodically while + open; the user chooses whether to install an available update. +- Startup and periodic update checks for Codex can be disabled in Settings. + Install or update operations contact the selected mirror, GitHub, official + OpenAI source, or a user-configured custom source. +- Downloads can use the system proxy, direct mode, or a custom proxy. Like any + HTTPS service, the selected endpoint can observe ordinary connection metadata + such as source IP, time, request path, and User-Agent; its own privacy and + retention policies apply. +- Mainland-China requests to `codexapp.agentsmirror.com` may be routed by + Cloudflare to IHEP S3; other regions are normally served from Cloudflare R2. + GitHub is a fallback source for Manager self-updates. +- Local diagnostic logs may contain versions, platform, update-source host, and + errors, but must not contain private keys, passwords, SignPath tokens, or + temporary signed query strings. Local diagnostics reach maintainers only when + a user deliberately includes them in an issue or support request. + +## 参考 · References + +- [SignPath Foundation terms](https://signpath.org/terms.html) +- [SignPath GitHub trusted build-system integration](https://docs.signpath.io/trusted-build-systems/github) +- [SignPath origin verification](https://docs.signpath.io/origin-verification/) +- [Privacy policy](./privacy.md) +- [Windows signing and verification](./windows-signing.md) +- [Release process](./release.md) diff --git a/docs/privacy.md b/docs/privacy.md new file mode 100644 index 0000000..8e15523 --- /dev/null +++ b/docs/privacy.md @@ -0,0 +1,140 @@ +# Privacy policy · 隐私政策 + +Effective date / 生效日期：2026-07-11 + +This policy applies to Codex App Manager, its public website, and the download +router maintained in this repository. It does not replace the privacy policies +of GitHub, Cloudflare, IHEP, OpenAI, Microsoft, or a custom endpoint/proxy chosen +by the user. + +本政策适用于 Codex App Manager、本项目官网以及本仓库维护的下载路由。GitHub、 +Cloudflare、IHEP、OpenAI、Microsoft，以及用户自行选择的自定义源或代理，分别适用其 +自己的隐私政策，本政策不能替代这些第三方政策。 + +## 我们不收集什么 · What we do not collect + +- 应用没有账户系统，不要求姓名、邮箱、电话或付款信息。 +- 应用不包含遥测、广告、崩溃上报或行为分析 SDK，也不会为画像目的上传使用行为。 +- 项目不会主动读取或上传 `~/.codex` 中的对话、凭据、工作区文件或其他用户内容。 +- 本地日志和设置不会自动发送给维护者。只有用户主动附在 Issue 或支持请求中时，维护者 + 才会收到用户选择提交的内容。 + +- The app has no account system and does not request a name, email address, + phone number, or payment information. +- The app includes no telemetry, advertising, crash-reporting, or behavioral + analytics SDK and does not upload usage activity for profiling. +- The project does not intentionally read or upload conversations, credentials, + workspace files, or other user content from `~/.codex`. +- Local logs and settings are not automatically sent to maintainers. Maintainers + receive only the material a user deliberately attaches to an issue or support + request. + +## 应用会发起的网络请求 · Network requests made by the app + +网络请求用于更新检查、下载和校验，不用于遥测： + +- **Manager 自身更新**：应用启动约 1.5 秒后检查一次；保持打开时约每 6 小时检查一次。 + 当前版本没有关闭 Manager 自身检查的设置。发现新版本后由用户决定是否安装。 +- **Codex 更新**：默认在 Manager 主界面启动时检查，并在应用保持打开时按设置周期检查。 + 用户可分别关闭启动检查和定时检查，也可调整定时间隔。 +- **安装、更新和校验**：用户发起操作时，应用会访问所选的镜像、GitHub、OpenAI 官方 + 源或用户配置的自定义 HTTPS 源，以取得 manifest、appcast、checksum 和安装包。 +- **代理**：请求可使用系统代理、直连或用户配置的代理。自定义代理能看到经其转发的 + 目标 host 和正常连接元数据。 + +These requests provide update, download, and verification functionality, not +telemetry: + +- **Manager self-update** — one check runs about 1.5 seconds after startup and + another runs about every six hours while the app remains open. The current + version has no setting to disable Manager self-update checks. The user decides + whether to install an available update. +- **Codex updates** — by default, the Manager checks when its main screen starts + and periodically while open. Users can independently disable startup and + periodic checks and can change the periodic interval. +- **Install, update, and verification** — when the user starts an operation, the + app contacts the selected mirror, GitHub, official OpenAI source, or a custom + HTTPS source to obtain manifests, appcasts, checksums, and installers. +- **Proxy behavior** — requests can use the system proxy, direct mode, or a + user-configured proxy. A custom proxy can observe destination hosts and + ordinary connection metadata for traffic it handles. + +## 服务与连接元数据 · Services and connection metadata + +默认网络路径可能包括： + +- `codexapp.agentsmirror.com`：由 Cloudflare Worker 提供；全球通常使用 Cloudflare R2， + 中国大陆请求可能按 `CF-IPCountry` 路由到 IHEP S3 的临时预签名地址。 +- `github.com`：Manager 自更新后备源及公开 release 下载。 +- `persistent.oaistatic.com` 等 OpenAI 官方 host：用户选择官方源时获取 Codex appcast 或 + 工件。 +- 用户配置的自定义 HTTPS 源或代理。 + +相关第三方隐私政策： + +- [GitHub General Privacy Statement](https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement) +- [Cloudflare Privacy Policy](https://www.cloudflare.com/privacypolicy/) +- [OpenAI Privacy Policy](https://openai.com/policies/privacy-policy/) +- [Microsoft Privacy Statement](https://privacy.microsoft.com/en-us/privacystatement) +- IHEP S3 为中国大陆镜像节点。截至本政策日期，项目未找到该镜像端点单独公开的隐私政策； + 相关处理受 IHEP/CAS 的适用服务条款与法律义务约束。可从 + [IHEP 官网](https://english.ihep.cas.cn/) 查询或联系其机构。若发现适用的官方政策， + 本页会补充直接链接。 + +这些服务与普通 HTTPS 服务一样，可能处理来源 IP、请求时间、请求路径、User-Agent、 +响应状态以及防滥用/安全日志。项目维护者无法代表第三方承诺其保留期限；请查阅所选服务 +的政策。官网自身不嵌入广告或分析脚本，但托管和路由服务仍可能生成正常的访问日志。 + +Default paths may include `codexapp.agentsmirror.com` (Cloudflare Worker, R2, +and possible IHEP S3 routing for mainland China), `github.com` (fallback update +and public release downloads), official OpenAI hosts such as +`persistent.oaistatic.com` when selected, and a custom HTTPS source or proxy. +Like ordinary HTTPS services, these providers may process source IP, request +time and path, User-Agent, response status, and security/abuse logs. Project +maintainers cannot promise third-party retention periods. The project website +embeds no advertising or analytics script, but hosting and routing providers +may still produce ordinary access logs. + +Third-party privacy policies: + +- [GitHub General Privacy Statement](https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement) +- [Cloudflare Privacy Policy](https://www.cloudflare.com/privacypolicy/) +- [OpenAI Privacy Policy](https://openai.com/policies/privacy-policy/) +- [Microsoft Privacy Statement](https://privacy.microsoft.com/en-us/privacystatement) +- IHEP S3 hosts the mainland-China mirror node. As of this policy date, the + project has not identified a standalone public privacy policy for that mirror + endpoint. Applicable IHEP/CAS service terms and legal obligations govern its + processing; consult the [IHEP website](https://english.ihep.cas.cn/) or the + institution directly. This page will add a direct link if an applicable + official policy is identified. + +## 本地数据 · Data stored locally + +应用在本机保存运行所需的设置、安装来源信息、更新状态、操作状态和诊断日志。诊断信息可 +包含应用版本、操作系统、架构、更新源 host、安装状态和错误文本。它不应包含代码签名 +私钥、密码、SignPath token，或下载 URL 的临时签名 query；发现这类泄漏应按安全问题 +处理。卸载 Manager 不等同于删除 Codex 自己的数据；卸载界面会明确说明保留范围。 + +The app stores settings, installation provenance, update state, operation state, +and diagnostic logs locally. Diagnostics can include app version, operating +system, architecture, update-source host, install state, and error text. They +must not contain code-signing private keys, passwords, SignPath tokens, or +temporary signed URL queries; any such leak is a security issue. Uninstalling +the Manager is not the same as deleting Codex data, and the uninstall UI states +what is retained. + +## 用户选择与反馈 · User choices and contact + +用户可以关闭 Codex 的启动/定时检查、选择更新源和代理，并在提交 Issue 前查看和删改诊断 +内容。隐私或安全问题请通过 +[GitHub Issues](https://github.com/Wangnov/Codex-App-Manager/issues) 报告；请勿公开粘贴 +token、密码、私钥、完整预签名 URL 或其他秘密。 + +Users can disable Codex startup/periodic checks, select an update source and +proxy, and review or redact diagnostics before filing an issue. Report privacy +or security concerns through +[GitHub Issues](https://github.com/Wangnov/Codex-App-Manager/issues), and never +post tokens, passwords, private keys, complete presigned URLs, or other secrets +publicly. + +See also the [code signing policy](./code-signing-policy.md). diff --git a/docs/release.md b/docs/release.md index a013419..8b760b7 100644 --- a/docs/release.md +++ b/docs/release.md @@ -8,8 +8,10 @@ tag 推送后 `release.yml` 按 tag 名取用该文件作为 GitHub Release 正 (安装表 + 升级说明),正文永远不会为空。写法与双语风格见 `docs/releases/TEMPLATE.md`。 Cross-platform release is tag-driven via [`.github/workflows/release.yml`](../.github/workflows/release.yml). -Push a `v*` tag and CI builds, signs, notarizes, and publishes a GitHub Release -with the Tauri updater manifest. +The publish job normally consumes the full four-platform build matrix. Windows +tag jobs currently fail closed while the SignPath Foundation application and +trusted-build migration are pending, so a new tag cannot publish a partial or +unsigned release. See the [code signing policy](./code-signing-policy.md). ## macOS signing pipeline @@ -41,30 +43,59 @@ bash scripts/finalize-macos.sh aarch64-apple-darwin Omit the `AC_API_*` vars to skip notarization for a quick local dev finalize. +## Manager updater trust and size limits + +`latest.json` contains provider-specific download URLs, so the R2/IHEP copy is +intentionally not byte-identical to GitHub's copy and is not itself a trust +anchor. `gen-updater-manifest.mjs` also emits a deterministic, URL-free +`release-identity.json` containing the version, release-note hash, exact target +artifact name, Tauri minisign signature, and SHA-256. The release workflow signs +that identity with the existing Tauri updater key and publishes the identity and +`.sig` as immutable `/` assets on GitHub, R2, and IHEP. + +The client still checks the mainland-friendly mirror first. Before displaying or +installing a candidate, it bounded-fetches the same source's versioned identity +and signature, verifies them with the pinned updater public key, and binds every +security-relevant manifest field to that identity. Artifact bytes then pass both +the normal Tauri minisign check and the signed SHA-256 before `Update::install`. +Any missing, oversized, invalid, or mismatched mirror response falls through to +the GitHub endpoint; installation still occurs at most once. + +Hard in-memory limits are 256 KiB for manifests/identity, 16 KiB for the identity +signature, and 64 MiB for updater artifacts. For comparison, v0.3.1's largest +updater artifact is about 10.9 MiB. The exact vendored +`tauri-plugin-updater` 2.10.1 patch and its upgrade checklist live in +[`vendor/tauri-plugin-updater-2.10.1/VENDORED.md`](../vendor/tauri-plugin-updater-2.10.1/VENDORED.md). + +Because Tauri's minisign trusted comment contains a timestamp, a rerun would +normally create a byte-different identity `.sig`. The workflow first reuses and +verifies an existing GitHub Release asset (then the mirror copy), and the mirror +sync refuses to overwrite byte-different versioned identity objects. + ## Windows Windows has no light/dark adaptive app icon (`.ico` is static) — the single Default icon is used. NSIS installer + updater bundle are produced by `tauri build`; no Apple-style finalize step. -Windows release builds are signed inside-out (see -[`release.yml`](../.github/workflows/release.yml)): - -1. **Prepare Authenticode** — import the release PFX and generate a temporary - Tauri config with the exact certificate thumbprint, SHA-256, and RFC3161 - timestamping (`tsp=true`). Missing credentials hard-fail the tag build. -2. **Build + sign all PE layers** — Tauri signs the main executable, the NSIS - uninstaller generated through `!uninstfinalize`, and the outer installer. -3. **Required verification** — every layer must report - `Get-AuthenticodeSignature.Status == Valid`, match the imported thumbprint, - and include a timestamp countersigner. x64 runs the full lifecycle; ARM64 is - installed on the x64 host to inspect its payload but is not launched there. -4. **Tauri updater `.sig`** — `npx tauri signer sign` authenticates the final, - Authenticode-signed installer bytes used by in-app updates. -5. **Collect + verify final artifacts** — space-stripped names under - `dist-artifacts/`, then another required signature check on the exact setup - executable that will be uploaded. -6. **Always clean up** — remove the temporary PFX directory and imported cert. +Windows Authenticode is in an explicit **application/migration pending** state: + +1. The project is applying to SignPath Foundation; approval, certificate + issuance, and trusted-build project identifiers do not exist yet. +2. `release.yml` runs `assert-signpath-foundation-ready.ps1` before a Windows + tag build. The script intentionally always fails and has no variable/secret + bypass. Because publish depends on the complete matrix, this blocks the + whole release rather than shipping an unsigned or macOS-only set. +3. No `WINDOWS_CERTIFICATE` PFX, password, thumbprint config, or local + `signCommand` is supported. SignPath Foundation signs submitted trusted-build + artifacts and requires per-request human approval; it is not a PFX provider. +4. A future PR must prove the NSIS packaging/signing order with real SignPath + pilot artifacts, exclude direct signing of third-party plugins, and verify + the final setup, installed app, uninstaller, timestamp, updater `.sig`, and + mirror hashes before replacing the blocker. +5. The existing `required` Authenticode and packaged-smoke steps are a + post-integration verification contract, not evidence that signing is active. + Removing the blocker alone still leaves unsigned output failing closed. PR-time x64 packaged smoke lives in [`win-installer-check.yml`](../.github/workflows/win-installer-check.yml) @@ -85,22 +116,21 @@ Required CI (`ci.yml`) also runs standalone engine crate tests for | `AC_API_KEY_BASE64` | base64 of the `AuthKey_XXXX.p8` | | `TAURI_SIGNING_PRIVATE_KEY` | updater private key | | `TAURI_SIGNING_PRIVATE_KEY_PASSWORD` | its password (empty if none) | -| `WINDOWS_CERTIFICATE` | base64 of the OV/EV code-signing **.pfx** (release env) | -| `WINDOWS_CERTIFICATE_PASSWORD` | password for that .pfx; may be empty only when the PFX has no password | - -### Optional release variables - -| Name | What | -|---|---| -| `WINDOWS_TIMESTAMP_URL` (repo **variable**) | optional RFC3161 timestamp URL | -Export your local .p12 / .p8 / .pfx to base64 with `base64 -i file -o -`. +There are currently **no Windows signing secrets or variables to configure**. +After Foundation approval, use only the exact organization/project/signing +policy/artifact-configuration values provisioned by SignPath, in a separately +reviewed trusted-build integration. Do not guess names and do not add a PFX +fallback. Export Apple `.p12` / `.p8` files to base64 with +`base64 -i file -o -`. > Artifact globs in the workflow's *Collect* step and the matcher regexes in > `gen-updater-manifest.mjs` assume the default Tauri bundler output names — > adjust them if your `productName`/bundler config changes the filenames. > > Keep **updater signature**, **Authenticode**, and **SmartScreen reputation** -> conceptually separate. Authenticode is mandatory for new tag builds, but a -> valid publisher signature does not guarantee instant SmartScreen reputation. -> See [`docs/windows-signing.md`](./windows-signing.md). +> conceptually separate. Current Windows installers remain unsigned and new tag +> publication is blocked until the SignPath migration is proven. See +> [`docs/windows-signing.md`](./windows-signing.md), the +> [code signing policy](./code-signing-policy.md), and the +> [privacy policy](./privacy.md). diff --git a/docs/releases/FALLBACK.md b/docs/releases/FALLBACK.md index 0e9c725..b130534 100644 --- a/docs/releases/FALLBACK.md +++ b/docs/releases/FALLBACK.md @@ -16,8 +16,10 @@ | Windows · x64 | [CodexAppManager_x64-setup.exe](https://codexapp.agentsmirror.com/manager/latest/CodexAppManager_x64-setup.exe) | | Windows · ARM64 | [CodexAppManager_arm64-setup.exe](https://codexapp.agentsmirror.com/manager/latest/CodexAppManager_arm64-setup.exe) | -**Windows 信任说明:** x64 / ARM64 安装器、主程序和卸载器均带 Authenticode 发行者签名与 RFC3161 时间戳;`.sig` / `latest.json` 中的 Tauri updater 签名另行保护应用内更新字节。SmartScreen 信誉仍由 Microsoft 独立评估,可能出现的信誉提示不等于任一签名失效。详情见 [Windows signing and verification](https://github.com/Wangnov/Codex-App-Manager/blob/main/docs/windows-signing.md)。 -**Windows trust:** The x64 / ARM64 installer, app, and uninstaller carry an Authenticode publisher signature and RFC3161 timestamp; the separate Tauri updater signature in `.sig` / `latest.json` protects in-app update bytes. Microsoft evaluates SmartScreen reputation independently, so a reputation prompt does not mean either signature failed. See [Windows signing and verification](https://github.com/Wangnov/Codex-App-Manager/blob/main/docs/windows-signing.md). +**Windows 信任状态:** 当前 SignPath Foundation 申请与 trusted-build 迁移尚未完成，Windows tag 发布门保持 fail-closed；`.sig` / `latest.json` 的 Tauri updater 签名不是 Authenticode 发行者身份。本 fallback 不得发布 Windows 工件；参见 [代码签名政策](https://github.com/Wangnov/Codex-App-Manager/blob/main/docs/code-signing-policy.md)与 [Windows signing and verification](https://github.com/Wangnov/Codex-App-Manager/blob/main/docs/windows-signing.md)。 +**Windows trust:** The SignPath Foundation application and trusted-build migration are pending, so the Windows tag gate remains fail-closed. A Tauri updater signature in `.sig` / `latest.json` is not Authenticode publisher identity. This fallback must not accompany published Windows artifacts; see the [code signing policy](https://github.com/Wangnov/Codex-App-Manager/blob/main/docs/code-signing-policy.md) and [Windows signing and verification](https://github.com/Wangnov/Codex-App-Manager/blob/main/docs/windows-signing.md). + +**隐私 · Privacy:** [隐私政策 · Privacy policy](https://github.com/Wangnov/Codex-App-Manager/blob/main/docs/privacy.md) **核验下载:** 本页 Assets 带有 `SHA256SUMS`;Windows 用 `Get-FileHash .\CodexAppManager_x64-setup.exe -Algorithm SHA256` 或替换为 ARM64 文件名,macOS 用 `shasum -a 256 CodexAppManager_aarch64.dmg`,再与 `SHA256SUMS` 比对。 **Verify downloads:** This release includes `SHA256SUMS` in Assets; on Windows run `Get-FileHash .\CodexAppManager_x64-setup.exe -Algorithm SHA256` or swap in the ARM64 filename, and on macOS run `shasum -a 256 CodexAppManager_aarch64.dmg`, then compare with `SHA256SUMS`. diff --git a/docs/releases/TEMPLATE.md b/docs/releases/TEMPLATE.md index ac5607d..62f3f99 100644 --- a/docs/releases/TEMPLATE.md +++ b/docs/releases/TEMPLATE.md @@ -42,8 +42,10 @@ | Windows · x64 | [CodexAppManager_x64-setup.exe](https://codexapp.agentsmirror.com/manager/latest/CodexAppManager_x64-setup.exe) | | Windows · ARM64 | [CodexAppManager_arm64-setup.exe](https://codexapp.agentsmirror.com/manager/latest/CodexAppManager_arm64-setup.exe) | -**Windows 信任说明:** x64 / ARM64 安装器、主程序和卸载器均带 Authenticode 发行者签名与 RFC3161 时间戳;`.sig` / `latest.json` 中的 Tauri updater 签名另行保护应用内更新字节。SmartScreen 信誉仍由 Microsoft 独立评估,可能出现的信誉提示不等于任一签名失效。详情见 [Windows signing and verification](https://github.com/Wangnov/Codex-App-Manager/blob/main/docs/windows-signing.md)。 -**Windows trust:** The x64 / ARM64 installer, app, and uninstaller carry an Authenticode publisher signature and RFC3161 timestamp; the separate Tauri updater signature in `.sig` / `latest.json` protects in-app update bytes. Microsoft evaluates SmartScreen reputation independently, so a reputation prompt does not mean either signature failed. See [Windows signing and verification](https://github.com/Wangnov/Codex-App-Manager/blob/main/docs/windows-signing.md). +**Windows 信任状态（本版必须据实填写）:** 当前 SignPath Foundation 申请与 trusted-build 迁移尚未完成，Windows tag 发布门保持 fail-closed；不得把 `.sig` / `latest.json` 的 Tauri updater 字节签名写成 Authenticode 发行者身份。启用后仍须写明本版实际核验到的发行者、时间戳和三层 PE 状态。参见 [代码签名政策](https://github.com/Wangnov/Codex-App-Manager/blob/main/docs/code-signing-policy.md)与 [Windows signing and verification](https://github.com/Wangnov/Codex-App-Manager/blob/main/docs/windows-signing.md)。 +**Windows trust (replace with this release's verified facts):** The SignPath Foundation application and trusted-build migration are still pending, so the Windows tag gate remains fail-closed. Never describe a Tauri updater signature in `.sig` / `latest.json` as Authenticode publisher identity. After activation, every release must still state the publisher, timestamp, and all three PE-layer results actually observed for that release. See the [code signing policy](https://github.com/Wangnov/Codex-App-Manager/blob/main/docs/code-signing-policy.md) and [Windows signing and verification](https://github.com/Wangnov/Codex-App-Manager/blob/main/docs/windows-signing.md). + +**隐私 · Privacy:** [隐私政策 · Privacy policy](https://github.com/Wangnov/Codex-App-Manager/blob/main/docs/privacy.md) **核验下载:** 本页 Assets 带有 `SHA256SUMS`;Windows 用 `Get-FileHash .\CodexAppManager_x64-setup.exe -Algorithm SHA256` 或替换为 ARM64 文件名,macOS 用 `shasum -a 256 CodexAppManager_aarch64.dmg`,再与 `SHA256SUMS` 比对。 **Verify downloads:** This release includes `SHA256SUMS` in Assets; on Windows run `Get-FileHash .\CodexAppManager_x64-setup.exe -Algorithm SHA256` or swap in the ARM64 filename, and on macOS run `shasum -a 256 CodexAppManager_aarch64.dmg`, then compare with `SHA256SUMS`. diff --git a/docs/releases/v0.3.1.md b/docs/releases/v0.3.1.md index 0074596..e29c05c 100644 --- a/docs/releases/v0.3.1.md +++ b/docs/releases/v0.3.1.md @@ -53,8 +53,10 @@ | Windows · x64 | [CodexAppManager_x64-setup.exe](https://codexapp.agentsmirror.com/manager/latest/CodexAppManager_x64-setup.exe) | | Windows · ARM64 | [CodexAppManager_arm64-setup.exe](https://codexapp.agentsmirror.com/manager/latest/CodexAppManager_arm64-setup.exe) | -**Windows 签名状态:** `CodexAppManager_x64-setup.exe` / `CodexAppManager_arm64-setup.exe` 当前没有 Authenticode 代码签名,首次运行可能出现 SmartScreen 提示;`.sig` / `latest.json` 里的 Tauri updater 签名只用于应用内自更新的字节校验,不代表 Windows 发行者信任。详情见 [Windows signing and verification](https://github.com/Wangnov/Codex-App-Manager/blob/main/docs/windows-signing.md)。 -**Windows signing status:** `CodexAppManager_x64-setup.exe` / `CodexAppManager_arm64-setup.exe` are not Authenticode-signed yet, so SmartScreen may warn on first run; the Tauri updater signature in `.sig` / `latest.json` verifies in-app update bytes only and is not Windows publisher trust. See [Windows signing and verification](https://github.com/Wangnov/Codex-App-Manager/blob/main/docs/windows-signing.md). +**Windows 签名状态:** `CodexAppManager_x64-setup.exe` / `CodexAppManager_arm64-setup.exe` 当前没有 Authenticode 代码签名,首次运行可能出现 SmartScreen 提示;`.sig` / `latest.json` 里的 Tauri updater 签名只用于应用内自更新的字节校验,不代表 Windows 发行者信任。详情见 [代码签名政策](https://github.com/Wangnov/Codex-App-Manager/blob/main/docs/code-signing-policy.md)与 [Windows signing and verification](https://github.com/Wangnov/Codex-App-Manager/blob/main/docs/windows-signing.md)。 +**Windows signing status:** `CodexAppManager_x64-setup.exe` / `CodexAppManager_arm64-setup.exe` are not Authenticode-signed yet, so SmartScreen may warn on first run; the Tauri updater signature in `.sig` / `latest.json` verifies in-app update bytes only and is not Windows publisher trust. See the [code signing policy](https://github.com/Wangnov/Codex-App-Manager/blob/main/docs/code-signing-policy.md) and [Windows signing and verification](https://github.com/Wangnov/Codex-App-Manager/blob/main/docs/windows-signing.md). + +**隐私 · Privacy:** [隐私政策 · Privacy policy](https://github.com/Wangnov/Codex-App-Manager/blob/main/docs/privacy.md) **核验下载:** 本页 Assets 带有 `SHA256SUMS`;Windows 用 `Get-FileHash .\CodexAppManager_x64-setup.exe -Algorithm SHA256` 或替换为 ARM64 文件名,macOS 用 `shasum -a 256 CodexAppManager_aarch64.dmg`,再与 `SHA256SUMS` 比对。 **Verify downloads:** This release includes `SHA256SUMS` in Assets; on Windows run `Get-FileHash .\CodexAppManager_x64-setup.exe -Algorithm SHA256` or swap in the ARM64 filename, and on macOS run `shasum -a 256 CodexAppManager_aarch64.dmg`, then compare with `SHA256SUMS`. diff --git a/docs/windows-signing.md b/docs/windows-signing.md index a7dde00..7523e31 100644 --- a/docs/windows-signing.md +++ b/docs/windows-signing.md @@ -1,128 +1,169 @@ # Windows signing and verification -The release workflow uses three independent trust mechanisms. Authenticode -identifies the Windows publisher, the Tauri updater signature protects the -bytes consumed by in-app updates, and SmartScreen reputation is a Microsoft -risk signal that neither signature can guarantee. Keep them separate when -triaging a warning or a failed release. +Windows publisher trust, Tauri updater signatures, and Microsoft SmartScreen +reputation are independent mechanisms. A `.sig` file is not Authenticode, and a +valid Authenticode signature cannot guarantee immediate SmartScreen reputation. -Historical releases keep the signing status recorded in their own release -notes. The mandatory pipeline below applies starting with the first release -built from this workflow revision. +Public policy: [code signing policy](./code-signing-policy.md) · +[privacy policy](./privacy.md) ## 中文 -### 发布状态 - -- Windows 正式发布必须提供 OV/EV Authenticode `.pfx`；缺少证书或密码会直接阻断 tag 发布。 -- x64 与 ARM64 的主程序、NSIS `uninstall.exe`、外层 `-setup.exe` 均由同一张证书签名，并使用 SHA-256 + RFC3161 时间戳。 -- CI 要求每层 `Get-AuthenticodeSignature` 都为 `Valid`、签名证书 thumbprint 与本次导入证书完全一致，并存在时间戳 countersigner。 -- PR 构建不会取得发布证书，仍以 unsigned 方式验证打包模板和安装生命周期；PR 的 optional 探测不代表正式发布可以未签名。 -- Windows 应用内更新仍另外要求 Tauri updater `.sig`；它覆盖已经完成 Authenticode 签名的最终安装器字节。 - -### 三个独立概念 - -**Authenticode 代码签名** - -Windows 对 PE 文件和安装器使用的发行者签名。本项目在 `tauri build` 前导入 PFX，并通过临时 Tauri config 配置 `certificateThumbprint`、`digestAlgorithm=sha256`、RFC3161 `timestampUrl` 与 `tsp=true`。Tauri 按 inside-out 顺序签主程序、NSIS 生成的卸载器和外层安装器。 - -**Tauri updater 签名** - -`latest.json` 的 `signature` 对应用内更新所下载的最终安装器字节签名。它防止 GitHub、镜像或传输链路改包，但不向 Windows 声明发行者身份。实现使用 `TAURI_SIGNING_PRIVATE_KEY` 和 `npx tauri signer sign`；其私钥与 Authenticode PFX 完全不同。 - -**SmartScreen 信誉** - -Microsoft Defender SmartScreen 会综合发行者、文件流行度、历史与其他风险信号。一个 Authenticode 签名可以让系统显示可验证的发行者，但不能承诺新证书或新工件绝不出现 SmartScreen 提示。看到 SmartScreen 提示也不等于 Tauri updater 签名失败。 - -### 发布硬门 - -Windows matrix 的顺序如下： - -1. `prepare-windows-authenticode.ps1` 解码并导入 PFX，生成仅用于当前 job 的 Tauri signing config。 -2. `tauri build --config ...` 完成三层 inside-out Authenticode 签名，并让自定义 NSIS 模板优先使用 bundler 准备的已签名插件目录。 -3. `verify-windows-authenticode.ps1 -Mode required` 验证外层安装器。Tauri 打包结束后会把 `target/.../release/codex-app-manager.exe` 恢复成 unsigned、未 patch 的构建输入，因此这个 raw 中间文件只用于 PE 架构诊断，不作为签名硬门。 -4. `windows-packaged-smoke.ps1` 安装包并直接验证安装后的主程序与 `uninstall.exe`。 - - x64 执行 `install → launch → upgrade → uninstall`。 - - ARM64 在 x64 runner 上执行安装、签名验证、升级和卸载，但跳过 ARM64 主程序启动；完整 ARM64 运行验收仍需 ARM64 设备或可信虚拟化。 -5. 对 Authenticode 签名后的最终 `-setup.exe` 生成独立的 Tauri updater `.sig`。 -6. 收集无空格的发布文件名后，再次对最终待发布安装器执行 required 验证。 -7. 无论成功失败都移除临时证书和 PFX 目录。 - -任何一层缺失、`Status != Valid`、证书 thumbprint 不符、没有时间戳、没有 updater `.sig`，发布 job 都失败。RFC3161 同时由生成配置中的 `tsp=true` / SHA-256 / timestamp URL 和工件上的 timestamp countersigner 证明。 - -### 必需配置 - -在 GitHub `release` environment 配置： - -| 名称 | 类型 | 用途 | -|---|---|---| -| `WINDOWS_CERTIFICATE` | secret | base64 编码的 OV/EV 代码签名 `.pfx` | -| `WINDOWS_CERTIFICATE_PASSWORD` | secret | PFX 密码；证书无密码时可以为空 | -| `WINDOWS_TIMESTAMP_URL` | variable，可选 | RFC3161 服务地址；默认 `http://timestamp.digicert.com` | -| `TAURI_SIGNING_PRIVATE_KEY` | secret | Tauri updater 私钥，不是 Authenticode 证书 | -| `TAURI_SIGNING_PRIVATE_KEY_PASSWORD` | secret | updater 私钥密码 | - -不再使用 `AUTHENTICODE_REQUIRED` 开关：tag release 永远是 required。不要把 PFX 暴露给 `pull_request` workflow，也不要把真实证书提交进仓库。 - -### 用户核验 - -在 Windows 上可直接查看三层签名： - -```powershell -Get-AuthenticodeSignature .\CodexAppManager_x64-setup.exe | Format-List Status,SignerCertificate,TimeStamperCertificate -Get-AuthenticodeSignature "$env:LOCALAPPDATA\Codex App Manager\codex-app-manager.exe" | Format-List Status,SignerCertificate,TimeStamperCertificate -Get-AuthenticodeSignature "$env:LOCALAPPDATA\Codex App Manager\uninstall.exe" | Format-List Status,SignerCertificate,TimeStamperCertificate -``` - -发布页仍提供 `SHA256SUMS`，用于确认下载文件与 release 资产逐字节一致： +### 当前状态（申请/迁移中） + +- 项目正在申请 **SignPath Foundation**。截至 2026-07-11，申请尚未获批，证书尚未签发， + GitHub trusted-build 签名集成尚未上线。 +- 当前已发布的 Windows x64 / ARM64 安装器**没有 Authenticode 发行者签名**，首次运行 + 可能出现 SmartScreen 提示。每个历史版本的实际状态以其 release note 为准。 +- `.sig` / `latest.json` 中已有的 Tauri updater 签名只校验应用内更新下载到的字节，不会 + 让 Windows 显示可信发行者。 +- tag 工作流中的 Windows job 当前会在构建前执行 + `assert-signpath-foundation-ready.ps1` 并故意失败。因为发布 job 依赖所有 matrix build， + 所以不会发布缺少 Windows 或 unsigned Windows 的不完整 release。 +- 仓库不再接受 `WINDOWS_CERTIFICATE`、PFX 密码或临时 Tauri thumbprint config。给 + environment 填入一个证书 secret 不能绕过阻断。 + +### 为什么没有直接接入 SignPath action + +SignPath Foundation 的公开 GitHub 流程是：可信 GitHub Actions 产生工件 → 把工件提交给 +SignPath → 对每次请求进行人工批准 → 下载签名后的工件。它不是本地 PFX，也不能直接当作 +Tauri `signCommand` 使用。 + +当前 Tauri/NSIS 的 inside-out 签名路径会在打包期间处理主程序、卸载器、外层安装器，且 +可能准备已签名的第三方 NSIS 插件副本；而 Foundation 证书只能用于本项目允许的开源 +工件，不能把第三方插件冒充项目自有二进制直接签名。SignPath 对 PE 的工件模型也不能被 +未经验证地当成会递归处理 NSIS 内嵌 payload。因此，本仓库不会先猜一个“两轮签名”顺序 +并把它当作生产方案。 + +### 启用前必须关闭的阻塞项 + +一个独立 PR 必须提供真实的 SignPath 测试项目/证书证据，并完成： + +1. **Trusted build**：签名请求绑定本公开仓库、受保护 tag、commit、workflow run 与准确 + 版本；任何 PR 代码都拿不到签名凭据。 +2. **人工批准**：每个 release 请求由明确的 SignPath approver 单独审核，不能自动批准。 +3. **工件配置**：明确哪些文件属于本项目，排除第三方 NSIS/Tauri 插件直接签名；产品名 + 与版本资源必须受 SignPath 规则约束。 +4. **可复现试签**：对 x64 与 ARM64 进行试签，证明最终安装器、安装后的主程序和 + `uninstall.exe` 都得到预期的 SignPath Foundation 发行者身份及有效时间戳。 +5. **NSIS 顺序**：用真实工件证明可行的打包/签名顺序；在证据出现前，不实现两轮签名 + 流水线，也不声称 SignPath 会深入签署 NSIS payload。 +6. **发布字节绑定**：在 Authenticode 完成后生成 Tauri updater `.sig`，再核对 GitHub + Release、R2 与 IHEP 最终上传文件的 hash 与已验证工件一致。 +7. **运行验收**：x64 完整执行 install → launch → upgrade → uninstall；ARM64 至少完成 + 安装、签名、升级和卸载检查，并在 ARM64 设备或可信虚拟化上补主程序启动。 + +只有上述证据经过 review，才可以用已批准的 trusted-build action 替换 fail-closed 脚本。 +仅删除阻断脚本仍不够：后续 `required` 验证会拒绝 `NotSigned`、错误发行者或缺少时间戳的 +工件。 + +### 预留的验证工具 + +- [`scripts/assert-signpath-foundation-ready.ps1`](../scripts/assert-signpath-foundation-ready.ps1) + — 当前正式发布硬阻断；故意没有成功路径或 secret 开关。 +- [`scripts/verify-windows-authenticode.ps1`](../scripts/verify-windows-authenticode.ps1) + — `required` 模式验证 Windows 报告的签名状态、预期 subject 与时间戳；`optional` 只供 + unsigned PR / 本地诊断。时间戳 countersigner 本身不足以证明所有 RFC3161 细节，试签还 + 必须检查 SignPath policy 与 `signtool verify /pa /all /v` 输出。 +- [`scripts/windows-packaged-smoke.ps1`](../scripts/windows-packaged-smoke.ps1) + — 安装后检查主程序与卸载器，并覆盖升级/卸载路径。 +- [`scripts/windows-pe-arch.ps1`](../scripts/windows-pe-arch.ps1) + — 断言 x64 / ARM64 主程序的 PE machine type；cross-build 不等同于 ARM64 运行验证。 + +仓库中不存在生产可用的 SignPath token、organization/project slug、signing policy slug 或 +artifact configuration slug。在申请获批前不要猜测这些值，也不要新增 PFX fallback。 + +### 用户如何核验现有版本 + +当前版本预期会显示 `NotSigned`；下面的命令用于核对实际文件，而不是把 updater `.sig` +误认成 Authenticode： ```powershell +Get-AuthenticodeSignature .\CodexAppManager_x64-setup.exe | + Format-List Status,StatusMessage,SignerCertificate,TimeStamperCertificate Get-FileHash .\CodexAppManager_x64-setup.exe -Algorithm SHA256 -Get-FileHash .\CodexAppManager_arm64-setup.exe -Algorithm SHA256 ``` -哈希、Authenticode、updater `.sig` 各自回答不同问题，不能互相替代。 - -### 相关脚本 - -- [`scripts/prepare-windows-authenticode.ps1`](../scripts/prepare-windows-authenticode.ps1) — 正式发布导入证书并生成 Tauri 配置；凭据缺失即失败。 -- [`scripts/verify-windows-authenticode.ps1`](../scripts/verify-windows-authenticode.ps1) — `required` 发布硬门；`optional` 仅供无 secret 的 PR / 本地诊断。 -- [`scripts/windows-packaged-smoke.ps1`](../scripts/windows-packaged-smoke.ps1) — 安装后验证主程序与卸载器，并覆盖升级、卸载路径。 -- [`scripts/sign-windows-authenticode.ps1`](../scripts/sign-windows-authenticode.ps1) — 旧的本地单文件签名工具；正式发布不依赖它。 -- [`scripts/windows-pe-arch.ps1`](../scripts/windows-pe-arch.ps1) — 验证 x64 / ARM64 PE machine type。 +文件 hash 应与对应 GitHub Release 的 `SHA256SUMS` 比对。未来启用 SignPath 后，每个 +release note 仍必须按真实验证结果说明该版的 Windows 签名状态。 ## English -### Release state - -- Windows releases require an OV/EV Authenticode PFX. Missing credentials hard-fail the tag build. -- The x64 and ARM64 main executable, generated NSIS uninstaller, and outer setup executable are signed by the same certificate with SHA-256 and an RFC3161 timestamp. -- CI requires `Get-AuthenticodeSignature.Status == Valid`, an exact match to the imported certificate thumbprint, and a timestamp countersigner on every layer. -- Pull requests do not receive release secrets. They intentionally build unsigned packages and run optional probes plus lifecycle smoke; this does not make unsigned release artifacts acceptable. -- In-app updates separately require a Tauri updater `.sig` over the final Authenticode-signed setup bytes. - -### Three independent mechanisms - -**Authenticode** is Windows publisher identity for PE files. The release job imports the PFX and gives Tauri a private config with `certificateThumbprint`, SHA-256, an RFC3161 timestamp URL, and `tsp=true`. Tauri signs the main executable, generated uninstaller, and outer NSIS installer inside-out; the custom template also selects Tauri's private signed NSIS plugin directory. - -**The Tauri updater signature** authenticates the final bytes referenced by `latest.json`. It protects downloads from tampering across GitHub, the mirror, and transport hops. It does not establish a Windows publisher. Its private key is separate from the Authenticode PFX. - -**SmartScreen reputation** is a Microsoft risk signal based on more than the presence of a signature. Authenticode provides a verifiable publisher but cannot promise that a new certificate or artifact will never trigger a warning. A SmartScreen warning is also not evidence that the updater signature failed. - -### Release gate - -The Windows jobs prepare the certificate, build with inside-out signing, verify the outer setup executable, install each architecture's package to inspect the signed embedded main/uninstaller, create the independent updater signature, collect the final names, and verify the publishable setup again. Tauri restores `target/.../release/codex-app-manager.exe` to its unsigned, unpatched build input after bundling, so that raw intermediate is used only for the PE architecture diagnostic and is not a signature gate. x64 runs the full launch lifecycle; ARM64 performs install/signature/upgrade/uninstall checks on the x64 host but requires ARM64 hardware or trusted virtualization for a real launch test. - -There is no `AUTHENTICODE_REQUIRED` toggle for a tag release. Any missing layer, non-`Valid` status, wrong thumbprint, absent timestamp, or missing updater signature blocks publication. The PFX and imported certificate are removed in an `always()` cleanup step. - -### Required release environment - -| Name | Kind | Purpose | -|---|---|---| -| `WINDOWS_CERTIFICATE` | secret | base64-encoded OV/EV code-signing PFX | -| `WINDOWS_CERTIFICATE_PASSWORD` | secret | PFX password; may be empty for an unprotected PFX | -| `WINDOWS_TIMESTAMP_URL` | optional variable | RFC3161 endpoint; defaults to `http://timestamp.digicert.com` | -| `TAURI_SIGNING_PRIVATE_KEY` | secret | Tauri updater private key, not the Authenticode certificate | -| `TAURI_SIGNING_PRIVATE_KEY_PASSWORD` | secret | updater-key password | - -Never expose the PFX to a pull-request workflow or commit certificate material to the repository. Historical release notes retain the actual status of those older artifacts. +### Current state (application/migration pending) + +- The project is applying to **SignPath Foundation**. As of 2026-07-11, the + application has not been approved, no certificate has been issued, and no + GitHub trusted-build signing integration is active. +- Published Windows x64/ARM64 installers are **not Authenticode-signed** today + and may trigger SmartScreen. The release note for each historical version is + the source of truth for that artifact. +- Existing Tauri updater signatures in `.sig` / `latest.json` authenticate the + downloaded update bytes only; they do not establish a Windows publisher. +- Windows tag jobs intentionally fail before building by running + `assert-signpath-foundation-ready.ps1`. The publish job requires the complete + build matrix, so it cannot produce a partial or silently unsigned release. +- This repository no longer accepts `WINDOWS_CERTIFICATE`, PFX passwords, or a + generated Tauri thumbprint config. Adding a certificate secret cannot bypass + the blocker. + +### Why there is no SignPath action yet + +The public SignPath Foundation GitHub flow submits an artifact from a trusted +GitHub Actions build, requires manual approval for each request, and returns a +signed artifact. It is not a local PFX and cannot be used directly as Tauri's +`signCommand`. + +Tauri/NSIS inside-out signing operates during packaging across the app, +uninstaller, outer installer, and potentially prepared copies of third-party +NSIS plugins. A Foundation certificate must not directly sign third-party +plugins as project-owned binaries. SignPath's PE artifact model must also not be +assumed to recursively sign an embedded NSIS payload without evidence. This +repository therefore does not implement or claim an unverified two-pass flow. + +### Blockers that must be closed before activation + +A separate PR must use a real SignPath test project/certificate to demonstrate: + +1. trusted origin binding to this public repository, protected tag, commit, + workflow run, and exact version, without exposing credentials to PR code; +2. manual approval of every release request by an explicit SignPath approver; +3. artifact rules that bind product/version metadata and exclude direct signing + of third-party NSIS/Tauri plugins; +4. reproducible x64 and ARM64 pilot signing for the final setup executable, + installed app, and `uninstall.exe`, with the expected SignPath Foundation + publisher and valid timestamp; +5. a proven NSIS packaging/signing order rather than an assumed two-pass design; +6. a Tauri updater `.sig` created only after Authenticode, followed by hash + equality across the verified artifact, GitHub Release, R2, and IHEP; and +7. x64 install/launch/upgrade/uninstall smoke plus native ARM64 launch evidence. + +Only reviewed evidence can replace the fail-closed script with the approved +trusted-build action. Deleting the blocker alone is insufficient: downstream +required checks must still reject `NotSigned`, an unexpected publisher, or a +missing timestamp. + +### Reserved verification tools + +- `assert-signpath-foundation-ready.ps1` is the current hard blocker and has no + success path or secret-controlled bypass. +- `verify-windows-authenticode.ps1` checks Windows signature status, expected + subject, and timestamp in required mode; optional mode is for intentionally + unsigned PR/local diagnostics. A timestamp countersigner alone does not prove + every RFC3161 detail, so the pilot must also review SignPath policy and + `signtool verify /pa /all /v` output. +- `windows-packaged-smoke.ps1` verifies installed PE files and exercises the + package lifecycle. +- `windows-pe-arch.ps1` asserts the app PE architecture; cross-building ARM64 + does not replace a native ARM64 launch test. + +There is no production SignPath token, organization/project slug, signing +policy slug, or artifact-configuration slug in this repository. Do not invent +those values or add a PFX fallback before approval. + +### Verifying current releases + +Current artifacts are expected to report `NotSigned`. Use +`Get-AuthenticodeSignature` to inspect the actual file and compare its SHA-256 +hash with the matching release's `SHA256SUMS`; do not treat a Tauri updater +`.sig` as publisher identity. After SignPath activation, each release note must +still state that release's observed Windows signing status. diff --git a/eslint.config.js b/eslint.config.js index 104698a..faf277f 100644 --- a/eslint.config.js +++ b/eslint.config.js @@ -20,6 +20,7 @@ export default tseslint.config( "src-tauri/", "website/", "cloudflare/", + "vendor/", "scripts/", "docs/", "*.config.*", diff --git a/scripts/assert-signpath-foundation-ready.ps1 b/scripts/assert-signpath-foundation-ready.ps1 new file mode 100644 index 0000000..c1423fc --- /dev/null +++ b/scripts/assert-signpath-foundation-ready.ps1 @@ -0,0 +1,24 @@ +# Fail-closed release placeholder for the SignPath Foundation migration. +# +# This script intentionally has no success path. Remove or replace it only in a +# reviewed change that implements an approved SignPath trusted-build flow, +# manual per-release approval, project-owned artifact boundaries, and final +# Authenticode/timestamp verification. Setting a secret or variable must never +# bypass this guard by itself. + +[CmdletBinding()] +param( + [string]$Stage = "signpath-readiness" +) + +Set-StrictMode -Version Latest +$ErrorActionPreference = "Stop" + +$message = @( + "Windows release signing is blocked: the SignPath Foundation application and trusted-build migration are not complete." + "No certificate has been issued and no production signing integration is active." + "See docs/code-signing-policy.md and docs/windows-signing.md." +) -join " " + +Write-Host "::error title=Windows release is fail-closed::[$Stage] $message" +throw "[$Stage] $message" diff --git a/scripts/gen-updater-manifest.mjs b/scripts/gen-updater-manifest.mjs index a7001e3..aa98abc 100644 --- a/scripts/gen-updater-manifest.mjs +++ b/scripts/gen-updater-manifest.mjs @@ -103,6 +103,29 @@ if (missing.length > 0) { } writeFileSync("latest.json", JSON.stringify(manifest, null, 2)); + +// `latest.json` remains URL-rewritten on the CN mirror for compatibility with +// already-shipped clients, so it cannot itself have one cross-provider +// signature. Sign this deterministic URL-free identity instead. New clients +// require the identity before trusting any mirror's version/signature claim. +// Deliberately exclude pub_date/build time so a rerun for the same release +// produces byte-identical identity JSON. +const releaseIdentity = { + schema: 1, + version, + notes_sha256: createHash("sha256").update(notes, "utf8").digest("hex"), + platforms: Object.fromEntries( + resolved.map(({ platform, artifact, sha256 }) => [ + platform, + { + artifact, + signature: platforms[platform].signature, + sha256, + }, + ]), + ), +}; +writeFileSync("release-identity.json", JSON.stringify(releaseIdentity, null, 2) + "\n"); writeFileSync( "manifest-summary.json", JSON.stringify( @@ -124,3 +147,4 @@ writeFileSync( ) + "\n", ); console.log("wrote latest.json:\n" + JSON.stringify(manifest, null, 2)); +console.log("wrote release-identity.json:\n" + JSON.stringify(releaseIdentity, null, 2)); diff --git a/scripts/gen-updater-manifest.test.mjs b/scripts/gen-updater-manifest.test.mjs new file mode 100644 index 0000000..3fdea47 --- /dev/null +++ b/scripts/gen-updater-manifest.test.mjs @@ -0,0 +1,57 @@ +import { createHash } from "node:crypto"; +import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs"; +import { tmpdir } from "node:os"; +import { dirname, join } from "node:path"; +import { fileURLToPath } from "node:url"; +import { spawnSync } from "node:child_process"; +import { afterEach, describe, expect, it } from "vitest"; + +const script = join(dirname(fileURLToPath(import.meta.url)), "gen-updater-manifest.mjs"); +const tempDirs = []; + +afterEach(() => { + for (const dir of tempDirs.splice(0)) rmSync(dir, { recursive: true, force: true }); +}); + +describe("release identity generation", () => { + it("is byte-stable across reruns and excludes the manifest clock", () => { + const root = mkdtempSync(join(tmpdir(), "cam-release-identity-")); + tempDirs.push(root); + mkdirSync(join(root, "dist")); + mkdirSync(join(root, "docs", "releases"), { recursive: true }); + writeFileSync(join(root, "docs", "releases", "v1.2.3.md"), "Reviewed notes\n"); + + const fixtures = [ + ["CodexAppManager_aarch64.app.tar.gz", "mac-arm"], + ["CodexAppManager_x86_64.app.tar.gz", "mac-x64"], + ["CodexAppManager_1.2.3_x64-setup.exe", "win-x64"], + ["CodexAppManager_1.2.3_arm64-setup.exe", "win-arm"], + ]; + for (const [name, bytes] of fixtures) { + writeFileSync(join(root, "dist", name), bytes); + writeFileSync(join(root, "dist", `${name}.sig`), `signature-${name}`); + } + + const run = () => { + const result = spawnSync(process.execPath, [script, "v1.2.3", "dist"], { + cwd: root, + encoding: "utf8", + }); + expect(result.status, result.stderr).toBe(0); + return readFileSync(join(root, "release-identity.json")); + }; + const first = run(); + const second = run(); + expect(second.equals(first)).toBe(true); + + const identity = JSON.parse(first.toString("utf8")); + expect(identity).not.toHaveProperty("pub_date"); + expect(identity.notes_sha256).toBe( + createHash("sha256").update("Reviewed notes", "utf8").digest("hex"), + ); + expect(identity.platforms["windows-x86_64"]).toMatchObject({ + artifact: "CodexAppManager_1.2.3_x64-setup.exe", + sha256: createHash("sha256").update("win-x64").digest("hex"), + }); + }); +}); diff --git a/scripts/minisign-verify.mjs b/scripts/minisign-verify.mjs new file mode 100644 index 0000000..9f332a8 --- /dev/null +++ b/scripts/minisign-verify.mjs @@ -0,0 +1,108 @@ +import { createHash, createPublicKey, timingSafeEqual, verify } from "node:crypto"; +import { readFileSync } from "node:fs"; +import { pathToFileURL } from "node:url"; + +const PUBLIC_KEY_PACKET_BYTES = 42; +const SIGNATURE_PACKET_BYTES = 74; +const ED25519_SIGNATURE_BYTES = 64; +const TRUSTED_COMMENT_PREFIX = "trusted comment: "; +const ED25519_SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex"); + +const decodeBase64 = (value, label) => { + const compact = String(value).trim(); + if (!compact) throw new Error(`${label} is empty`); + const decoded = Buffer.from(compact, "base64"); + if (decoded.length === 0) throw new Error(`${label} is not valid base64`); + return decoded; +}; + +const decodeTauriPublicKey = (encodedPublicKey) => { + const text = decodeBase64(encodedPublicKey, "Tauri updater public key").toString("utf8"); + const lines = text.trim().split(/\r?\n/); + const packet = decodeBase64(lines.at(-1), "minisign public key packet"); + if (packet.length !== PUBLIC_KEY_PACKET_BYTES) { + throw new Error("minisign public key packet has an invalid length"); + } + const algorithm = packet.subarray(0, 2).toString("ascii"); + if (algorithm !== "Ed" && algorithm !== "ED") { + throw new Error("minisign public key uses an unsupported algorithm"); + } + return { + keyId: packet.subarray(2, 10), + key: createPublicKey({ + key: Buffer.concat([ED25519_SPKI_PREFIX, packet.subarray(10)]), + format: "der", + type: "spki", + }), + }; +}; + +const decodeTauriSignature = (encodedSignature) => { + const text = decodeBase64(encodedSignature, "Tauri updater signature").toString("utf8"); + const lines = text.trim().split(/\r?\n/); + if (lines.length !== 4 || !lines[2].startsWith(TRUSTED_COMMENT_PREFIX)) { + throw new Error("minisign signature has an invalid four-line envelope"); + } + const packet = decodeBase64(lines[1], "minisign signature packet"); + const globalSignature = decodeBase64(lines[3], "minisign global signature"); + if ( + packet.length !== SIGNATURE_PACKET_BYTES || + globalSignature.length !== ED25519_SIGNATURE_BYTES + ) { + throw new Error("minisign signature packet has an invalid length"); + } + const algorithm = packet.subarray(0, 2).toString("ascii"); + if (algorithm !== "Ed" && algorithm !== "ED") { + throw new Error("minisign signature uses an unsupported algorithm"); + } + return { + algorithm, + keyId: packet.subarray(2, 10), + signature: packet.subarray(10), + trustedComment: lines[2].slice(TRUSTED_COMMENT_PREFIX.length), + globalSignature, + }; +}; + +export const verifyTauriMinisign = (bytes, encodedSignature, encodedPublicKey) => { + const data = Buffer.isBuffer(bytes) ? bytes : Buffer.from(bytes); + const publicKey = decodeTauriPublicKey(encodedPublicKey); + const signature = decodeTauriSignature(encodedSignature); + if (!timingSafeEqual(publicKey.keyId, signature.keyId)) { + throw new Error("minisign signature key id does not match the updater public key"); + } + + const message = + signature.algorithm === "ED" ? createHash("blake2b512").update(data).digest() : data; + if (!verify(null, message, publicKey.key, signature.signature)) { + throw new Error("minisign content signature verification failed"); + } + const globalMessage = Buffer.concat([ + signature.signature, + Buffer.from(signature.trustedComment, "utf8"), + ]); + if (!verify(null, globalMessage, publicKey.key, signature.globalSignature)) { + throw new Error("minisign trusted-comment signature verification failed"); + } + return true; +}; + +if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) { + const [, , filePath, signaturePath, configPath = "src-tauri/tauri.conf.json"] = process.argv; + if (!filePath || !signaturePath) { + console.error("usage: minisign-verify.mjs [tauri.conf.json]"); + process.exit(2); + } + try { + const config = JSON.parse(readFileSync(configPath, "utf8")); + verifyTauriMinisign( + readFileSync(filePath), + readFileSync(signaturePath, "utf8").trim(), + config?.plugins?.updater?.pubkey ?? "", + ); + console.log(`verified minisign signature: ${filePath}`); + } catch (error) { + console.error(error instanceof Error ? error.message : String(error)); + process.exit(1); + } +} diff --git a/scripts/minisign-verify.test.mjs b/scripts/minisign-verify.test.mjs new file mode 100644 index 0000000..5c3ca74 --- /dev/null +++ b/scripts/minisign-verify.test.mjs @@ -0,0 +1,110 @@ +import { describe, expect, it } from "vitest"; +import { verifyTauriMinisign } from "./minisign-verify.mjs"; +import { + reuseGithubReleaseIdentitySignature, + reuseReleaseIdentitySignature, +} from "./reuse-release-identity-signature.mjs"; + +const RAW_PUBLIC_KEY = + "RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3"; +const RAW_SIGNATURE = `untrusted comment: signature from minisign secret key +RUQf6LRCGA9i559r3g7V1qNyJDApGip8MfqcadIgT9CuhV3EMhHoN1mGTkUidF/z7SrlQgXdy8ofjb7bNJJylDOocrCo8KLzZwo= +trusted comment: timestamp:1633700835\tfile:test\tprehashed +wLMDjy9FLAuxZ3q4NlEvkgtyhrr0gtTu6KC4KBJdITbbOeAi1zBIYo0v4iTgt8jJpIidRJnp94ABQkJAgAooBQ==`; +const TAURI_PUBLIC_KEY = Buffer.from( + `untrusted comment: minisign public key\n${RAW_PUBLIC_KEY}\n`, +).toString("base64"); +const TAURI_SIGNATURE = Buffer.from(`${RAW_SIGNATURE}\n`).toString("base64"); + +const response = (body, status = 200) => + new Response(body, { + status, + headers: body == null ? {} : { "content-length": String(Buffer.byteLength(body)) }, + }); + +describe("release identity minisign", () => { + it("verifies the Tauri base64 minisign envelope and rejects changed bytes", () => { + expect(verifyTauriMinisign(Buffer.from("test"), TAURI_SIGNATURE, TAURI_PUBLIC_KEY)).toBe(true); + expect(() => + verifyTauriMinisign(Buffer.from("tampered"), TAURI_SIGNATURE, TAURI_PUBLIC_KEY), + ).toThrow(/content signature verification failed/); + }); + + it("reuses the exact first-stage signature on a release rerun", async () => { + const identityBytes = Buffer.from("test"); + const missingFetch = async () => response(null, 404); + await expect( + reuseReleaseIdentitySignature({ + identityBytes, + version: "1.0.0", + mirrorBase: "https://mirror.example/manager", + publicKey: TAURI_PUBLIC_KEY, + fetchImpl: missingFetch, + }), + ).resolves.toBeNull(); + + const rerunFetch = async (url) => + response(url.pathname.endsWith(".sig") ? TAURI_SIGNATURE : identityBytes); + const reused = await reuseReleaseIdentitySignature({ + identityBytes, + version: "1.0.0", + mirrorBase: "https://mirror.example/manager", + publicKey: TAURI_PUBLIC_KEY, + fetchImpl: rerunFetch, + }); + + expect(reused.toString("utf8")).toBe(`${TAURI_SIGNATURE}\n`); + }); + + it("reuses an already-published GitHub Release signature before consulting mirrors", async () => { + const identityBytes = Buffer.from("test"); + const calls = []; + const fetchImpl = async (url) => { + calls.push(String(url)); + if (String(url).includes("/releases/tags/v1.0.0")) { + return response( + JSON.stringify({ + assets: [ + { name: "release-identity.json", url: "https://api.github.test/assets/1" }, + { name: "release-identity.json.sig", url: "https://api.github.test/assets/2" }, + ], + }), + ); + } + if (String(url).endsWith("/assets/1")) return response(identityBytes); + if (String(url).endsWith("/assets/2")) return response(TAURI_SIGNATURE); + throw new Error(`unexpected URL ${url}`); + }; + + const reused = await reuseGithubReleaseIdentitySignature({ + identityBytes, + version: "1.0.0", + repository: "owner/repo", + tag: "v1.0.0", + token: "test-token", + publicKey: TAURI_PUBLIC_KEY, + fetchImpl, + }); + + expect(reused.toString("utf8")).toBe(`${TAURI_SIGNATURE}\n`); + expect(calls).toEqual([ + "https://api.github.com/repos/owner/repo/releases/tags/v1.0.0", + "https://api.github.test/assets/1", + "https://api.github.test/assets/2", + ]); + }); + + it("fails closed when an immutable prior identity differs", async () => { + const fetchImpl = async (url) => + response(url.pathname.endsWith(".sig") ? TAURI_SIGNATURE : "different"); + await expect( + reuseReleaseIdentitySignature({ + identityBytes: Buffer.from("test"), + version: "1.0.0", + mirrorBase: "https://mirror.example/manager", + publicKey: TAURI_PUBLIC_KEY, + fetchImpl, + }), + ).rejects.toThrow(/immutable release identity differs/); + }); +}); diff --git a/scripts/prepare-windows-authenticode.ps1 b/scripts/prepare-windows-authenticode.ps1 deleted file mode 100644 index d939905..0000000 --- a/scripts/prepare-windows-authenticode.ps1 +++ /dev/null @@ -1,103 +0,0 @@ -# Import the release code-signing certificate and generate the Tauri config used -# for inside-out Windows signing (main executable, NSIS uninstaller, installer). -# -# This script is intentionally release-only: missing credentials are fatal. Pull -# request workflows must never receive the PFX secret; they keep building unsigned -# installers and exercise the same NSIS template in optional verification mode. - -[CmdletBinding()] -param( - [string]$CertificateBase64 = $env:WINDOWS_CERTIFICATE, - [string]$CertificatePassword = $env:WINDOWS_CERTIFICATE_PASSWORD, - [string]$TimestampUrl = $(if ($env:WINDOWS_TIMESTAMP_URL) { $env:WINDOWS_TIMESTAMP_URL } else { "http://timestamp.digicert.com" }), - [string]$ConfigPath = $(Join-Path ([System.IO.Path]::GetTempPath()) "tauri-authenticode.conf.json"), - [string]$Stage = "sign-prepare" -) - -Set-StrictMode -Version Latest -$ErrorActionPreference = "Stop" - -function Fail-Stage([string]$Message) { - Write-Host "::error::[$Stage] $Message" - throw "[$Stage] $Message" -} - -if ([string]::IsNullOrWhiteSpace($CertificateBase64)) { - Fail-Stage "WINDOWS_CERTIFICATE is required for a release build" -} -if ([string]::IsNullOrWhiteSpace($TimestampUrl)) { - Fail-Stage "WINDOWS_TIMESTAMP_URL must resolve to an RFC3161 timestamp service" -} - -$timestamp = $null -try { - $timestamp = [Uri]$TimestampUrl -} -catch { - Fail-Stage "WINDOWS_TIMESTAMP_URL is not a valid absolute URL" -} -if (-not $timestamp.IsAbsoluteUri -or $timestamp.Scheme -notin @("http", "https")) { - Fail-Stage "WINDOWS_TIMESTAMP_URL must use http or https" -} - -$tempDir = Join-Path ([System.IO.Path]::GetTempPath()) ("cam-authenticode-" + [guid]::NewGuid().ToString("n")) -New-Item -ItemType Directory -Path $tempDir | Out-Null -$pfxPath = Join-Path $tempDir "codesign.pfx" - -try { - [IO.File]::WriteAllBytes($pfxPath, [Convert]::FromBase64String($CertificateBase64.Trim())) - $securePass = if ([string]::IsNullOrEmpty($CertificatePassword)) { - New-Object System.Security.SecureString - } - else { - ConvertTo-SecureString -String $CertificatePassword -AsPlainText -Force - } - - $imported = @(Import-PfxCertificate ` - -FilePath $pfxPath ` - -CertStoreLocation Cert:\CurrentUser\My ` - -Password $securePass) - $certificate = $imported | - Where-Object { $_.HasPrivateKey } | - Select-Object -First 1 - if (-not $certificate) { - Fail-Stage "the imported PFX contains no certificate with a private key" - } - - $thumbprint = $certificate.Thumbprint.Replace(" ", "").ToUpperInvariant() - $configDir = Split-Path -Parent $ConfigPath - if ($configDir) { - New-Item -ItemType Directory -Path $configDir -Force | Out-Null - } - @{ - bundle = @{ - windows = @{ - certificateThumbprint = $thumbprint - digestAlgorithm = "sha256" - timestampUrl = $TimestampUrl - tsp = $true - } - } - } | ConvertTo-Json -Depth 6 | Set-Content -LiteralPath $ConfigPath -Encoding utf8 - - Write-Host "[$Stage] imported subject=$($certificate.Subject) thumbprint=$thumbprint" - Write-Host "[$Stage] generated Tauri Authenticode config: $ConfigPath" - - if ($env:GITHUB_ENV) { - "TAURI_AUTHENTICODE_CONFIG=$ConfigPath" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8 - "WINDOWS_CERTIFICATE_THUMBPRINT=$thumbprint" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8 - "WINDOWS_CERTIFICATE_TEMP_DIR=$tempDir" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8 - } - if ($env:GITHUB_OUTPUT) { - "thumbprint=$thumbprint" | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8 - "config=$ConfigPath" | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8 - } -} -catch { - if (Test-Path -LiteralPath $tempDir) { - Remove-Item -LiteralPath $tempDir -Recurse -Force -ErrorAction SilentlyContinue - } - throw -} - -return diff --git a/scripts/release-identity-workflow.test.mjs b/scripts/release-identity-workflow.test.mjs new file mode 100644 index 0000000..940ad27 --- /dev/null +++ b/scripts/release-identity-workflow.test.mjs @@ -0,0 +1,16 @@ +import { readFileSync } from "node:fs"; +import { dirname, join } from "node:path"; +import { fileURLToPath } from "node:url"; +import { describe, expect, it } from "vitest"; + +const root = join(dirname(fileURLToPath(import.meta.url)), ".."); + +describe("release identity workflow wiring", () => { + it("publishes one latest.json asset while retaining versioned identity assets", () => { + const workflow = readFileSync(join(root, ".github", "workflows", "release.yml"), "utf8"); + expect(workflow).toContain("cp release-identity.json release-identity.json.sig dist/"); + expect(workflow).not.toMatch(/cp latest\.json release-identity\.json/); + expect(workflow.match(/rm -f dist\/latest\.json dist\/latest\.mirror\.json/g)).toHaveLength(2); + expect(workflow).toMatch(/files:\s*\|[\s\S]*?dist\/\*[\s\S]*?\n\s+latest\.json/); + }); +}); diff --git a/scripts/reuse-release-identity-signature.mjs b/scripts/reuse-release-identity-signature.mjs new file mode 100644 index 0000000..bd50935 --- /dev/null +++ b/scripts/reuse-release-identity-signature.mjs @@ -0,0 +1,172 @@ +#!/usr/bin/env node +import { readFileSync, writeFileSync } from "node:fs"; +import { pathToFileURL } from "node:url"; +import { verifyTauriMinisign } from "./minisign-verify.mjs"; + +const IDENTITY_MAX_BYTES = 256 * 1024; +const SIGNATURE_MAX_BYTES = 16 * 1024; + +export const fetchBounded = async (fetchImpl, url, maxBytes, label, options = {}) => { + const response = await fetchImpl(url, { redirect: "follow", ...options }); + if (response.status === 404) return null; + if (!response.ok) throw new Error(`${label} returned HTTP ${response.status}`); + + const announced = Number(response.headers.get("content-length")); + if (Number.isFinite(announced) && announced > maxBytes) { + throw new Error(`${label} exceeds ${maxBytes}-byte limit (announced ${announced})`); + } + if (!response.body) return Buffer.alloc(0); + + const chunks = []; + let observed = 0; + for await (const chunk of response.body) { + const bytes = Buffer.from(chunk); + observed += bytes.length; + if (!Number.isSafeInteger(observed) || observed > maxBytes) { + await response.body.cancel().catch(() => {}); + throw new Error(`${label} exceeds ${maxBytes}-byte limit (observed ${observed})`); + } + chunks.push(bytes); + } + return Buffer.concat(chunks, observed); +}; + +const verifyReusableSignature = ({ identityBytes, remoteIdentity, remoteSignature, publicKey }) => { + if (remoteIdentity && !remoteIdentity.equals(identityBytes)) { + throw new Error("prior immutable release identity differs from the local canonical bytes"); + } + if (!remoteSignature) return null; + const encodedSignature = remoteSignature.toString("utf8").trim(); + verifyTauriMinisign(identityBytes, encodedSignature, publicKey); + return Buffer.from(`${encodedSignature}\n`, "utf8"); +}; + +export const reuseGithubReleaseIdentitySignature = async ({ + identityBytes, + version, + repository, + tag, + token, + publicKey, + fetchImpl = fetch, +}) => { + if (!repository || !tag || tag.replace(/^v/, "") !== version) return null; + const headers = { + accept: "application/vnd.github+json", + "x-github-api-version": "2022-11-28", + ...(token ? { authorization: `Bearer ${token}` } : {}), + }; + const metadataBytes = await fetchBounded( + fetchImpl, + `https://api.github.com/repos/${repository}/releases/tags/${encodeURIComponent(tag)}`, + 1024 * 1024, + "prior GitHub Release metadata", + { headers }, + ); + if (!metadataBytes) return null; + const release = JSON.parse(metadataBytes.toString("utf8")); + const assets = Array.isArray(release.assets) ? release.assets : []; + const identityAsset = assets.find((asset) => asset?.name === "release-identity.json"); + const signatureAsset = assets.find((asset) => asset?.name === "release-identity.json.sig"); + if (!identityAsset && !signatureAsset) return null; + + const assetHeaders = { ...headers, accept: "application/octet-stream" }; + const [remoteIdentity, remoteSignature] = await Promise.all([ + identityAsset + ? fetchBounded( + fetchImpl, + identityAsset.url, + IDENTITY_MAX_BYTES, + "prior GitHub release identity", + { headers: assetHeaders }, + ) + : null, + signatureAsset + ? fetchBounded( + fetchImpl, + signatureAsset.url, + SIGNATURE_MAX_BYTES, + "prior GitHub identity signature", + { headers: assetHeaders }, + ) + : null, + ]); + return verifyReusableSignature({ identityBytes, remoteIdentity, remoteSignature, publicKey }); +}; + +export const reuseReleaseIdentitySignature = async ({ + identityBytes, + version, + mirrorBase, + publicKey, + fetchImpl = fetch, +}) => { + if (!/^[0-9A-Za-z.+-]+$/.test(version)) { + throw new Error("release identity has an unsafe version"); + } + const base = new URL(`${mirrorBase.replace(/\/+$/, "")}/${encodeURIComponent(version)}/`); + const identityUrl = new URL("release-identity.json", base); + const signatureUrl = new URL("release-identity.json.sig", base); + const [remoteIdentity, remoteSignature] = await Promise.all([ + fetchBounded(fetchImpl, identityUrl, IDENTITY_MAX_BYTES, "prior release identity"), + fetchBounded(fetchImpl, signatureUrl, SIGNATURE_MAX_BYTES, "prior identity signature"), + ]); + + return verifyReusableSignature({ identityBytes, remoteIdentity, remoteSignature, publicKey }); +}; + +const main = async () => { + const [, , identityPath, signaturePath, configPath = "src-tauri/tauri.conf.json"] = process.argv; + if (!identityPath || !signaturePath) { + console.error( + "usage: reuse-release-identity-signature.mjs [tauri.conf.json]", + ); + process.exit(2); + } + const identityBytes = readFileSync(identityPath); + const identity = JSON.parse(identityBytes.toString("utf8")); + const config = JSON.parse(readFileSync(configPath, "utf8")); + const mirrorBase = process.env.MANAGER_MIRROR_BASE_URL ?? "https://codexapp.agentsmirror.com/manager"; + const publicKey = config?.plugins?.updater?.pubkey ?? ""; + let reused; + try { + const version = String(identity.version ?? ""); + try { + reused = await reuseGithubReleaseIdentitySignature({ + identityBytes, + version, + repository: process.env.GITHUB_REPOSITORY, + tag: process.env.GITHUB_REF_NAME, + token: process.env.GITHUB_TOKEN ?? process.env.GH_TOKEN, + publicKey, + }); + } catch (error) { + if (!(error instanceof TypeError && /fetch/i.test(error.message))) throw error; + console.warn(`prior GitHub identity lookup unavailable: ${error.message}`); + } + if (!reused) { + reused = await reuseReleaseIdentitySignature({ + identityBytes, + version, + mirrorBase, + publicKey, + }); + } + } catch (error) { + if (error instanceof TypeError && /fetch/i.test(error.message)) { + console.warn(`prior mirror identity lookup unavailable: ${error.message}`); + process.exit(3); + } + throw error; + } + if (!reused) process.exit(3); + writeFileSync(signaturePath, reused); + console.log(`reused verified immutable identity signature for ${identity.version}`); +}; + +if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) { + main().catch((error) => { + console.error(error instanceof Error ? error.message : String(error)); + process.exit(1); + }); +} diff --git a/scripts/sign-windows-authenticode.ps1 b/scripts/sign-windows-authenticode.ps1 deleted file mode 100644 index 1fc230d..0000000 --- a/scripts/sign-windows-authenticode.ps1 +++ /dev/null @@ -1,129 +0,0 @@ -# Authenticode-sign Windows PE files when a code-signing certificate is available. -# -# Non-blocking milestone: if WINDOWS_CERTIFICATE (base64 PFX) is unset/empty, -# the script prints a clear skip message and exits 0. Wire secrets into the -# `release` environment, then set repo variable AUTHENTICODE_REQUIRED=true to -# make verify-windows-authenticode.ps1 enforce Valid signatures. -# -# Signing order for a full release (see docs/windows-signing.md): -# 1. Prefer signing during `tauri build` via certificateThumbprint once the -# cert is imported (covers main binary + uninstaller + installer). -# 2. This script is the post-build fallback for final published artifacts -# (primarily the NSIS -setup.exe) and for local/CI verification of the path. -# -# Usage: -# $env:WINDOWS_CERTIFICATE = "" -# $env:WINDOWS_CERTIFICATE_PASSWORD = "..." -# pwsh scripts/sign-windows-authenticode.ps1 -Path path\to\setup.exe -# -# Does NOT produce Tauri updater .sig files — use `tauri signer sign` for that. - -[CmdletBinding()] -param( - [Parameter(Mandatory = $true)] - [string[]]$Path, - - [string]$CertificateBase64 = $env:WINDOWS_CERTIFICATE, - [string]$CertificatePassword = $env:WINDOWS_CERTIFICATE_PASSWORD, - [string]$TimestampUrl = $(if ($env:WINDOWS_TIMESTAMP_URL) { $env:WINDOWS_TIMESTAMP_URL } else { "http://timestamp.digicert.com" }), - [string]$Stage = "sign" -) - -Set-StrictMode -Version Latest -$ErrorActionPreference = "Stop" - -function Write-Stage([string]$Message) { - Write-Host "::group::[$Stage] $Message" -} - -function Close-Stage { - Write-Host "::endgroup::" -} - -function Fail-Stage([string]$Message) { - Write-Host "::error::[$Stage] $Message" - throw "[$Stage] $Message" -} - -if ([string]::IsNullOrWhiteSpace($CertificateBase64)) { - Write-Host "[$Stage] WINDOWS_CERTIFICATE not set — skipping Authenticode signing (non-blocking milestone)." - Write-Host "[$Stage] Installer remains unsigned; see docs/windows-signing.md." - # Do not `exit` — CI invokes this in-process with `&`. - return -} - -Write-Stage "Import certificate and locate signtool" - -$tempDir = Join-Path ([System.IO.Path]::GetTempPath()) ("cam-codesign-" + [guid]::NewGuid().ToString("n")) -New-Item -ItemType Directory -Path $tempDir | Out-Null -$pfxPath = Join-Path $tempDir "codesign.pfx" -$securePass = $null -$cert = $null - -try { - [IO.File]::WriteAllBytes($pfxPath, [Convert]::FromBase64String($CertificateBase64.Trim())) - - if ([string]::IsNullOrEmpty($CertificatePassword)) { - $securePass = New-Object System.Security.SecureString - } - else { - $securePass = ConvertTo-SecureString -String $CertificatePassword -AsPlainText -Force - } - - $cert = Import-PfxCertificate -FilePath $pfxPath -CertStoreLocation Cert:\CurrentUser\My -Password $securePass - if (-not $cert) { - Fail-Stage "Import-PfxCertificate returned no certificate" - } - $thumbprint = $cert.Thumbprint - Write-Host "[$Stage] Imported cert thumbprint=$thumbprint subject=$($cert.Subject)" - - $signtool = $null - $kitsRoot = "${env:ProgramFiles(x86)}\Windows Kits\10\bin" - if (Test-Path $kitsRoot) { - $candidates = Get-ChildItem -Path $kitsRoot -Recurse -Filter signtool.exe -ErrorAction SilentlyContinue | - Where-Object { $_.FullName -match '\\x64\\signtool\.exe$' } | - Sort-Object FullName -Descending - if ($candidates) { $signtool = $candidates[0].FullName } - } - if (-not $signtool) { - $cmd = Get-Command signtool.exe -ErrorAction SilentlyContinue - if ($cmd) { $signtool = $cmd.Source } - } - if (-not $signtool) { - Fail-Stage "signtool.exe not found (install Windows SDK signing tools on the runner)" - } - Write-Host "[$Stage] Using signtool: $signtool" - Close-Stage - - foreach ($raw in $Path) { - if ([string]::IsNullOrWhiteSpace($raw)) { continue } - $item = Get-Item -LiteralPath $raw -ErrorAction Stop - Write-Stage "Sign $($item.Name)" - & $signtool sign ` - /fd SHA256 ` - /td SHA256 ` - /tr $TimestampUrl ` - /sha1 $thumbprint ` - $item.FullName - if ($LASTEXITCODE -ne 0) { - Fail-Stage "signtool failed for $($item.FullName) (exit=$LASTEXITCODE)" - } - $sig = Get-AuthenticodeSignature -LiteralPath $item.FullName - if ($sig.Status -ne "Valid") { - Fail-Stage "post-sign status for $($item.Name) is $($sig.Status), expected Valid" - } - Write-Host "[$Stage] Signed OK: $($item.Name) subject=$($sig.SignerCertificate.Subject)" - Close-Stage - } -} -finally { - if ($cert -and $cert.Thumbprint) { - Remove-Item -LiteralPath "Cert:\CurrentUser\My\$($cert.Thumbprint)" -ErrorAction SilentlyContinue - } - if (Test-Path $tempDir) { - Remove-Item -LiteralPath $tempDir -Recurse -Force -ErrorAction SilentlyContinue - } -} - -Write-Host "[$Stage] Authenticode signing complete" -return diff --git a/scripts/sync-mirror-identity.test.mjs b/scripts/sync-mirror-identity.test.mjs new file mode 100644 index 0000000..2acb547 --- /dev/null +++ b/scripts/sync-mirror-identity.test.mjs @@ -0,0 +1,92 @@ +import { chmodSync, mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs"; +import { tmpdir } from "node:os"; +import { delimiter, dirname, join } from "node:path"; +import { fileURLToPath } from "node:url"; +import { spawnSync } from "node:child_process"; +import { afterEach, describe, expect, it } from "vitest"; + +const script = join(dirname(fileURLToPath(import.meta.url)), "sync-mirror.sh"); +const tempDirs = []; + +afterEach(() => { + for (const dir of tempDirs.splice(0)) rmSync(dir, { recursive: true, force: true }); +}); + +describe("mirror identity staging", () => { + it("reuses identical immutable identity bytes and rejects a rerun with a new signature", () => { + const root = mkdtempSync(join(tmpdir(), "cam-mirror-identity-")); + tempDirs.push(root); + const dist = join(root, "dist"); + const bin = join(root, "bin"); + const store = join(root, "s3"); + mkdirSync(dist); + mkdirSync(bin); + mkdirSync(store); + writeFileSync(join(dist, "app.bin"), "artifact"); + writeFileSync(join(dist, "release-identity.json"), '{"schema":1,"version":"1.2.3"}\n'); + writeFileSync(join(dist, "release-identity.json.sig"), "first-signature\n"); + writeFileSync( + join(dist, "latest.json"), + JSON.stringify({ + version: "1.2.3", + platforms: { test: { url: "https://github.test/app.bin", signature: "artifact-sig" } }, + }), + ); + + const fakeAws = join(bin, "aws"); + writeFileSync( + fakeAws, + `#!/usr/bin/env bash +set -euo pipefail +if [ "$1 $2" = "s3api head-object" ]; then + shift 2; bucket=""; key="" + while [ "$#" -gt 0 ]; do + case "$1" in --bucket) bucket="$2"; shift 2;; --key) key="$2"; shift 2;; *) shift;; esac + done + [ -f "$FAKE_S3/$bucket/$key" ] && { echo '{}'; exit 0; } + echo 'An error occurred (404) when calling HeadObject' >&2; exit 255 +fi +if [ "$1 $2" = "s3 cp" ]; then + src="$3"; dst="$4" + if [[ "$src" == s3://* ]]; then + remote="\${src#s3://}"; cp "$FAKE_S3/$remote" "$dst" + else + remote="\${dst#s3://}"; mkdir -p "$(dirname "$FAKE_S3/$remote")"; cp "$src" "$FAKE_S3/$remote" + echo "$remote" >> "$FAKE_AWS_LOG" + fi + exit 0 +fi +echo "unsupported fake aws invocation: $*" >&2; exit 2 +`, + ); + chmodSync(fakeAws, 0o755); + + const env = { + ...process.env, + PATH: `${bin}${delimiter}${process.env.PATH}`, + FAKE_S3: store, + FAKE_AWS_LOG: join(root, "aws.log"), + MIRROR_PHASE: "stage", + MIRROR_BASE_URL: "https://mirror.test/manager", + MANAGER_R2_S3_ENDPOINT: "https://r2.test", + MANAGER_R2_BUCKET: "bucket", + MANAGER_R2_ACCESS_KEY_ID: "test-ak", + MANAGER_R2_SECRET_ACCESS_KEY: "test-sk", + }; + const run = () => spawnSync("bash", [script, dist], { encoding: "utf8", env }); + + const first = run(); + expect(first.status, first.stderr).toBe(0); + const second = run(); + expect(second.status, second.stderr).toBe(0); + expect(second.stdout).toContain("identical immutable object already staged"); + const uploads = readFileSync(env.FAKE_AWS_LOG, "utf8").trim().split("\n"); + expect(uploads.filter((key) => key.endsWith("/release-identity.json"))).toHaveLength(1); + expect(uploads.filter((key) => key.endsWith("/release-identity.json.sig"))).toHaveLength(1); + + writeFileSync(join(dist, "release-identity.json.sig"), "different-rerun-signature\n"); + const changed = run(); + expect(changed.status).not.toBe(0); + expect(changed.stderr).toContain("refusing to overwrite byte-different immutable identity object"); + }); +}); diff --git a/scripts/sync-mirror.sh b/scripts/sync-mirror.sh index d055373..f7a0590 100755 --- a/scripts/sync-mirror.sh +++ b/scripts/sync-mirror.sh @@ -75,6 +75,51 @@ content_type() { esac } +upload_immutable_identity_asset() { # endpoint bucket region access_key secret_key file key content_type + local endpoint="$1" bucket="$2" region="$3" ak="$4" sk="$5" file="$6" key="$7" type="$8" + local head_output head_status existing + set +e + head_output="$(AWS_ACCESS_KEY_ID="$ak" \ + AWS_SECRET_ACCESS_KEY="$sk" \ + AWS_DEFAULT_REGION="$region" \ + aws s3api head-object --bucket "$bucket" --key "$key" \ + --endpoint-url "$endpoint" 2>&1)" + head_status=$? + set -e + + if [ "$head_status" -eq 0 ]; then + existing="$(mktemp)" + AWS_ACCESS_KEY_ID="$ak" \ + AWS_SECRET_ACCESS_KEY="$sk" \ + AWS_DEFAULT_REGION="$region" \ + aws s3 cp "s3://$bucket/$key" "$existing" \ + --endpoint-url "$endpoint" --only-show-errors + if cmp -s "$file" "$existing"; then + rm -f "$existing" + echo " = $key (identical immutable object already staged)" + return 0 + fi + rm -f "$existing" + echo "::error::refusing to overwrite byte-different immutable identity object: $key" >&2 + return 1 + fi + + if ! grep -Eqi '(404|NoSuchKey|Not Found|not found)' <<<"$head_output"; then + echo "::error::could not determine whether immutable identity object exists: $key" >&2 + echo "$head_output" >&2 + return "$head_status" + fi + + AWS_ACCESS_KEY_ID="$ak" \ + AWS_SECRET_ACCESS_KEY="$sk" \ + AWS_DEFAULT_REGION="$region" \ + aws s3 cp "$file" "s3://$bucket/$key" \ + --endpoint-url "$endpoint" \ + --content-type "$type" \ + --only-show-errors + echo " ↑ $key" +} + candidate_key="latest.candidate.json" latest_key="latest.json" @@ -96,14 +141,22 @@ upload_assets() { # endpoint bucket region access_key secret_key phase [prefix] key="$version/$name" # immutable, per-version object fi [ -n "$prefix" ] && key="${prefix%/}/$key" - AWS_ACCESS_KEY_ID="$ak" \ - AWS_SECRET_ACCESS_KEY="$sk" \ - AWS_DEFAULT_REGION="$region" \ - aws s3 cp "$f" "s3://$bucket/$key" \ - --endpoint-url "$endpoint" \ - --content-type "$(content_type "$name")" \ - --only-show-errors - echo " ↑ $key" + if [ "$name" = "release-identity.json" ] || [ "$name" = "release-identity.json.sig" ]; then + # Tauri's trusted-comment timestamp makes a freshly generated `.sig` + # byte-different on rerun. These versioned identity objects are immutable: + # reuse identical prior bytes or fail instead of silently replacing them. + upload_immutable_identity_asset "$endpoint" "$bucket" "$region" "$ak" "$sk" \ + "$f" "$key" "$(content_type "$name")" + else + AWS_ACCESS_KEY_ID="$ak" \ + AWS_SECRET_ACCESS_KEY="$sk" \ + AWS_DEFAULT_REGION="$region" \ + aws s3 cp "$f" "s3://$bucket/$key" \ + --endpoint-url "$endpoint" \ + --content-type "$(content_type "$name")" \ + --only-show-errors + echo " ↑ $key" + fi done } diff --git a/scripts/verify-windows-authenticode.ps1 b/scripts/verify-windows-authenticode.ps1 index 3dedb2e..b825ae7 100644 --- a/scripts/verify-windows-authenticode.ps1 +++ b/scripts/verify-windows-authenticode.ps1 @@ -4,7 +4,7 @@ # optional — PR/local diagnostic for builds that intentionally receive no # release certificate. Reports unsigned files without blocking. # required — release gate: every path must have Status -eq Valid. Can also -# pin the imported thumbprint and require RFC3161 evidence. +# pin the SignPath subject and require timestamp evidence. # # Usage: # pwsh scripts/verify-windows-authenticode.ps1 -Path a.exe,b.exe -Mode optional @@ -24,18 +24,11 @@ param( # When set (required mode), SignerCertificate.Subject must contain this. [string]$ExpectedSubject = "", - # When set (required mode), the signer must be the exact certificate that - # the release job imported, not merely any locally trusted publisher. - [string]$ExpectedThumbprint = "", - - # Tauri is configured with tsp=true (/tr + /td SHA256). Requiring a - # countersigner here ensures the RFC3161 timestamp was actually embedded. + # Requires a timestamp countersigner on the artifact. This property alone + # does not distinguish RFC3161 from every legacy timestamp form; the future + # SignPath pilot must also validate its policy and verbose signtool output. [switch]$RequireTimestamp, - # Required together with -RequireTimestamp. The generated Tauri config is - # the build-time proof that signing used RFC3161 (/tr), not legacy /t. - [string]$SigningConfigPath = "", - [string]$Stage = "sign-verify" ) @@ -55,24 +48,6 @@ function Fail-Stage([string]$Message) { throw "[$Stage] $Message" } -if ($RequireTimestamp) { - if ([string]::IsNullOrWhiteSpace($SigningConfigPath) -or -not (Test-Path -LiteralPath $SigningConfigPath)) { - Fail-Stage "-RequireTimestamp also requires the generated Tauri signing config" - } - $signingConfig = Get-Content -LiteralPath $SigningConfigPath -Raw | ConvertFrom-Json - $windowsSigning = $signingConfig.bundle.windows - if ($windowsSigning.tsp -ne $true) { - Fail-Stage "Tauri signing config must set bundle.windows.tsp=true (RFC3161 /tr)" - } - if ([string]::IsNullOrWhiteSpace([string]$windowsSigning.timestampUrl)) { - Fail-Stage "Tauri signing config has no RFC3161 timestampUrl" - } - if ([string]$windowsSigning.digestAlgorithm -ne "sha256") { - Fail-Stage "Tauri signing config must use SHA256" - } - Write-Host "[$Stage] RFC3161 config asserted: tsp=true digest=sha256 url=$($windowsSigning.timestampUrl)" -} - Write-Stage "Authenticode verification (mode=$Mode)" $results = @() @@ -126,10 +101,6 @@ foreach ($raw in $Path) { $ok = $false Write-Host "::error::[$Stage] $($item.Name): subject '$subject' does not contain '$ExpectedSubject'" } - elseif ($ExpectedThumbprint -and ($thumbprint -ne $ExpectedThumbprint.Replace(" ", "").ToUpperInvariant())) { - $ok = $false - Write-Host "::error::[$Stage] $($item.Name): signer thumbprint '$thumbprint' does not match the release certificate" - } elseif ($RequireTimestamp -and -not $sig.TimeStamperCertificate) { $ok = $false Write-Host "::error::[$Stage] $($item.Name): no RFC3161 timestamp countersigner" diff --git a/scripts/windows-packaged-smoke.ps1 b/scripts/windows-packaged-smoke.ps1 index d2ca521..122e59e 100644 --- a/scripts/windows-packaged-smoke.ps1 +++ b/scripts/windows-packaged-smoke.ps1 @@ -26,9 +26,8 @@ param( [int]$LaunchSeconds = 12, [ValidateSet("optional", "required", "skip")] [string]$AuthenticodeMode = "optional", - [string]$ExpectedThumbprint = "", + [string]$ExpectedSubject = "", [switch]$RequireTimestamp, - [string]$SigningConfigPath = "", [switch]$SkipLaunch ) @@ -105,9 +104,8 @@ try { & $verifyScript ` -Path $installerItem.FullName ` -Mode $AuthenticodeMode ` - -ExpectedThumbprint $ExpectedThumbprint ` + -ExpectedSubject $ExpectedSubject ` -RequireTimestamp:$RequireTimestamp ` - -SigningConfigPath $SigningConfigPath ` -Stage "sign-verify" Close-Stage } @@ -143,9 +141,8 @@ try { & $verifyScript ` -Path @($mainExe, $uninstaller) ` -Mode $AuthenticodeMode ` - -ExpectedThumbprint $ExpectedThumbprint ` + -ExpectedSubject $ExpectedSubject ` -RequireTimestamp:$RequireTimestamp ` - -SigningConfigPath $SigningConfigPath ` -Stage "sign-verify" Close-Stage } @@ -202,9 +199,8 @@ try { & $verifyScript ` -Path @($mainExe, $uninstaller) ` -Mode $AuthenticodeMode ` - -ExpectedThumbprint $ExpectedThumbprint ` + -ExpectedSubject $ExpectedSubject ` -RequireTimestamp:$RequireTimestamp ` - -SigningConfigPath $SigningConfigPath ` -Stage "sign-verify" Close-Stage } diff --git a/src-tauri/Cargo.lock b/src-tauri/Cargo.lock index 6767d44..d3d9b7e 100644 --- a/src-tauri/Cargo.lock +++ b/src-tauri/Cargo.lock @@ -615,11 +615,13 @@ dependencies = [ "codex-win-engine", "directories", "fs4", + "futures-util", "libc", "log", "reqwest", "serde", "serde_json", + "sha2", "tauri", "tauri-build", "tauri-plugin-autostart", @@ -645,6 +647,7 @@ dependencies = [ "roxmltree", "serde", "thiserror 2.0.18", + "url", "uuid", ] @@ -658,6 +661,7 @@ dependencies = [ "serde_json", "sha2", "thiserror 2.0.18", + "url", "uuid", "windows-sys 0.61.2", "zip 2.4.2", @@ -4381,8 +4385,6 @@ dependencies = [ [[package]] name = "tauri-plugin-updater" version = "2.10.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "806d9dac662c2e4594ff03c647a552f2c9bd544e7d0f683ec58f872f952ce4af" dependencies = [ "base64 0.22.1", "dirs 6.0.0", diff --git a/src-tauri/Cargo.toml b/src-tauri/Cargo.toml index fc12a57..6e3f441 100644 --- a/src-tauri/Cargo.toml +++ b/src-tauri/Cargo.toml @@ -26,9 +26,11 @@ codex-win-engine = { path = "../crates/codex-win-engine" } directories = "6.0.0" fs4 = "1.1" log = "0.4" -reqwest = { version = "0.13.4", default-features = false, features = ["socks", "system-proxy"] } +futures-util = "0.3" +reqwest = { version = "0.13.4", default-features = false, features = ["socks", "system-proxy", "stream"] } serde = { version = "1.0", features = ["derive"] } serde_json = "1.0" +sha2 = "0.10" tauri = { version = "2.11.2", features = ["tray-icon", "image-png", "macos-private-api"] } tauri-plugin-autostart = "2" tauri-plugin-dialog = "2.7.1" @@ -41,5 +43,11 @@ url = "2.5" uuid = { version = "1", features = ["v4"] } windows-sys = { version = "0.61.2", features = ["Win32_Foundation", "Win32_Storage_FileSystem", "Win32_UI_Shell", "Win32_UI_WindowsAndMessaging"] } +# Upstream 2.10.1 buffers manifest and artifact responses without a byte cap. +# Keep the exact vendored patch until an upstream release exposes equivalent +# Content-Length plus streaming limits; see the vendor VENDORED.md checklist. +[patch.crates-io] +tauri-plugin-updater = { path = "../vendor/tauri-plugin-updater-2.10.1" } + [target.'cfg(unix)'.dependencies] libc = "0.2" diff --git a/src-tauri/installer/installer.nsi b/src-tauri/installer/installer.nsi index ac3c370..ec18242 100644 --- a/src-tauri/installer/installer.nsi +++ b/src-tauri/installer/installer.nsi @@ -23,14 +23,6 @@ ManifestDPIAwareness PerMonitorV2 SetCompressor /SOLID "{{compression}}" !endif -; Keep above !include to stay ahead of any plugin command. Tauri signs a private -; plugin copy when Windows code signing is configured; using the system plugin -; directory here would silently embed unsigned DLLs in an otherwise signed setup. -; https://github.com/tauri-apps/tauri/pull/15422 -{{#if signed_plugins_path}} -!addplugindir "{{signed_plugins_path}}" -{{/if}} - !include MUI2.nsh !include FileFunc.nsh !include x64.nsh diff --git a/src-tauri/src/app/logging.rs b/src-tauri/src/app/logging.rs index f8f075a..99d1e8c 100644 --- a/src-tauri/src/app/logging.rs +++ b/src-tauri/src/app/logging.rs @@ -26,6 +26,17 @@ pub fn redact_url(raw: &str) -> String { redacted } +/// Parsed host (plus an explicit non-default port) for user-facing source +/// labels. Reuses the origin redactor so credentials, path, query, and fragment +/// can never enter progress events or logs. +pub fn redact_url_host(raw: &str) -> String { + let origin = redact_url(raw); + origin + .split_once("://") + .map(|(_, host)| host.to_string()) + .unwrap_or(origin) +} + pub fn prune_old_logs(dir: &Path, keep: usize) { let Ok(entries) = std::fs::read_dir(dir) else { return; @@ -66,7 +77,7 @@ pub fn prune_old_logs(dir: &Path, keep: usize) { #[cfg(test)] mod tests { - use super::{prune_old_logs, redact_url}; + use super::{prune_old_logs, redact_url, redact_url_host}; fn temp_dir(name: &str) -> std::path::PathBuf { std::env::temp_dir().join(format!("{name}-{}", std::process::id())) @@ -81,6 +92,11 @@ mod tests { assert_eq!(redact_url("http://127.0.0.1/path"), "http://127.0.0.1"); assert_eq!(redact_url("127.0.0.1/path"), ""); assert_eq!(redact_url("not a url"), ""); + assert_eq!( + redact_url_host("https://u:p@example.com:8443/a/b?x=1#frag"), + "example.com:8443" + ); + assert_eq!(redact_url_host("not a url"), ""); } #[test] diff --git a/src-tauri/src/app/mac_update.rs b/src-tauri/src/app/mac_update.rs index cc45c1c..19f750c 100644 --- a/src-tauri/src/app/mac_update.rs +++ b/src-tauri/src/app/mac_update.rs @@ -24,6 +24,7 @@ use codex_mac_engine::{ use crate::app::disk; use crate::app::install_tx::{ActiveInstallTx, InstallTxKind}; +use crate::app::logging::redact_url_host; use crate::app::op_phase::OperationPhase; use crate::app::operation_outcome::{recovery, OperationOutcome, StepOutcome}; use crate::app::provenance::ProvenanceStore; @@ -456,11 +457,60 @@ pub struct DownloadProgress { /// Host portion of a URL, for showing the user which source is downloading. fn host_of(url: &str) -> String { - url.split("://") - .nth(1) - .and_then(|rest| rest.split('/').next()) - .unwrap_or("") - .to_string() + redact_url_host(url) +} + +fn download_file_name(url: &str) -> String { + url::Url::parse(url) + .ok() + .and_then(|parsed| { + parsed + .path_segments()? + .rev() + .find(|segment| !segment.is_empty()) + .map(str::to_string) + }) + .unwrap_or_else(|| "payload.bin".to_string()) +} + +#[cfg(test)] +mod download_diagnostic_tests { + use super::{download_file_name, host_of, DownloadProgress}; + + #[test] + fn malicious_enclosure_never_reaches_progress_or_log_material() { + let raw = "https://basic-user:basic-pass@downloads.example/private/Codex.zip?X-Amz-Credential=presigned-secret#fragment-secret"; + let source = host_of(raw); + let progress = DownloadProgress { + downloaded: 1, + total: 2, + source: source.clone(), + }; + let progress_json = serde_json::to_string(&progress).unwrap(); + let start_log = format!("macOS download and verify start source={source}"); + let file_name = download_file_name(raw); + let complete_log = "macOS download and verify complete"; + + assert_eq!(source, "downloads.example"); + assert_eq!(file_name, "Codex.zip"); + for secret in [ + "basic-user", + "basic-pass", + "X-Amz-Credential", + "presigned-secret", + "fragment-secret", + ] { + assert!(!progress_json.contains(secret), "progress leaked {secret}"); + assert!(!start_log.contains(secret), "start log leaked {secret}"); + assert!( + !complete_log.contains(secret), + "complete log leaked {secret}" + ); + } + + assert_eq!(host_of("not a URL with-secret"), ""); + assert_eq!(download_file_name("not a URL with-secret"), "payload.bin"); + } } /// No-op progress sink for downloads whose progress isn't surfaced (e.g. stage). @@ -496,12 +546,12 @@ fn download_and_verify( "artifact size {size} exceeds {max_size} byte limit" ))); } - let file_name = url.rsplit('/').next().unwrap_or("payload.bin"); + let file_name = download_file_name(url); // Download into the PERSISTENT cache (not a per-run staging dir): a paused // `.part` survives here, so the next perform/install resumes it instead of // restarting at 0. The artifact is consumed (verified → unpacked/applied) // from here; success clears the cache (see perform/install tails). - let dest = staging::download_cache_path(url, file_name)?; + let dest = staging::download_cache_path(url, &file_name)?; let source = host_of(url); let already = std::fs::metadata(&dest) @@ -553,8 +603,7 @@ fn download_and_verify( return Err(err); } - let path = dest.display(); - log::info!("macOS download and verify complete path={path}"); + log::info!("macOS download and verify complete"); Ok(dest) } @@ -815,13 +864,7 @@ pub fn perform_macos_update_with_network( progress: &dyn Fn(DownloadProgress), network: &NetworkConfig, ) -> Result { - perform_macos_update_with_network_and_phase( - binary_delta, - expected, - progress, - network, - None, - ) + perform_macos_update_with_network_and_phase(binary_delta, expected, progress, network, None) } pub fn perform_macos_update_with_network_and_phase( @@ -1438,7 +1481,8 @@ fn install_macos_in_staging( } else { outcome.path = Some(install_path.to_string_lossy().into_owned()); outcome.provenance = StepOutcome::failed("安装后未能读取 bundle 版本，托管记录未写入"); - outcome.push_warning("已写入应用，但未能确认版本；请重新检查状态或「开始管理」".to_string()); + outcome + .push_warning("已写入应用，但未能确认版本；请重新检查状态或「开始管理」".to_string()); outcome.push_recovery(recovery::RECORD_PROVENANCE); outcome.install_class = Some("external".to_string()); // Honest: app may be present but we couldn't classify it as managed. @@ -1683,11 +1727,7 @@ pub fn retry_macos_ancillary( match detect_managed_installed().or_else(detect_installed) { Some(installed) => { let mut store = ProvenanceStore::load(); - store.record( - installed.path.clone(), - installed.build, - "manager-installed", - ); + store.record(installed.path.clone(), installed.build, "manager-installed"); match store.save() { Ok(()) => { outcome.provenance = StepOutcome::ok(); diff --git a/src-tauri/src/app/staging.rs b/src-tauri/src/app/staging.rs index 74cc8db..0f6b4b9 100644 --- a/src-tauri/src/app/staging.rs +++ b/src-tauri/src/app/staging.rs @@ -170,10 +170,7 @@ pub fn cleanup_stale_staging(ops: &OperationManager) -> CleanupSummary { } summary.scanned += 1; if crate::app::install_tx::path_is_protected(&path, &protected) { - log::info!( - "staging cleanup skipped protected path={}", - path.display() - ); + log::info!("staging cleanup skipped protected path={}", path.display()); continue; } if !is_stale(&path, now) { @@ -214,13 +211,14 @@ pub fn cleanup_stale_staging(ops: &OperationManager) -> CleanupSummary { match std::fs::remove_file(&path) { Ok(()) => { summary.removed += 1; - let path_display = path.display(); - log::debug!("download cache cleanup removed path={path_display}"); + // Older releases derived the cache suffix from the raw URL + // tail, so a historical filename can contain a presigned + // query. Never carry cache paths across the log boundary. + log::debug!("download cache cleanup removed artifact"); } Err(err) => { summary.failed += 1; - let path_display = path.display(); - log::debug!("download cache cleanup failed path={path_display} error={err}"); + log::debug!("download cache cleanup failed error={err}"); } } } diff --git a/src-tauri/src/app/url_guard.rs b/src-tauri/src/app/url_guard.rs index 373f5c1..b91b23f 100644 --- a/src-tauri/src/app/url_guard.rs +++ b/src-tauri/src/app/url_guard.rs @@ -12,6 +12,8 @@ pub enum UrlRejectReason { BareIp, #[error("自定义源不能包含用户名/密码")] HasUserinfo, + #[error("自定义源必须是基础 URL，不能包含查询参数或片段")] + HasQueryOrFragment, #[error("自定义源缺少有效主机名")] MissingHost, #[error("无法解析该 URL")] @@ -59,6 +61,9 @@ pub fn validate_custom_source(raw: &str) -> Result { if !url.username().is_empty() || url.password().is_some() { return Err(UrlRejectReason::HasUserinfo); } + if url.query().is_some() || url.fragment().is_some() { + return Err(UrlRejectReason::HasQueryOrFragment); + } match url.host() { None => return Err(UrlRejectReason::MissingHost), @@ -213,6 +218,22 @@ mod tests { ); } + #[test] + fn rejects_query_and_fragment_on_custom_source_base_urls() { + for raw in [ + "https://mirror.example.com?token=secret", + "https://mirror.example.com/feed?token=secret", + "https://mirror.example.com/#private", + "https://mirror.example.com/feed#private", + ] { + assert_eq!( + validate_custom_source(raw), + Err(UrlRejectReason::HasQueryOrFragment), + "{raw}" + ); + } + } + #[test] fn rejects_loopback_private_and_local_domains() { for raw in [ diff --git a/src-tauri/src/app/win_update.rs b/src-tauri/src/app/win_update.rs index 9736a07..12b7260 100644 --- a/src-tauri/src/app/win_update.rs +++ b/src-tauri/src/app/win_update.rs @@ -26,6 +26,7 @@ use codex_win_engine::{ }; use crate::app::install_tx::{ActiveInstallTx, InstallTxKind}; +use crate::app::logging::redact_url_host; use crate::app::op_phase::OperationPhase; use crate::app::operation_outcome::{ recovery, AncillaryRetryReport, OperationOutcome, StepOutcome, @@ -186,8 +187,8 @@ fn record_managed_install( installed: &InstalledWindowsCodex, source: &str, ) -> OperationOutcome { - let mut outcome = - OperationOutcome::full_success("present", Some("managed")).with_path(installed.path.clone()); + let mut outcome = OperationOutcome::full_success("present", Some("managed")) + .with_path(installed.path.clone()); outcome.cleanup = StepOutcome::not_applicable(); let mut store = ProvenanceStore::load(); if let Some(previous) = previous { @@ -264,7 +265,9 @@ fn outcome_from_portable_uninstall( if outcome.cleanup.is_failed() { // Shortcut / uninstall-entry failures. if portable.notes.iter().any(|n| { - n.contains("Start Menu") || n.contains("Apps & Features") || n.contains("uninstall entry") + n.contains("Start Menu") + || n.contains("Apps & Features") + || n.contains("uninstall entry") }) { outcome.push_recovery(recovery::CLEANUP_METADATA); } @@ -287,11 +290,7 @@ fn outcome_from_portable_uninstall( } fn host_of(url: &str) -> String { - url.split("://") - .nth(1) - .and_then(|rest| rest.split('/').next()) - .unwrap_or("") - .to_string() + redact_url_host(url) } fn no_progress(_p: DownloadProgress) {} @@ -1229,9 +1228,7 @@ pub fn perform_windows_update_with_install_mode_network_and_phase( app_state: "unknown".to_string(), install_class: None, path: None, - provenance: StepOutcome::failed( - "安装完成但未检测到可记录的安装，托管状态未知", - ), + provenance: StepOutcome::failed("安装完成但未检测到可记录的安装，托管状态未知"), cleanup: StepOutcome::not_applicable(), warnings: vec![ "MSIX sideload reported success but no install was detected afterward." @@ -1279,7 +1276,14 @@ pub fn perform_windows_update_with_install_mode_network_and_phase( return Ok(report); } - install_portable_after_stage(settings, stage, Some(sideload), None, current_installed, phase) + install_portable_after_stage( + settings, + stage, + Some(sideload), + None, + current_installed, + phase, + ) } fn install_portable_after_stage( @@ -1381,9 +1385,7 @@ fn install_portable_after_stage( }, install_class: None, path: Some(install_root.clone()), - provenance: StepOutcome::failed( - "便携安装完成但未检测到可记录的安装，托管状态未知", - ), + provenance: StepOutcome::failed("便携安装完成但未检测到可记录的安装，托管状态未知"), cleanup: StepOutcome::not_applicable(), warnings: vec![ "Portable install finished but no install was detected for provenance.".to_string(), @@ -1650,7 +1652,10 @@ pub fn uninstall_windows_codex( success: msix.success, action: "remove-msix".to_string(), message: if outcome.is_partial() { - format!("{}（主卸载已完成，附属步骤有失败 — 可仅重试清理）", msix.message) + format!( + "{}（主卸载已完成，附属步骤有失败 — 可仅重试清理）", + msix.message + ) } else { msix.message.clone() }, @@ -1677,8 +1682,7 @@ pub fn uninstall_windows_codex( provenance = StepOutcome::failed(format!("托管记录清除失败（{e}）")); } } - let outcome = - outcome_from_portable_uninstall(&portable, provenance, &installed_before.path); + let outcome = outcome_from_portable_uninstall(&portable, provenance, &installed_before.path); let mut notes = portable.notes.clone(); notes.extend(outcome.warnings.iter().cloned()); let report = WinUninstallReport { @@ -1826,8 +1830,8 @@ pub fn retry_windows_ancillary( mod tests { use super::{ bind_manifest_checksums, check_win_update_abort, detect_existing_windows_install_at_path, - detect_managed_codex, outcome_from_portable_uninstall, WinAbortGuard, WinPerformAction, - WIN_UPDATE_ABORT, + detect_managed_codex, host_of, outcome_from_portable_uninstall, DownloadProgress, + WinAbortGuard, WinPerformAction, WIN_UPDATE_ABORT, }; use crate::app::operation_outcome::{recovery, StepOutcome}; use crate::app::provenance::ProvenanceStore; @@ -1843,6 +1847,31 @@ mod tests { dir } + #[test] + fn malicious_package_url_never_reaches_progress_source() { + let raw = "https://basic-user:basic-pass@downloads.example:8443/private/Codex.msix?X-Amz-Signature=presigned-secret#fragment-secret"; + let source = host_of(raw); + let progress = DownloadProgress { + downloaded: 1, + total: 2, + source: source.clone(), + }; + let progress_json = serde_json::to_string(&progress).unwrap(); + + assert_eq!(source, "downloads.example:8443"); + for secret in [ + "basic-user", + "basic-pass", + "/private/Codex.msix", + "X-Amz-Signature", + "presigned-secret", + "fragment-secret", + ] { + assert!(!progress_json.contains(secret), "progress leaked {secret}"); + } + assert_eq!(host_of("not a URL with-secret"), ""); + } + fn write_fake_portable_install(dir: &std::path::Path, version: &str) { std::fs::write(dir.join("Codex.exe"), b"").unwrap(); std::fs::write( @@ -2044,11 +2073,7 @@ aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa OpenAI.Codex_2 message: "cleanup warnings".into(), notes: vec!["Start Menu shortcut cleanup failed: access denied".into()], }; - let outcome = outcome_from_portable_uninstall( - &portable, - StepOutcome::ok(), - r"C:\Codex", - ); + let outcome = outcome_from_portable_uninstall(&portable, StepOutcome::ok(), r"C:\Codex"); assert!(outcome.primary_ok, "absent tree is still primary success"); assert_eq!(outcome.app_state, "absent"); assert_eq!(outcome.path.as_deref(), Some(r"C:\Codex")); @@ -2074,11 +2099,7 @@ aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa OpenAI.Codex_2 message: "cleanup warnings".into(), notes: vec!["User data cleanup failed: access denied".into()], }; - let outcome = outcome_from_portable_uninstall( - &portable, - StepOutcome::ok(), - r"C:\Codex", - ); + let outcome = outcome_from_portable_uninstall(&portable, StepOutcome::ok(), r"C:\Codex"); assert!(outcome.primary_ok); assert!(outcome.is_partial()); assert!(outcome @@ -2100,8 +2121,7 @@ aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa OpenAI.Codex_2 message: "remove failed".into(), notes: vec![], }; - let outcome = - outcome_from_portable_uninstall(&portable, StepOutcome::ok(), r"C:\Codex"); + let outcome = outcome_from_portable_uninstall(&portable, StepOutcome::ok(), r"C:\Codex"); assert!(!outcome.primary_ok); assert!(!outcome.is_partial()); assert_eq!(outcome.app_state, "present"); diff --git a/src-tauri/src/commands.rs b/src-tauri/src/commands.rs index dfecfcd..b1d2750 100644 --- a/src-tauri/src/commands.rs +++ b/src-tauri/src/commands.rs @@ -1,4 +1,5 @@ use std::{ + collections::HashMap, future::Future, path::{Path, PathBuf}, sync::Arc, @@ -6,7 +7,10 @@ use std::{ }; use codex_win_engine::InstalledWindowsCodex; +use futures_util::StreamExt; +use reqwest::header::CONTENT_LENGTH; use serde::{Deserialize, Serialize}; +use sha2::{Digest, Sha256}; use tauri::{AppHandle, Emitter, Manager, State}; use tauri_plugin_autostart::ManagerExt; use tauri_plugin_dialog::DialogExt; @@ -28,8 +32,7 @@ use crate::app::mac_update::{ use crate::app::manager_update_handoff::clear_for_platform as clear_manager_update_handoff; #[cfg(target_os = "windows")] use crate::app::manager_update_handoff::{ - now_unix_ms, persist_for_platform as persist_manager_update_handoff, - ManagerUpdateHandoff, + now_unix_ms, persist_for_platform as persist_manager_update_handoff, ManagerUpdateHandoff, }; use crate::app::manager_update_handoff::{ status_for_platform as manager_update_handoff_status, ManagerUpdateHandoffStatus, @@ -51,10 +54,9 @@ use crate::app::win_update::{ detect_existing_windows_install_at_path as detect_windows_install_at_path, discard_windows_download, pause_windows_download, perform_windows_update_with_install_mode_network_and_phase, - plan_windows_update_with_install_mode_and_network, - retry_windows_ancillary, stage_windows_update_with_install_mode_and_network, - uninstall_windows_codex, win_adopt as adopt_windows_install, - win_adopt_path as adopt_windows_path, win_install_status, + plan_windows_update_with_install_mode_and_network, retry_windows_ancillary, + stage_windows_update_with_install_mode_and_network, uninstall_windows_codex, + win_adopt as adopt_windows_install, win_adopt_path as adopt_windows_path, win_install_status, DownloadProgress as WinDownloadProgress, WinAutoStageReport, WinInstallStatus, WinPerformExpectation, WinPerformReport, WinStageReport, WinUninstallReport, WinUpdateReport, }; @@ -177,6 +179,33 @@ const MANAGER_UPDATE_STATE_EVENT: &str = "manager://update-state"; const MANAGER_UPDATE_CHECK_TIMEOUT: Duration = Duration::from_secs(30); const MANAGER_UPDATE_CONNECT_TIMEOUT: Duration = Duration::from_secs(15); const MANAGER_UPDATE_READ_TIMEOUT: Duration = Duration::from_secs(30); +const MANAGER_UPDATE_MANIFEST_MAX_BYTES: u64 = 256 * 1024; +const MANAGER_UPDATE_IDENTITY_MAX_BYTES: u64 = 256 * 1024; +const MANAGER_UPDATE_IDENTITY_SIGNATURE_MAX_BYTES: u64 = 16 * 1024; +const MANAGER_UPDATE_ARTIFACT_MAX_BYTES: u64 = 64 * 1024 * 1024; +const MANAGER_UPDATE_IDENTITY_SCHEMA: u32 = 1; +const MANAGER_UPDATE_IDENTITY_FILE: &str = "release-identity.json"; +const MANAGER_UPDATE_IDENTITY_SIGNATURE_FILE: &str = "release-identity.json.sig"; + +#[derive(Debug, Deserialize)] +struct ManagerReleaseIdentity { + schema: u32, + version: String, + notes_sha256: String, + platforms: HashMap, +} + +#[derive(Debug, Deserialize)] +struct ManagerReleaseIdentityPlatform { + artifact: String, + signature: String, + sha256: String, +} + +struct AuthenticatedManagerUpdate { + update: tauri_plugin_updater::Update, + artifact_sha256: String, +} fn emit_manager_update_state(app: &AppHandle, snapshot: ManagerUpdateRuntimeSnapshot) { let _ = app.emit(MANAGER_UPDATE_STATE_EVENT, snapshot); @@ -236,12 +265,13 @@ fn manager_updater_builder_for_endpoints( .endpoints(endpoints) .map_err(|e| AppError::Engine(format!("configure manager updater endpoints: {e}")))?; } - // `UpdaterBuilder::timeout` only reaches manifest checks. The updater - // deliberately creates downloads without that total timeout, so keep - // downloads unbounded while data is flowing and enforce a read-stall - // timeout through the shared reqwest client configuration instead. + // `UpdaterBuilder::timeout` only reaches manifest checks. Artifact transfer + // remains allowed to run while bytes keep flowing, but the patched plugin + // enforces a hard byte cap and this client still aborts read stalls. Ok(builder .timeout(MANAGER_UPDATE_CHECK_TIMEOUT) + .max_manifest_size(MANAGER_UPDATE_MANIFEST_MAX_BYTES) + .max_download_size(MANAGER_UPDATE_ARTIFACT_MAX_BYTES) .configure_client(|client| { client .connect_timeout(MANAGER_UPDATE_CONNECT_TIMEOUT) @@ -249,7 +279,9 @@ fn manager_updater_builder_for_endpoints( })) } -fn configured_manager_update_endpoints(app: &AppHandle) -> Result, AppError> { +fn configured_manager_update_config( + app: &AppHandle, +) -> Result { let raw = app .config() .plugins @@ -257,14 +289,250 @@ fn configured_manager_update_endpoints(app: &AppHandle) -> Result, .get("updater") .cloned() .ok_or_else(|| AppError::Internal("missing updater plugin configuration".to_string()))?; - let config: tauri_plugin_updater::Config = serde_json::from_value(raw) - .map_err(|e| AppError::Internal(format!("read updater plugin configuration: {e}")))?; - if config.endpoints.is_empty() { - return Err(AppError::Internal( - "updater plugin has no configured endpoints".to_string(), + serde_json::from_value(raw) + .map_err(|e| AppError::Internal(format!("read updater plugin configuration: {e}"))) +} + +fn manager_update_identity_client() -> Result { + let saved = PersistedAppSettings::load(); + let mut builder = reqwest::Client::builder() + .connect_timeout(MANAGER_UPDATE_CONNECT_TIMEOUT) + .read_timeout(MANAGER_UPDATE_READ_TIMEOUT) + .timeout(MANAGER_UPDATE_CHECK_TIMEOUT); + match saved.proxy_mode { + ProxyMode::System => {} + ProxyMode::Direct => builder = builder.no_proxy(), + ProxyMode::Custom => { + let normalized = + validated_custom_proxy_for_settings(&saved.custom_proxy_url, "manager updater")?; + let proxy = reqwest::Proxy::all(&normalized) + .map_err(|e| AppError::Engine(format!("configure manager updater proxy: {e}")))?; + builder = builder.proxy(proxy); + } + } + builder + .build() + .map_err(|e| AppError::Engine(format!("build manager updater identity client: {e}"))) +} + +async fn fetch_manager_update_file_limited( + client: &reqwest::Client, + url: url::Url, + max_bytes: u64, + resource: &'static str, +) -> Result, AppError> { + let response = client + .get(url) + .send() + .await + .map_err(|e| AppError::Engine(format!("fetch {resource}: {e}")))?; + if !response.status().is_success() { + return Err(AppError::Engine(format!( + "fetch {resource}: HTTP {}", + response.status() + ))); + } + + let content_length = response + .headers() + .get(CONTENT_LENGTH) + .and_then(|value| value.to_str().ok()) + .and_then(|value| value.parse::().ok()); + if let Some(announced) = content_length.filter(|length| *length > max_bytes) { + return Err(AppError::Engine(format!( + "{resource} exceeds {max_bytes}-byte limit (announced {announced} bytes)" + ))); + } + + let mut bytes = Vec::new(); + let mut observed = 0_u64; + let mut stream = response.bytes_stream(); + while let Some(chunk) = stream.next().await { + let chunk = chunk.map_err(|e| AppError::Engine(format!("read {resource}: {e}")))?; + observed = observed.checked_add(chunk.len() as u64).ok_or_else(|| { + AppError::Engine(format!("{resource} exceeds {max_bytes}-byte limit")) + })?; + if observed > max_bytes { + return Err(AppError::Engine(format!( + "{resource} exceeds {max_bytes}-byte limit (observed {observed} bytes)" + ))); + } + bytes.extend_from_slice(&chunk); + } + Ok(bytes) +} + +fn manager_update_versioned_url( + manifest_endpoint: &url::Url, + version: &str, + filename: &str, +) -> Result { + let safe_filename = !filename.is_empty() + && filename != "." + && filename != ".." + && filename + .bytes() + .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'.' | b'_' | b'-')); + if !safe_filename { + return Err(AppError::Engine( + "signed manager update identity contains an unsafe artifact name".to_string(), )); } - Ok(config.endpoints) + + let mut url = manifest_endpoint.clone(); + url.set_query(None); + url.set_fragment(None); + let is_github = url.scheme() == "https" + && url.host_str() == Some("github.com") + && url.path() == "/Wangnov/Codex-App-Manager/releases/latest/download/latest.json"; + url.set_path(""); + { + let mut segments = url.path_segments_mut().map_err(|_| { + AppError::Engine("manager updater endpoint cannot be a base URL".to_string()) + })?; + if is_github { + for segment in ["Wangnov", "Codex-App-Manager", "releases", "download"] { + segments.push(segment); + } + segments.push(&format!("v{version}")); + } else { + let base_segments = manifest_endpoint + .path_segments() + .ok_or_else(|| { + AppError::Engine("manager updater endpoint has no path".to_string()) + })? + .collect::>(); + let Some((manifest_name, directories)) = base_segments.split_last() else { + return Err(AppError::Engine( + "manager updater endpoint has no manifest filename".to_string(), + )); + }; + if *manifest_name != "latest.json" { + return Err(AppError::Engine( + "manager updater endpoint must end in latest.json".to_string(), + )); + } + for segment in directories { + if !segment.is_empty() { + segments.push(segment); + } + } + segments.push(version); + } + segments.push(filename); + } + Ok(url) +} + +fn sha256_hex(bytes: &[u8]) -> String { + format!("{:x}", Sha256::digest(bytes)) +} + +fn validate_manager_update_identity_claim( + version: &str, + notes: Option<&str>, + platform_key: &str, + manifest_artifact: &str, + manifest_signature: &str, + identity: &ManagerReleaseIdentity, +) -> Result { + if identity.schema != MANAGER_UPDATE_IDENTITY_SCHEMA || identity.version != version { + return Err(AppError::Engine( + "manager update manifest does not match the signed release identity".to_string(), + )); + } + if identity.notes_sha256 != sha256_hex(notes.unwrap_or_default().as_bytes()) { + return Err(AppError::Engine( + "manager update notes do not match the signed release identity".to_string(), + )); + } + let platform = identity.platforms.get(platform_key).ok_or_else(|| { + AppError::Engine( + "signed manager update identity has no entry for this platform".to_string(), + ) + })?; + if platform.artifact != manifest_artifact || platform.signature != manifest_signature { + return Err(AppError::Engine( + "manager update artifact does not match the signed release identity".to_string(), + )); + } + let valid_sha256 = platform.sha256.len() == 64 + && platform + .sha256 + .bytes() + .all(|byte| byte.is_ascii_hexdigit() && !byte.is_ascii_uppercase()); + if !valid_sha256 { + return Err(AppError::Engine( + "signed manager update identity has an invalid artifact digest".to_string(), + )); + } + Ok(platform.sha256.clone()) +} + +async fn authenticate_manager_update( + client: &reqwest::Client, + manifest_endpoint: &url::Url, + pubkey: &str, + mut update: tauri_plugin_updater::Update, +) -> Result { + let identity_url = manager_update_versioned_url( + manifest_endpoint, + &update.version, + MANAGER_UPDATE_IDENTITY_FILE, + )?; + let signature_url = manager_update_versioned_url( + manifest_endpoint, + &update.version, + MANAGER_UPDATE_IDENTITY_SIGNATURE_FILE, + )?; + let identity_bytes = fetch_manager_update_file_limited( + client, + identity_url, + MANAGER_UPDATE_IDENTITY_MAX_BYTES, + "manager release identity", + ) + .await?; + let signature_bytes = fetch_manager_update_file_limited( + client, + signature_url, + MANAGER_UPDATE_IDENTITY_SIGNATURE_MAX_BYTES, + "manager release identity signature", + ) + .await?; + let signature = std::str::from_utf8(&signature_bytes) + .map(str::trim) + .map_err(|_| { + AppError::Engine("manager release identity signature is not UTF-8".to_string()) + })?; + tauri_plugin_updater::verify_signature(&identity_bytes, signature, pubkey) + .map_err(|e| AppError::Engine(format!("verify manager release identity: {e}")))?; + let identity: ManagerReleaseIdentity = serde_json::from_slice(&identity_bytes) + .map_err(|e| AppError::Engine(format!("parse manager release identity: {e}")))?; + let manifest_artifact = update + .download_url + .path_segments() + .and_then(|mut segments| segments.next_back()) + .unwrap_or_default(); + let artifact_sha256 = validate_manager_update_identity_claim( + &update.version, + update.body.as_deref(), + &update.platform, + manifest_artifact, + &update.signature, + &identity, + )?; + let artifact = identity + .platforms + .get(&update.platform) + .expect("validated identity platform") + .artifact + .clone(); + update.download_url = + manager_update_versioned_url(manifest_endpoint, &update.version, &artifact)?; + Ok(AuthenticatedManagerUpdate { + update, + artifact_sha256, + }) } async fn download_with_manager_fallback( @@ -385,24 +653,46 @@ fn manager_update_matches_confirmation( pub async fn manager_check_update( app: AppHandle, ) -> Result, CommandError> { - let endpoints = configured_manager_update_endpoints(&app)?; + let config = configured_manager_update_config(&app)?; + if config.endpoints.is_empty() { + return Err( + AppError::Internal("updater plugin has no configured endpoints".to_string()).into(), + ); + } + let endpoints = config.endpoints.clone(); + let pubkey = Arc::new(config.pubkey); + let identity_client = manager_update_identity_client()?; let update = check_with_manager_fallback(endpoints, |endpoint| { let app = app.clone(); + let pubkey = Arc::clone(&pubkey); + let identity_client = identity_client.clone(); async move { - let updater = manager_updater_builder_for_endpoints(&app, Some(vec![endpoint]))? - .build() - .map_err(|e| AppError::Engine(format!("build manager updater: {e}")))?; - updater + let updater = + manager_updater_builder_for_endpoints(&app, Some(vec![endpoint.clone()]))? + .build() + .map_err(|e| AppError::Engine(format!("build manager updater: {e}")))?; + let update = updater .check() .await - .map_err(|e| AppError::Engine(format!("check manager update: {e}"))) + .map_err(|e| AppError::Engine(format!("check manager update: {e}")))?; + match update { + Some(update) => authenticate_manager_update( + &identity_client, + &endpoint, + pubkey.as_str(), + update, + ) + .await + .map(Some), + None => Ok(None), + } } }) .await?; - Ok(update.map(|update| ManagerUpdateMetadata { - version: update.version, - current_version: update.current_version, - body: update.body, + Ok(update.map(|authenticated| ManagerUpdateMetadata { + version: authenticated.update.version, + current_version: authenticated.update.current_version, + body: authenticated.update.body, })) } @@ -475,7 +765,15 @@ pub async fn manager_install_update( .operations .set_phase(op.token(), OperationPhase::Downloading) .map_err(AppError::from)?; - let endpoints = configured_manager_update_endpoints(&app)?; + let config = configured_manager_update_config(&app)?; + if config.endpoints.is_empty() { + return Err(AppError::Internal( + "updater plugin has no configured endpoints".to_string(), + )); + } + let endpoints = config.endpoints.clone(); + let pubkey = Arc::new(config.pubkey); + let identity_client = manager_update_identity_client()?; let runtime_for_attempts = state.manager_update.clone(); let operations_for_attempts = state.operations.clone(); let token_for_attempts = op.token().clone(); @@ -492,6 +790,8 @@ pub async fn manager_install_update( let app = app_for_attempts.clone(); let expected_version = Arc::clone(&expected_version); let expected_current_version = Arc::clone(&expected_current_version); + let pubkey = Arc::clone(&pubkey); + let identity_client = identity_client.clone(); async move { operations .set_phase(&token, OperationPhase::Downloading) @@ -515,6 +815,14 @@ pub async fn manager_install_update( "管理器更新内容已变化，请重新检查后再确认。".to_string(), ) })?; + let authenticated = authenticate_manager_update( + &identity_client, + &endpoint, + pubkey.as_str(), + update, + ) + .await?; + let update = authenticated.update; if !manager_update_matches_confirmation( &update.version, &update.current_version, @@ -561,6 +869,13 @@ pub async fn manager_install_update( ) .await .map_err(|e| AppError::Engine(format!("download manager update: {e}")))?; + let actual_sha256 = sha256_hex(&bytes); + if actual_sha256 != authenticated.artifact_sha256 { + return Err(AppError::Engine( + "downloaded manager update does not match the signed release identity digest" + .to_string(), + )); + } Ok(DownloadedManagerUpdate { update, bytes }) } }, @@ -768,7 +1083,8 @@ fn destructive_token_error(err: OperationError) -> CommandError { fn refresh_config_health(state: &ManagerState) -> ConfigHealth { let (_, settings_health) = PersistedAppSettings::load_with_health(); let (_, provenance_health) = ProvenanceStore::load_with_health(); - let health = ConfigHealth::from_parts(settings_health, provenance_health).with_live_backup_flags(); + let health = + ConfigHealth::from_parts(settings_health, provenance_health).with_live_backup_flags(); let mut slot = state .config_health .lock() @@ -1216,9 +1532,7 @@ pub fn mac_pause_download(state: State<'_, ManagerState>) -> Result "ok", }; if status == "corrupt" { - return Err(AppError::Internal(format!( - "已从 .bak 还原 {which}，但重新读取仍判定为损坏" - )) - .into()); + return Err( + AppError::Internal(format!("已从 .bak 还原 {which}，但重新读取仍判定为损坏")).into(), + ); } Ok(health) } @@ -1427,10 +1740,7 @@ pub fn reset_config( _ => "ok", }; if status == "corrupt" { - return Err(AppError::Internal(format!( - "已重置 {which}，但重新读取仍判定为损坏" - )) - .into()); + return Err(AppError::Internal(format!("已重置 {which}，但重新读取仍判定为损坏")).into()); } Ok(health) } @@ -1463,10 +1773,9 @@ pub fn retry_ancillary( } let _guard: RetryGuard = if purge { if confirm != Some(true) { - return Err(AppError::Internal( - "清除用户数据需要二次确认（confirm=true）".to_string(), - ) - .into()); + return Err( + AppError::Internal("清除用户数据需要二次确认（confirm=true）".to_string()).into(), + ); } let token = token.ok_or_else(|| { AppError::Internal( @@ -1478,9 +1787,7 @@ pub fn retry_ancillary( RetryGuard::Scoped(begin_guard(&state, OperationKind::Adopt)?) }; match state.target.os { - OperatingSystem::Macos => { - retry_macos_ancillary(actions, path, purge).map_err(Into::into) - } + OperatingSystem::Macos => retry_macos_ancillary(actions, path, purge).map_err(Into::into), OperatingSystem::Windows => { let settings = windows_domain_settings_for_persisted(&state); retry_windows_ancillary(&settings, actions, path, purge).map_err(Into::into) @@ -1555,7 +1862,10 @@ pub fn get_operation_snapshot( /// CloseRequested / ExitRequested guards stop intercepting and let it go. /// Still refuses when the backend is in a non-interruptible install phase. #[tauri::command] -pub fn confirm_quit(app: tauri::AppHandle, state: State<'_, ManagerState>) -> Result<(), CommandError> { +pub fn confirm_quit( + app: tauri::AppHandle, + state: State<'_, ManagerState>, +) -> Result<(), CommandError> { let confirm_close = crate::app::settings_store::AppSettings::load().confirm_close; // Evaluate as if force_quit is not yet set so a point-of-no-return phase // still blocks even after the user clicks the confirm dialog. @@ -1783,9 +2093,7 @@ pub fn win_pause_download(state: State<'_, ManagerState>) -> Result ManagerReleaseIdentity { + ManagerReleaseIdentity { + schema: 1, + version: version.to_string(), + notes_sha256: sha256_hex(notes.as_bytes()), + platforms: HashMap::from([( + "windows-x86_64".to_string(), + ManagerReleaseIdentityPlatform { + artifact: "CodexAppManager_0.3.1_x64-setup.exe".to_string(), + signature: signature.to_string(), + sha256: "a".repeat(64), + }, + )]), + } + } + + #[test] + fn manager_update_rejects_forged_v999_with_replayed_old_signature() { + let identity = manager_release_identity("0.3.1", "reviewed notes", "old-valid-signature"); + let error = validate_manager_update_identity_claim( + "999.0.0", + Some("reviewed notes"), + "windows-x86_64", + "CodexAppManager_0.3.1_x64-setup.exe", + "old-valid-signature", + &identity, + ) + .unwrap_err(); + + assert!(error + .to_string() + .contains("does not match the signed release identity")); + } + + #[test] + fn manager_update_accepts_mirror_claim_bound_to_signed_identity() { + let identity = manager_release_identity("0.3.1", "reviewed notes", "current-signature"); + let digest = validate_manager_update_identity_claim( + "0.3.1", + Some("reviewed notes"), + "windows-x86_64", + "CodexAppManager_0.3.1_x64-setup.exe", + "current-signature", + &identity, + ) + .unwrap(); + + assert_eq!(digest, "a".repeat(64)); + } + + #[test] + fn manager_update_derives_versioned_identity_and_artifact_urls_per_source() { + let mirror = + url::Url::parse("https://codexapp.agentsmirror.com/manager/latest.json?ignored=1") + .unwrap(); + assert_eq!( + manager_update_versioned_url(&mirror, "0.3.2", "release-identity.json") + .unwrap() + .as_str(), + "https://codexapp.agentsmirror.com/manager/0.3.2/release-identity.json" + ); + + let github = url::Url::parse( + "https://github.com/Wangnov/Codex-App-Manager/releases/latest/download/latest.json", + ) + .unwrap(); + assert_eq!( + manager_update_versioned_url( + &github, + "0.3.2", + "CodexAppManager_0.3.2_x64-setup.exe" + ) + .unwrap() + .as_str(), + "https://github.com/Wangnov/Codex-App-Manager/releases/download/v0.3.2/CodexAppManager_0.3.2_x64-setup.exe" + ); + assert!(manager_update_versioned_url(&mirror, "0.3.2", "../escape").is_err()); + } + + #[test] + fn manager_update_cn_path_accepts_authenticated_mirror_first() { + let attempts = Arc::new(Mutex::new(Vec::new())); + let attempts_for_check = Arc::clone(&attempts); + let result = tauri::async_runtime::block_on(check_with_manager_fallback( + manager_update_test_endpoints(), + move |endpoint| { + let attempts = Arc::clone(&attempts_for_check); + async move { + attempts + .lock() + .unwrap() + .push(endpoint.host_str().unwrap().to_string()); + Ok(Some("authenticated-mirror-update")) + } + }, + )); + + assert_eq!(result.unwrap(), Some("authenticated-mirror-update")); + assert_eq!(*attempts.lock().unwrap(), vec!["mirror.example"]); + } + #[test] fn manager_update_check_falls_back_after_primary_reports_no_update() { let attempts = Arc::new(Mutex::new(Vec::new())); @@ -2405,6 +2821,39 @@ mod tests { assert_eq!(*installed.lock().unwrap(), vec!["github-verified-package"]); } + #[test] + fn manager_update_falls_back_when_mirror_serves_old_bytes_for_current_signature() { + let attempts = Arc::new(Mutex::new(Vec::new())); + let attempts_for_download = Arc::clone(&attempts); + let result = tauri::async_runtime::block_on(download_then_install_manager_update( + manager_update_test_endpoints(), + move |endpoint| { + let attempts = Arc::clone(&attempts_for_download); + async move { + attempts + .lock() + .unwrap() + .push(endpoint.host_str().unwrap().to_string()); + if endpoint.host_str() == Some("mirror.example") { + Err(AppError::Engine( + "download manager update: minisign verification failed for old bytes" + .to_string(), + )) + } else { + Ok("github-current-signed-bytes") + } + } + }, + |_| Ok(()), + )); + + assert!(result.is_ok()); + assert_eq!( + *attempts.lock().unwrap(), + vec!["mirror.example", "github.com"] + ); + } + #[test] fn manager_update_falls_back_after_mirror_stream_resets() { let attempts = Arc::new(Mutex::new(Vec::new())); diff --git a/src-tauri/src/errors.rs b/src-tauri/src/errors.rs index 26f7d7d..6671d2a 100644 --- a/src-tauri/src/errors.rs +++ b/src-tauri/src/errors.rs @@ -66,7 +66,7 @@ impl ErrorKind { } /// Pull the curl exit code out of an engine message such as -/// `"curl failed for host=… exit=23: stderr='…'"`. Uses the LAST `exit=` so a +/// `"curl failed for host=… exit=23 reason='disk is full'"`. Uses the LAST `exit=` so a /// combined `resume failed (…exit=A…); fresh download failed (…exit=B…)` message /// classifies on the final (fresh) attempt the user must act on — not the resume, /// whose range/partial failure is incidental. @@ -116,7 +116,9 @@ pub fn classify(message: &str) -> ErrorKind { { return ErrorKind::Signature; } - if m.contains("capability probe") || m.contains("sideload policy") || m.contains("developer mode") + if m.contains("capability probe") + || m.contains("sideload policy") + || m.contains("developer mode") { return ErrorKind::Incompatible; } @@ -237,22 +239,58 @@ mod tests { #[test] fn curl_connect_and_timeout_codes() { - assert_eq!(classify("curl failed exit=7: stderr='Failed to connect'"), ErrorKind::Network); - assert_eq!(classify("curl failed exit=6: stderr='Could not resolve host'"), ErrorKind::Network); - assert_eq!(classify("curl failed exit=28: stderr='Operation timed out'"), ErrorKind::Timeout); - assert_eq!(classify("curl failed exit=35: stderr='SSL connect error'"), ErrorKind::Network); - assert_eq!(classify("curl failed exit=55: stderr='Failed sending network data'"), ErrorKind::Network); - assert_eq!(classify("curl failed exit=22: stderr='The requested URL returned error: 404'"), ErrorKind::Artifact); + assert_eq!( + classify("curl failed exit=7: stderr='Failed to connect'"), + ErrorKind::Network + ); + assert_eq!( + classify("curl failed exit=6: stderr='Could not resolve host'"), + ErrorKind::Network + ); + assert_eq!( + classify("curl failed exit=28: stderr='Operation timed out'"), + ErrorKind::Timeout + ); + assert_eq!( + classify("curl failed exit=35: stderr='SSL connect error'"), + ErrorKind::Network + ); + assert_eq!( + classify("curl failed exit=55: stderr='Failed sending network data'"), + ErrorKind::Network + ); + assert_eq!( + classify("curl failed exit=22: stderr='The requested URL returned error: 404'"), + ErrorKind::Artifact + ); } #[test] fn marker_based_classification_without_exit_code() { - assert_eq!(classify("Authenticode verification failed"), ErrorKind::Signature); - assert_eq!(classify("codesign verification failed: invalid signature"), ErrorKind::Signature); - assert_eq!(classify("Access is denied. (os error 5)"), ErrorKind::Permission); - assert_eq!(classify("hash mismatch for staged package"), ErrorKind::Artifact); - assert_eq!(classify("run Add-AppxPackage: deployment failed"), ErrorKind::Install); - assert_eq!(classify("capability probe error: sideloading is disabled"), ErrorKind::Incompatible); + assert_eq!( + classify("Authenticode verification failed"), + ErrorKind::Signature + ); + assert_eq!( + classify("codesign verification failed: invalid signature"), + ErrorKind::Signature + ); + assert_eq!( + classify("Access is denied. (os error 5)"), + ErrorKind::Permission + ); + assert_eq!( + classify("hash mismatch for staged package"), + ErrorKind::Artifact + ); + assert_eq!( + classify("run Add-AppxPackage: deployment failed"), + ErrorKind::Install + ); + assert_eq!( + classify("capability probe error: sideloading is disabled"), + ErrorKind::Incompatible + ); assert_eq!(classify("download cancelled"), ErrorKind::Cancelled); } @@ -279,14 +317,20 @@ mod tests { #[test] fn unknown_engine_message_falls_back_to_generic() { - assert_eq!(classify("something unexpected happened"), ErrorKind::Generic); + assert_eq!( + classify("something unexpected happened"), + ErrorKind::Generic + ); assert_eq!(code_of("something unexpected happened"), "engine_error"); } #[test] fn non_engine_variants_keep_their_codes() { assert_eq!(AppError::UnsupportedPlatform.code(), "unsupported_platform"); - assert_eq!(AppError::StaleExpectation("x".into()).code(), "stale_expectation"); + assert_eq!( + AppError::StaleExpectation("x".into()).code(), + "stale_expectation" + ); assert_eq!(AppError::Busy("x".into()).code(), "operation_busy"); assert_eq!(AppError::Internal("x".into()).code(), "internal_error"); } diff --git a/src/app/signingPolicyFiles.test.ts b/src/app/signingPolicyFiles.test.ts new file mode 100644 index 0000000..35509a2 --- /dev/null +++ b/src/app/signingPolicyFiles.test.ts @@ -0,0 +1,67 @@ +import { describe, expect, it } from "vitest"; + +import releaseWorkflow from "../../.github/workflows/release.yml?raw"; +import readme from "../../README.md?raw"; +import codeSigningPolicy from "../../docs/code-signing-policy.md?raw"; +import privacyPolicy from "../../docs/privacy.md?raw"; +import fallbackRelease from "../../docs/releases/FALLBACK.md?raw"; +import releaseTemplate from "../../docs/releases/TEMPLATE.md?raw"; +import readinessGuard from "../../scripts/assert-signpath-foundation-ready.ps1?raw"; +import website from "../../website/index.html?raw"; +import websiteEnglish from "../../website/src/locales/en.ts?raw"; +import websiteChinese from "../../website/src/locales/zh.ts?raw"; + +describe("public SignPath Foundation disclosures", () => { + it("states the pending status, attribution, members, and privacy behavior", () => { + expect(codeSigningPolicy).toContain( + "Free code signing provided by [SignPath.io](https://signpath.io/), certificate by [SignPath Foundation](https://signpath.org/)", + ); + expect(codeSigningPolicy).toMatch(/The application\s+has not yet been approved/); + expect(codeSigningPolicy).toContain("[@Wangnov](https://github.com/Wangnov)"); + expect(codeSigningPolicy).toContain("manual approval"); + expect(codeSigningPolicy).toContain("[Privacy policy](./privacy.md)"); + + expect(privacyPolicy).toContain("about 1.5 seconds after startup"); + expect(privacyPolicy).toContain("about every six hours"); + expect(privacyPolicy).toContain("Users can independently disable startup and"); + expect(privacyPolicy).toContain("includes no telemetry"); + expect(privacyPolicy).toContain("GitHub General Privacy Statement"); + expect(privacyPolicy).toContain("Cloudflare Privacy Policy"); + expect(privacyPolicy).toContain("OpenAI Privacy Policy"); + expect(privacyPolicy).toContain("Microsoft Privacy Statement"); + }); + + it("links the stable policies from download, footer, README, and release copy", () => { + for (const content of [website, readme, releaseTemplate, fallbackRelease]) { + expect(content).toContain("docs/code-signing-policy.md"); + expect(content).toContain("docs/privacy.md"); + } + + for (const locale of [websiteChinese, websiteEnglish]) { + expect(locale).toContain("signingPolicy"); + expect(locale).toContain("privacyPolicy"); + } + + expect(releaseTemplate).not.toContain("均带 Authenticode 发行者签名"); + expect(fallbackRelease).not.toContain("carry an Authenticode publisher signature"); + expect(website).toContain("Free code signing provided by"); + expect(website).toContain("https://signpath.io/"); + expect(website).toContain("https://signpath.org/"); + }); +}); + +describe("Windows release signing readiness", () => { + it("fails closed without accepting the retired PFX assumptions", () => { + expect(releaseWorkflow).toContain( + "Assert SignPath Foundation readiness (fail closed)", + ); + expect(releaseWorkflow).toContain("assert-signpath-foundation-ready.ps1"); + expect(releaseWorkflow).toContain('ExpectedSubject "SignPath Foundation"'); + expect(releaseWorkflow).not.toContain("WINDOWS_CERTIFICATE"); + expect(releaseWorkflow).not.toContain("prepare-windows-authenticode.ps1"); + + expect(readinessGuard).toContain("intentionally has no success path"); + expect(readinessGuard).toContain("throw \"[$Stage] $message\""); + expect(readinessGuard).not.toMatch(/SIGNPATH_.*READY/); + }); +}); diff --git a/vendor/tauri-plugin-updater-2.10.1/CHANGELOG.md b/vendor/tauri-plugin-updater-2.10.1/CHANGELOG.md new file mode 100644 index 0000000..8e84961 --- /dev/null +++ b/vendor/tauri-plugin-updater-2.10.1/CHANGELOG.md @@ -0,0 +1,210 @@ +# Changelog + +## \[2.10.1] + +- [`31ab6f8d`](https://github.com/tauri-apps/plugins-workspace/commit/31ab6f8d2466d86c80b1d70510c0400ce2cdcb0a) ([#3285](https://github.com/tauri-apps/plugins-workspace/pull/3285) by [@hrzlgnm](https://github.com/tauri-apps/plugins-workspace/../../hrzlgnm)) fix: preserve file extension of updater package, otherwise users may get confused when presented with a sudo dialog suggesting to install a file with the extension `.rpm` using `dpkg -i` + +## \[2.10.0] + +- [`4375c98b`](https://github.com/tauri-apps/plugins-workspace/commit/4375c98bed1769a1fc1be26eded4db9f7c095d95) ([#3073](https://github.com/tauri-apps/plugins-workspace/pull/3073)) Add no_proxy config to disable system proxy for updater plugin. +- [`f122ee98`](https://github.com/tauri-apps/plugins-workspace/commit/f122ee98c6954075891ac3cd530f5e29da117b39) Allow configuring the updater client to accept invalid TLS certificates and hostnames for internal/self-signed update servers. These options are available via the plugin config (`dangerousAcceptInvalidCerts`, `dangerousAcceptInvalidHostnames`) and via the `UpdaterBuilder` (`dangerous_accept_invalid_certs`, `dangerous_accept_invalid_hostnames`). +- [`f122ee98`](https://github.com/tauri-apps/plugins-workspace/commit/f122ee98c6954075891ac3cd530f5e29da117b39) Updater plugin now supports all bundle types: Deb, Rpm and AppImage for Linux; NSiS, MSI for Windows. This was added in https://github.com/tauri-apps/plugins-workspace/pull/2624 +- [`05c5da07`](https://github.com/tauri-apps/plugins-workspace/commit/05c5da072b6e3254c19ee69024f80f4dfe1b779b) ([#3213](https://github.com/tauri-apps/plugins-workspace/pull/3213)) Updated `reqwest` to 0.13, make sure to update your `reqwest` dependency if you're using `UpdaterBuilder::configure_client` + +## \[2.9.0] + +- [`f209b2f2`](https://github.com/tauri-apps/plugins-workspace/commit/f209b2f23cb29133c97ad5961fb46ef794dbe063) ([#2804](https://github.com/tauri-apps/plugins-workspace/pull/2804) by [@renovate](https://github.com/tauri-apps/plugins-workspace/../../renovate)) Updated tauri to 2.6 + +## \[2.8.1] + +- [`735d209d`](https://github.com/tauri-apps/plugins-workspace/commit/735d209d5d1d92dcac70c6083bcfcd34ec7d84be) ([#2761](https://github.com/tauri-apps/plugins-workspace/pull/2761) by [@FabianLars](https://github.com/tauri-apps/plugins-workspace/../../FabianLars)) Fixed an issue preventing updates via the NSIS installer from succeeding when the app was launched with command line arguments containing spaces. + +## \[2.8.0] + +- [`87afa23c`](https://github.com/tauri-apps/plugins-workspace/commit/87afa23cad077c09bc1eb743800ae3396b531146) ([#2726](https://github.com/tauri-apps/plugins-workspace/pull/2726)) Add allowDowngrades parameter to check command + + Added a new optional `allowDowngrades` parameter to the JavaScript check command that allows the updater to consider versions that are lower than the current version as valid updates. When enabled, the version comparator will accept any version that is different from the current version, effectively allowing downgrades. +- [`73ff15de`](https://github.com/tauri-apps/plugins-workspace/commit/73ff15de5d07d476693e40e8e5d138c16da5211e) ([#2757](https://github.com/tauri-apps/plugins-workspace/pull/2757)) Fix headers option in `Update.download` and `Update.downloadAndInstall` doesn't work with `Record | Headers` types + +## \[2.7.1] + +- [`c5b0f51c`](https://github.com/tauri-apps/plugins-workspace/commit/c5b0f51cfd911cca9317b59efc718b570980129b) ([#2621](https://github.com/tauri-apps/plugins-workspace/pull/2621) by [@Legend-Master](https://github.com/tauri-apps/plugins-workspace/../../Legend-Master)) Fix `check` and `download` overrides the `accept` header + +## \[2.7.0] + +### bug + +- [`2d731f80`](https://github.com/tauri-apps/plugins-workspace/commit/2d731f80224f74faf1b7170b25e04f5da1da49c8) ([#2573](https://github.com/tauri-apps/plugins-workspace/pull/2573)) Fix JS API `Update.date` not formatted to RFC 3339 +- [`0bc5d588`](https://github.com/tauri-apps/plugins-workspace/commit/0bc5d5887420ba1eb718254490b7995c771c0447) ([#2572](https://github.com/tauri-apps/plugins-workspace/pull/2572)) Fix `timeout` passed to `check` gets re-used by `download` and `downloadAndinstall` + +## \[2.6.1] + +- [`12c4537b`](https://github.com/tauri-apps/plugins-workspace/commit/12c4537b8e4fed29b415ff817434b664c0596dac) ([#2541](https://github.com/tauri-apps/plugins-workspace/pull/2541) by [@lucasfernog](https://github.com/tauri-apps/plugins-workspace/../../lucasfernog)) Add support to the `riscv64` architecture. + +## \[2.6.0] + +- [`faefcc9f`](https://github.com/tauri-apps/plugins-workspace/commit/faefcc9fd8c61f709d491649e255a7fcac82c09a) ([#2430](https://github.com/tauri-apps/plugins-workspace/pull/2430) by [@goenning](https://github.com/tauri-apps/plugins-workspace/../../goenning)) Add `UpdaterBuilder::configure_client` method on Rust side, to configure the `reqwest` client used to check and download the update. +- [`ac60d589`](https://github.com/tauri-apps/plugins-workspace/commit/ac60d589eca2bbc4aed040feb18da148e66ec171) ([#2513](https://github.com/tauri-apps/plugins-workspace/pull/2513) by [@lucasfernog](https://github.com/tauri-apps/plugins-workspace/../../lucasfernog)) Enhance error logging. + +## \[2.5.1] + +- [`6f881293`](https://github.com/tauri-apps/plugins-workspace/commit/6f881293fcd67838f6f3f8063f536292431dd1f7) ([#2439](https://github.com/tauri-apps/plugins-workspace/pull/2439) by [@FabianLars](https://github.com/tauri-apps/plugins-workspace/../../FabianLars)) Fixed an issue that caused the plugin to emit a `ReleaseNotFound` error instead of a `Reqwest` error when the http request in `check()` failed. + +## \[2.5.0] + +- [`5369898d`](https://github.com/tauri-apps/plugins-workspace/commit/5369898db7a6098e3e2f43436100ea556d405628) ([#2067](https://github.com/tauri-apps/plugins-workspace/pull/2067) by [@jLynx](https://github.com/tauri-apps/plugins-workspace/../../jLynx)) Fix update installation on macOS when using an user without admin privileges. +- [`5369898d`](https://github.com/tauri-apps/plugins-workspace/commit/5369898db7a6098e3e2f43436100ea556d405628) ([#2067](https://github.com/tauri-apps/plugins-workspace/pull/2067) by [@jLynx](https://github.com/tauri-apps/plugins-workspace/../../jLynx)) Remove the `UpdaterBuilder::new` function, use `UpdaterExt::updater_builder` instead. + +## \[2.4.0] + +- [`0afc9b6b`](https://github.com/tauri-apps/plugins-workspace/commit/0afc9b6be07bee1077f05a86285d977e57810ed9) ([#2325](https://github.com/tauri-apps/plugins-workspace/pull/2325) by [@FabianLars](https://github.com/tauri-apps/plugins-workspace/../../FabianLars)) The `Update` struct/object will now contain a `raw_json`/`rawJson` property to be able to read parts of server's json response that are not handled by the plugin. + +## \[2.3.1] + +- [`57efb47c`](https://github.com/tauri-apps/plugins-workspace/commit/57efb47c116f880477f72f02a8e4239e88007d44) ([#2235](https://github.com/tauri-apps/plugins-workspace/pull/2235) by [@amrbashir](https://github.com/tauri-apps/plugins-workspace/../../amrbashir)) Add `Builder::header` and `Builder::headers` method to configure default headers for updater. + +## \[2.3.0] + +- [`829b6326`](https://github.com/tauri-apps/plugins-workspace/commit/829b63265030bc9c61d1738c4eaca0ffb3178677) ([#1919](https://github.com/tauri-apps/plugins-workspace/pull/1919) by [@n1ght-hunter](https://github.com/tauri-apps/plugins-workspace/../../n1ght-hunter)) Add `tauri_plugin_updater::Builder::default_version_comparator` method to set the default version comparator for the updater. + +## \[2.2.0] + +- [`3a79266b`](https://github.com/tauri-apps/plugins-workspace/commit/3a79266b8cf96a55b1ae6339d725567d45a44b1d) ([#2173](https://github.com/tauri-apps/plugins-workspace/pull/2173) by [@FabianLars](https://github.com/tauri-apps/plugins-workspace/../../FabianLars)) Bumped all plugins to `v2.2.0`. From now, the versions for the Rust and JavaScript packages of each plugin will be in sync with each other. + +## \[2.1.0] + +- [`f8f2eefe`](https://github.com/tauri-apps/plugins-workspace/commit/f8f2eefe03ab231beafbd6a88d61b53d77f0400d) ([#1991](https://github.com/tauri-apps/plugins-workspace/pull/1991) by [@jLynx](https://github.com/tauri-apps/plugins-workspace/../../jLynx)) Added support for `.deb` package updates on Linux systems. + +## \[2.0.2] + +- [`a1a82208`](https://github.com/tauri-apps/plugins-workspace/commit/a1a82208ed4ab87f83310be0dc95428aec9ab241) ([#1873](https://github.com/tauri-apps/plugins-workspace/pull/1873) by [@lucasfernog](https://github.com/tauri-apps/plugins-workspace/../../lucasfernog)) Downgrade MSRV to 1.77.2 to support Windows 7. + +## \[2.0.1] + +- [`9501cfa5`](https://github.com/tauri-apps/plugins-workspace/commit/9501cfa5f5385b2d7eb43a8378b322ee97cba06f) ([#1868](https://github.com/tauri-apps/plugins-workspace/pull/1868) by [@lucasfernog](https://github.com/tauri-apps/plugins-workspace/../../lucasfernog)) Fix configuration parser incorrectly warning about the endpoint scheme. + +## \[2.0.0] + +- [`e2c4dfb6`](https://github.com/tauri-apps/plugins-workspace/commit/e2c4dfb6af43e5dd8d9ceba232c315f5febd55c1) Update to tauri v2 stable release. + +## \[2.0.0-rc.4] + +- [`221f50f5`](https://github.com/tauri-apps/plugins-workspace/commit/221f50f53bd7a87dbd404e4cb1aaf502a5047785) ([#1816](https://github.com/tauri-apps/plugins-workspace/pull/1816) by [@amrbashir](https://github.com/tauri-apps/plugins-workspace/../../amrbashir)) Encode `+` when making updater requests which can be cause incorrectly interpolating the endpoint when using `{{current_version}}` in the endpoint where the current version contains a build number, for example `1.8.0+1`. +- [`04a0aea0`](https://github.com/tauri-apps/plugins-workspace/commit/04a0aea0ab9f8750200bc2fe5aff99c1c488082d) ([#1814](https://github.com/tauri-apps/plugins-workspace/pull/1814) by [@amrbashir](https://github.com/tauri-apps/plugins-workspace/../../amrbashir)) **Breaking change**, Changed `UpdaterBuilder::endpoints` method to return a `Result`. +- [`04a0aea0`](https://github.com/tauri-apps/plugins-workspace/commit/04a0aea0ab9f8750200bc2fe5aff99c1c488082d) ([#1814](https://github.com/tauri-apps/plugins-workspace/pull/1814) by [@amrbashir](https://github.com/tauri-apps/plugins-workspace/../../amrbashir)) Add `dangerousInsecureTransportProtocol` config option to allow using insecure transport protocols, like `http` + +## \[2.0.0-rc.3] + +- [`d00519e3`](https://github.com/tauri-apps/plugins-workspace/commit/d00519e3e3a3234f9eb6c2ba82c92d4199f03e53) ([#1735](https://github.com/tauri-apps/plugins-workspace/pull/1735) by [@FabianLars](https://github.com/tauri-apps/plugins-workspace/../../FabianLars)) This releases the changes from 2.0.0-rc.2 to crates.io. Please see the links below for the actual changes. + +## \[2.0.0-rc.2] + +- [`f8255e1d`](https://github.com/tauri-apps/plugins-workspace/commit/f8255e1db5df6cf562b9334fbefe5e62f4a28e0a) ([#1661](https://github.com/tauri-apps/plugins-workspace/pull/1661) by [@amrbashir](https://github.com/tauri-apps/plugins-workspace/../../amrbashir)) Add a second argument in `Update.download` and `Update.donloadAndInstall` JS APIs to modify headers and timeout when downloading the update. + +## \[2.0.0-rc.1] + +- [`e2e97db5`](https://github.com/tauri-apps/plugins-workspace/commit/e2e97db51983267f5be84d4f6f0278d58834d1f5) ([#1701](https://github.com/tauri-apps/plugins-workspace/pull/1701) by [@lucasfernog](https://github.com/tauri-apps/plugins-workspace/../../lucasfernog)) Update to tauri 2.0.0-rc.8 + +## \[2.0.0-rc.1] + +- [`77013925`](https://github.com/tauri-apps/plugins-workspace/commit/7701392500f375340045880fce5fb8f867bfe670) ([#1636](https://github.com/tauri-apps/plugins-workspace/pull/1636) by [@lucasfernog](https://github.com/tauri-apps/plugins-workspace/../../lucasfernog)) Fixes the updater not preserving AppImage file permissions. +- [`5d170a54`](https://github.com/tauri-apps/plugins-workspace/commit/5d170a5444982dcc14135f6f1fc3e5da359f0eb0) ([#1671](https://github.com/tauri-apps/plugins-workspace/pull/1671) by [@lucasfernog](https://github.com/tauri-apps/plugins-workspace/../../lucasfernog)) Update to tauri 2.0.0-rc.3. + +## \[2.0.0-rc.0] + +- [`9887d1`](https://github.com/tauri-apps/plugins-workspace/commit/9887d14bd0e971c4c0f5c1188fc4005d3fc2e29e) Update to tauri RC. + +## \[2.0.0-beta.8] + +- [`99d6ac0f`](https://github.com/tauri-apps/plugins-workspace/commit/99d6ac0f9506a6a4a1aa59c728157190a7441af6) ([#1606](https://github.com/tauri-apps/plugins-workspace/pull/1606) by [@FabianLars](https://github.com/tauri-apps/plugins-workspace/../../FabianLars)) The JS packages now specify the *minimum* `@tauri-apps/api` version instead of a single exact version. +- [`6de87966`](https://github.com/tauri-apps/plugins-workspace/commit/6de87966ecc00ad9d91c25be452f1f46bd2b7e1f) ([#1597](https://github.com/tauri-apps/plugins-workspace/pull/1597) by [@Legend-Master](https://github.com/tauri-apps/plugins-workspace/../../Legend-Master)) Update to tauri beta.25. + +## \[2.0.0-beta.11] + +- [`f83b9e98`](https://github.com/tauri-apps/plugins-workspace/commit/f83b9e9813843df19b03b6af1018d848111b2a62) ([#1544](https://github.com/tauri-apps/plugins-workspace/pull/1544) by [@Legend-Master](https://github.com/tauri-apps/plugins-workspace/../../Legend-Master)) On Windows, use a named tempfile with `--installer.exe` (or `.msi`) for v2 updater + + **Breaking Change**: `UpdaterBuilder::new` now takes one more argument `app_name: String` + +## \[2.0.0-beta.7] + +- [`22a17980`](https://github.com/tauri-apps/plugins-workspace/commit/22a17980ff4f6f8c40adb1b8f4ffc6dae2fe7e30) ([#1537](https://github.com/tauri-apps/plugins-workspace/pull/1537) by [@lucasfernog](https://github.com/tauri-apps/plugins-workspace/../../lucasfernog)) Update to tauri beta.24. + +## \[2.0.0-beta.6] + +- [`76daee7a`](https://github.com/tauri-apps/plugins-workspace/commit/76daee7aafece34de3092c86e531cf9eb1138989) ([#1512](https://github.com/tauri-apps/plugins-workspace/pull/1512) by [@renovate](https://github.com/tauri-apps/plugins-workspace/../../renovate)) Update to tauri beta.23. + +## \[2.0.0-beta.8] + +- [`bf29a72b`](https://github.com/tauri-apps/plugins-workspace/commit/bf29a72baaff15214a21989df23081eee84e3b8b) ([#1454](https://github.com/tauri-apps/plugins-workspace/pull/1454) by [@amrbashir](https://github.com/tauri-apps/plugins-workspace/../../amrbashir)) Fix regression in updater plugin failing to update using `.msi` installer. + +## \[2.0.0-beta.5] + +- [`9013854f`](https://github.com/tauri-apps/plugins-workspace/commit/9013854f42a49a230b9dbb9d02774765528a923f)([#1382](https://github.com/tauri-apps/plugins-workspace/pull/1382)) Update to tauri beta.22. + +## \[2.0.0-beta.4] + +- [`430bd6f4`](https://github.com/tauri-apps/plugins-workspace/commit/430bd6f4f379bee5d232ae6b098ae131db7f178a)([#1363](https://github.com/tauri-apps/plugins-workspace/pull/1363)) Update to tauri beta.20. +- [`43224c5d`](https://github.com/tauri-apps/plugins-workspace/commit/43224c5d5cfe2dd676e79ebafe424027c62c51c3)([#1330](https://github.com/tauri-apps/plugins-workspace/pull/1330)) Add `Update.download` and `Update.install` functions to the JavaScript API + +## \[2.0.0-beta.3] + +- [`bd1ed590`](https://github.com/tauri-apps/plugins-workspace/commit/bd1ed5903ffcce5500310dac1e59e8c67674ef1e)([#1237](https://github.com/tauri-apps/plugins-workspace/pull/1237)) Update to tauri beta.17. + +## \[2.0.0-beta.4] + +- [`293f363`](https://github.com/tauri-apps/plugins-workspace/commit/293f363c0dccc43e8403729fdc8cc2b4311c2d5b)([#1175](https://github.com/tauri-apps/plugins-workspace/pull/1175)) Add a `on_before_exit` hook for cleanup before spawning the updater on Windows, defaults to `app.cleanup_before_exit` when used through `UpdaterExt` +- [`293f363`](https://github.com/tauri-apps/plugins-workspace/commit/293f363c0dccc43e8403729fdc8cc2b4311c2d5b)([#1175](https://github.com/tauri-apps/plugins-workspace/pull/1175)) **Breaking change:** The `rustls-tls` feature flag is now enabled by default. +- [`e3d41f4`](https://github.com/tauri-apps/plugins-workspace/commit/e3d41f4011bd3ea3ce281bb38bbe31d3709f8e0f)([#1191](https://github.com/tauri-apps/plugins-workspace/pull/1191)) Internally use the webview scoped resources table instead of the app one, so other webviews can't access other webviews resources. +- [`7e2fcc5`](https://github.com/tauri-apps/plugins-workspace/commit/7e2fcc5e74df7c3c718e40f75bfb0eafc7d69d8d)([#1146](https://github.com/tauri-apps/plugins-workspace/pull/1146)) Update dependencies to align with tauri 2.0.0-beta.14. +- [`e3d41f4`](https://github.com/tauri-apps/plugins-workspace/commit/e3d41f4011bd3ea3ce281bb38bbe31d3709f8e0f)([#1191](https://github.com/tauri-apps/plugins-workspace/pull/1191)) Update for tauri 2.0.0-beta.15. + +## \[2.0.0-beta.3] + +- [`4e37316`](https://github.com/tauri-apps/plugins-workspace/commit/4e37316af0d6532bf9a9bd0e712b5b14b0598285)([#1051](https://github.com/tauri-apps/plugins-workspace/pull/1051)) Fix deserialization of `windows > installerArgs` config field. +- [`4e37316`](https://github.com/tauri-apps/plugins-workspace/commit/4e37316af0d6532bf9a9bd0e712b5b14b0598285)([#1051](https://github.com/tauri-apps/plugins-workspace/pull/1051)) On Windows, fallback to `passive` install mode when not defined in config. +- [`a3b5396`](https://github.com/tauri-apps/plugins-workspace/commit/a3b5396113ca93912274f6890d9ef5b1a409587a)([#1054](https://github.com/tauri-apps/plugins-workspace/pull/1054)) Fix Windows powershell window flashing on update +- [`a04ea2f`](https://github.com/tauri-apps/plugins-workspace/commit/a04ea2f38294d5a3987578283badc8eec87a7752)([#1071](https://github.com/tauri-apps/plugins-workspace/pull/1071)) The global API script is now only added to the binary when the `withGlobalTauri` config is true. + +## \[2.0.0-beta.2] + +- [`99bea25`](https://github.com/tauri-apps/plugins-workspace/commit/99bea2559c2c0648c2519c50a18cd124dacef57b)([#1005](https://github.com/tauri-apps/plugins-workspace/pull/1005)) Update to tauri beta.8. + +## \[2.0.0-beta.1] + +- [`569defb`](https://github.com/tauri-apps/plugins-workspace/commit/569defbe9492e38938554bb7bdc1be9151456d21) Update to tauri beta.4. + +## \[2.0.0-beta.0] + +- [`d198c01`](https://github.com/tauri-apps/plugins-workspace/commit/d198c014863ee260cb0de88a14b7fc4356ef7474)([#862](https://github.com/tauri-apps/plugins-workspace/pull/862)) Update to tauri beta. +- [`0879a87`](https://github.com/tauri-apps/plugins-workspace/commit/0879a87a7ecc83c9e886e6f1412fe253082b8d34)([#899](https://github.com/tauri-apps/plugins-workspace/pull/899)) Fix `Started` event not emitted to JS when downloading update. +- [`8505a75`](https://github.com/tauri-apps/plugins-workspace/commit/8505a756b569d88757ec58e452bfe4814d8107bf)([#907](https://github.com/tauri-apps/plugins-workspace/pull/907)) Add support for specifying proxy to use for checking and downloading updates. + +## \[2.0.0-alpha.5] + +- [`387c2f9`](https://github.com/tauri-apps/plugins-workspace/commit/387c2f9e0ce4c75c07ffa3fd76391a25b58f5daf)([#802](https://github.com/tauri-apps/plugins-workspace/pull/802)) Update to @tauri-apps/api v2.0.0-alpha.13. +- [`e5f979f`](https://github.com/tauri-apps/plugins-workspace/commit/e5f979f91abbb1775fa048af3219b30ff30ed691)([#818](https://github.com/tauri-apps/plugins-workspace/pull/818)) Fix NSIS updater failing to launch when using `basicUi` mode. + +## \[2.0.0-alpha.4] + +- [`387c2f9`](https://github.com/tauri-apps/plugins-workspace/commit/387c2f9e0ce4c75c07ffa3fd76391a25b58f5daf)([#802](https://github.com/tauri-apps/plugins-workspace/pull/802)) Update to @tauri-apps/api v2.0.0-alpha.12. + +## \[2.0.0-alpha.3] + +- [`e438e0a`](https://github.com/tauri-apps/plugins-workspace/commit/e438e0a62d4b430a5159f05f13ecd397dd891a0d)([#676](https://github.com/tauri-apps/plugins-workspace/pull/676)) Update to @tauri-apps/api v2.0.0-alpha.11. + +## \[2.0.0-alpha.2] + +- [`5c13736`](https://github.com/tauri-apps/plugins-workspace/commit/5c137365c60790e8d4037d449e8237aa3fffdab0)([#673](https://github.com/tauri-apps/plugins-workspace/pull/673)) Update to @tauri-apps/api v2.0.0-alpha.9. + +## \[2.0.0-alpha.2] + +- [`4e2cef9`](https://github.com/tauri-apps/plugins-workspace/commit/4e2cef9b702bbbb9cf4ee17de50791cb21f1b2a4)([#593](https://github.com/tauri-apps/plugins-workspace/pull/593)) Update to alpha.12. + +## \[2.0.0-alpha.1] + +- [`d74fc0a`](https://github.com/tauri-apps/plugins-workspace/commit/d74fc0a097996e90a37be8f57d50b7d1f6ca616f)([#555](https://github.com/tauri-apps/plugins-workspace/pull/555)) Update to alpha.11. +- [`4ab90f0`](https://github.com/tauri-apps/plugins-workspace/commit/4ab90f048eab2918344f97dc8e04413a404e392d)([#431](https://github.com/tauri-apps/plugins-workspace/pull/431)) The updater plugin is recieving a few changes to improve consistency and ergonomics of the Rust and JS APIs + +## \[2.0.0-alpha.0] + +- [`717ae67`](https://github.com/tauri-apps/plugins-workspace/commit/717ae670978feb4492fac1f295998b93f2b9347f)([#371](https://github.com/tauri-apps/plugins-workspace/pull/371)) First v2 alpha release! diff --git a/vendor/tauri-plugin-updater-2.10.1/Cargo.lock b/vendor/tauri-plugin-updater-2.10.1/Cargo.lock new file mode 100644 index 0000000..6afe78c --- /dev/null +++ b/vendor/tauri-plugin-updater-2.10.1/Cargo.lock @@ -0,0 +1,4580 @@ +# This file is automatically @generated by Cargo. +# It is not intended for manual editing. +version = 3 + +[[package]] +name = "addr2line" +version = "0.24.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "dfbe277e56a376000877090da837660b4427aad530e3028d44e0bffe4f89a1c1" +dependencies = [ + "gimli", +] + +[[package]] +name = "adler2" +version = "2.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "512761e0bb2578dd7380c6baaa0f4ce03e84f95e960231d1dec8bf4d7d6e2627" + +[[package]] +name = "aho-corasick" +version = "1.1.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916" +dependencies = [ + "memchr", +] + +[[package]] +name = "android-tzdata" +version = "0.1.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e999941b234f3131b00bc13c22d06e8c5ff726d1b6318ac7eb276997bbb4fef0" + +[[package]] +name = "android_system_properties" +version = "0.1.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311" +dependencies = [ + "libc", +] + +[[package]] +name = "anyhow" +version = "1.0.98" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e16d2d3311acee920a9eb8d33b8cbc1787ce4a264e85f964c2404b969bdcd487" + +[[package]] +name = "arbitrary" +version = "1.4.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "dde20b3d026af13f561bdd0f15edf01fc734f0dafcedbaf42bba506a9517f223" +dependencies = [ + "derive_arbitrary", +] + +[[package]] +name = "atk" +version = "0.18.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "241b621213072e993be4f6f3a9e4b45f65b7e6faad43001be957184b7bb1824b" +dependencies = [ + "atk-sys", + "glib", + "libc", +] + +[[package]] +name = "atk-sys" +version = "0.18.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c5e48b684b0ca77d2bbadeef17424c2ea3c897d44d566a1617e7e8f30614d086" +dependencies = [ + "glib-sys", + "gobject-sys", + "libc", + "system-deps", +] + +[[package]] +name = "atomic-waker" +version = "1.1.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0" + +[[package]] +name = "autocfg" +version = "1.4.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26" + +[[package]] +name = "backtrace" +version = "0.3.74" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8d82cb332cdfaed17ae235a638438ac4d4839913cc2af585c3c6746e8f8bee1a" +dependencies = [ + "addr2line", + "cfg-if", + "libc", + "miniz_oxide", + "object", + "rustc-demangle", + "windows-targets 0.52.6", +] + +[[package]] +name = "base64" +version = "0.21.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567" + +[[package]] +name = "base64" +version = "0.22.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6" + +[[package]] +name = "bitflags" +version = "1.3.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a" + +[[package]] +name = "bitflags" +version = "2.9.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5c8214115b7bf84099f1309324e63141d4c5d7cc26862f97a0a857dbefe165bd" +dependencies = [ + "serde", +] + +[[package]] +name = "block-buffer" +version = "0.10.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71" +dependencies = [ + "generic-array", +] + +[[package]] +name = "block2" +version = "0.6.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cdeb9d870516001442e364c5220d3574d2da8dc765554b4a617230d33fa58ef5" +dependencies = [ + "objc2", +] + +[[package]] +name = "bumpalo" +version = "3.17.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1628fb46dfa0b37568d12e5edd512553eccf6a22a78e8bde00bb4aed84d5bdbf" + +[[package]] +name = "byteorder" +version = "1.5.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b" + +[[package]] +name = "bytes" +version = "1.11.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33" +dependencies = [ + "serde", +] + +[[package]] +name = "cairo-rs" +version = "0.18.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8ca26ef0159422fb77631dc9d17b102f253b876fe1586b03b803e63a309b4ee2" +dependencies = [ + "bitflags 2.9.0", + "cairo-sys-rs", + "glib", + "libc", + "once_cell", + "thiserror 1.0.69", +] + +[[package]] +name = "cairo-sys-rs" +version = "0.18.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "685c9fa8e590b8b3d678873528d83411db17242a73fccaed827770ea0fedda51" +dependencies = [ + "glib-sys", + "libc", + "system-deps", +] + +[[package]] +name = "camino" +version = "1.1.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8b96ec4966b5813e2c0507c1f86115c8c5abaadc3980879c3424042a02fd1ad3" +dependencies = [ + "serde", +] + +[[package]] +name = "cargo-platform" +version = "0.1.8" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "24b1f0365a6c6bb4020cd05806fd0d33c44d38046b8bd7f0e40814b9763cabfc" +dependencies = [ + "serde", +] + +[[package]] +name = "cargo_metadata" +version = "0.19.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "afc309ed89476c8957c50fb818f56fe894db857866c3e163335faa91dc34eb85" +dependencies = [ + "camino", + "cargo-platform", + "semver", + "serde", + "serde_json", + "thiserror 1.0.69", +] + +[[package]] +name = "cargo_toml" +version = "0.22.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "02260d489095346e5cafd04dea8e8cb54d1d74fcd759022a9b72986ebe9a1257" +dependencies = [ + "serde", + "toml 0.8.20", +] + +[[package]] +name = "cc" +version = "1.2.19" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8e3a13707ac958681c13b39b458c073d0d9bc8a22cb1b2f4c8e55eb72c13f362" +dependencies = [ + "shlex", +] + +[[package]] +name = "cesu8" +version = "1.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6d43a04d8753f35258c91f8ec639f792891f748a1edbd759cf1dcea3382ad83c" + +[[package]] +name = "cfb" +version = "0.7.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d38f2da7a0a2c4ccf0065be06397cc26a81f4e528be095826eee9d4adbb8c60f" +dependencies = [ + "byteorder", + "fnv", + "uuid", +] + +[[package]] +name = "cfg-expr" +version = "0.15.8" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d067ad48b8650848b989a59a86c6c36a995d02d2bf778d45c3c5d57bc2718f02" +dependencies = [ + "smallvec", + "target-lexicon", +] + +[[package]] +name = "cfg-if" +version = "1.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd" + +[[package]] +name = "chrono" +version = "0.4.40" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1a7964611d71df112cb1730f2ee67324fcf4d0fc6606acbbe9bfe06df124637c" +dependencies = [ + "android-tzdata", + "iana-time-zone", + "num-traits", + "serde", + "windows-link", +] + +[[package]] +name = "combine" +version = "4.6.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ba5a308b75df32fe02788e748662718f03fde005016435c444eea572398219fd" +dependencies = [ + "bytes", + "memchr", +] + +[[package]] +name = "convert_case" +version = "0.4.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6245d59a3e82a7fc217c5828a6692dbc6dfb63a0c8c90495621f7b9d79704a0e" + +[[package]] +name = "cookie" +version = "0.18.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4ddef33a339a91ea89fb53151bd0a4689cfce27055c291dfa69945475d22c747" +dependencies = [ + "time", + "version_check", +] + +[[package]] +name = "core-foundation" +version = "0.9.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f" +dependencies = [ + "core-foundation-sys", + "libc", +] + +[[package]] +name = "core-foundation" +version = "0.10.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b55271e5c8c478ad3f38ad24ef34923091e0548492a266d19b3c0b4d82574c63" +dependencies = [ + "core-foundation-sys", + "libc", +] + +[[package]] +name = "core-foundation-sys" +version = "0.8.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b" + +[[package]] +name = "cpufeatures" +version = "0.2.17" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280" +dependencies = [ + "libc", +] + +[[package]] +name = "crc32fast" +version = "1.4.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a97769d94ddab943e4510d138150169a2758b5ef3eb191a9ee688de3e23ef7b3" +dependencies = [ + "cfg-if", +] + +[[package]] +name = "crossbeam-channel" +version = "0.5.15" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "82b8f8f868b36967f9606790d1903570de9ceaf870a7bf9fbbd3016d636a2cb2" +dependencies = [ + "crossbeam-utils", +] + +[[package]] +name = "crossbeam-utils" +version = "0.8.21" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28" + +[[package]] +name = "crypto-common" +version = "0.1.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3" +dependencies = [ + "generic-array", + "typenum", +] + +[[package]] +name = "cssparser" +version = "0.29.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f93d03419cb5950ccfd3daf3ff1c7a36ace64609a1a8746d493df1ca0afde0fa" +dependencies = [ + "cssparser-macros", + "dtoa-short", + "itoa", + "matches", + "phf 0.10.1", + "proc-macro2", + "quote", + "smallvec", + "syn 1.0.109", +] + +[[package]] +name = "cssparser-macros" +version = "0.6.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "13b588ba4ac1a99f7f2964d24b3d896ddc6bf847ee3855dbd4366f058cfcd331" +dependencies = [ + "quote", + "syn 2.0.100", +] + +[[package]] +name = "ctor" +version = "0.2.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "32a2785755761f3ddc1492979ce1e48d2c00d09311c39e4466429188f3dd6501" +dependencies = [ + "quote", + "syn 2.0.100", +] + +[[package]] +name = "darling" +version = "0.20.11" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "fc7f46116c46ff9ab3eb1597a45688b6715c6e628b5c133e288e709a29bcb4ee" +dependencies = [ + "darling_core", + "darling_macro", +] + +[[package]] +name = "darling_core" +version = "0.20.11" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0d00b9596d185e565c2207a0b01f8bd1a135483d02d9b7b0a54b11da8d53412e" +dependencies = [ + "fnv", + "ident_case", + "proc-macro2", + "quote", + "strsim", + "syn 2.0.100", +] + +[[package]] +name = "darling_macro" +version = "0.20.11" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "fc34b93ccb385b40dc71c6fceac4b2ad23662c7eeb248cf10d529b7e055b6ead" +dependencies = [ + "darling_core", + "quote", + "syn 2.0.100", +] + +[[package]] +name = "deranged" +version = "0.4.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9c9e6a11ca8224451684bc0d7d5a7adbf8f2fd6887261a1cfc3c0432f9d4068e" +dependencies = [ + "powerfmt", + "serde", +] + +[[package]] +name = "derive_arbitrary" +version = "1.4.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "30542c1ad912e0e3d22a1935c290e12e8a29d704a420177a31faad4a601a0800" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.100", +] + +[[package]] +name = "derive_more" +version = "0.99.19" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3da29a38df43d6f156149c9b43ded5e018ddff2a855cf2cfd62e8cd7d079c69f" +dependencies = [ + "convert_case", + "proc-macro2", + "quote", + "rustc_version", + "syn 2.0.100", +] + +[[package]] +name = "digest" +version = "0.10.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292" +dependencies = [ + "block-buffer", + "crypto-common", +] + +[[package]] +name = "dirs" +version = "6.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c3e8aa94d75141228480295a7d0e7feb620b1a5ad9f12bc40be62411e38cce4e" +dependencies = [ + "dirs-sys", +] + +[[package]] +name = "dirs-sys" +version = "0.5.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e01a3366d27ee9890022452ee61b2b63a67e6f13f58900b651ff5665f0bb1fab" +dependencies = [ + "libc", + "option-ext", + "redox_users", + "windows-sys 0.60.2", +] + +[[package]] +name = "displaydoc" +version = "0.2.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.100", +] + +[[package]] +name = "dpi" +version = "0.1.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f25c0e292a7ca6d6498557ff1df68f32c99850012b6ea401cf8daf771f22ff53" +dependencies = [ + "serde", +] + +[[package]] +name = "dtoa" +version = "1.0.10" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d6add3b8cff394282be81f3fc1a0605db594ed69890078ca6e2cab1c408bcf04" + +[[package]] +name = "dtoa-short" +version = "0.3.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cd1511a7b6a56299bd043a9c167a6d2bfb37bf84a6dfceaba651168adfb43c87" +dependencies = [ + "dtoa", +] + +[[package]] +name = "dunce" +version = "1.0.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813" + +[[package]] +name = "dyn-clone" +version = "1.0.19" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1c7a8fb8a9fbf66c1f703fe16184d10ca0ee9d23be5b4436400408ba54a95005" + +[[package]] +name = "embed-resource" +version = "3.0.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7fbc6e0d8e0c03a655b53ca813f0463d2c956bc4db8138dbc89f120b066551e3" +dependencies = [ + "cc", + "memchr", + "rustc_version", + "toml 0.8.20", + "vswhom", + "winreg", +] + +[[package]] +name = "embed_plist" +version = "1.2.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4ef6b89e5b37196644d8796de5268852ff179b44e96276cf4290264843743bb7" + +[[package]] +name = "equivalent" +version = "1.0.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f" + +[[package]] +name = "erased-serde" +version = "0.4.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e004d887f51fcb9fef17317a2f3525c887d8aa3f4f50fed920816a688284a5b7" +dependencies = [ + "serde", + "typeid", +] + +[[package]] +name = "errno" +version = "0.3.11" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "976dd42dc7e85965fe702eb8164f21f450704bdde31faefd6471dba214cb594e" +dependencies = [ + "libc", + "windows-sys 0.59.0", +] + +[[package]] +name = "fastrand" +version = "2.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be" + +[[package]] +name = "fdeflate" +version = "0.3.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1e6853b52649d4ac5c0bd02320cddc5ba956bdb407c4b75a2c6b75bf51500f8c" +dependencies = [ + "simd-adler32", +] + +[[package]] +name = "field-offset" +version = "0.3.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "38e2275cc4e4fc009b0669731a1e5ab7ebf11f469eaede2bab9309a5b4d6057f" +dependencies = [ + "memoffset", + "rustc_version", +] + +[[package]] +name = "filetime" +version = "0.2.25" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "35c0522e981e68cbfa8c3f978441a5f34b30b96e146b33cd3359176b50fe8586" +dependencies = [ + "cfg-if", + "libc", + "libredox", + "windows-sys 0.59.0", +] + +[[package]] +name = "flate2" +version = "1.1.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7ced92e76e966ca2fd84c8f7aa01a4aea65b0eb6648d72f7c8f3e2764a67fece" +dependencies = [ + "crc32fast", + "miniz_oxide", +] + +[[package]] +name = "fnv" +version = "1.0.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1" + +[[package]] +name = "foreign-types" +version = "0.3.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f6f339eb8adc052cd2ca78910fda869aefa38d22d5cb648e6485e4d3fc06f3b1" +dependencies = [ + "foreign-types-shared", +] + +[[package]] +name = "foreign-types-shared" +version = "0.1.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b" + +[[package]] +name = "form_urlencoded" +version = "1.2.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e13624c2627564efccf4934284bdd98cbaa14e79b0b5a141218e507b3a823456" +dependencies = [ + "percent-encoding", +] + +[[package]] +name = "futf" +version = "0.1.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "df420e2e84819663797d1ec6544b13c5be84629e7bb00dc960d6917db2987843" +dependencies = [ + "mac", + "new_debug_unreachable", +] + +[[package]] +name = "futures-channel" +version = "0.3.31" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2dff15bf788c671c1934e366d07e30c1814a8ef514e1af724a602e8a2fbe1b10" +dependencies = [ + "futures-core", +] + +[[package]] +name = "futures-core" +version = "0.3.31" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "05f29059c0c2090612e8d742178b0580d2dc940c837851ad723096f87af6663e" + +[[package]] +name = "futures-executor" +version = "0.3.31" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1e28d1d997f585e54aebc3f97d39e72338912123a67330d723fdbb564d646c9f" +dependencies = [ + "futures-core", + "futures-task", + "futures-util", +] + +[[package]] +name = "futures-io" +version = "0.3.31" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9e5c1b78ca4aae1ac06c48a526a655760685149f0d465d21f37abfe57ce075c6" + +[[package]] +name = "futures-macro" +version = "0.3.31" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "162ee34ebcb7c64a8abebc059ce0fee27c2262618d7b60ed8faf72fef13c3650" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.100", +] + +[[package]] +name = "futures-sink" +version = "0.3.31" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e575fab7d1e0dcb8d0c7bcf9a63ee213816ab51902e6d244a95819acacf1d4f7" + +[[package]] +name = "futures-task" +version = "0.3.31" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f90f7dce0722e95104fcb095585910c0977252f286e354b5e3bd38902cd99988" + +[[package]] +name = "futures-util" +version = "0.3.31" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9fa08315bb612088cc391249efdc3bc77536f16c91f6cf495e6fbe85b20a4a81" +dependencies = [ + "futures-core", + "futures-io", + "futures-macro", + "futures-sink", + "futures-task", + "memchr", + "pin-project-lite", + "pin-utils", + "slab", +] + +[[package]] +name = "fxhash" +version = "0.2.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c31b6d751ae2c7f11320402d34e41349dd1016f8d5d45e48c4312bc8625af50c" +dependencies = [ + "byteorder", +] + +[[package]] +name = "gdk" +version = "0.18.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d9f245958c627ac99d8e529166f9823fb3b838d1d41fd2b297af3075093c2691" +dependencies = [ + "cairo-rs", + "gdk-pixbuf", + "gdk-sys", + "gio", + "glib", + "libc", + "pango", +] + +[[package]] +name = "gdk-pixbuf" +version = "0.18.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "50e1f5f1b0bfb830d6ccc8066d18db35c487b1b2b1e8589b5dfe9f07e8defaec" +dependencies = [ + "gdk-pixbuf-sys", + "gio", + "glib", + "libc", + "once_cell", +] + +[[package]] +name = "gdk-pixbuf-sys" +version = "0.18.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3f9839ea644ed9c97a34d129ad56d38a25e6756f99f3a88e15cd39c20629caf7" +dependencies = [ + "gio-sys", + "glib-sys", + "gobject-sys", + "libc", + "system-deps", +] + +[[package]] +name = "gdk-sys" +version = "0.18.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5c2d13f38594ac1e66619e188c6d5a1adb98d11b2fcf7894fc416ad76aa2f3f7" +dependencies = [ + "cairo-sys-rs", + "gdk-pixbuf-sys", + "gio-sys", + "glib-sys", + "gobject-sys", + "libc", + "pango-sys", + "pkg-config", + "system-deps", +] + +[[package]] +name = "generic-array" +version = "0.14.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a" +dependencies = [ + "typenum", + "version_check", +] + +[[package]] +name = "getrandom" +version = "0.1.16" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8fc3cb4d91f53b50155bdcfd23f6a4c39ae1969c2ae85982b135750cccaf5fce" +dependencies = [ + "cfg-if", + "libc", + "wasi 0.9.0+wasi-snapshot-preview1", +] + +[[package]] +name = "getrandom" +version = "0.2.15" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c4567c8db10ae91089c99af84c68c38da3ec2f087c3f82960bcdbf3656b6f4d7" +dependencies = [ + "cfg-if", + "libc", + "wasi 0.11.0+wasi-snapshot-preview1", +] + +[[package]] +name = "getrandom" +version = "0.3.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "73fea8450eea4bac3940448fb7ae50d91f034f941199fcd9d909a5a07aa455f0" +dependencies = [ + "cfg-if", + "libc", + "r-efi", + "wasi 0.14.2+wasi-0.2.4", +] + +[[package]] +name = "gimli" +version = "0.31.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "07e28edb80900c19c28f1072f2e8aeca7fa06b23cd4169cefe1af5aa3260783f" + +[[package]] +name = "gio" +version = "0.18.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d4fc8f532f87b79cbc51a79748f16a6828fb784be93145a322fa14d06d354c73" +dependencies = [ + "futures-channel", + "futures-core", + "futures-io", + "futures-util", + "gio-sys", + "glib", + "libc", + "once_cell", + "pin-project-lite", + "smallvec", + "thiserror 1.0.69", +] + +[[package]] +name = "gio-sys" +version = "0.18.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "37566df850baf5e4cb0dfb78af2e4b9898d817ed9263d1090a2df958c64737d2" +dependencies = [ + "glib-sys", + "gobject-sys", + "libc", + "system-deps", + "winapi", +] + +[[package]] +name = "glib" +version = "0.18.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "233daaf6e83ae6a12a52055f568f9d7cf4671dabb78ff9560ab6da230ce00ee5" +dependencies = [ + "bitflags 2.9.0", + "futures-channel", + "futures-core", + "futures-executor", + "futures-task", + "futures-util", + "gio-sys", + "glib-macros", + "glib-sys", + "gobject-sys", + "libc", + "memchr", + "once_cell", + "smallvec", + "thiserror 1.0.69", +] + +[[package]] +name = "glib-macros" +version = "0.18.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0bb0228f477c0900c880fd78c8759b95c7636dbd7842707f49e132378aa2acdc" +dependencies = [ + "heck 0.4.1", + "proc-macro-crate 2.0.0", + "proc-macro-error", + "proc-macro2", + "quote", + "syn 2.0.100", +] + +[[package]] +name = "glib-sys" +version = "0.18.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "063ce2eb6a8d0ea93d2bf8ba1957e78dbab6be1c2220dd3daca57d5a9d869898" +dependencies = [ + "libc", + "system-deps", +] + +[[package]] +name = "glob" +version = "0.3.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a8d1add55171497b4705a648c6b583acafb01d58050a51727785f0b2c8e0a2b2" + +[[package]] +name = "gobject-sys" +version = "0.18.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0850127b514d1c4a4654ead6dedadb18198999985908e6ffe4436f53c785ce44" +dependencies = [ + "glib-sys", + "libc", + "system-deps", +] + +[[package]] +name = "gtk" +version = "0.18.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "fd56fb197bfc42bd5d2751f4f017d44ff59fbb58140c6b49f9b3b2bdab08506a" +dependencies = [ + "atk", + "cairo-rs", + "field-offset", + "futures-channel", + "gdk", + "gdk-pixbuf", + "gio", + "glib", + "gtk-sys", + "gtk3-macros", + "libc", + "pango", + "pkg-config", +] + +[[package]] +name = "gtk-sys" +version = "0.18.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8f29a1c21c59553eb7dd40e918be54dccd60c52b049b75119d5d96ce6b624414" +dependencies = [ + "atk-sys", + "cairo-sys-rs", + "gdk-pixbuf-sys", + "gdk-sys", + "gio-sys", + "glib-sys", + "gobject-sys", + "libc", + "pango-sys", + "system-deps", +] + +[[package]] +name = "gtk3-macros" +version = "0.18.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "52ff3c5b21f14f0736fed6dcfc0bfb4225ebf5725f3c0209edeec181e4d73e9d" +dependencies = [ + "proc-macro-crate 1.3.1", + "proc-macro-error", + "proc-macro2", + "quote", + "syn 2.0.100", +] + +[[package]] +name = "hashbrown" +version = "0.12.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888" + +[[package]] +name = "hashbrown" +version = "0.15.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bf151400ff0baff5465007dd2f3e717f3fe502074ca563069ce3a6629d07b289" + +[[package]] +name = "heck" +version = "0.4.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8" + +[[package]] +name = "heck" +version = "0.5.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea" + +[[package]] +name = "hex" +version = "0.4.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70" + +[[package]] +name = "html5ever" +version = "0.29.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3b7410cae13cbc75623c98ac4cbfd1f0bedddf3227afc24f370cf0f50a44a11c" +dependencies = [ + "log", + "mac", + "markup5ever", + "match_token", +] + +[[package]] +name = "http" +version = "1.3.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f4a85d31aea989eead29a3aaf9e1115a180df8282431156e533de47660892565" +dependencies = [ + "bytes", + "fnv", + "itoa", +] + +[[package]] +name = "http-body" +version = "1.0.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184" +dependencies = [ + "bytes", + "http", +] + +[[package]] +name = "http-body-util" +version = "0.1.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a" +dependencies = [ + "bytes", + "futures-core", + "http", + "http-body", + "pin-project-lite", +] + +[[package]] +name = "httparse" +version = "1.10.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87" + +[[package]] +name = "hyper" +version = "1.8.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2ab2d4f250c3d7b1c9fcdff1cece94ea4e2dfbec68614f7b87cb205f24ca9d11" +dependencies = [ + "atomic-waker", + "bytes", + "futures-channel", + "futures-core", + "http", + "http-body", + "httparse", + "itoa", + "pin-project-lite", + "pin-utils", + "smallvec", + "tokio", + "want", +] + +[[package]] +name = "hyper-rustls" +version = "0.27.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2d191583f3da1305256f22463b9bb0471acad48a4e534a5218b9963e9c1f59b2" +dependencies = [ + "futures-util", + "http", + "hyper", + "hyper-util", + "rustls", + "rustls-pki-types", + "tokio", + "tokio-rustls", + "tower-service", +] + +[[package]] +name = "hyper-tls" +version = "0.6.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "70206fc6890eaca9fde8a0bf71caa2ddfc9fe045ac9e5c70df101a7dbde866e0" +dependencies = [ + "bytes", + "http-body-util", + "hyper", + "hyper-util", + "native-tls", + "tokio", + "tokio-native-tls", + "tower-service", +] + +[[package]] +name = "hyper-util" +version = "0.1.19" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "727805d60e7938b76b826a6ef209eb70eaa1812794f9424d4a4e2d740662df5f" +dependencies = [ + "base64 0.22.1", + "bytes", + "futures-channel", + "futures-core", + "futures-util", + "http", + "http-body", + "hyper", + "ipnet", + "libc", + "percent-encoding", + "pin-project-lite", + "socket2", + "tokio", + "tower-service", + "tracing", +] + +[[package]] +name = "iana-time-zone" +version = "0.1.63" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b0c919e5debc312ad217002b8048a17b7d83f80703865bbfcfebb0458b0b27d8" +dependencies = [ + "android_system_properties", + "core-foundation-sys", + "iana-time-zone-haiku", + "js-sys", + "log", + "wasm-bindgen", + "windows-core", +] + +[[package]] +name = "iana-time-zone-haiku" +version = "0.1.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f" +dependencies = [ + "cc", +] + +[[package]] +name = "ico" +version = "0.5.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3e795dff5605e0f04bff85ca41b51a96b83e80b281e96231bcaaf1ac35103371" +dependencies = [ + "byteorder", + "png", +] + +[[package]] +name = "icu_collections" +version = "1.5.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "db2fa452206ebee18c4b5c2274dbf1de17008e874b4dc4f0aea9d01ca79e4526" +dependencies = [ + "displaydoc", + "yoke", + "zerofrom", + "zerovec", +] + +[[package]] +name = "icu_locid" +version = "1.5.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "13acbb8371917fc971be86fc8057c41a64b521c184808a698c02acc242dbf637" +dependencies = [ + "displaydoc", + "litemap", + "tinystr", + "writeable", + "zerovec", +] + +[[package]] +name = "icu_locid_transform" +version = "1.5.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "01d11ac35de8e40fdeda00d9e1e9d92525f3f9d887cdd7aa81d727596788b54e" +dependencies = [ + "displaydoc", + "icu_locid", + "icu_locid_transform_data", + "icu_provider", + "tinystr", + "zerovec", +] + +[[package]] +name = "icu_locid_transform_data" +version = "1.5.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7515e6d781098bf9f7205ab3fc7e9709d34554ae0b21ddbcb5febfa4bc7df11d" + +[[package]] +name = "icu_normalizer" +version = "1.5.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "19ce3e0da2ec68599d193c93d088142efd7f9c5d6fc9b803774855747dc6a84f" +dependencies = [ + "displaydoc", + "icu_collections", + "icu_normalizer_data", + "icu_properties", + "icu_provider", + "smallvec", + "utf16_iter", + "utf8_iter", + "write16", + "zerovec", +] + +[[package]] +name = "icu_normalizer_data" +version = "1.5.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c5e8338228bdc8ab83303f16b797e177953730f601a96c25d10cb3ab0daa0cb7" + +[[package]] +name = "icu_properties" +version = "1.5.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "93d6020766cfc6302c15dbbc9c8778c37e62c14427cb7f6e601d849e092aeef5" +dependencies = [ + "displaydoc", + "icu_collections", + "icu_locid_transform", + "icu_properties_data", + "icu_provider", + "tinystr", + "zerovec", +] + +[[package]] +name = "icu_properties_data" +version = "1.5.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "85fb8799753b75aee8d2a21d7c14d9f38921b54b3dbda10f5a3c7a7b82dba5e2" + +[[package]] +name = "icu_provider" +version = "1.5.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6ed421c8a8ef78d3e2dbc98a973be2f3770cb42b606e3ab18d6237c4dfde68d9" +dependencies = [ + "displaydoc", + "icu_locid", + "icu_provider_macros", + "stable_deref_trait", + "tinystr", + "writeable", + "yoke", + "zerofrom", + "zerovec", +] + +[[package]] +name = "icu_provider_macros" +version = "1.5.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1ec89e9337638ecdc08744df490b221a7399bf8d164eb52a665454e60e075ad6" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.100", +] + +[[package]] +name = "ident_case" +version = "1.0.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39" + +[[package]] +name = "idna" +version = "1.0.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "686f825264d630750a544639377bae737628043f20d38bbc029e8f29ea968a7e" +dependencies = [ + "idna_adapter", + "smallvec", + "utf8_iter", +] + +[[package]] +name = "idna_adapter" +version = "1.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "daca1df1c957320b2cf139ac61e7bd64fed304c5040df000a745aa1de3b4ef71" +dependencies = [ + "icu_normalizer", + "icu_properties", +] + +[[package]] +name = "indexmap" +version = "1.9.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99" +dependencies = [ + "autocfg", + "hashbrown 0.12.3", + "serde", +] + +[[package]] +name = "indexmap" +version = "2.9.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cea70ddb795996207ad57735b50c5982d8844f38ba9ee5f1aedcfb708a2aa11e" +dependencies = [ + "equivalent", + "hashbrown 0.15.2", + "serde", +] + +[[package]] +name = "infer" +version = "0.19.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a588916bfdfd92e71cacef98a63d9b1f0d74d6599980d11894290e7ddefffcf7" +dependencies = [ + "cfb", +] + +[[package]] +name = "ipnet" +version = "2.11.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "469fb0b9cefa57e3ef31275ee7cacb78f2fdca44e4765491884a2b119d4eb130" + +[[package]] +name = "iri-string" +version = "0.7.10" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c91338f0783edbd6195decb37bae672fd3b165faffb89bf7b9e6942f8b1a731a" +dependencies = [ + "memchr", + "serde", +] + +[[package]] +name = "itoa" +version = "1.0.15" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c" + +[[package]] +name = "javascriptcore-rs" +version = "1.1.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ca5671e9ffce8ffba57afc24070e906da7fc4b1ba66f2cabebf61bf2ea257fcc" +dependencies = [ + "bitflags 1.3.2", + "glib", + "javascriptcore-rs-sys", +] + +[[package]] +name = "javascriptcore-rs-sys" +version = "1.1.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "af1be78d14ffa4b75b66df31840478fef72b51f8c2465d4ca7c194da9f7a5124" +dependencies = [ + "glib-sys", + "gobject-sys", + "libc", + "system-deps", +] + +[[package]] +name = "jni" +version = "0.21.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1a87aa2bb7d2af34197c04845522473242e1aa17c12f4935d5856491a7fb8c97" +dependencies = [ + "cesu8", + "cfg-if", + "combine", + "jni-sys", + "log", + "thiserror 1.0.69", + "walkdir", + "windows-sys 0.45.0", +] + +[[package]] +name = "jni-sys" +version = "0.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8eaf4bc02d17cbdd7ff4c7438cafcdf7fb9a4613313ad11b4f8fefe7d3fa0130" + +[[package]] +name = "js-sys" +version = "0.3.77" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1cfaf33c695fc6e08064efbc1f72ec937429614f25eef83af942d0e227c3a28f" +dependencies = [ + "once_cell", + "wasm-bindgen", +] + +[[package]] +name = "json-patch" +version = "3.0.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "863726d7afb6bc2590eeff7135d923545e5e964f004c2ccf8716c25e70a86f08" +dependencies = [ + "jsonptr", + "serde", + "serde_json", + "thiserror 1.0.69", +] + +[[package]] +name = "jsonptr" +version = "0.6.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5dea2b27dd239b2556ed7a25ba842fe47fd602e7fc7433c2a8d6106d4d9edd70" +dependencies = [ + "serde", + "serde_json", +] + +[[package]] +name = "keyboard-types" +version = "0.7.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b750dcadc39a09dbadd74e118f6dd6598df77fa01df0cfcdc52c28dece74528a" +dependencies = [ + "bitflags 2.9.0", + "serde", + "unicode-segmentation", +] + +[[package]] +name = "kuchikiki" +version = "0.8.8-speedreader" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "02cb977175687f33fa4afa0c95c112b987ea1443e5a51c8f8ff27dc618270cc2" +dependencies = [ + "cssparser", + "html5ever", + "indexmap 2.9.0", + "selectors", +] + +[[package]] +name = "libc" +version = "0.2.180" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bcc35a38544a891a5f7c865aca548a982ccb3b8650a5b06d0fd33a10283c56fc" + +[[package]] +name = "libredox" +version = "0.1.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c0ff37bd590ca25063e35af745c343cb7a0271906fb7b37e4813e8f79f00268d" +dependencies = [ + "bitflags 2.9.0", + "libc", + "redox_syscall", +] + +[[package]] +name = "linux-raw-sys" +version = "0.11.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "df1d3c3b53da64cf5760482273a98e575c651a67eec7f77df96b5b642de8f039" + +[[package]] +name = "litemap" +version = "0.7.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4ee93343901ab17bd981295f2cf0026d4ad018c7c31ba84549a4ddbb47a45104" + +[[package]] +name = "lock_api" +version = "0.4.12" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "07af8b9cdd281b7915f413fa73f29ebd5d55d0d3f0155584dade1ff18cea1b17" +dependencies = [ + "autocfg", + "scopeguard", +] + +[[package]] +name = "log" +version = "0.4.27" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "13dc2df351e3202783a1fe0d44375f7295ffb4049267b0f3018346dc122a1d94" + +[[package]] +name = "mac" +version = "0.1.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c41e0c4fef86961ac6d6f8a82609f55f31b05e4fce149ac5710e439df7619ba4" + +[[package]] +name = "markup5ever" +version = "0.14.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c7a7213d12e1864c0f002f52c2923d4556935a43dec5e71355c2760e0f6e7a18" +dependencies = [ + "log", + "phf 0.11.3", + "phf_codegen 0.11.3", + "string_cache", + "string_cache_codegen", + "tendril", +] + +[[package]] +name = "match_token" +version = "0.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "88a9689d8d44bf9964484516275f5cd4c9b59457a6940c1d5d0ecbb94510a36b" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.100", +] + +[[package]] +name = "matches" +version = "0.1.10" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2532096657941c2fea9c289d370a250971c689d4f143798ff67113ec042024a5" + +[[package]] +name = "memchr" +version = "2.7.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3" + +[[package]] +name = "memoffset" +version = "0.9.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "488016bfae457b036d996092f6cb448677611ce4449e970ceaf42695203f218a" +dependencies = [ + "autocfg", +] + +[[package]] +name = "mime" +version = "0.3.17" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a" + +[[package]] +name = "minisign-verify" +version = "0.2.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6367d84fb54d4242af283086402907277715b8fe46976963af5ebf173f8efba3" + +[[package]] +name = "miniz_oxide" +version = "0.8.8" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3be647b768db090acb35d5ec5db2b0e1f1de11133ca123b9eacf5137868f892a" +dependencies = [ + "adler2", + "simd-adler32", +] + +[[package]] +name = "mio" +version = "1.0.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2886843bf800fba2e3377cff24abf6379b4c4d5c6681eaf9ea5b0d15090450bd" +dependencies = [ + "libc", + "wasi 0.11.0+wasi-snapshot-preview1", + "windows-sys 0.52.0", +] + +[[package]] +name = "muda" +version = "0.17.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "01c1738382f66ed56b3b9c8119e794a2e23148ac8ea214eda86622d4cb9d415a" +dependencies = [ + "crossbeam-channel", + "dpi", + "gtk", + "keyboard-types", + "objc2", + "objc2-app-kit", + "objc2-core-foundation", + "objc2-foundation", + "once_cell", + "png", + "serde", + "thiserror 2.0.12", + "windows-sys 0.60.2", +] + +[[package]] +name = "native-tls" +version = "0.2.12" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a8614eb2c83d59d1c8cc974dd3f920198647674a0a035e1af1fa58707e317466" +dependencies = [ + "libc", + "log", + "openssl", + "openssl-probe", + "openssl-sys", + "schannel", + "security-framework 2.11.1", + "security-framework-sys", + "tempfile", +] + +[[package]] +name = "new_debug_unreachable" +version = "1.0.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086" + +[[package]] +name = "nodrop" +version = "0.1.14" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "72ef4a56884ca558e5ddb05a1d1e7e1bfd9a68d9ed024c21704cc98872dae1bb" + +[[package]] +name = "num-conv" +version = "0.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9" + +[[package]] +name = "num-traits" +version = "0.2.19" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841" +dependencies = [ + "autocfg", +] + +[[package]] +name = "objc2" +version = "0.6.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b7c2599ce0ec54857b29ce62166b0ed9b4f6f1a70ccc9a71165b6154caca8c05" +dependencies = [ + "objc2-encode", +] + +[[package]] +name = "objc2-app-kit" +version = "0.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5906f93257178e2f7ae069efb89fbd6ee94f0592740b5f8a1512ca498814d0fb" +dependencies = [ + "bitflags 2.9.0", + "objc2", + "objc2-core-foundation", + "objc2-foundation", +] + +[[package]] +name = "objc2-core-foundation" +version = "0.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "daeaf60f25471d26948a1c2f840e3f7d86f4109e3af4e8e4b5cd70c39690d925" +dependencies = [ + "bitflags 2.9.0", + "objc2", +] + +[[package]] +name = "objc2-encode" +version = "4.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ef25abbcd74fb2609453eb695bd2f860d389e457f67dc17cafc8b8cbc89d0c33" + +[[package]] +name = "objc2-foundation" +version = "0.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3a21c6c9014b82c39515db5b396f91645182611c97d24637cf56ac01e5f8d998" +dependencies = [ + "bitflags 2.9.0", + "block2", + "libc", + "objc2", + "objc2-core-foundation", +] + +[[package]] +name = "objc2-osa-kit" +version = "0.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a1ac59da3ceebc4a82179b35dc550431ad9458f9cc326e053f49ba371ce76c5a" +dependencies = [ + "bitflags 2.9.0", + "objc2", + "objc2-app-kit", + "objc2-foundation", +] + +[[package]] +name = "objc2-security" +version = "0.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3126341c65c5d5728423ae95d788e1b660756486ad0592307ab87ba02d9a7268" +dependencies = [ + "bitflags 2.9.0", + "objc2", + "objc2-core-foundation", +] + +[[package]] +name = "objc2-ui-kit" +version = "0.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "777a571be14a42a3990d4ebedaeb8b54cd17377ec21b92e8200ac03797b3bee1" +dependencies = [ + "bitflags 2.9.0", + "objc2", + "objc2-foundation", +] + +[[package]] +name = "objc2-web-kit" +version = "0.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b717127e4014b0f9f3e8bba3d3f2acec81f1bde01f656823036e823ed2c94dce" +dependencies = [ + "bitflags 2.9.0", + "block2", + "objc2", + "objc2-app-kit", + "objc2-core-foundation", + "objc2-foundation", + "objc2-security", +] + +[[package]] +name = "object" +version = "0.36.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "62948e14d923ea95ea2c7c86c71013138b66525b86bdc08d2dcc262bdb497b87" +dependencies = [ + "memchr", +] + +[[package]] +name = "once_cell" +version = "1.21.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d" + +[[package]] +name = "openssl" +version = "0.10.72" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "fedfea7d58a1f73118430a55da6a286e7b044961736ce96a16a17068ea25e5da" +dependencies = [ + "bitflags 2.9.0", + "cfg-if", + "foreign-types", + "libc", + "once_cell", + "openssl-macros", + "openssl-sys", +] + +[[package]] +name = "openssl-macros" +version = "0.1.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.100", +] + +[[package]] +name = "openssl-probe" +version = "0.1.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d05e27ee213611ffe7d6348b942e8f942b37114c00cc03cec254295a4a17852e" + +[[package]] +name = "openssl-src" +version = "300.5.0+3.5.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e8ce546f549326b0e6052b649198487d91320875da901e7bd11a06d1ee3f9c2f" +dependencies = [ + "cc", +] + +[[package]] +name = "openssl-sys" +version = "0.9.107" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8288979acd84749c744a9014b4382d42b8f7b2592847b5afb2ed29e5d16ede07" +dependencies = [ + "cc", + "libc", + "openssl-src", + "pkg-config", + "vcpkg", +] + +[[package]] +name = "option-ext" +version = "0.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "04744f49eae99ab78e0d5c0b603ab218f515ea8cfe5a456d7629ad883a3b6e7d" + +[[package]] +name = "osakit" +version = "0.3.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "732c71caeaa72c065bb69d7ea08717bd3f4863a4f451402fc9513e29dbd5261b" +dependencies = [ + "objc2", + "objc2-foundation", + "objc2-osa-kit", + "serde", + "serde_json", + "thiserror 2.0.12", +] + +[[package]] +name = "pango" +version = "0.18.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7ca27ec1eb0457ab26f3036ea52229edbdb74dee1edd29063f5b9b010e7ebee4" +dependencies = [ + "gio", + "glib", + "libc", + "once_cell", + "pango-sys", +] + +[[package]] +name = "pango-sys" +version = "0.18.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "436737e391a843e5933d6d9aa102cb126d501e815b83601365a948a518555dc5" +dependencies = [ + "glib-sys", + "gobject-sys", + "libc", + "system-deps", +] + +[[package]] +name = "parking_lot" +version = "0.12.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f1bf18183cf54e8d6059647fc3063646a1801cf30896933ec2311622cc4b9a27" +dependencies = [ + "lock_api", + "parking_lot_core", +] + +[[package]] +name = "parking_lot_core" +version = "0.9.10" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1e401f977ab385c9e4e3ab30627d6f26d00e2c73eef317493c4ec6d468726cf8" +dependencies = [ + "cfg-if", + "libc", + "redox_syscall", + "smallvec", + "windows-targets 0.52.6", +] + +[[package]] +name = "percent-encoding" +version = "2.3.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e3148f5046208a5d56bcfc03053e3ca6334e51da8dfb19b6cdc8b306fae3283e" + +[[package]] +name = "phf" +version = "0.8.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3dfb61232e34fcb633f43d12c58f83c1df82962dcdfa565a4e866ffc17dafe12" +dependencies = [ + "phf_shared 0.8.0", +] + +[[package]] +name = "phf" +version = "0.10.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "fabbf1ead8a5bcbc20f5f8b939ee3f5b0f6f281b6ad3468b84656b658b455259" +dependencies = [ + "phf_macros 0.10.0", + "phf_shared 0.10.0", + "proc-macro-hack", +] + +[[package]] +name = "phf" +version = "0.11.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1fd6780a80ae0c52cc120a26a1a42c1ae51b247a253e4e06113d23d2c2edd078" +dependencies = [ + "phf_macros 0.11.3", + "phf_shared 0.11.3", +] + +[[package]] +name = "phf_codegen" +version = "0.8.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cbffee61585b0411840d3ece935cce9cb6321f01c45477d30066498cd5e1a815" +dependencies = [ + "phf_generator 0.8.0", + "phf_shared 0.8.0", +] + +[[package]] +name = "phf_codegen" +version = "0.11.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "aef8048c789fa5e851558d709946d6d79a8ff88c0440c587967f8e94bfb1216a" +dependencies = [ + "phf_generator 0.11.3", + "phf_shared 0.11.3", +] + +[[package]] +name = "phf_generator" +version = "0.8.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "17367f0cc86f2d25802b2c26ee58a7b23faeccf78a396094c13dced0d0182526" +dependencies = [ + "phf_shared 0.8.0", + "rand 0.7.3", +] + +[[package]] +name = "phf_generator" +version = "0.10.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5d5285893bb5eb82e6aaf5d59ee909a06a16737a8970984dd7746ba9283498d6" +dependencies = [ + "phf_shared 0.10.0", + "rand 0.8.5", +] + +[[package]] +name = "phf_generator" +version = "0.11.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3c80231409c20246a13fddb31776fb942c38553c51e871f8cbd687a4cfb5843d" +dependencies = [ + "phf_shared 0.11.3", + "rand 0.8.5", +] + +[[package]] +name = "phf_macros" +version = "0.10.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "58fdf3184dd560f160dd73922bea2d5cd6e8f064bf4b13110abd81b03697b4e0" +dependencies = [ + "phf_generator 0.10.0", + "phf_shared 0.10.0", + "proc-macro-hack", + "proc-macro2", + "quote", + "syn 1.0.109", +] + +[[package]] +name = "phf_macros" +version = "0.11.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f84ac04429c13a7ff43785d75ad27569f2951ce0ffd30a3321230db2fc727216" +dependencies = [ + "phf_generator 0.11.3", + "phf_shared 0.11.3", + "proc-macro2", + "quote", + "syn 2.0.100", +] + +[[package]] +name = "phf_shared" +version = "0.8.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c00cf8b9eafe68dde5e9eaa2cef8ee84a9336a47d566ec55ca16589633b65af7" +dependencies = [ + "siphasher 0.3.11", +] + +[[package]] +name = "phf_shared" +version = "0.10.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b6796ad771acdc0123d2a88dc428b5e38ef24456743ddb1744ed628f9815c096" +dependencies = [ + "siphasher 0.3.11", +] + +[[package]] +name = "phf_shared" +version = "0.11.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "67eabc2ef2a60eb7faa00097bd1ffdb5bd28e62bf39990626a582201b7a754e5" +dependencies = [ + "siphasher 1.0.1", +] + +[[package]] +name = "pin-project-lite" +version = "0.2.16" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3b3cff922bd51709b605d9ead9aa71031d81447142d828eb4a6eba76fe619f9b" + +[[package]] +name = "pin-utils" +version = "0.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184" + +[[package]] +name = "pkg-config" +version = "0.3.32" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c" + +[[package]] +name = "plist" +version = "1.7.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "eac26e981c03a6e53e0aee43c113e3202f5581d5360dae7bd2c70e800dd0451d" +dependencies = [ + "base64 0.22.1", + "indexmap 2.9.0", + "quick-xml", + "serde", + "time", +] + +[[package]] +name = "png" +version = "0.17.16" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "82151a2fc869e011c153adc57cf2789ccb8d9906ce52c0b39a6b5697749d7526" +dependencies = [ + "bitflags 1.3.2", + "crc32fast", + "fdeflate", + "flate2", + "miniz_oxide", +] + +[[package]] +name = "powerfmt" +version = "0.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391" + +[[package]] +name = "ppv-lite86" +version = "0.2.21" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9" +dependencies = [ + "zerocopy", +] + +[[package]] +name = "precomputed-hash" +version = "0.1.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "925383efa346730478fb4838dbe9137d2a47675ad789c546d150a6e1dd4ab31c" + +[[package]] +name = "proc-macro-crate" +version = "1.3.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7f4c021e1093a56626774e81216a4ce732a735e5bad4868a03f3ed65ca0c3919" +dependencies = [ + "once_cell", + "toml_edit 0.19.15", +] + +[[package]] +name = "proc-macro-crate" +version = "2.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7e8366a6159044a37876a2b9817124296703c586a5c92e2c53751fa06d8d43e8" +dependencies = [ + "toml_edit 0.20.7", +] + +[[package]] +name = "proc-macro-error" +version = "1.0.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "da25490ff9892aab3fcf7c36f08cfb902dd3e71ca0f9f9517bea02a73a5ce38c" +dependencies = [ + "proc-macro-error-attr", + "proc-macro2", + "quote", + "syn 1.0.109", + "version_check", +] + +[[package]] +name = "proc-macro-error-attr" +version = "1.0.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a1be40180e52ecc98ad80b184934baf3d0d29f979574e439af5a55274b35f869" +dependencies = [ + "proc-macro2", + "quote", + "version_check", +] + +[[package]] +name = "proc-macro-hack" +version = "0.5.20+deprecated" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "dc375e1527247fe1a97d8b7156678dfe7c1af2fc075c9a4db3690ecd2a148068" + +[[package]] +name = "proc-macro2" +version = "1.0.94" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a31971752e70b8b2686d7e46ec17fb38dad4051d94024c88df49b667caea9c84" +dependencies = [ + "unicode-ident", +] + +[[package]] +name = "quick-xml" +version = "0.32.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1d3a6e5838b60e0e8fa7a43f22ade549a37d61f8bdbe636d0d7816191de969c2" +dependencies = [ + "memchr", +] + +[[package]] +name = "quote" +version = "1.0.40" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1885c039570dc00dcb4ff087a89e185fd56bae234ddc7f056a945bf36467248d" +dependencies = [ + "proc-macro2", +] + +[[package]] +name = "r-efi" +version = "5.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "74765f6d916ee2faa39bc8e68e4f3ed8949b48cccdac59983d287a7cb71ce9c5" + +[[package]] +name = "rand" +version = "0.7.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6a6b1679d49b24bbfe0c803429aa1874472f50d9b363131f0e89fc356b544d03" +dependencies = [ + "getrandom 0.1.16", + "libc", + "rand_chacha 0.2.2", + "rand_core 0.5.1", + "rand_hc", + "rand_pcg", +] + +[[package]] +name = "rand" +version = "0.8.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404" +dependencies = [ + "libc", + "rand_chacha 0.3.1", + "rand_core 0.6.4", +] + +[[package]] +name = "rand_chacha" +version = "0.2.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f4c8ed856279c9737206bf725bf36935d8666ead7aa69b52be55af369d193402" +dependencies = [ + "ppv-lite86", + "rand_core 0.5.1", +] + +[[package]] +name = "rand_chacha" +version = "0.3.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88" +dependencies = [ + "ppv-lite86", + "rand_core 0.6.4", +] + +[[package]] +name = "rand_core" +version = "0.5.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "90bde5296fc891b0cef12a6d03ddccc162ce7b2aff54160af9338f8d40df6d19" +dependencies = [ + "getrandom 0.1.16", +] + +[[package]] +name = "rand_core" +version = "0.6.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c" +dependencies = [ + "getrandom 0.2.15", +] + +[[package]] +name = "rand_hc" +version = "0.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ca3129af7b92a17112d59ad498c6f81eaf463253766b90396d39ea7a39d6613c" +dependencies = [ + "rand_core 0.5.1", +] + +[[package]] +name = "rand_pcg" +version = "0.2.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "16abd0c1b639e9eb4d7c50c0b8100b0d0f849be2349829c740fe8e6eb4816429" +dependencies = [ + "rand_core 0.5.1", +] + +[[package]] +name = "raw-window-handle" +version = "0.6.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "20675572f6f24e9e76ef639bc5552774ed45f1c30e2951e1e99c59888861c539" + +[[package]] +name = "redox_syscall" +version = "0.5.11" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d2f103c6d277498fbceb16e84d317e2a400f160f46904d5f5410848c829511a3" +dependencies = [ + "bitflags 2.9.0", +] + +[[package]] +name = "redox_users" +version = "0.5.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "dd6f9d3d47bdd2ad6945c5015a226ec6155d0bcdfd8f7cd29f86b71f8de99d2b" +dependencies = [ + "getrandom 0.2.15", + "libredox", + "thiserror 2.0.12", +] + +[[package]] +name = "regex" +version = "1.11.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b544ef1b4eac5dc2db33ea63606ae9ffcfac26c1416a2806ae0bf5f56b201191" +dependencies = [ + "aho-corasick", + "memchr", + "regex-automata", + "regex-syntax", +] + +[[package]] +name = "regex-automata" +version = "0.4.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "809e8dc61f6de73b46c85f4c96486310fe304c434cfa43669d7b40f711150908" +dependencies = [ + "aho-corasick", + "memchr", + "regex-syntax", +] + +[[package]] +name = "regex-syntax" +version = "0.8.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2b15c43186be67a4fd63bee50d0303afffcef381492ebe2c5d87f324e1b8815c" + +[[package]] +name = "reqwest" +version = "0.13.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "04e9018c9d814e5f30cc16a0f03271aeab3571e609612d9fe78c1aa8d11c2f62" +dependencies = [ + "base64 0.22.1", + "bytes", + "futures-core", + "futures-util", + "http", + "http-body", + "http-body-util", + "hyper", + "hyper-rustls", + "hyper-tls", + "hyper-util", + "js-sys", + "log", + "native-tls", + "percent-encoding", + "pin-project-lite", + "rustls", + "rustls-pki-types", + "rustls-platform-verifier", + "serde", + "serde_json", + "sync_wrapper", + "tokio", + "tokio-native-tls", + "tokio-rustls", + "tokio-util", + "tower", + "tower-http", + "tower-service", + "url", + "wasm-bindgen", + "wasm-bindgen-futures", + "wasm-streams", + "web-sys", +] + +[[package]] +name = "ring" +version = "0.17.14" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7" +dependencies = [ + "cc", + "cfg-if", + "getrandom 0.2.15", + "libc", + "untrusted", + "windows-sys 0.52.0", +] + +[[package]] +name = "rustc-demangle" +version = "0.1.24" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "719b953e2095829ee67db738b3bfa9fa368c94900df327b3f07fe6e794d2fe1f" + +[[package]] +name = "rustc_version" +version = "0.4.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92" +dependencies = [ + "semver", +] + +[[package]] +name = "rustix" +version = "1.1.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "146c9e247ccc180c1f61615433868c99f3de3ae256a30a43b49f67c2d9171f34" +dependencies = [ + "bitflags 2.9.0", + "errno", + "libc", + "linux-raw-sys", + "windows-sys 0.59.0", +] + +[[package]] +name = "rustls" +version = "0.23.28" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7160e3e10bf4535308537f3c4e1641468cd0e485175d6163087c0393c7d46643" +dependencies = [ + "once_cell", + "ring", + "rustls-pki-types", + "rustls-webpki", + "subtle", + "zeroize", +] + +[[package]] +name = "rustls-native-certs" +version = "0.8.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7fcff2dd52b58a8d98a70243663a0d234c4e2b79235637849d15913394a247d3" +dependencies = [ + "openssl-probe", + "rustls-pki-types", + "schannel", + "security-framework 3.5.1", +] + +[[package]] +name = "rustls-pki-types" +version = "1.14.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "be040f8b0a225e40375822a563fa9524378b9d63112f53e19ffff34df5d33fdd" +dependencies = [ + "zeroize", +] + +[[package]] +name = "rustls-platform-verifier" +version = "0.6.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1d99feebc72bae7ab76ba994bb5e121b8d83d910ca40b36e0921f53becc41784" +dependencies = [ + "core-foundation 0.10.0", + "core-foundation-sys", + "jni", + "log", + "once_cell", + "rustls", + "rustls-native-certs", + "rustls-platform-verifier-android", + "rustls-webpki", + "security-framework 3.5.1", + "security-framework-sys", + "webpki-root-certs", + "windows-sys 0.59.0", +] + +[[package]] +name = "rustls-platform-verifier-android" +version = "0.1.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f" + +[[package]] +name = "rustls-webpki" +version = "0.103.10" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "df33b2b81ac578cabaf06b89b0631153a3f416b0a886e8a7a1707fb51abbd1ef" +dependencies = [ + "ring", + "rustls-pki-types", + "untrusted", +] + +[[package]] +name = "rustversion" +version = "1.0.20" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "eded382c5f5f786b989652c49544c4877d9f015cc22e145a5ea8ea66c2921cd2" + +[[package]] +name = "ryu" +version = "1.0.20" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f" + +[[package]] +name = "same-file" +version = "1.0.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502" +dependencies = [ + "winapi-util", +] + +[[package]] +name = "schannel" +version = "0.1.27" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1f29ebaa345f945cec9fbbc532eb307f0fdad8161f281b6369539c8d84876b3d" +dependencies = [ + "windows-sys 0.59.0", +] + +[[package]] +name = "schemars" +version = "0.8.22" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3fbf2ae1b8bc8e02df939598064d22402220cd5bbcca1c76f7d6a310974d5615" +dependencies = [ + "dyn-clone", + "indexmap 1.9.3", + "schemars_derive", + "serde", + "serde_json", + "url", + "uuid", +] + +[[package]] +name = "schemars_derive" +version = "0.8.22" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "32e265784ad618884abaea0600a9adf15393368d840e0222d101a072f3f7534d" +dependencies = [ + "proc-macro2", + "quote", + "serde_derive_internals", + "syn 2.0.100", +] + +[[package]] +name = "scopeguard" +version = "1.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49" + +[[package]] +name = "security-framework" +version = "2.11.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "897b2245f0b511c87893af39b033e5ca9cce68824c4d7e7630b5a1d339658d02" +dependencies = [ + "bitflags 2.9.0", + "core-foundation 0.9.4", + "core-foundation-sys", + "libc", + "security-framework-sys", +] + +[[package]] +name = "security-framework" +version = "3.5.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b3297343eaf830f66ede390ea39da1d462b6b0c1b000f420d0a83f898bbbe6ef" +dependencies = [ + "bitflags 2.9.0", + "core-foundation 0.10.0", + "core-foundation-sys", + "libc", + "security-framework-sys", +] + +[[package]] +name = "security-framework-sys" +version = "2.15.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cc1f0cbffaac4852523ce30d8bd3c5cdc873501d96ff467ca09b6767bb8cd5c0" +dependencies = [ + "core-foundation-sys", + "libc", +] + +[[package]] +name = "selectors" +version = "0.24.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0c37578180969d00692904465fb7f6b3d50b9a2b952b87c23d0e2e5cb5013416" +dependencies = [ + "bitflags 1.3.2", + "cssparser", + "derive_more", + "fxhash", + "log", + "phf 0.8.0", + "phf_codegen 0.8.0", + "precomputed-hash", + "servo_arc", + "smallvec", +] + +[[package]] +name = "semver" +version = "1.0.26" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "56e6fa9c48d24d85fb3de5ad847117517440f6beceb7798af16b4a87d616b8d0" +dependencies = [ + "serde", +] + +[[package]] +name = "serde" +version = "1.0.228" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e" +dependencies = [ + "serde_core", + "serde_derive", +] + +[[package]] +name = "serde-untagged" +version = "0.1.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "299d9c19d7d466db4ab10addd5703e4c615dec2a5a16dbbafe191045e87ee66e" +dependencies = [ + "erased-serde", + "serde", + "typeid", +] + +[[package]] +name = "serde_core" +version = "1.0.228" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad" +dependencies = [ + "serde_derive", +] + +[[package]] +name = "serde_derive" +version = "1.0.228" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.100", +] + +[[package]] +name = "serde_derive_internals" +version = "0.29.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "18d26a20a969b9e3fdf2fc2d9f21eda6c40e2de84c9408bb5d3b05d499aae711" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.100", +] + +[[package]] +name = "serde_json" +version = "1.0.140" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "20068b6e96dc6c9bd23e01df8827e6c7e1f2fddd43c21810382803c136b99373" +dependencies = [ + "itoa", + "memchr", + "ryu", + "serde", +] + +[[package]] +name = "serde_repr" +version = "0.1.20" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "175ee3e80ae9982737ca543e96133087cbd9a485eecc3bc4de9c1a37b47ea59c" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.100", +] + +[[package]] +name = "serde_spanned" +version = "0.6.8" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "87607cb1398ed59d48732e575a4c28a7a8ebf2454b964fe3f224f2afc07909e1" +dependencies = [ + "serde", +] + +[[package]] +name = "serde_spanned" +version = "1.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "40734c41988f7306bb04f0ecf60ec0f3f1caa34290e4e8ea471dcd3346483b83" +dependencies = [ + "serde", +] + +[[package]] +name = "serde_with" +version = "3.12.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d6b6f7f2fcb69f747921f79f3926bd1e203fce4fef62c268dd3abfb6d86029aa" +dependencies = [ + "base64 0.22.1", + "chrono", + "hex", + "indexmap 1.9.3", + "indexmap 2.9.0", + "serde", + "serde_derive", + "serde_json", + "serde_with_macros", + "time", +] + +[[package]] +name = "serde_with_macros" +version = "3.12.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8d00caa5193a3c8362ac2b73be6b9e768aa5a4b2f721d8f4b339600c3cb51f8e" +dependencies = [ + "darling", + "proc-macro2", + "quote", + "syn 2.0.100", +] + +[[package]] +name = "serialize-to-javascript" +version = "0.1.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "04f3666a07a197cdb77cdf306c32be9b7f598d7060d50cfd4d5aa04bfd92f6c5" +dependencies = [ + "serde", + "serde_json", + "serialize-to-javascript-impl", +] + +[[package]] +name = "serialize-to-javascript-impl" +version = "0.1.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "772ee033c0916d670af7860b6e1ef7d658a4629a6d0b4c8c3e67f09b3765b75d" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.100", +] + +[[package]] +name = "servo_arc" +version = "0.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d52aa42f8fdf0fed91e5ce7f23d8138441002fa31dca008acf47e6fd4721f741" +dependencies = [ + "nodrop", + "stable_deref_trait", +] + +[[package]] +name = "sha2" +version = "0.10.8" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "793db75ad2bcafc3ffa7c68b215fee268f537982cd901d132f89c6343f3a3dc8" +dependencies = [ + "cfg-if", + "cpufeatures", + "digest", +] + +[[package]] +name = "shlex" +version = "1.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64" + +[[package]] +name = "simd-adler32" +version = "0.3.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d66dc143e6b11c1eddc06d5c423cfc97062865baf299914ab64caa38182078fe" + +[[package]] +name = "siphasher" +version = "0.3.11" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "38b58827f4464d87d377d175e90bf58eb00fd8716ff0a62f80356b5e61555d0d" + +[[package]] +name = "siphasher" +version = "1.0.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "56199f7ddabf13fe5074ce809e7d3f42b42ae711800501b5b16ea82ad029c39d" + +[[package]] +name = "slab" +version = "0.4.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8f92a496fb766b417c996b9c5e57daf2f7ad3b0bebe1ccfca4856390e3d3bb67" +dependencies = [ + "autocfg", +] + +[[package]] +name = "smallvec" +version = "1.15.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8917285742e9f3e1683f0a9c4e6b57960b7314d0b08d30d1ecd426713ee2eee9" + +[[package]] +name = "socket2" +version = "0.5.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4f5fd57c80058a56cf5c777ab8a126398ece8e442983605d280a44ce79d0edef" +dependencies = [ + "libc", + "windows-sys 0.52.0", +] + +[[package]] +name = "soup3" +version = "0.5.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "471f924a40f31251afc77450e781cb26d55c0b650842efafc9c6cbd2f7cc4f9f" +dependencies = [ + "futures-channel", + "gio", + "glib", + "libc", + "soup3-sys", +] + +[[package]] +name = "soup3-sys" +version = "0.5.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7ebe8950a680a12f24f15ebe1bf70db7af98ad242d9db43596ad3108aab86c27" +dependencies = [ + "gio-sys", + "glib-sys", + "gobject-sys", + "libc", + "system-deps", +] + +[[package]] +name = "stable_deref_trait" +version = "1.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a8f112729512f8e442d81f95a8a7ddf2b7c6b8a1a6f509a95864142b30cab2d3" + +[[package]] +name = "string_cache" +version = "0.8.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bf776ba3fa74f83bf4b63c3dcbbf82173db2632ed8452cb2d891d33f459de70f" +dependencies = [ + "new_debug_unreachable", + "parking_lot", + "phf_shared 0.11.3", + "precomputed-hash", + "serde", +] + +[[package]] +name = "string_cache_codegen" +version = "0.5.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c711928715f1fe0fe509c53b43e993a9a557babc2d0a3567d0a3006f1ac931a0" +dependencies = [ + "phf_generator 0.11.3", + "phf_shared 0.11.3", + "proc-macro2", + "quote", +] + +[[package]] +name = "strsim" +version = "0.11.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f" + +[[package]] +name = "subtle" +version = "2.6.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292" + +[[package]] +name = "swift-rs" +version = "1.0.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4057c98e2e852d51fdcfca832aac7b571f6b351ad159f9eda5db1655f8d0c4d7" +dependencies = [ + "base64 0.21.7", + "serde", + "serde_json", +] + +[[package]] +name = "syn" +version = "1.0.109" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237" +dependencies = [ + "proc-macro2", + "quote", + "unicode-ident", +] + +[[package]] +name = "syn" +version = "2.0.100" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b09a44accad81e1ba1cd74a32461ba89dee89095ba17b32f5d03683b1b1fc2a0" +dependencies = [ + "proc-macro2", + "quote", + "unicode-ident", +] + +[[package]] +name = "sync_wrapper" +version = "1.0.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263" +dependencies = [ + "futures-core", +] + +[[package]] +name = "synstructure" +version = "0.13.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c8af7666ab7b6390ab78131fb5b0fce11d6b7a6951602017c35fa82800708971" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.100", +] + +[[package]] +name = "system-deps" +version = "6.2.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a3e535eb8dded36d55ec13eddacd30dec501792ff23a0b1682c38601b8cf2349" +dependencies = [ + "cfg-expr", + "heck 0.5.0", + "pkg-config", + "toml 0.8.20", + "version-compare", +] + +[[package]] +name = "tar" +version = "0.4.45" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "22692a6476a21fa75fdfc11d452fda482af402c008cdbaf3476414e122040973" +dependencies = [ + "filetime", + "libc", + "xattr", +] + +[[package]] +name = "target-lexicon" +version = "0.12.16" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "61c41af27dd6d1e27b1b16b489db798443478cef1f06a660c96db617ba5de3b1" + +[[package]] +name = "tauri" +version = "2.10.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e19299a5f2ccb6bcb2a38b1eb7999e8bbdbd5bdd3cf74a4f8ab412726cbd65e7" +dependencies = [ + "anyhow", + "bytes", + "cookie", + "dirs", + "dunce", + "embed_plist", + "getrandom 0.3.2", + "glob", + "gtk", + "heck 0.5.0", + "http", + "jni", + "libc", + "log", + "mime", + "muda", + "objc2", + "objc2-app-kit", + "objc2-foundation", + "objc2-ui-kit", + "objc2-web-kit", + "percent-encoding", + "plist", + "raw-window-handle", + "reqwest", + "serde", + "serde_json", + "serde_repr", + "serialize-to-javascript", + "swift-rs", + "tauri-build", + "tauri-macros", + "tauri-runtime", + "tauri-utils", + "thiserror 2.0.12", + "tokio", + "url", + "window-vibrancy", + "windows", +] + +[[package]] +name = "tauri-build" +version = "2.5.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "76809f63061c8b25537b87f46b8733b31397cf419706dc874e1602be6479ba90" +dependencies = [ + "anyhow", + "cargo_toml", + "dirs", + "glob", + "heck 0.5.0", + "json-patch", + "schemars", + "semver", + "serde", + "serde_json", + "tauri-utils", + "tauri-winres", + "toml 0.9.5", + "walkdir", +] + +[[package]] +name = "tauri-codegen" +version = "2.5.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8b2ebe49d690ccaea93aa81fff99277d4f445968f085ba13be67859151e9e4b8" +dependencies = [ + "base64 0.22.1", + "ico", + "json-patch", + "plist", + "png", + "proc-macro2", + "quote", + "semver", + "serde", + "serde_json", + "sha2", + "syn 2.0.100", + "tauri-utils", + "thiserror 2.0.12", + "time", + "url", + "uuid", + "walkdir", +] + +[[package]] +name = "tauri-macros" +version = "2.5.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1119f651b0187c686c0fc72c66bba311e560e1b5f61869086ce788d43be6cf41" +dependencies = [ + "heck 0.5.0", + "proc-macro2", + "quote", + "syn 2.0.100", + "tauri-codegen", + "tauri-utils", +] + +[[package]] +name = "tauri-plugin" +version = "2.5.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "692a77abd8b8773e107a42ec0e05b767b8d2b7ece76ab36c6c3947e34df9f53f" +dependencies = [ + "anyhow", + "glob", + "plist", + "schemars", + "serde", + "serde_json", + "tauri-utils", + "toml 0.9.5", + "walkdir", +] + +[[package]] +name = "tauri-plugin-updater" +version = "2.10.1" +dependencies = [ + "base64 0.22.1", + "dirs", + "flate2", + "futures-util", + "http", + "infer", + "log", + "minisign-verify", + "osakit", + "percent-encoding", + "reqwest", + "rustls", + "semver", + "serde", + "serde_json", + "tar", + "tauri", + "tauri-plugin", + "tempfile", + "thiserror 2.0.12", + "time", + "tokio", + "url", + "windows-sys 0.60.2", + "zip", +] + +[[package]] +name = "tauri-runtime" +version = "2.10.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b885ffeac82b00f1f6fd292b6e5aabfa7435d537cef57d11e38a489956535651" +dependencies = [ + "cookie", + "dpi", + "gtk", + "http", + "jni", + "objc2", + "objc2-ui-kit", + "objc2-web-kit", + "raw-window-handle", + "serde", + "serde_json", + "tauri-utils", + "thiserror 2.0.12", + "url", + "webkit2gtk", + "webview2-com", + "windows", +] + +[[package]] +name = "tauri-utils" +version = "2.8.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "fcd169fccdff05eff2c1033210b9b94acd07a47e6fa9a3431cf09cfd4f01c87e" +dependencies = [ + "anyhow", + "cargo_metadata", + "ctor", + "dunce", + "glob", + "html5ever", + "http", + "infer", + "json-patch", + "kuchikiki", + "log", + "memchr", + "phf 0.11.3", + "proc-macro2", + "quote", + "regex", + "schemars", + "semver", + "serde", + "serde-untagged", + "serde_json", + "serde_with", + "swift-rs", + "thiserror 2.0.12", + "toml 0.9.5", + "url", + "urlpattern", + "uuid", + "walkdir", +] + +[[package]] +name = "tauri-winres" +version = "0.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "56eaa45f707bedf34d19312c26d350bc0f3c59a47e58e8adbeecdc850d2c13a0" +dependencies = [ + "embed-resource", + "toml 0.8.20", +] + +[[package]] +name = "tempfile" +version = "3.24.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "655da9c7eb6305c55742045d5a8d2037996d61d8de95806335c7c86ce0f82e9c" +dependencies = [ + "fastrand", + "getrandom 0.3.2", + "once_cell", + "rustix", + "windows-sys 0.59.0", +] + +[[package]] +name = "tendril" +version = "0.4.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d24a120c5fc464a3458240ee02c299ebcb9d67b5249c8848b09d639dca8d7bb0" +dependencies = [ + "futf", + "mac", + "utf-8", +] + +[[package]] +name = "thiserror" +version = "1.0.69" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52" +dependencies = [ + "thiserror-impl 1.0.69", +] + +[[package]] +name = "thiserror" +version = "2.0.12" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "567b8a2dae586314f7be2a752ec7474332959c6460e02bde30d702a66d488708" +dependencies = [ + "thiserror-impl 2.0.12", +] + +[[package]] +name = "thiserror-impl" +version = "1.0.69" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.100", +] + +[[package]] +name = "thiserror-impl" +version = "2.0.12" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7f7cf42b4507d8ea322120659672cf1b9dbb93f8f2d4ecfd6e51350ff5b17a1d" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.100", +] + +[[package]] +name = "time" +version = "0.3.41" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8a7619e19bc266e0f9c5e6686659d394bc57973859340060a69221e57dbc0c40" +dependencies = [ + "deranged", + "itoa", + "num-conv", + "powerfmt", + "serde", + "time-core", + "time-macros", +] + +[[package]] +name = "time-core" +version = "0.1.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c9e9a38711f559d9e3ce1cdb06dd7c5b8ea546bc90052da6d06bb76da74bb07c" + +[[package]] +name = "time-macros" +version = "0.2.22" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3526739392ec93fd8b359c8e98514cb3e8e021beb4e5f597b00a0221f8ed8a49" +dependencies = [ + "num-conv", + "time-core", +] + +[[package]] +name = "tinystr" +version = "0.7.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9117f5d4db391c1cf6927e7bea3db74b9a1c1add8f7eda9ffd5364f40f57b82f" +dependencies = [ + "displaydoc", + "zerovec", +] + +[[package]] +name = "tokio" +version = "1.44.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e6b88822cbe49de4185e3a4cbf8321dd487cf5fe0c5c65695fef6346371e9c48" +dependencies = [ + "backtrace", + "bytes", + "libc", + "mio", + "pin-project-lite", + "socket2", + "windows-sys 0.52.0", +] + +[[package]] +name = "tokio-native-tls" +version = "0.3.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bbae76ab933c85776efabc971569dd6119c580d8f5d448769dec1764bf796ef2" +dependencies = [ + "native-tls", + "tokio", +] + +[[package]] +name = "tokio-rustls" +version = "0.26.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8e727b36a1a0e8b74c376ac2211e40c2c8af09fb4013c60d910495810f008e9b" +dependencies = [ + "rustls", + "tokio", +] + +[[package]] +name = "tokio-util" +version = "0.7.14" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6b9590b93e6fcc1739458317cccd391ad3955e2bde8913edf6f95f9e65a8f034" +dependencies = [ + "bytes", + "futures-core", + "futures-sink", + "pin-project-lite", + "tokio", +] + +[[package]] +name = "toml" +version = "0.8.20" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cd87a5cdd6ffab733b2f74bc4fd7ee5fff6634124999ac278c35fc78c6120148" +dependencies = [ + "serde", + "serde_spanned 0.6.8", + "toml_datetime 0.6.8", + "toml_edit 0.22.24", +] + +[[package]] +name = "toml" +version = "0.9.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "75129e1dc5000bfbaa9fee9d1b21f974f9fbad9daec557a521ee6e080825f6e8" +dependencies = [ + "indexmap 2.9.0", + "serde", + "serde_spanned 1.0.0", + "toml_datetime 0.7.0", + "toml_parser", + "toml_writer", + "winnow 0.7.12", +] + +[[package]] +name = "toml_datetime" +version = "0.6.8" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0dd7358ecb8fc2f8d014bf86f6f638ce72ba252a2c3a2572f2a795f1d23efb41" +dependencies = [ + "serde", +] + +[[package]] +name = "toml_datetime" +version = "0.7.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bade1c3e902f58d73d3f294cd7f20391c1cb2fbcb643b73566bc773971df91e3" +dependencies = [ + "serde", +] + +[[package]] +name = "toml_edit" +version = "0.19.15" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1b5bb770da30e5cbfde35a2d7b9b8a2c4b8ef89548a7a6aeab5c9a576e3e7421" +dependencies = [ + "indexmap 2.9.0", + "toml_datetime 0.6.8", + "winnow 0.5.40", +] + +[[package]] +name = "toml_edit" +version = "0.20.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "70f427fce4d84c72b5b732388bf4a9f4531b53f74e2887e3ecb2481f68f66d81" +dependencies = [ + "indexmap 2.9.0", + "toml_datetime 0.6.8", + "winnow 0.5.40", +] + +[[package]] +name = "toml_edit" +version = "0.22.24" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "17b4795ff5edd201c7cd6dca065ae59972ce77d1b80fa0a84d94950ece7d1474" +dependencies = [ + "indexmap 2.9.0", + "serde", + "serde_spanned 0.6.8", + "toml_datetime 0.6.8", + "winnow 0.7.12", +] + +[[package]] +name = "toml_parser" +version = "1.0.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b551886f449aa90d4fe2bdaa9f4a2577ad2dde302c61ecf262d80b116db95c10" +dependencies = [ + "winnow 0.7.12", +] + +[[package]] +name = "toml_writer" +version = "1.0.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "fcc842091f2def52017664b53082ecbbeb5c7731092bad69d2c63050401dfd64" + +[[package]] +name = "tower" +version = "0.5.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d039ad9159c98b70ecfd540b2573b97f7f52c3e8d9f8ad57a24b916a536975f9" +dependencies = [ + "futures-core", + "futures-util", + "pin-project-lite", + "sync_wrapper", + "tokio", + "tower-layer", + "tower-service", +] + +[[package]] +name = "tower-http" +version = "0.6.8" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d4e6559d53cc268e5031cd8429d05415bc4cb4aefc4aa5d6cc35fbf5b924a1f8" +dependencies = [ + "bitflags 2.9.0", + "bytes", + "futures-util", + "http", + "http-body", + "iri-string", + "pin-project-lite", + "tower", + "tower-layer", + "tower-service", +] + +[[package]] +name = "tower-layer" +version = "0.3.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e" + +[[package]] +name = "tower-service" +version = "0.3.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3" + +[[package]] +name = "tracing" +version = "0.1.41" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "784e0ac535deb450455cbfa28a6f0df145ea1bb7ae51b821cf5e7927fdcfbdd0" +dependencies = [ + "pin-project-lite", + "tracing-core", +] + +[[package]] +name = "tracing-core" +version = "0.1.33" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e672c95779cf947c5311f83787af4fa8fffd12fb27e4993211a84bdfd9610f9c" +dependencies = [ + "once_cell", +] + +[[package]] +name = "try-lock" +version = "0.2.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b" + +[[package]] +name = "typeid" +version = "1.0.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bc7d623258602320d5c55d1bc22793b57daff0ec7efc270ea7d55ce1d5f5471c" + +[[package]] +name = "typenum" +version = "1.18.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1dccffe3ce07af9386bfd29e80c0ab1a8205a2fc34e4bcd40364df902cfa8f3f" + +[[package]] +name = "unic-char-property" +version = "0.9.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a8c57a407d9b6fa02b4795eb81c5b6652060a15a7903ea981f3d723e6c0be221" +dependencies = [ + "unic-char-range", +] + +[[package]] +name = "unic-char-range" +version = "0.9.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0398022d5f700414f6b899e10b8348231abf9173fa93144cbc1a43b9793c1fbc" + +[[package]] +name = "unic-common" +version = "0.9.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "80d7ff825a6a654ee85a63e80f92f054f904f21e7d12da4e22f9834a4aaa35bc" + +[[package]] +name = "unic-ucd-ident" +version = "0.9.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e230a37c0381caa9219d67cf063aa3a375ffed5bf541a452db16e744bdab6987" +dependencies = [ + "unic-char-property", + "unic-char-range", + "unic-ucd-version", +] + +[[package]] +name = "unic-ucd-version" +version = "0.9.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "96bd2f2237fe450fcd0a1d2f5f4e91711124f7857ba2e964247776ebeeb7b0c4" +dependencies = [ + "unic-common", +] + +[[package]] +name = "unicode-ident" +version = "1.0.18" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5a5f39404a5da50712a4c1eecf25e90dd62b613502b7e925fd4e4d19b5c96512" + +[[package]] +name = "unicode-segmentation" +version = "1.12.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f6ccf251212114b54433ec949fd6a7841275f9ada20dddd2f29e9ceea4501493" + +[[package]] +name = "untrusted" +version = "0.9.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1" + +[[package]] +name = "url" +version = "2.5.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "32f8b686cadd1473f4bd0117a5d28d36b1ade384ea9b5069a1c40aefed7fda60" +dependencies = [ + "form_urlencoded", + "idna", + "percent-encoding", + "serde", +] + +[[package]] +name = "urlpattern" +version = "0.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "70acd30e3aa1450bc2eece896ce2ad0d178e9c079493819301573dae3c37ba6d" +dependencies = [ + "regex", + "serde", + "unic-ucd-ident", + "url", +] + +[[package]] +name = "utf-8" +version = "0.7.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "09cc8ee72d2a9becf2f2febe0205bbed8fc6615b7cb429ad062dc7b7ddd036a9" + +[[package]] +name = "utf16_iter" +version = "1.0.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c8232dd3cdaed5356e0f716d285e4b40b932ac434100fe9b7e0e8e935b9e6246" + +[[package]] +name = "utf8_iter" +version = "1.0.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be" + +[[package]] +name = "uuid" +version = "1.19.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e2e054861b4bd027cd373e18e8d8d8e6548085000e41290d95ce0c373a654b4a" +dependencies = [ + "getrandom 0.3.2", + "js-sys", + "serde_core", + "wasm-bindgen", +] + +[[package]] +name = "vcpkg" +version = "0.2.15" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426" + +[[package]] +name = "version-compare" +version = "0.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "852e951cb7832cb45cb1169900d19760cfa39b82bc0ea9c0e5a14ae88411c98b" + +[[package]] +name = "version_check" +version = "0.9.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a" + +[[package]] +name = "vswhom" +version = "0.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "be979b7f07507105799e854203b470ff7c78a1639e330a58f183b5fea574608b" +dependencies = [ + "libc", + "vswhom-sys", +] + +[[package]] +name = "vswhom-sys" +version = "0.1.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "fb067e4cbd1ff067d1df46c9194b5de0e98efd2810bbc95c5d5e5f25a3231150" +dependencies = [ + "cc", + "libc", +] + +[[package]] +name = "walkdir" +version = "2.5.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b" +dependencies = [ + "same-file", + "winapi-util", +] + +[[package]] +name = "want" +version = "0.3.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e" +dependencies = [ + "try-lock", +] + +[[package]] +name = "wasi" +version = "0.9.0+wasi-snapshot-preview1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cccddf32554fecc6acb585f82a32a72e28b48f8c4c1883ddfeeeaa96f7d8e519" + +[[package]] +name = "wasi" +version = "0.11.0+wasi-snapshot-preview1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423" + +[[package]] +name = "wasi" +version = "0.14.2+wasi-0.2.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9683f9a5a998d873c0d21fcbe3c083009670149a8fab228644b8bd36b2c48cb3" +dependencies = [ + "wit-bindgen-rt", +] + +[[package]] +name = "wasm-bindgen" +version = "0.2.100" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1edc8929d7499fc4e8f0be2262a241556cfc54a0bea223790e71446f2aab1ef5" +dependencies = [ + "cfg-if", + "once_cell", + "rustversion", + "wasm-bindgen-macro", +] + +[[package]] +name = "wasm-bindgen-backend" +version = "0.2.100" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2f0a0651a5c2bc21487bde11ee802ccaf4c51935d0d3d42a6101f98161700bc6" +dependencies = [ + "bumpalo", + "log", + "proc-macro2", + "quote", + "syn 2.0.100", + "wasm-bindgen-shared", +] + +[[package]] +name = "wasm-bindgen-futures" +version = "0.4.50" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "555d470ec0bc3bb57890405e5d4322cc9ea83cebb085523ced7be4144dac1e61" +dependencies = [ + "cfg-if", + "js-sys", + "once_cell", + "wasm-bindgen", + "web-sys", +] + +[[package]] +name = "wasm-bindgen-macro" +version = "0.2.100" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7fe63fc6d09ed3792bd0897b314f53de8e16568c2b3f7982f468c0bf9bd0b407" +dependencies = [ + "quote", + "wasm-bindgen-macro-support", +] + +[[package]] +name = "wasm-bindgen-macro-support" +version = "0.2.100" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8ae87ea40c9f689fc23f209965b6fb8a99ad69aeeb0231408be24920604395de" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.100", + "wasm-bindgen-backend", + "wasm-bindgen-shared", +] + +[[package]] +name = "wasm-bindgen-shared" +version = "0.2.100" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1a05d73b933a847d6cccdda8f838a22ff101ad9bf93e33684f39c1f5f0eece3d" +dependencies = [ + "unicode-ident", +] + +[[package]] +name = "wasm-streams" +version = "0.4.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "15053d8d85c7eccdbefef60f06769760a563c7f0a9d6902a13d35c7800b0ad65" +dependencies = [ + "futures-util", + "js-sys", + "wasm-bindgen", + "wasm-bindgen-futures", + "web-sys", +] + +[[package]] +name = "web-sys" +version = "0.3.77" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "33b6dd2ef9186f1f2072e409e99cd22a975331a6b3591b12c764e0e55c60d5d2" +dependencies = [ + "js-sys", + "wasm-bindgen", +] + +[[package]] +name = "webkit2gtk" +version = "2.0.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a1027150013530fb2eaf806408df88461ae4815a45c541c8975e61d6f2fc4793" +dependencies = [ + "bitflags 1.3.2", + "cairo-rs", + "gdk", + "gdk-sys", + "gio", + "gio-sys", + "glib", + "glib-sys", + "gobject-sys", + "gtk", + "gtk-sys", + "javascriptcore-rs", + "libc", + "once_cell", + "soup3", + "webkit2gtk-sys", +] + +[[package]] +name = "webkit2gtk-sys" +version = "2.0.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "916a5f65c2ef0dfe12fff695960a2ec3d4565359fdbb2e9943c974e06c734ea5" +dependencies = [ + "bitflags 1.3.2", + "cairo-sys-rs", + "gdk-sys", + "gio-sys", + "glib-sys", + "gobject-sys", + "gtk-sys", + "javascriptcore-rs-sys", + "libc", + "pkg-config", + "soup3-sys", + "system-deps", +] + +[[package]] +name = "webpki-root-certs" +version = "1.0.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "36a29fc0408b113f68cf32637857ab740edfafdf460c326cd2afaa2d84cc05dc" +dependencies = [ + "rustls-pki-types", +] + +[[package]] +name = "webview2-com" +version = "0.38.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d4ba622a989277ef3886dd5afb3e280e3dd6d974b766118950a08f8f678ad6a4" +dependencies = [ + "webview2-com-macros", + "webview2-com-sys", + "windows", + "windows-core", + "windows-implement", + "windows-interface", +] + +[[package]] +name = "webview2-com-macros" +version = "0.8.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1d228f15bba3b9d56dde8bddbee66fa24545bd17b48d5128ccf4a8742b18e431" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.100", +] + +[[package]] +name = "webview2-com-sys" +version = "0.38.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "36695906a1b53a3bf5c4289621efedac12b73eeb0b89e7e1a89b517302d5d75c" +dependencies = [ + "thiserror 2.0.12", + "windows", + "windows-core", +] + +[[package]] +name = "winapi" +version = "0.3.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419" +dependencies = [ + "winapi-i686-pc-windows-gnu", + "winapi-x86_64-pc-windows-gnu", +] + +[[package]] +name = "winapi-i686-pc-windows-gnu" +version = "0.4.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6" + +[[package]] +name = "winapi-util" +version = "0.1.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cf221c93e13a30d793f7645a0e7762c55d169dbb0a49671918a2319d289b10bb" +dependencies = [ + "windows-sys 0.48.0", +] + +[[package]] +name = "winapi-x86_64-pc-windows-gnu" +version = "0.4.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f" + +[[package]] +name = "window-vibrancy" +version = "0.6.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d9bec5a31f3f9362f2258fd0e9c9dd61a9ca432e7306cc78c444258f0dce9a9c" +dependencies = [ + "objc2", + "objc2-app-kit", + "objc2-core-foundation", + "objc2-foundation", + "raw-window-handle", + "windows-sys 0.59.0", + "windows-version", +] + +[[package]] +name = "windows" +version = "0.61.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c5ee8f3d025738cb02bad7868bbb5f8a6327501e870bf51f1b455b0a2454a419" +dependencies = [ + "windows-collections", + "windows-core", + "windows-future", + "windows-link", + "windows-numerics", +] + +[[package]] +name = "windows-collections" +version = "0.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3beeceb5e5cfd9eb1d76b381630e82c4241ccd0d27f1a39ed41b2760b255c5e8" +dependencies = [ + "windows-core", +] + +[[package]] +name = "windows-core" +version = "0.61.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4763c1de310c86d75a878046489e2e5ba02c649d185f21c67d4cf8a56d098980" +dependencies = [ + "windows-implement", + "windows-interface", + "windows-link", + "windows-result", + "windows-strings", +] + +[[package]] +name = "windows-future" +version = "0.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7a1d6bbefcb7b60acd19828e1bc965da6fcf18a7e39490c5f8be71e54a19ba32" +dependencies = [ + "windows-core", + "windows-link", +] + +[[package]] +name = "windows-implement" +version = "0.60.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a47fddd13af08290e67f4acabf4b459f647552718f683a7b415d290ac744a836" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.100", +] + +[[package]] +name = "windows-interface" +version = "0.59.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bd9211b69f8dcdfa817bfd14bf1c97c9188afa36f4750130fcdf3f400eca9fa8" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.100", +] + +[[package]] +name = "windows-link" +version = "0.1.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "76840935b766e1b0a05c0066835fb9ec80071d4c09a16f6bd5f7e655e3c14c38" + +[[package]] +name = "windows-numerics" +version = "0.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9150af68066c4c5c07ddc0ce30421554771e528bde427614c61038bc2c92c2b1" +dependencies = [ + "windows-core", + "windows-link", +] + +[[package]] +name = "windows-result" +version = "0.3.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c64fd11a4fd95df68efcfee5f44a294fe71b8bc6a91993e2791938abcc712252" +dependencies = [ + "windows-link", +] + +[[package]] +name = "windows-strings" +version = "0.4.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7a2ba9642430ee452d5a7aa78d72907ebe8cfda358e8cb7918a2050581322f97" +dependencies = [ + "windows-link", +] + +[[package]] +name = "windows-sys" +version = "0.45.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "75283be5efb2831d37ea142365f009c02ec203cd29a3ebecbc093d52315b66d0" +dependencies = [ + "windows-targets 0.42.2", +] + +[[package]] +name = "windows-sys" +version = "0.48.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9" +dependencies = [ + "windows-targets 0.48.5", +] + +[[package]] +name = "windows-sys" +version = "0.52.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d" +dependencies = [ + "windows-targets 0.52.6", +] + +[[package]] +name = "windows-sys" +version = "0.59.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b" +dependencies = [ + "windows-targets 0.52.6", +] + +[[package]] +name = "windows-sys" +version = "0.60.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb" +dependencies = [ + "windows-targets 0.53.2", +] + +[[package]] +name = "windows-targets" +version = "0.42.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8e5180c00cd44c9b1c88adb3693291f1cd93605ded80c250a75d472756b4d071" +dependencies = [ + "windows_aarch64_gnullvm 0.42.2", + "windows_aarch64_msvc 0.42.2", + "windows_i686_gnu 0.42.2", + "windows_i686_msvc 0.42.2", + "windows_x86_64_gnu 0.42.2", + "windows_x86_64_gnullvm 0.42.2", + "windows_x86_64_msvc 0.42.2", +] + +[[package]] +name = "windows-targets" +version = "0.48.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c" +dependencies = [ + "windows_aarch64_gnullvm 0.48.5", + "windows_aarch64_msvc 0.48.5", + "windows_i686_gnu 0.48.5", + "windows_i686_msvc 0.48.5", + "windows_x86_64_gnu 0.48.5", + "windows_x86_64_gnullvm 0.48.5", + "windows_x86_64_msvc 0.48.5", +] + +[[package]] +name = "windows-targets" +version = "0.52.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973" +dependencies = [ + "windows_aarch64_gnullvm 0.52.6", + "windows_aarch64_msvc 0.52.6", + "windows_i686_gnu 0.52.6", + "windows_i686_gnullvm 0.52.6", + "windows_i686_msvc 0.52.6", + "windows_x86_64_gnu 0.52.6", + "windows_x86_64_gnullvm 0.52.6", + "windows_x86_64_msvc 0.52.6", +] + +[[package]] +name = "windows-targets" +version = "0.53.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c66f69fcc9ce11da9966ddb31a40968cad001c5bedeb5c2b82ede4253ab48aef" +dependencies = [ + "windows_aarch64_gnullvm 0.53.0", + "windows_aarch64_msvc 0.53.0", + "windows_i686_gnu 0.53.0", + "windows_i686_gnullvm 0.53.0", + "windows_i686_msvc 0.53.0", + "windows_x86_64_gnu 0.53.0", + "windows_x86_64_gnullvm 0.53.0", + "windows_x86_64_msvc 0.53.0", +] + +[[package]] +name = "windows-version" +version = "0.1.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e04a5c6627e310a23ad2358483286c7df260c964eb2d003d8efd6d0f4e79265c" +dependencies = [ + "windows-link", +] + +[[package]] +name = "windows_aarch64_gnullvm" +version = "0.42.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "597a5118570b68bc08d8d59125332c54f1ba9d9adeedeef5b99b02ba2b0698f8" + +[[package]] +name = "windows_aarch64_gnullvm" +version = "0.48.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8" + +[[package]] +name = "windows_aarch64_gnullvm" +version = "0.52.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3" + +[[package]] +name = "windows_aarch64_gnullvm" +version = "0.53.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "86b8d5f90ddd19cb4a147a5fa63ca848db3df085e25fee3cc10b39b6eebae764" + +[[package]] +name = "windows_aarch64_msvc" +version = "0.42.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e08e8864a60f06ef0d0ff4ba04124db8b0fb3be5776a5cd47641e942e58c4d43" + +[[package]] +name = "windows_aarch64_msvc" +version = "0.48.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc" + +[[package]] +name = "windows_aarch64_msvc" +version = "0.52.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469" + +[[package]] +name = "windows_aarch64_msvc" +version = "0.53.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c7651a1f62a11b8cbd5e0d42526e55f2c99886c77e007179efff86c2b137e66c" + +[[package]] +name = "windows_i686_gnu" +version = "0.42.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c61d927d8da41da96a81f029489353e68739737d3beca43145c8afec9a31a84f" + +[[package]] +name = "windows_i686_gnu" +version = "0.48.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e" + +[[package]] +name = "windows_i686_gnu" +version = "0.52.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b" + +[[package]] +name = "windows_i686_gnu" +version = "0.53.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c1dc67659d35f387f5f6c479dc4e28f1d4bb90ddd1a5d3da2e5d97b42d6272c3" + +[[package]] +name = "windows_i686_gnullvm" +version = "0.52.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66" + +[[package]] +name = "windows_i686_gnullvm" +version = "0.53.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9ce6ccbdedbf6d6354471319e781c0dfef054c81fbc7cf83f338a4296c0cae11" + +[[package]] +name = "windows_i686_msvc" +version = "0.42.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "44d840b6ec649f480a41c8d80f9c65108b92d89345dd94027bfe06ac444d1060" + +[[package]] +name = "windows_i686_msvc" +version = "0.48.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406" + +[[package]] +name = "windows_i686_msvc" +version = "0.52.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66" + +[[package]] +name = "windows_i686_msvc" +version = "0.53.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "581fee95406bb13382d2f65cd4a908ca7b1e4c2f1917f143ba16efe98a589b5d" + +[[package]] +name = "windows_x86_64_gnu" +version = "0.42.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8de912b8b8feb55c064867cf047dda097f92d51efad5b491dfb98f6bbb70cb36" + +[[package]] +name = "windows_x86_64_gnu" +version = "0.48.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e" + +[[package]] +name = "windows_x86_64_gnu" +version = "0.52.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78" + +[[package]] +name = "windows_x86_64_gnu" +version = "0.53.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2e55b5ac9ea33f2fc1716d1742db15574fd6fc8dadc51caab1c16a3d3b4190ba" + +[[package]] +name = "windows_x86_64_gnullvm" +version = "0.42.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "26d41b46a36d453748aedef1486d5c7a85db22e56aff34643984ea85514e94a3" + +[[package]] +name = "windows_x86_64_gnullvm" +version = "0.48.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc" + +[[package]] +name = "windows_x86_64_gnullvm" +version = "0.52.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d" + +[[package]] +name = "windows_x86_64_gnullvm" +version = "0.53.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0a6e035dd0599267ce1ee132e51c27dd29437f63325753051e71dd9e42406c57" + +[[package]] +name = "windows_x86_64_msvc" +version = "0.42.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9aec5da331524158c6d1a4ac0ab1541149c0b9505fde06423b02f5ef0106b9f0" + +[[package]] +name = "windows_x86_64_msvc" +version = "0.48.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538" + +[[package]] +name = "windows_x86_64_msvc" +version = "0.52.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec" + +[[package]] +name = "windows_x86_64_msvc" +version = "0.53.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "271414315aff87387382ec3d271b52d7ae78726f5d44ac98b4f4030c91880486" + +[[package]] +name = "winnow" +version = "0.5.40" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f593a95398737aeed53e489c785df13f3618e41dbcd6718c6addbf1395aa6876" +dependencies = [ + "memchr", +] + +[[package]] +name = "winnow" +version = "0.7.12" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f3edebf492c8125044983378ecb5766203ad3b4c2f7a922bd7dd207f6d443e95" +dependencies = [ + "memchr", +] + +[[package]] +name = "winreg" +version = "0.52.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a277a57398d4bfa075df44f501a17cfdf8542d224f0d36095a2adc7aee4ef0a5" +dependencies = [ + "cfg-if", + "windows-sys 0.48.0", +] + +[[package]] +name = "wit-bindgen-rt" +version = "0.39.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6f42320e61fe2cfd34354ecb597f86f413484a798ba44a8ca1165c58d42da6c1" +dependencies = [ + "bitflags 2.9.0", +] + +[[package]] +name = "write16" +version = "1.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d1890f4022759daae28ed4fe62859b1236caebfc61ede2f63ed4e695f3f6d936" + +[[package]] +name = "writeable" +version = "0.5.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1e9df38ee2d2c3c5948ea468a8406ff0db0b29ae1ffde1bcf20ef305bcc95c51" + +[[package]] +name = "xattr" +version = "1.5.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0d65cbf2f12c15564212d48f4e3dfb87923d25d611f2aed18f4cb23f0413d89e" +dependencies = [ + "libc", + "rustix", +] + +[[package]] +name = "yoke" +version = "0.7.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "120e6aef9aa629e3d4f52dc8cc43a015c7724194c97dfaf45180d2daf2b77f40" +dependencies = [ + "serde", + "stable_deref_trait", + "yoke-derive", + "zerofrom", +] + +[[package]] +name = "yoke-derive" +version = "0.7.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2380878cad4ac9aac1e2435f3eb4020e8374b5f13c296cb75b4620ff8e229154" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.100", + "synstructure", +] + +[[package]] +name = "zerocopy" +version = "0.8.24" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2586fea28e186957ef732a5f8b3be2da217d65c5969d4b1e17f973ebbe876879" +dependencies = [ + "zerocopy-derive", +] + +[[package]] +name = "zerocopy-derive" +version = "0.8.24" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a996a8f63c5c4448cd959ac1bab0aaa3306ccfd060472f85943ee0750f0169be" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.100", +] + +[[package]] +name = "zerofrom" +version = "0.1.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cff3ee08c995dee1859d998dea82f7374f2826091dd9cd47def953cae446cd2e" +dependencies = [ + "zerofrom-derive", +] + +[[package]] +name = "zerofrom-derive" +version = "0.1.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d71e5d6e06ab090c67b5e44993ec16b72dcbaabc526db883a360057678b48502" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.100", + "synstructure", +] + +[[package]] +name = "zeroize" +version = "1.8.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ced3678a2879b30306d323f4542626697a464a97c0a07c9aebf7ebca65cd4dde" + +[[package]] +name = "zerovec" +version = "0.10.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "aa2b893d79df23bfb12d5461018d408ea19dfafe76c2c7ef6d4eba614f8ff079" +dependencies = [ + "yoke", + "zerofrom", + "zerovec-derive", +] + +[[package]] +name = "zerovec-derive" +version = "0.10.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6eafa6dfb17584ea3e2bd6e76e0cc15ad7af12b09abdd1ca55961bed9b1063c6" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.100", +] + +[[package]] +name = "zip" +version = "4.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "153a6fff49d264c4babdcfa6b4d534747f520e56e8f0f384f3b808c4b64cc1fd" +dependencies = [ + "arbitrary", + "crc32fast", + "indexmap 2.9.0", + "memchr", +] diff --git a/vendor/tauri-plugin-updater-2.10.1/Cargo.toml b/vendor/tauri-plugin-updater-2.10.1/Cargo.toml new file mode 100644 index 0000000..f33dec5 --- /dev/null +++ b/vendor/tauri-plugin-updater-2.10.1/Cargo.toml @@ -0,0 +1,185 @@ +# THIS FILE IS AUTOMATICALLY GENERATED BY CARGO +# +# When uploading crates to the registry Cargo will automatically +# "normalize" Cargo.toml files for maximal compatibility +# with all versions of Cargo and also rewrite `path` dependencies +# to registry (e.g., crates.io) dependencies. +# +# If you are reading this file be aware that the original Cargo.toml +# will likely look very different (and much more reasonable). +# See Cargo.toml.orig for the original contents. + +[package] +edition = "2021" +rust-version = "1.77.2" +name = "tauri-plugin-updater" +version = "2.10.1" +authors = ["Tauri Programme within The Commons Conservancy"] +build = "build.rs" +links = "tauri-plugin-updater" +autolib = false +autobins = false +autoexamples = false +autotests = false +autobenches = false +description = "In-app updates for Tauri applications." +readme = "README.md" +license = "Apache-2.0 OR MIT" +repository = "https://github.com/tauri-apps/plugins-workspace" + +[package.metadata.docs.rs] +no-default-features = true +features = ["zip"] + +[package.metadata.platforms.support.windows] +level = "full" +notes = "" + +[package.metadata.platforms.support.linux] +level = "full" +notes = "" + +[package.metadata.platforms.support.macos] +level = "full" +notes = "" + +[package.metadata.platforms.support.android] +level = "none" +notes = "" + +[package.metadata.platforms.support.ios] +level = "none" +notes = "" + +[features] +default = [ + "rustls-tls", + "zip", +] +native-tls = ["reqwest/native-tls"] +native-tls-vendored = ["reqwest/native-tls-vendored"] +rustls-tls = [ + "reqwest/rustls-no-provider", + "dep:rustls", +] +zip = [ + "dep:zip", + "dep:tar", + "dep:flate2", +] + +[lib] +name = "tauri_plugin_updater" +path = "src/lib.rs" + +[dependencies.base64] +version = "0.22" + +[dependencies.futures-util] +version = "0.3" + +[dependencies.http] +version = "1" + +[dependencies.infer] +version = "0.19" + +[dependencies.log] +version = "0.4" + +[dependencies.minisign-verify] +version = "0.2" + +[dependencies.percent-encoding] +version = "2.3" + +[dependencies.reqwest] +version = "0.13" +features = [ + "json", + "stream", +] +default-features = false + +[dependencies.rustls] +version = "0.23" +features = ["ring"] +optional = true +default-features = false + +[dependencies.semver] +version = "1" +features = ["serde"] + +[dependencies.serde] +version = "1" +features = ["derive"] + +[dependencies.serde_json] +version = "1" + +[dependencies.tauri] +version = "2.10" +default-features = false + +[dependencies.tempfile] +version = "3.20" + +[dependencies.thiserror] +version = "2" + +[dependencies.time] +version = "0.3" +features = [ + "parsing", + "formatting", +] + +[dependencies.tokio] +version = "1" + +[dependencies.url] +version = "2" + +[build-dependencies.tauri-plugin] +version = "2.5" +features = ["build"] + +[dev-dependencies.tauri] +version = "2.10" +features = ["test"] +default-features = false + +[target.'cfg(target_os = "linux")'.dependencies.dirs] +version = "6" + +[target.'cfg(target_os = "linux")'.dependencies.flate2] +version = "1" +optional = true + +[target.'cfg(target_os = "linux")'.dependencies.tar] +version = "0.4" +optional = true + +[target.'cfg(target_os = "macos")'.dependencies.flate2] +version = "1" + +[target.'cfg(target_os = "macos")'.dependencies.osakit] +version = "0.3" +features = ["full"] + +[target.'cfg(target_os = "macos")'.dependencies.tar] +version = "0.4" + +[target.'cfg(target_os = "windows")'.dependencies.windows-sys] +version = "0.60.0" +features = [ + "Win32_Foundation", + "Win32_UI_WindowsAndMessaging", + "Win32_UI_Shell", +] + +[target.'cfg(target_os = "windows")'.dependencies.zip] +version = "4" +optional = true +default-features = false diff --git a/vendor/tauri-plugin-updater-2.10.1/Cargo.toml.orig b/vendor/tauri-plugin-updater-2.10.1/Cargo.toml.orig new file mode 100644 index 0000000..3324825 --- /dev/null +++ b/vendor/tauri-plugin-updater-2.10.1/Cargo.toml.orig @@ -0,0 +1,74 @@ +[package] +name = "tauri-plugin-updater" +version = "2.10.1" +description = "In-app updates for Tauri applications." +edition = { workspace = true } +authors = { workspace = true } +license = { workspace = true } +rust-version = { workspace = true } +repository = { workspace = true } +links = "tauri-plugin-updater" + +[package.metadata.docs.rs] +no-default-features = true +features = ["zip"] + +[package.metadata.platforms.support] +windows = { level = "full", notes = "" } +linux = { level = "full", notes = "" } +macos = { level = "full", notes = "" } +android = { level = "none", notes = "" } +ios = { level = "none", notes = "" } + +[build-dependencies] +tauri-plugin = { workspace = true, features = ["build"] } + +[dependencies] +tauri = { workspace = true } +serde = { workspace = true } +serde_json = { workspace = true } +thiserror = { workspace = true } +log = { workspace = true } +tokio = "1" +reqwest = { version = "0.13", default-features = false, features = [ + "json", + "stream", +] } +rustls = { version = "0.23", default-features = false, features = [ + "ring", +], optional = true } +url = { workspace = true } +http = "1" +minisign-verify = "0.2" +time = { version = "0.3", features = ["parsing", "formatting"] } +base64 = "0.22" +semver = { version = "1", features = ["serde"] } +futures-util = "0.3" +tempfile = "3.20" +infer = "0.19" +percent-encoding = "2.3" + +[target."cfg(target_os = \"windows\")".dependencies] +zip = { version = "4", default-features = false, optional = true } +windows-sys = { version = "0.60.0", features = [ + "Win32_Foundation", + "Win32_UI_WindowsAndMessaging", + "Win32_UI_Shell", +] } + +[target."cfg(target_os = \"linux\")".dependencies] +dirs = "6" +tar = { version = "0.4", optional = true } +flate2 = { version = "1", optional = true } + +[target."cfg(target_os = \"macos\")".dependencies] +tar = "0.4" +flate2 = "1" +osakit = { version = "0.3", features = ["full"] } + +[features] +default = ["rustls-tls", "zip"] +zip = ["dep:zip", "dep:tar", "dep:flate2"] +native-tls = ["reqwest/native-tls"] +native-tls-vendored = ["reqwest/native-tls-vendored"] +rustls-tls = ["reqwest/rustls-no-provider", "dep:rustls"] diff --git a/vendor/tauri-plugin-updater-2.10.1/LICENSE.spdx b/vendor/tauri-plugin-updater-2.10.1/LICENSE.spdx new file mode 100644 index 0000000..cdd0df5 --- /dev/null +++ b/vendor/tauri-plugin-updater-2.10.1/LICENSE.spdx @@ -0,0 +1,20 @@ +SPDXVersion: SPDX-2.1 +DataLicense: CC0-1.0 +PackageName: tauri +DataFormat: SPDXRef-1 +PackageSupplier: Organization: The Tauri Programme in the Commons Conservancy +PackageHomePage: https://tauri.app +PackageLicenseDeclared: Apache-2.0 +PackageLicenseDeclared: MIT +PackageCopyrightText: 2019-2022, The Tauri Programme in the Commons Conservancy +PackageSummary: Tauri is a rust project that enables developers to make secure +and small desktop applications using a web frontend. + +PackageComment: The package includes the following libraries; see +Relationship information. + +Created: 2019-05-20T09:00:00Z +PackageDownloadLocation: git://github.com/tauri-apps/tauri +PackageDownloadLocation: git+https://github.com/tauri-apps/tauri.git +PackageDownloadLocation: git+ssh://github.com/tauri-apps/tauri.git +Creator: Person: Daniel Thompson-Yvetot \ No newline at end of file diff --git a/vendor/tauri-plugin-updater-2.10.1/LICENSE_APACHE-2.0 b/vendor/tauri-plugin-updater-2.10.1/LICENSE_APACHE-2.0 new file mode 100644 index 0000000..4947287 --- /dev/null +++ b/vendor/tauri-plugin-updater-2.10.1/LICENSE_APACHE-2.0 @@ -0,0 +1,177 @@ + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS \ No newline at end of file diff --git a/vendor/tauri-plugin-updater-2.10.1/LICENSE_MIT b/vendor/tauri-plugin-updater-2.10.1/LICENSE_MIT new file mode 100644 index 0000000..4d75472 --- /dev/null +++ b/vendor/tauri-plugin-updater-2.10.1/LICENSE_MIT @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2017 - Present Tauri Apps Contributors + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. \ No newline at end of file diff --git a/vendor/tauri-plugin-updater-2.10.1/README.md b/vendor/tauri-plugin-updater-2.10.1/README.md new file mode 100644 index 0000000..b3afb81 --- /dev/null +++ b/vendor/tauri-plugin-updater-2.10.1/README.md @@ -0,0 +1,102 @@ +![plugin-updater](https://github.com/tauri-apps/plugins-workspace/raw/v2/plugins/updater/banner.png) + +In-app updates for Tauri applications. + +| Platform | Supported | +| -------- | --------- | +| Linux | ✓ | +| Windows | ✓ | +| macOS | ✓ | +| Android | x | +| iOS | x | + +## Install + +_This plugin requires a Rust version of at least **1.77.2**_ + +There are three general methods of installation that we can recommend. + +1. Use crates.io and npm (easiest, and requires you to trust that our publishing pipeline worked) +2. Pull sources directly from Github using git tags / revision hashes (most secure) +3. Git submodule install this repo in your tauri project and then use file protocol to ingest the source (most secure, but inconvenient to use) + +Install the Core plugin by adding the following to your `Cargo.toml` file: + +`src-tauri/Cargo.toml` + +```toml +# you can add the dependencies on the `[dependencies]` section if you do not target mobile +[target."cfg(not(any(target_os = \"android\", target_os = \"ios\")))".dependencies] +tauri-plugin-updater = "2.0.0" +# alternatively with Git: +tauri-plugin-updater = { git = "https://github.com/tauri-apps/plugins-workspace", branch = "v2" } +``` + +You can install the JavaScript Guest bindings using your preferred JavaScript package manager: + +```sh +pnpm add @tauri-apps/plugin-updater +# or +npm add @tauri-apps/plugin-updater +# or +yarn add @tauri-apps/plugin-updater +``` + +## Usage + +First you need to register the core plugin with Tauri: + +`src-tauri/src/lib.rs` + +```rust +fn main() { + tauri::Builder::default() + .setup(|app| { + #[cfg(desktop)] + app.handle().plugin(tauri_plugin_updater::Builder::new().build())?; + Ok(()) + }) + .run(tauri::generate_context!()) + .expect("error while running tauri application"); +} +``` + +Afterwards all the plugin's APIs are available through the JavaScript guest bindings: + +```javascript +import { check } from '@tauri-apps/plugin-updater' +import { relaunch } from '@tauri-apps/plugin-process' +const update = await check() +if (update) { + await update.downloadAndInstall() + await relaunch() +} +``` + +Note that for these APIs to work you have to properly configure the updater first and generate updater artifacts. Please refer to the [guide on our website](https://v2.tauri.app/plugin/updater/) for this. + +## Contributing + +PRs accepted. Please make sure to read the Contributing Guide before making a pull request. + +## Partners + + + + + + + +
+ + CrabNebula + +
+ +For the complete list of sponsors please visit our [website](https://tauri.app#sponsors) and [Open Collective](https://opencollective.com/tauri). + +## License + +Code: (c) 2015 - Present - The Tauri Programme within The Commons Conservancy. + +MIT or MIT/Apache 2.0 where applicable. diff --git a/vendor/tauri-plugin-updater-2.10.1/SECURITY.md b/vendor/tauri-plugin-updater-2.10.1/SECURITY.md new file mode 100644 index 0000000..4f09bba --- /dev/null +++ b/vendor/tauri-plugin-updater-2.10.1/SECURITY.md @@ -0,0 +1,23 @@ +# Security Policy + +**Do not report security vulnerabilities through public GitHub issues.** + +**Please use the [Private Vulnerability Disclosure](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability#privately-reporting-a-security-vulnerability) feature of GitHub.** + +Include as much of the following information: + +- Type of issue (e.g. improper input parsing, privilege escalation, etc.) +- The location of the affected source code (tag/branch/commit or direct URL) +- Any special configuration required to reproduce the issue +- The distribution affected or used to help us with reproduction of the issue +- Step-by-step instructions to reproduce the issue +- Ideally a reproduction repository +- Impact of the issue, including how an attacker might exploit the issue + +We prefer to receive reports in English. + +## Contact + +Please disclose a vulnerability or security relevant issue here: [https://github.com/tauri-apps/plugins-workspace/security/advisories/new](https://github.com/tauri-apps/plugins-workspace/security/advisories/new). + +Alternatively, you can also contact us by email via [security@tauri.app](mailto:security@tauri.app). diff --git a/vendor/tauri-plugin-updater-2.10.1/VENDORED.md b/vendor/tauri-plugin-updater-2.10.1/VENDORED.md new file mode 100644 index 0000000..ff3f91b --- /dev/null +++ b/vendor/tauri-plugin-updater-2.10.1/VENDORED.md @@ -0,0 +1,48 @@ +# Vendored tauri-plugin-updater 2.10.1 + +This directory is an exact source-vendor of +[`tauri-plugin-updater` 2.10.1](https://crates.io/crates/tauri-plugin-updater/2.10.1), +whose crates.io checksum is +`806d9dac662c2e4594ff03c647a552f2c9bd544e7d0f683ec58f872f952ce4af`. +The upstream repository is +[`tauri-apps/plugins-workspace`](https://github.com/tauri-apps/plugins-workspace). +The original Apache-2.0 and MIT license files are preserved beside this note. + +## Local security patch + +Upstream 2.10.1 reads both `latest.json` and updater artifacts completely into +memory. `configure_client` only exposes `reqwest::ClientBuilder`, so callers +cannot impose a response-body limit. This vendor adds: + +- explicit non-zero default manifest and artifact byte limits; +- `UpdaterBuilder::max_manifest_size` and `max_download_size` overrides; +- `Content-Length` preflight plus checked streaming byte accumulation; +- an explicit `ResponseTooLarge` error before an oversized chunk is retained; +- the selected static-manifest platform key on `Update`; +- public reuse of the plugin's exact minisign verification routine for signed + release identity files; and +- regression tests for header-declared and chunked/no-header oversized bodies. + +No installer, extraction, proxy, TLS, or minisign artifact semantics are +otherwise changed. + +The standalone `Cargo.lock` is retained so CI can run this vendor's own tests +with `--locked`; the application still resolves the path patch through +`src-tauri/Cargo.lock`. + +## Upgrade checklist + +Do not remove the `[patch.crates-io]` entry during an updater upgrade until the +candidate upstream version is verified to provide all of these properties: + +1. Manifest and artifact responses have both header and streamed hard limits. +2. The limit aborts before appending the first over-limit chunk. +3. Minisign verification still runs before `Update::install`. +4. Codex App Manager can identify the exact selected platform and verify its + signed release identity before trusting a mirror manifest. +5. The tests in this vendor and the Manager replay/fallback tests have been + ported and pass against the replacement. + +When upgrading, diff this directory against the exact new crate source, retain +the upstream license files, update the checksum/version above, regenerate +`src-tauri/Cargo.lock`, and run both the vendor and application Rust suites. diff --git a/vendor/tauri-plugin-updater-2.10.1/api-iife.js b/vendor/tauri-plugin-updater-2.10.1/api-iife.js new file mode 100644 index 0000000..e13f519 --- /dev/null +++ b/vendor/tauri-plugin-updater-2.10.1/api-iife.js @@ -0,0 +1 @@ +if("__TAURI__"in window){var __TAURI_PLUGIN_UPDATER__=function(t){"use strict";function e(t,e,s,n){if("function"==typeof e?t!==e||!n:!e.has(t))throw new TypeError("Cannot read private member from an object whose class did not declare it");return"m"===s?n:"a"===s?n.call(t):n?n.value:e.get(t)}function s(t,e,s,n,i){if("function"==typeof e||!e.has(t))throw new TypeError("Cannot write private member to an object whose class did not declare it");return e.set(t,s),s}var n,i,a,r,o;"function"==typeof SuppressedError&&SuppressedError;const d="__TAURI_TO_IPC_KEY__";class c{constructor(t){n.set(this,void 0),i.set(this,0),a.set(this,[]),r.set(this,void 0),s(this,n,t||(()=>{})),this.id=function(t,e=!1){return window.__TAURI_INTERNALS__.transformCallback(t,e)}(t=>{const o=t.index;if("end"in t)return void(o==e(this,i,"f")?this.cleanupCallback():s(this,r,o));const d=t.message;if(o==e(this,i,"f")){for(e(this,n,"f").call(this,d),s(this,i,e(this,i,"f")+1);e(this,i,"f")in e(this,a,"f");){const t=e(this,a,"f")[e(this,i,"f")];e(this,n,"f").call(this,t),delete e(this,a,"f")[e(this,i,"f")],s(this,i,e(this,i,"f")+1)}e(this,i,"f")===e(this,r,"f")&&this.cleanupCallback()}else e(this,a,"f")[o]=d})}cleanupCallback(){window.__TAURI_INTERNALS__.unregisterCallback(this.id)}set onmessage(t){s(this,n,t)}get onmessage(){return e(this,n,"f")}[(n=new WeakMap,i=new WeakMap,a=new WeakMap,r=new WeakMap,d)](){return`__CHANNEL__:${this.id}`}toJSON(){return this[d]()}}async function l(t,e={},s){return window.__TAURI_INTERNALS__.invoke(t,e,s)}class h{get rid(){return e(this,o,"f")}constructor(t){o.set(this,void 0),s(this,o,t)}async close(){return l("plugin:resources|close",{rid:this.rid})}}o=new WeakMap;class u extends h{constructor(t){super(t.rid),this.available=!0,this.currentVersion=t.currentVersion,this.version=t.version,this.date=t.date,this.body=t.body,this.rawJson=t.rawJson}async download(t,e){_(e);const s=new c;t&&(s.onmessage=t);const n=await l("plugin:updater|download",{onEvent:s,rid:this.rid,...e});this.downloadedBytes=new h(n)}async install(){if(!this.downloadedBytes)throw new Error("Update.install called before Update.download");await l("plugin:updater|install",{updateRid:this.rid,bytesRid:this.downloadedBytes.rid}),this.downloadedBytes=void 0}async downloadAndInstall(t,e){_(e);const s=new c;t&&(s.onmessage=t),await l("plugin:updater|download_and_install",{onEvent:s,rid:this.rid,...e})}async close(){await(this.downloadedBytes?.close()),await super.close()}}function _(t){t?.headers&&(t.headers=Array.from(new Headers(t.headers).entries()))}return t.Update=u,t.check=async function(t){_(t);const e=await l("plugin:updater|check",{...t});return e?new u(e):null},t}({});Object.defineProperty(window.__TAURI__,"updater",{value:__TAURI_PLUGIN_UPDATER__})} diff --git a/vendor/tauri-plugin-updater-2.10.1/banner.png b/vendor/tauri-plugin-updater-2.10.1/banner.png new file mode 100644 index 0000000000000000000000000000000000000000..439110d842e2c80461003f4a9a5ede92ae410a96 GIT binary patch literal 57959 zcmX_oc|6qL_kW~9$(roz7&{3OgCa5ZM0R6MmO}Qu#lCylcQVMnXE(@_?369*Ac-*c z-S2vT9^c=8>G7Dk_nv#s^E}VJY6>L8bi`M#Tp>X!KGD2#<%ZvtD|ils*TMhP z%x$ps7VR}t*b0kY>y_XvuE2P0-Dgzy z<}bKx_4O=`jD$))tvwsQHfH|lvBqN#_J=DBj3%<`X81#+7dt*b7;QZptQrc9e-?S} zouxg`H#PCJX*g+i+Z3FU{q|lqd*~S#Rf8O16TG^nM)mLCzf*-JC9g+iv&$b7zKk1@76O% zGRsKs?(V{vk3?^gkZ>II+(mf{@fkOX^PyT0N1{lZJ2Nvg*%*wBv#TropnWC7OQ2p* zNwbJf?2Td4L#LOO#@-77ciUTAAGsebCsz3yKw6?>KEf~i6!)8MQu7hsyerUm%#S3= zEh^$IuATKn-U^`^K0Vs0@>Py_WldHKI#Q_51gAEV81bg#440c|tRKI-oXJser$Px)$jEeA!YWxpdXZmq@*}*8b}H!-q6Jzn$rY~6K^)4Jm*&*@ z_wQeiPqY_XnT^*|bw|+G`WP7eGJgH~bz^O9?dVLSC1JMA+5x;k0+B|u zr_%oM2GwGLd;PQcA3SxWUBd%*Hbk?X-@lId3trfb=s@T1H&7c9xt+o=1gzlay|Z^- ztS5im?c>l*!96Gn%tlDAsL*2pxF3JCB8kVSsyn#g=Iq8suXAA1oR1$rx&iBN@5l4% z7@uRq1ZTxWM1BmRwgOepUESQ=z=kja{toV5UMFie1KRt@WSM0K^)O<{pNnl&lD_5# z*UeQ*G@u{EirZaP-u0vu79I!p zfo`072Es!-=;`{lWsF*oAfBXjWr3&zC(^cCDwaH-YB>5d;y?og;q(bs&u^NPn+e!$ z{`~1Ja*;3^vAD6NiIoPk;h!ijs$)qBiI+9CwamkllO6_y3r)+tiKy-EUO_<{^qcuW z#q%#UH7-Mwl8)Gpt3iQ*YTRIF7H1i-pVvuqxS!|2LQv<)B!wX;q(|3FQCCZq6cOu) zLY0k=VbuIe#HKK$dAE;q+lOnW$GfXV8&%WKNjw#8t~vh2W9DYCkg~>Qp%Ee7Y?H%W z5#geb_@W6r*@%Aj*8yb0DlIv~FLjqBf9{uV1yiNyf7dJP<$ z{?cMbz+!}~3>1@E+C(`39TT@Yy?a$qg!F1F?+m)dA$w1(zvN6aAHFE^%h$5+l#q@f~ror+%H?}2H% ze{W!5pl^fs(Y7r>7$iO>?x)vxzN24bV`GxOr-vVbA!lVr#Qe*RUu?>2{=>1DIVp|X z-}*jWu<%M6=|LIWf>W7WK+cIL#NpH2{S9d`eqcz89q>uKV!D35ch18-IPtvO1%4pe z;LE{nultK!-J;oQTL<{j_P8xth>G|couS*>>gv&%vS9OWD!8W$%jNI!$$UTVBhUAD zckKYks|mn;#THgX!VXvqd?(VNL(2tfv3%Gg7`LFV^QcRg^HqopcPjdz&^foWid$7l zQPZ<7bL1a&qu)b)3t(jA`v};wHewACm*yt`_S`LdYD7Bf9(NjdT`?x?!KihYZIq^y4p zoSB1Ly>2{SZTS8XZ%M&!AF3=S@ay#PxU;jf9i8k%ZGQerc&>8d`KJu~EaRTJecWQV z{i6{OPfddUL(0X~YJOkPw_>ia;tcfTn;aHoi(+7+q8qPs7uOfX3pGXpx|#=eyg3T? z%_>L^EE@bcRa4@q=;^M+#3?wR-N#B#?D2AUE828QeNliT*~2OdOtx!dTms0xtgf%0 zE-dxLlKQRYCaR&n*iG8CSk|0>w9WVru7^N0ZPht0N>j>C#G?xLGPw(cG(4Vc@xy)1 z?{{>RplE|p&I*UNta}_*+A3i;}h9nfrhqPpHDlQOP@nbJ9udmbfPR)0fzu(!g zr(&vvTmI`wUfC$)SSCMtBT1KAvm;^66ARF*u?t}BGJw5g;1?sAH*VZOeO_kP9bK~5 z(HY;}*x2wRW=$iLP15d_QPwmMG1uT!&qzb~6Mhr&9W1m!_J{h*B1RMa1WIJ{>H_=) znHd{7k&`S$vW{x&SAKUk>p|NeT(}OtXz-P~`tfs@nQ4Z}N^iQ1qy!^7JM8Zr{o;ES zK9f^awANQzT3V7Ih&mqyOaXx^k|}=KGiQcPd^6`K5b2TdLl*l@s;fGhFniIhGxUxg zh9Ajeu)fPN(d7Z&DZhOJr4Xg64m@A%JPY?D?Oeh?5HW_|ffZCZ*k_14VhaaQ z#-(x`%XruLVeb|nuBbhTj?;lvbG5^d=%aL@>V}b}vT?=dDP*#TCcwyj+1c4;&4<{q zTJ+fsbjB&8*qiALz<;c$hy%{JRa8!Plx^&Aw?2u7hE@rBOp`)(7Ryt%crbtYoqRCo1f&v48xSZ^Aneu<3!iQ zH{C{3RL+0Ps%LAs8@Rb0?2@%(Kqd|w&p+z4SPaZJ{S^!MpzhaatqS-_>!oyc82-DrYIgp53ta)Su9@o##OC|EoXrCG&>*KVA8LVNIl zn1cUFT$~k^WjC5SwpO1BsNF-p$qZji`vo?$-SL{BvvAyXVMr zYD$b%Albg!;ttYA0AWE>qA=o5!cByt;DD*Z3Z6M`vL!toaob+%>1lrm_bEtPlJ4rg zRt*znreJscbk(R8=1an$Wbe;Y;uTb@-Gea)0c)A*axh z?bR0o9Ryn-*MC&kI_a4zJR`Wgm!ihT)Q(N#pS}Xf{t$tB_Xlu#&2EsZE%?Hb*B$2m z{`;rO!$DLWvujzr0|;;I-3zWdRpl_zoBLBfK0ZYQ0xMh; zjh?V&#sg{M>iPqrfG{)ZgB1{u<78o0nR4u3v7KSBjlabJPcQ|Z@Dg}J?WHH6R#yt@ zc4|Q;_5|)~4cu~0L?W0&l$l8crhz@eCm5ZGZs3aj@v2V25tAbAfR~+v z;LDETPBpqM8TPsH*gMaj2Q=FhTZY_DiPI37(_=47=%u?_{QX-BCLjZe@m!9zIgbo zp*l}|{~^_Zq%mjx4?Qlb*{PWs)s;;hV{csNLpe*|oL;qQK%({lQ(?XC z>zvmwRx`GIIglj*NKz`nE-Qi=3``4F5L2Fz>mDN|wx&H+mZ2?BpzT1)H}h4}NP|uf z@RWhM=`|A8Q)R#sa=^lOas13{_I$iYmjo#pIRA+Xq3K%aY#utVn=QOU(1@~vI60A& z7OA&*-a)(6q*N4u+^5*(9I{VLgw?=5usNT+-S_e~9zw2A5h5e}+3swp6S&mNJbU%e zpC4KBLCPDkmgbdt;%048Oj&3AAstgg5;kh> z?!!c-n0V}-ED~ztzXUaAHHErnULCV)nz)ck>I43Vzr@~9Blq7@KNOUJPm3#Q+UC#% zKT&eeE%*4D@&cm63*aucHXo-y;2o=ie(+!?R!p{a=(Mea5aYp)M+p^9;NaHFr-2o& z=hU8_p0j|NMw;w8SppJY#g6NxwXPucm~HZqHi22fUtDuSvAr8?=B8?FBuwDftL(su zL1=AvrY$>@UEvuQgp6Wwl3`4o=vYlSI!d0KLA%{^%%vFpqWxTYV@+yP2UtADU#Ki$ z#27f;_~@w9=t!>ept)CL>D;}%C3|)C!58W2>6y1#Rn(SWE7?d0J?iqn*SbS;>y|iN zT@!8=&z?@67V;uxmqVi~*lJT9LdR@*&p&K)^4CG3Q10hPEBvqG;tJ~KA_K-$ChjNk z7X0ksHZJaEu;h&>6*;mE@>Wis0zBuf5Z>v0!}*F!q|X~rscHfmO2TTFJY^8~Ln|DU-soaSKNbUu zfpie{H{6_^o231R;{X1N`$6TNrSZNGKRk%Y$R)gYr;V*3Lvi~)aTyRcJf4NO`vgBr z2U>$-*N~Sz1dF)Vb0>q=aayq43SJCpg-Y5O+0wlQ6g6e2b(UpZ935@?TM8xL_EJ zNkr@C9Qubmn07NWHBVDyL6*QX4wTt?cYJe)J8yfG-U);0Q>Tu}H8wV)6qwwqFRXuD z42_L_d7Q0r_=wO{sekqpI#3=8=ny2OVuBNN(a3NhYpA=W9LL0G$Ot+n4u>N;lNYDM zitXZH+F@2VZ4EO-sifZKA=;i&+`G=e@l!KRoGj{oHcdd)x8?&y8*NDHXk&yJc~-MN8G85!<-*kn0;@$1YS1=L*5 z;R-2Rg8+A!-(vU+v>gRu*J(o)5FWRJL>fjGht^MDgXERHb!^7u)`8dz#!O63KJ)-8 z)Q=R56p|z;>#q5WRbLZaXVS|1_jqETAe&GxQoQn(mKNBNGC48Qcz}+RhWhFb1j~(J zV}~n~A+n*26^&bkikc}C=2hb_2N}Z{0Pitz%t0qSC3j!-z_^|(<%FG3bxZR$Y4&+5 z0fae>IsX;hGY5d~D>${9sGk)$b-ZhMrrEIkr_PAaXnnRTPqWgkub!Qq72U}o3(gd? zH@^RS5}yjGS+W(rp!XF`Kh|6vguJqYfY2f_^Cp;ng$=1j28C5Y!ks z%$Gk-!`(8%!{&g{>TZcpZ()AE)h2NE^tJr~nCLB@=*6dT^NBOAkPQcQYKN1LoMRKE z`EPEC3eRT%T@XQB2rTWLZkZihYB?pPt0(`&mjh*E#a};y^l5SLl1?MiG0@X4X^uFU zU+$LDw%hpr{=SbKVPgEb=dbdMf@a`WXRQ9#E`CAK{m!Rxw{K7z5Y#E2ACtwzeVO>z zcz(Rb$$aGY!I%K^axf#^S;l=c24;C#aUfYKkf;y5&CSioN16~%CsXQ~D+A}CPvBy_ zii6?^Z+bYc3AGV6OP@O&@7m*4^0{M4HrwGzwuWxWq+89BJ>WyOzkdC4%L&ffuvgc7 ziG7GcAlw~>aPvubkk+AAClpUs>`)KfwRk8_v49gHQg`EFqWBWq;z6-1RBIMp)m=PZ zNS+(ECV5*Gb9sM+)M!jd_>i8tu|jaa2ze#jyWP^Ur|NQjPPkTXM1rNBgm zcaWc=otg(pSEPHY*e$rWApS2dj2r-NhhnMN0T?yzI}Etwr1o{Bb5kV>}940MCpRi*oZk=O6NiGP&1a;l_s^Wg4=Fu{PisJ+T@WyMaK zFjAAodu(zgqkt5 zOAP5%#Kwe}z^lNbC16nnX$v0Ko*+0AfL5ZN+#-c^k-MMgd`dZ!fJjkEHz=zgD>BXth&WgjhH4hkse)&~D+2#IwYGBLEeDzGG-+jsE__`x>pj_AC z;(oX5%Ze;o^zCWjVIp1jz>G}AyPh|c4sjhzNJ`fF0KuLUka_{NDMuiQjooDJ`+l5` zERD)eafvV9`a(9rOJl(nz#I09M7Ppz%RTGfhWeZ2Mky96?xZCs8>=*&&#dp~qZx{pB{v^Dind6-T}Wvv#ma zn8kLHqK9J+BYIHgNBTjuOI|?4DdRl)H3PDX?W!Ot}3=}02WUG|NpT199(c*RKNN_UPHS0M~)+bG`2uZ+4IqpS*PMToS63FQ zY1Zr7jr>!#y84_z7U#|M6yelWM*je*Ig6V%=V#0efxS1sQH~yy#nzUU*=rxr9R!Lq z8AG5TiJg{_b2M5exMTe<7?XUeP3sD0e6n5J2*kMuYi{fXu4X~T>jSC6R*_a$6?v44 z`*Mrk3*>98`?4)a`ki}=*+S?9iouz*rmC%rB4t=tdwtrx z-oZ*3amc*j0IUb5iwmGnbNQIbT$|_Dib4HEY&~X%5pZCJ^G542dqvIHTMjI^-mbVC z1XiT=pCPT=Jhvv3_V)MTL?#;?T6FiNGZOIxkea+$y>C-=LU^|*9+lSSdYiwVo}0^D zuhqLL{5u&-TIPe)uXXp<3g@SJ9{sethJtg`qxn_%n60gC>h$o>pL;fyt$G-G*(n-VaShy1H&DD^w-4!F0+{T!+sER$VDv6d!{iC?&&M!tCp*lOj=3 z+7No%ft3HBS+)C9eM#(F$MvcTp9pQhE21U;!SyiY$W=3TrFrhiY&N~Gy{)lm7gI{$ z(@TN}kofn=)`Z0*7?O@L{&44azw+3EbG1tHeU2j+%2v%CcAVtvscMUozCD$0!E4Nb z(-t74q@<9=??1hz(4$UN&dI6grA~J&soT(?eee$`LV!*^{5qNDC{zQKeAxVwnbOEq z$Fq2XLR#}~jIeJ=D|PJErXWSA`i&!jNDu4SB0`5~s+>tomtB;3tfM#rpk;>hOgTL7 z-iWO}^!@JQ?Rh4pg*1=``lC-tI@LVPop`=_I-je3J2p~OBAo#u*J7R3ATv}gFfI6J zcR5^^I-a1In_;22-Lf}fvIK_Iq*c5kEc9{y*4kTRf;Wgjc^d)4T4!AMVq9Gwceq8w zI+FqPy?fU`=^NY2)n+aI#)%{PQ1;A-LF-~5b*Mm?=Km~cBB!(+NN|tvUQAsKdbs=u zYbc99%Ez;qWc5M+`ezPgp^Ehl2bC*TFF3i^ceHK1i^I4hEz(tn;yVP_%=af;Pn9$+ zv2j9UK=}5Qi64vHQ$%bgo&}_1c)q$r7#}^%P2{SHv(jpv)q^}pgzkZH+GcO_$CK;Y zwbNpX=lbt?k(w@q109PxiY&vAzwIQT%ZW^Y=K5+mCAVC{_4Msb<sR&lt z|E6`%Y+Gj;v?`Xbq>k1-&b1xvFF?nXzk>Z?=vJ$AFs!sdQvBG?V0Ac@Jovv^0Ho%> zt+d>$Nv$Lb0$VEZo+qr-gJudnN|UBWDy*X8u$dzqpHf&M2e*{-y{;wB7ggvS>A7BFIs`cvt`M*i@DOjfA<10cZvDPJ@P1>;OAc03VtCW zzJeC6R+a_&@g7H>0iY=}AbF77rX_L|VG~dI%44csoxgW~Ad1Bl`uCs;LOO9Jh+FPg zq7ON;U`TSjk`PMH(gvOKVXQRyRsGBIu~1Ng=%HNPiqooaih$f8Ucz6_(%6T$1JF;_ zhgOzrxWI*_%MH^5B}~41T*;iQjMnTN<`*$nU( zdgrv_msrNtOJqN#>%Om8NJ7kCH%4>NCz0&q+_YiHsjS(+^@TN%c9BAjFAhNQd8Jy# zd%6F=<9Itmc_y4)w51TOp!0-zk?$&_)&Nn`ryiJjOLI@y28S>I3fr zic9;*nFS4NHIa2oDO05K;OoPD^|&ev%$#9u=2!J0n5e*07R};L;WWT0vOG!!!4QH+ zpd{0?!rL<~IPW=esW3HEsZgUetiV-i@I>^8H-h9E<(ElGUJ@<}NjuHS z;syt(qxroFwcrM+*0rv82}W|@`=v9+cUA_~GnN@PDF)echhh^SGZ);a(sD3zR3%rm zWM&-i*~kT~q;91v=X2eh=AYj_I{LM`_u7uORNkuIP{FIJHTYQAh{ z;2X>`!;m)8jtueXh^Y1qSUL9HDC=hj2&kB40A-awQM%ZN1h94#iLw+a!fJV$EA5-3J zIX*dwHQ~X$xskI=YRK%^=VZt(Ou|Y1OcDAUgcclCmaSMDXLGT(3%;m|Bw>lupW7_dqe`nZHSw?C0rYc^>D@e z9dA&??A+m7DbZ-Vj?y{zmjwsr)-%C-6&WGjFD90e@|BaJwA>lrXqafLecxr*JchN#N95=nRfMXDaPGG83wZ$%p^f@<-(s3@Fo zE7cV-4d_ygeq3=gser|?noZv9RHD;V(|GvbWeaa3gb=5&{Y6v9_ln1AYy3hbuJmxvAZbkr0fVZQ%~*hYo@H z%gGIPM`Y+T@!wOA`@>ndC>;*#Bh8;2)vs91=EQ(LXmnHP^WHig;ZW2_L&a?Nj+n9J z1E0_O0GF;)bxQ?dgKu<68Fcd1+@|)PzDhXXwbM&zH{7;JBZ-7WC@4$`LjHuKZzj!? zkIE^YQ@AfLOUU;7&vVY0pQ=3X)0mR)Vw%jfM%o~7T*T!96<1X0=*`~ejz?BgYGb-aHxjczn zEi+z8xp?lKSK*lt$88sq!PZ9_dJ-R!TgGRYp@FeBjl{w^~MBhb*v=w zA{oDHBLefBr0o81ZL9-#7@M?P^GgS!qdeGJSUln=p&!3BuFjX{kX|Zs>A8fd1`iq> z`_@`p-_aWs$d|XSf%+8Ri0_!NuWRSTa0>~c-&RCrDMRz*J;v}b4HN3CRaD8_Ymw$! z>?Wj!5|wFt_YP_EXrN5LQwb>+3qhiO#7ohZJ9gMJ%zsVeHPlj^N&6X2+5xxgnv@5&AXQh z%0yL+ibcA^SCwnaWD=nthrzaQWjOKre10JVMSfRfIU*tR;Nc)3|RP+v-{1w;X z4<9X`Y5`A5La2~{@a&Q7$hXRbuQ zhVmVA$2lpCB${x_Se^Fauq#mHU8JVd!mOI1FjanXaud{bSreyx8$jiDE|tYqBwhLR z_aWSmuuk#2*oP93bLSoZjn1@A$V)N+rY=RM%SO~U`w?b19lOPbQ)WwwiSQO7Dz@oB z3lh!g+L3`nWeWS=K1$xTQiW2~!(VF-QRa&$fo0%K@5w{uQy%zp0SC+te|D$4-r&Dx z!(Bzqmf=-(Y~tG7C0+YY;T0`zlh{gW?vA|DZNWGr30paQWu~?qj6{Vp9Zi1v6N9?h z858LEqYjBe+Prb*gFxAF(n!gG-Y(z2-HBB(|ELt!gW@)a`I_SgXN6jsDIPt=CJOsb zGIUlQ(Clqs)gYK7(#uM&iT^+*mM zhOQ_B!4duY?&h9jIHm_>y&g>3wd4EmR2xhnDA9hxPxO0B{dO=r z@_Q!DFAJl2M{-RMT`NjXi{>Q}s@xuME#y3Z%qfED8y7QjPeT`HCdoQGHo@rV+Zkm* zR6dC(2U{2+isI*~kW$1`y5mDLUp)iQZmrRO)Gi6iykU&9@^`W4IzQcVY8xb!k%L{G z-c-^&zc-6;uX2SyhkKGCILHAAy~P~*y4R*J|Y%*LNMp$d)pl++%^~} za}$a~6<;$OXFKqXs)o8EZG%Mb)VZph^QZzpxaIJi^Huxx+{gs5;FwmVip~`93YVuW{-vll>vnM^p|RUREI?k%&B@^2 zo%a;GG~)Io6=Qm!90DV1WpZrdaAG9gTY~Es>MB$ajjQU9B(wI!O?EFG32)?n z0^ED?;C{vdgC8{vS@LlOe~>t14{_BUe#jU7{rS{G`)wU-;UnIk`|WrMH?7t=xN|`4Wn2$Q(tQN ze6CxxjXj}M@Ys=BH19Zw-&9@4M$U;{J%xTuVXLDw-p)3nE7)aPMJ={ogaH9e9_+dcWHy7LQ%eskOb#!__hsDULjnaH-$005Gay5^UVMNSxh;H zpifaBiLOpQjsN@3pR7!SVX>8DroTFllwerA5ll4Jw;)d`9_>gZg4F-qnl0&!-1c)) z5-f=U^)i|I!}*R7SJQcIAsZ4y(Nw3QUYMtR6u{VPvSfl@lZRBaOb|Fp1am=%o~mQpzJPRLYy3 zEu2niF!0<9`_;MRGC7sqE};Q-A61}Z-ONy6aJv&aXgA0c|6NCaUJ)-q>n3C4dZqH% z=Hu_8)K6f3dJGjTY(hW!GTgBt_dvt8crGxm-o49y{m`=Ff&FY#!n#BZ45_4SZ3bn% zwZ5P9#A=;5GH2T?k+(+!Xn6iaMLwnC4ME(+v;m zTCW~ey9oyQ-;CMIeb-Vs?XuCKwt@Nn`wQ-+Fmr-L^3?9vNKAKbdd1gH$L8CNVX?ss^Rkj#Wh$CajRq_f|GAKDkJXxq9{LrTPH<4PUZCU><~~R|#e7 zOYlg*1C&vx$5T-09u?(aF4A}`DHp?ZVX%6^4l?%;j=s@%QRpW0oign1!i4irs0Vm| zSMW8upB_TEUbfc&a(nU=AQ*BojA&#b&~5JaW_tt@J5su^aAAC0KW14yurNa2|FzL0 z$dB*elLQ#IEhVR#O2&IcBA0(Hp)n70KoHzdn-uQHfu#Gm5Q3s;0a-)0Wb_I6&IoR} zh5~(&*y*j=1&s6*rmTO`2JtWh9xOnS@)@zciGpHGY})VGhzI&^ zcMh*+>=o(j9~1+Mq)(HYI?^E+CQOL|JAq&YcQnY<+e4EGV?{2X0qhxoEHkc&5KFE5 zq~P^A0pK?zLQH|VEZ*Y}eZY7tc%|_U^vf?l{DVUAv`bitJ9veoz#9nBMFaitu2%pK zmo9JUX{%Xy$7V+erH^L#bY%gg{)(5Gg^II8fk#M0f3;gRze%D5c9*aKrW5ZV;3no`Y!>;1q7_XV@) zmAr~23ljpB+N%DLIGOJkv<8qg5U^}5LAP&UUa9hZ{mN4jlDDh zvXH*Pms2Gvxp)`~^&?GK5UBi>2FHRj6C4%8I_`>%vM+<1w9vIyQ zXVA}4;79YXiLrEq003Oeqqmhxb@hFH5M}dsb4*oy`W6xY9bSW?f&d=_C>GB+jh7`Wrv6(QU?1~1^ z{Qs(Fm2N4Y_M`PrpVbq|R9b4&a6{V5njetd|1L_t7zQs4PNZ3k<53X0Cg{LF>HNtP zXjBpNxNc^3F#U6puqNntq+GW@Worw%ZQ4O3eIRya!I+j!2ue)&zvC9f3#B}O`_UdX zS@cj09>*89ir$IEM0&qy_V`^Ua%;v{-(Vm!_OHT&1c5++n85L6C@|rlNjeuR_~H_I?kY$N zzmEoxF_`cd@NAJjU^+4;a4n(s-=_PRJ^y5HEybz_sy>*6?H%NAM=$XjHN6Z7MfyHC zRD_Clwe7uC#n%$bh;GIx4GHy%j{Lckb$SLmr4VM*pNLY{&(Ck$)|*-Jbi0at@Qe}3 z;M9?qKjx=1dzY~XCeM4+vgL;Lf`0xEKVaydQ~@)1O@Fn^h=0AVHG0dulzF6xZQj*i zvJz@J&^YznsqsBt&HtMA&Qz=Drl8&~6?jl>l4!aGbH&t5U$GY*L0DD0N`W zMdfdJ&m4OEZjSp{W*{ZD_0zk=y^IRqp-YPw>&38nBYr*wyQUN6xQ|mQS1KcF=`L=@ z`eYeSKd+0@IbO+Um7Y`1+&OJNTv56({y9IjXsfw8s4jX)7w0R5JxeK5NI2Ng54OE! zjPrQG-C{hQYFjfqFA-vd@aP=#)@061XaM zoULKbZ6|=SVhJ?s4^QqH#38`3>D>T#&Md$yOQ2(qzw!pDMD;6XsDQ`Dt&Jwhu}O z29tIMWn{b;>E{$TZp2T#uAOP8wMvVDjdzFkOQM9&*TF^w5f`UBqBGyBdOW%%XUWy1 z_I`wB1WYp@(VcB4V(fa}eN~hEM_BMyXiGYFMZfX8mKBZQ@t)D$qy@A=}%2WtQ<{M zT}QtP$Xpy*kr_PEU!3v+yQEQ*SVdcqXl?r6_Uo1pqvr6lI!`XUHkg01iIMS$>?)%? z*z}}&@sk*}Qc^oB!QeLSxDYLOn`ks&y{z!c`?B85^WFTd9Og5wX>cb6EjnW|n;wH+ z(3-{Jj;Q)!y;;Oo{h*J4o^UbAT#=F6jHvhD=b1`l0{v-JD-zgm*;NA)ywkoX|17WF z$yZBHLD)u0{QX=*EjLDNE8b$?RA*nVwvh3-jrrQUL8*i3!jt@1Q&_>iQW#JDfdq$Y z;cX#U=(?;>OOm{4xqd3Bb=DQ*} zS76<}6vCN7V|>ss9zWAhs|qG-z1Pi|mEokP=LZ<|v$J?MMWwfiviKA+1Zv#y;IOG` zoam(YPJit9umW?s^L3O{zbG<#CsJ}lv6S`0$C{^5YSvqh00MHOr?6haH|JYHGJGco zJ64$h6HEbK@UI=?T<43ti--4o=J&#E$t7`#z+gmi5= z!t-VRRgXd)PjcO7w;q~RJSmCZIvxs=*3z!{RjgM9vGJEKx^UP9diC2H$0Am$R8Bw0 z7V4_h^gsAjyg#RSzU{UsPM)y?^Y;+a{zUy?+Tp81I}s=B8iAh4zfRsM%S59WXTo@- z=NpK8#p9h%gpvLpB`r)fmBUZzIb>>sm^@$cWJay@HqM=GZ2i^2NO&Z~9xB~jn_rBQ zksc43(`a&QSs<||6q|8=z8!8r-!fa=m?DLv50w`$^E+FM#cJ-8FHl{xYc9&$ zw0}L3=)gcIcuUY`F}d~Z!wKi${V}zslz(7~r~jS5ecEq1!|G>?2+b-k#v_LOQxV&R zqLf7707>q0FLv0o9<5mAn6W-Gvsg)YQ!|Fue0I-231R8(7n@5v^-59vG)$z$Pc67s zhVi99D4$5>1w`Czo3xRn)h)(3J-OF7qSo)S&^*F#V2u^SHg9{_B%dy?d9>o)fTgRQ z@{xZo)gEyZ@kXt-atNt!zq4HquCb=PV!E=KL$M0`2DgN^jz1o6lDpXYjPl-%ECG?=6(^J}? z^H#~Q`{PgQd*=9Sr|;Jb(9@3d2|_B)Zkp@zZ$nS+FpsL4IrNMC9rr&WovCb!6vqZz z;N!_707U6%4$0vRgsDung&Vt>y!?IkCpq^9RcmF4>dSoo*%tVy5&O~YS$(3`y-{-W znq9GJsua#3)XTBn_Gg86NoB{NfFLoA_-%h8{AuCRrtR+*jOGX7uv|{2Ws1+eilhr>+9=RQLkg2Xy28Au!f0$H5x!wOb$Di)!t>&F~Nw(ldf z7)$ddy95wdeQ@&IH28J6>}q#`o!l$yv?iw!%tlJ>Ag1?-0R= zDa6N}ib}rN)Rpn#sfWVi{1(F`?-|7CtF52sX9e2g z#4tyy_pi4wEw0g%qe#2_c0?Bl@r+Ry$K$pSUgzk;N^CvQggK3?-|T+$@MtFJ#=gav z%yd5qV7@r)?&(Ntfq{aew^+CtA6uCI~Jw^TH(4ZVeB6dmu^ zVx-c%HtKtl4IOVqJypPpMXvN4=qNPfYGB{`>jP0|e|2K3Cg}Kqx2W=(e}0&F(2F{M zJA$11HnXaST?7B(43LsBR{!#Uvj7Lv!fUl`HO0Dh+aTE@lJy_4)x~e>X?5@PdCZ;6 z-W8}{f-KJDSSp7bXrllxNGa{sJz?}%is3)2Vkx<~_G~QID#PRDeRw+d$@m$hMH~5R zf$6*M6qqzgMnjrp`2;bCHCeKHjxKyil1O=RBNo*0NMd`C%;^G*>vIe_3!Ft6TRZ%r zvp=wGE-&>B9Z0U#TklD|S&*N_ddK7B_kYdqe?gmP?1YTcJx&vYY5)1XpTTAshUR3n zyExyx$O!*wzlUZ$CGo<##hOlLHq|oZQ(u448?)zZt0u^Zs_DvXn;en`Qs3ld z$x|RmHKcec-zRn|46s`+RjoiuKXbC!x;Pk*iuvkO?Wo4*r|F`$FQ7ku>lNMYfT36VDr@%sdfUq% z8*`F*y2SZ)R9z;0?^h4Q;30_2e$(Mk@(ba@1ONTV!;+6fBx01}uMqe9NK~GV#;wcW znixMFjNSfF<;QKpKtn@#Fz4q7$~}mV`s5Mu6iuS~I#8DzDRcjlD}8)`b##A6p}d)W0DFoa23z>Im`- z;A6#eYI3ILZ#&2pU?I3L!IlYCOq@`LrPq3eg7_*rw*4;VQ2y%mPOGyR1t!|xgPF|d zfQR$O5_?KGip{z&Hl+VQp1v|5s;+BW5d;C1ZUu%8X^=)>Xawny2BoD-O6l%Sg`vBY zZcu6Ilx~pj`u6d8?{EIk%*nm3T5F5QQ_}n2^S+vyCu^e*$L@jwTZ8AiM(b+H00I7SzX*$q% zS%QejA{kIz(Xv}hHdWVMiG7(C-=Dk$5og!)#lR{r0p(s}^aowM;J}SJRqG@7UQWSC^eJ45yw4vt;WKZ%V(3#sO9>5 zZXy3=N&nkFhYA01()RagVjkv$9b=pp9ZnC`i;ZKUo$`(tJ2y88w*8YbZ_i1amYWz^ z`H~Ny{9r=ZT0LEnis3D(b+r=j^?pakLsF}#legwX)cSl6lI(t-bZT23^}j6J&J2bC zyH({cTA3(y?NmZN*RQ20*x?ZjGSr_)7mICWEVy!XTjW*PMQL(;ebDtPvj3bTD&Mb{ z*?;yAQL`wdkzBBSeyr)sNS&Z5k6XOGy)AcJM<6{+=6!vzSe1EW)r;aWSsr!1YAG-A zOoGBnr;$)~t)|S=dUyr`$x9JF`w=!;yy~{@ar?4y z@$uqXs*S>*P<5%pM3$GkOo2j+u$0@CIV6~Rq<)FGf9%4M4{IR2|VR|`|vCC}Leq6O; zIjrV7jzNV{n9*F9-eURomwVNfMvPvYP!ccBncjGUe5ZXlLym6~rF-C;u+K7Dz;}@` z-X9WwN@HC6s5A@(!{Yg+he;aaT%5p8x%i}cUb^ybA=PPFpdmmdZ&8RD`rxSX(tH?U+ryCO2MV!i-45?*pRyt=Jvu>_x`O zY{Le+5U4%vprEB}C6{}A7`SWtTfe>Kx=qbWXI~p0MBDu^+U0`ogBPs@~H~Xijgx33)`E?zLMpK`W6JgU~=P zt3$2Q%ZbjdrhluvsyT1#c@RB`_@&Q{6x$NR_0aLb+{f*b#m&6T(v33*+TG*Lkq&TB z|5$4-KY!GhNB3jZWp0OcyCyiDRbt@??Xi&C9&7}ixhNLPYnMN6rZ||5+ocWTd@-q( zVFTZ0Y+8gi`I|PfLfb+0NenYrxblSf*+t{`S^LnoR&3jGL1Q%;9_f;$Uv!!BILPsM zes5aE7CTwJ4nh&`x1M|M`h|PpE3B45AL+aYMeeR`e>`&u+q_$y>YMm%07H?OHT@3m zmF=jK6isk?wLmsQq4BQxaM8G^T&}XMeqT?K-bvw#rR&L(O;%9{X6p-ZRTuu6@B4FbyYGqv;L(i7)vz#fb4o%{vxQ@|Mt-)26fQcFGuxUF7zee-=W*J2;%<>hvnBF@sRO)`D! zRF`?WZZGHO&ci*gvj%n-It`yI%3%EvL}A-m$uNRRMCw|X>Gf^p?aI~u)%=}syeY$@ zTL=^Ut5;*0p-bfusFyj=s5vLW?JQld^RKv9@yDOot-U@HNmS3VKn2rv+B}a2*K4@7 zruR2(q|m7*W2RzEidI^!+Vn~48BvTXtB(EwJ;pdf@2v$g@H7e{&~Vsuqe7foXRGRL=o+@eD`uyD(7@k);E z1d^W)Z-haSjM?+nmKI}UN&g^H5@8u$){iQ@|Ct)ASF1m!JK$;@g-|C7&$S7>YOhzB z<^B#jdT|VV(;DEUnG}5$Jpr8@wcW+kpcl_(yPT!RArK0ZW{Uvvq`B`jX&9&$Urk#e zAy$-<)$+3WAbinM|4KVa$lY0@MZ}ABxb=*+1ewW_H{`r>Crxen3&mdJ(SV#+H>52g z7OJ$1&699!54s5R4xfWYdpi*md(>^&)15E`cLEG7eMlAD!pcNCgGO+3>tTkb1nPMI zR<>*~PD_ky&$RBhr}%JM7hWnpQo#rHLa9&Ipfbzs9ti=NL}r1dnpu%+ zi3!taac&$Va&FvSPMc+`is=7&qbg?PZx?KyhRskDgZkW+V%Blwb%FJ@j2Mr@A)!2- z;jXwcT}fH*eN?ij%ews>P`1BQcbUd7)j?JW?fPF1f=1Iy1`r&SSrzR zPsTUF{31nRd(Q)oiy}!wu_#87Xm!aoR1zI% z8MXd0J9C85YuU2h(MOx&x3;z69GF&?a-GhHzF5CqTD0X5-8c=j^1@3pi79qG6z7#vxkH=LUnosP##^wE~x>g3U8d3N`k* zBQVA+Dt_L8wLYU~UD+6>wER=ae8;H#wPigZg(^(ci-IQOkIng4qQu)r3sjhHZ?5M` z>()}n20Xk@r%Yp4Si6+tm-gyM6a@I%)$4w&WLE#pq~=e0LnTw<=ZcGRQYX_OrR4!C3sy#E%cLaMuu;g*VIF5+g5&kaEFKv0znmj>lfpYFXVp&~^{c6CN`m03oXM2%Vmy|gny zMzQYZnt!CD)=fTUy)CKWa8o|K~ z5u`^O&lz-!yXv}w3IOKFkz9^Yis7i7_qxg%zmR)FRq`Z-8M~EcNZcqbgs)JgB%>&u z>xapqknFaV95)L(C!|Z3gL`UvqmBp|pP3;A3rvGayBLYI&dRP<(zxA|;%D^lWgleE z03Wfe99V%G*L?JT^+5ZR+To%;{|NBET6|Cn$2(cqxoy3~>o6I&<3f!l#vLF86yQ4v zUT$O)#K>AOP-id2l}*w|eTRuLSdys_8YgzX(6!9R&T;3BiNp5!-E!W=I!=OT+$N5- z24F8HL;!2=Zm&qa{Qgiy3gSQnv$SxWv>)J>%(T0jz2>WcaGq&;VsF!zuZ)-7k1HZQ znQQiN=PJg+u&t1-?swJnoyZu}MwcnwJUE*iu6i7=sFPRqzF)T9o80T%@CUst z6$Nn}fUC5R>Z>!3ir*d)ypcXiJFjjY2vf;D`kqoHsnt?7K~zEkESysGALQO1F`XsI zXNF$i#^2gBv4Lz%$b4SmkHMaTyo?m;lkM=UHXFdRA%?PAcpd>8f)oM6L|tbYYyN)l zf`Zox6dh3|ov@<)uu3W=S#mqwQ_lnbSQ4Ppt|FOphdOHyTM4LBA{Sq91Ndw5R#k?Zl(i6t!acaFHr2 z1(GISam&J7rf>-dP`e8EOu4Rgly3Tvgly6sPg+kt0z;E_Fi-#XF!5L2Y>b{Ljy)*% zav^6tGgeij!mJZ-|CH8L$4t$}7RroEdh8JuGy+3H^_ow*U5Q9s>;u>JOMc&ri+rv+ z2~+C5_^fe3n%k6q^|#jXjg^Oxe(Q0)Os?paaro(j^J&H1vEp6a7QM^q6&Pf)0S}8c z)fA{)=Prfigf^j~5EQT04Ulk`QGm8hIasau!pG1T-_U>_=3EQGa=2wxw%j2QYCtsi zpTI*INEWlDsi79QhhqBk8BjugF_o+cwyEH>K%E$?M`NU+G>mJYwf)*t`u*GVX?~FS z!G?eUB8aYpC9>wL+{Hh-kyvFqSbC9}D5V+;biTc(z(SL%z53e#2@&E8eBKM6Q3GNX zh52Oe<@v8uKI&?8y3OS~ts7>URxTFjHLXq&qo%FUao?@kp4GSps<6x{Y^-<$k{SP{ z8VKEq)B+s3F8C}?S6F4{A=2M?5N?ABmDNJ3em+*u;;zw{(Va=TstiL<(e}hnn?E6_ zIg+mgUlL?apA<>HSC@Vf`U-olBJ2;%x#McQ#u{zDGe8l3ch`e=@{GBB8tPLpieE{i zLZ_2dJ0QLEODmaLV5GgyZbHZ5bnTCSKfdzJOLC+hhwWu zZ{vD(T5vgxbL-TU2Zw*#O;R=1Do^0=1M>4%=bd!I(Od4ZDUSwO&^3vU8ati{_(8&e zjK=#EC@8iM{%-AqvS>EGTR&K@&`Tu!P)o^I>dQV7zhoLQZ*yN^8@B)R zKtyYKGU34!UW2|nk**BKoQfxlH?f^-VUDMA<_(uyMK6wHM>$+s%3C7lg7AV?t#9bx zg*#!|$qRSGFbb5wW6_&^mFV!DD0O_tG&f<%supr5A+s0^;S>O(;4x9j8C39PsuO(6 zgq~3&2fUm#@I}03v8J{|gYi)LtWkSSA<9J!e|OIRcr3g9rNQ?~RR{#{k{rDT-T#bK z{+b6i-W`UG=l0v!PuAQJMz;M$ljtV`yxxMQmkbzEWOncvX{Pmyj(|*4qKV%Dq#u%~ z*)7=ZR)I@a^edEP`ASmBjGM~i(d{e{*o>zYvBFlbdY&Vc@z|a@4vErw$Me-Yw_LBX zMqb>R_76^H+6C`~F9}mv?=Y}5?zgXGQ?Kf#Vo>og42E;;2& zzCYA>5!w1|E=l$B4$z#QvDc{wgMfl%#@HDY4gk)cm{z3rK{=-D)s9&S%AY}i;l``| zF_@FkF87_X9FpyVGo(he=_90%biUgo*lDY^<^Y_MN%XAIZJ=(3oMzkJ7vHI$*@S=c zL5dKX1h|RQlf0NNsnZVh-wPzvJbJStft0NyxNON+dJ7hJIrPS1lIU4!k^yD(U4zZ9;pMhIVS>;tmhP&i1b7V4xkjr(-C)r2)7Z(qksrsPw% z@8n6ZW4t{nA$9oUF3STVkyMS*4UmcHs;EK^DZm_1IZQ;S#+i0}KgMx?3f&^Tvjh(# z+{WuD^)>ORK?VFfp8nfX0UW6eDHZ+jea_eS6@&&Z#&5R zZ@xz3Oyh;y{`KHKzq0+arzr&VMH$K`%c)E?kh!{-nu#lO*P4F~Sv`eAO;8&KQeX6v!I99SG2(Fb)BcLjx<1l~T{jwb_M_Oa+hDRNId8p(bwre7a zs~G~CmX5f8TkdWRm&0FzW5|C5)&t{3APoEe3gtK0aRD_#Eps{2``S23z~yh!o%gtK zqTWYyHC#n{ME2Ep?2tNyr0634*#J{%Eet4qAmb*r`D6JH*%|Ygg8Z$|(%<)1ol2JM zOHBB7e@w=o0JW9*y|7ki#AVD(rJi7hodMHbMe(`*V zbT>$QR1_YiJ$kiU-tojR_BBtzxr4M@dkv)H(2bO()lwGVmlG_|zgSA{yi0mwY9%2{ zULn7f#1#>JoJ0A;@^v_icQQ+X7_x!9Preo;1ug>D$xtQZL@p}6Uxxmn8Bwg+I}0A^ zbGLa*Yh+a3!-apuH*ooa`h9T9E^PtHP>6yF| z?B<5*Pb?vHHF+xXi2;+C@Aryo{XGWt{23;kR$-|miNCD#MoKNx=r~Wk!^f|}=BfwPxM)jxrO5_>lV9hi1^8XY%)*D! zk$wPxjUAm)*I*iX7C#6oD39!YE3aZf4Ll6+vI&#+s&WDXk1xPbFlqCRrN?Qp?fBdG zrv4|zWEAVj_&$kX6DJvPt1u~9~6vsNOYPNApZI{MOnEh=l~xyX_o61 zrn`P~rhiVV^{bPd0ffcJ4r|SEtr|cM+P+4M`ds{#B`E*ENXeH?>-`8;=0Mv;h94pdqE=|!(Qzf z`=5(EksI^#@7`D6ZSQW*zRLs6h|~LmBu0>x&^Qld6($O4@uNH%0Qm0!;VJ!t^@R*~ zs7_dB%i4|ek3dOkrGxc14vWH~h8vl8*XzI}qD8B>pYs4=il>=Zv+MREwE8i!(Lt~a z(q$&Hy!brV+)*=4%aNb$PTeG(+pqiEhYf1Da9XIx2EZjmV6d}FUpH^Qwn5Ll9L)oy zt`O;SAJ9RlE{Gx7HZ{$7ENn6fYvJ82=V!)Sy?&lb?d|TfWE8u)`M3N$13(~NSvMXp z)-t{nO0yx7`b)2?q3`L$p?(YAkK(N(FcmTHGy~BHdn2_JP+HRhep9AGgGq+zf^=|> zk#LY~fW9pEZ32Q-w_&W*@b8OTs zgq587&gx>q*VQz1@iROQf0ctW6ux=4F4)&}I^DZs6Mns8DuMx7gToTE44#f3Z&z8p zW&V0XLC%BEdI%>Hh(WQbEdf|_%|78J=K2iyz1~-;`n`Q(v^wp2~TmwE- z_4E89sZ5>-@AuoAaskVkiG9FUU{>g!_uW-8^&Aa@WijrgOVu51Y5Pi)dNK*syU$`6 zxx@iRxLSWA!c?0f*hYEb2&SP0{;QB6iX%NB(<2TG3H-ec;#w=kT~PYt_~ay+$ebgr zIp(#!`)DN$48XbC_}jRaVi`l|uj{7et6n%vy>4rFt6H&GMom?frAMsulaab=D>7pUVKlWCn8{5H$9e!dGi`$(aCWrb({t=^$*}hR zk&^LO_*r2?QA4I_iMHo^h0MQ&y6$_^SMDvg!!lElO#b;}E}J6fV3bcIbLaJZ&sAvF zjDmrLmsd-syN9;`lHTk*?>T0MP%&q)Lc?ZmY9$158H5;UBtbyqmX&z((zEH^z5CzL z%#PGm-s2jEp3j(*LqiJqd)l=vOX5$F;juG65E|tl%y_07gPItzZ9oWIpC3;MZW2dv ziFHN3O?WB@X0dFaF$80Bhw+WGgz=r)`9A+bl^wWLhKUkX2e8cMko9d)Ev#mfv8Z@> zPlecR|1XrIt^!E>`)UhKlQFyrXY~m1@^?>#&kgtkxR(O`v43+dM)!0hCN_iE#17IW zK1DN>=8#gnC!ooyhUt}SF>hs*)6D^U|EB%^CbRfOyBx z<|DA2QTzzhS^E}68c}j8q%!;t%m@w%zC3)IQm3nXe?}koGc%LtliD|pThYcUl6+?(sBKhe|vvdzeLAQ+e946qH z8sC8G;&Pq-)~Z6{+j4}!d($+#?xDYVaQI>Q9nFHT#+uN0`n#uQ*u;*LRq!6uGiQz< z`rD8ouKT|QAjTIm8{JJ|WTe@3FWA8E989O22q4Bhm#_}V&j}B-{=RTzEIP%&OT>kd zCFmoEUEmqYwek{)GQ;c;W|mVT84WGM0yoDaDi&S%>Y88Y^G5K{Y(Rd^>Kl~DrTgp^ zGERA&0fGT9#(bHTub;6xNNWj`M;Fegn*SXGggr||I|;@!B&F_Ax!48a zI5RvY^cab(+Y1zomnV8;+(h1C9SUC}_bProFZl3LV4w~L^L@xe5FsrzW7UmgtHi7DNfilCygQu>;YIh)P_1ed& zrAuGA>`B4_fQZD%3ww+ow$_AM$tkEq0jqtKQ4x)-^Z6^a27zo zFUxx@OoDWfzpHwsfv~y;C`eX8319<7smu;duc=qucB`$lCP zag-tLVmKRp$X8_I%QdX`5W7ns8=C>sj{yD(4h!Q5YAzXHWI~69%X9_blmCcNph#!m zq{Oans95O0(vABvWr2)WAoFs{BsQWYQR2X&s3ZaA(2(35Pd}=#XKH}>dCnFPA#!_e z1(xGMJ>Zg^UOA>9Ma}{o#r@0|%>h$Mwa+j;WCG19tp5Y=!hT&`Eman~EcIA>Cxh|24Df7mv7cWQ60!W0wV!K2!Y6qEE z{#!D^+aR1R$z#@b4kTIZg2XD>tzmVuF0(&qfBBr$8=jfh0@c8@m!-jqGV=taw3?y@ ziJfh+cn^P4ov`dt!dD0v&DuTWbvr+N5`UFvE>IPM^(p`@gOG!yxMo~?3bKXUhlS^X zrS!Tb(WwXMR%$=b5{Rc=#?&-+&&-2H{hYc0&7C<|H%Q7UYuUB7VX}Jm0;bGkTN{Qc zZ-U!iH>bT0n?t!G`24t-8_SD9h5CQ5n>1xPZ~FuCuXx770oPvc2<5%fd@~N1Kh{gF zYkU+vKPclFOW7E7Tun5h9bSKPlzFF_Eg1V4 z{G{c`-n{E_xQh0QAu1(ibi+^XP-&$o{0*R{v3A~%=6eTh1-WFFojn+bl>zHQ^1y9M z4aZSlfvH6O(<|N6p~;?d%Pllk-w^0sbCgHG&?8lmr6auZBq+De0PSa7slp-yVZk$k z1jZPij`MKr#*u25HXvD!S1xz~mzzNSieS+jfW|&ZGi|pl8E(N^2$dC*uV>yGkZ~}u z;$2HJ)($C;J*9l-r1YnYsB`{ez=dEfu5H~49NVTt=%?+*i?vjY3ucCwf>hst+iwM; zyDZGBoF`4epUfX(=I^=w5Req3FcOk{OZu4M9m?WaI|i%#6S8!%i#W&@xn+TgOH67W za!c{S5e=P_y^ImLac{Q1TdN>+@w_GA2xHisgF5?)anK82sV%6Kg)I?udvRVB+m2#IfRfmwrbCC}4XEfmm{1tao4 zYnZQd`+!Zx&_GnV30oE1#ERz*KO=L)L z9yyYMn`pKwJ!yC_=(t0iAdS8GcyhhmPIAkc zcqrX3wktm@LU^CF90+q1GoEL20^qi!_uZV$i+Czvi*Zm~;#|yFAftp%0bL*~%Hby? z#=GIYXCV1dkYSfsK1H*Xc&crl6OYa(1@#%lE-Ix2z8>VB(1}fV7~u0%+!Wp!dU*%Z z^LU3^VP7>Gm++@VQJ=+GgY=5EK;eNry|UUBjUMn&K9rmHjmFq>JM`k#y_w zwukToy7KlK3nLw4FsumS>r4A_~ z43HGmPd#X*$_fkW0(Yo1YLCW6{%N?gz>JxC z@KkWpq~Mz6#518+BW25^pDYHxEcXukym44_2a;Q^fzxY1vMex4}CD% z{lx@hV%t4biZ%2~o}s&tKD7HF*l1G;`Y2io&Xy38uRnIT=eO3Y^PScH%nFETI=K6d%<8g_kO%S{Y`cq7W>`uUG$$%8>IJ1CVQ%he|^b@ z9usR&<19@?fZq}`NmKxr2_0qvZ+s&pj7~wS;=X54RZt{osQXAMsn26TR4rpI-?Ij( zzJR|SRf4Qo;fH5fnB@qaIZ!xNMn}SkInfD!%6PiXd!E&te7}C?G$H*%3r~j=y8)2~ zpB1II;i(}P6LKQv!h^&HdO(IkCFY9Z zfG8U5(jGvXJ{GV836~3ZNIi|cEwJ+xPX>Y;=`1QYJ{FK{_V$7jI6f>GEKbxNlL$cR zW^%9SN85-Gy#CnilU7ahiOt73Q|L^^Y&a)g4@%?Re|o;T-hFaxJ>GF#;?>UkrB9|P zN2KST7K`ml>#wpAC;p>8aAi|Lr;O7SXkNq+kiw4E^HCA9{9wh*JC1u|Ijse*=5Fu_ zva`atn&fQn|6R||wG)cQgwf1FgK&RX>$vY@TuB;>Zdg45%I^}QT0ShFU^wk%LjM#f zd&*a~297!D^~nKG4iZSd^^>#}QKlRL-{&XP-14rdxKh?|T_S}MIs2){!h?clcAssC zi{Y8e3yn0Qa*Dya-G+a`;zpe3pflEr(HT`z`ZK!z_ug32+M}8dO)yJZ_s7!2P4tAUCTlwVb0x-GD?oke> zZ8;;;@iQ_v*X~GEN!7IAkUk1_`Zs5ZVN|@anpGwpx-ItB@Sj5mbv+%;gW*{}$3U(aa*$WrM+kCteUoqpqEYWbv9nJ9-dJ-RC zq{5UNxpBNdr+kAGP~3CD;4vrCbbp*G21~U8D`|vqAeuR5AS?L2h8O}|_D6<^+4@ll zY0a%pvZe-pyuf>`s+rIecnjKlt~~k0AHl9b#yZ^^R25y^5-evs#Nq~bm=p(+*-(sn zo6=|1ivITvuims{7okbv!_4fGworI2*iHqU0@{@VdA`hk#$+`~_^R3p2z&C{gs2a_ zZd$tVS>2%1wN@CRg)SA+vMoJ~Lpn;7rc$p$vRmt86xm1kLt?*qO&8J=rVbydf?_f+ zCck`cl@pt5^>yP-)3zdjhS7_I@hbtfB8~&P{6>4f(ii$0yOV zBA{rC)-Zv*xP*%?h zET@}i1$Ym$cupLD6uHkb!=>T7^I6+Fr>Ri;;N0CoR%Z@(K5;`A!CORJp|T*toaQxO z1d{|&XK%asQ=zzY$6*sb z54C^EZ-xh=3@gUamgVEc5v9molZ{+VDpAr*Ic#51OMW zFT!|_rWtsn`qKESqKk@Ck zp^=L_`69r|_B^=r66C8>vl`(k{>|d)^H4hrDF3eeEtg|u0}$GaXvqvR9>;2O)O>|0 zj>ZHVhIU_6xZo*{k8K!%bCFG3=rFAWrC04 z1_$!ify~Oq>=sg(n?*R(T~Azv`g`g{RuZrgl&$}Kbsf}Ozei+0f=ECwa#*BG9XphYyZds;=FN`jl_v>I z*?xZ|`;;k_8B?t9nJ@LdSo_1;@pe}z%@WFjM0DzFg7>NlD3RRZ6490Rpt|SqH$icg z;iFO&o;k-62)@gm_({Nf9uA&@X`Z>6!8|4<%gt&CmxWKFJx+RdVjU4HL~({jY~pTk zIGq2}>oL&CnFJep?sdNCm8md7QBHZO+&~c7`9Z9Z0an6RI}b(@v0*dOzX3s#N^0RE!&AP}PUq21pA(-pI^D~5Y_tYlT4aF!kgbx2< zQ~g^KD*ZzTb&xmY>7?BnU68Mg37&LM%1o-^7ny4F$tEL9=K-$f#pw~ecQqSE?WTQhDhvI~q9KlQ|sJNVYqVm(3lau9<40O4Vx1&JWEa_6y10{3SM(flY)LB?t0TxX+$ z_Z8*6GmI>(pT%#GAzBHxzk&Cl8)t0HgUCCx;H5bcPRo0^Hl{NMQ`V9`R+i5h?mJ$#0o%2wpv)90&-LS6bNrTs;Jk-3r z2GL1f>0?$UC(tpb!kA0}Q+}Aw8nO|mMrLNWq3VdU`68%!5$_l83KlUBMDbEO>z}S7 zMy`BB6Z4;A_Cwa`DFB5u!R4A(TM12F)33|2mxbNbPW7l0 zCJ+@kUGROHYliUpj;l93dMt4)K|!ZotnWnp_UoK8Q(;qs+x$k66uGA(#~>C+z}--^O#MDW*QDO z?|z%91Qn6Xy@T{m6o*dKQX_8QXX|fMwC>>M&mUYsMo2G|w~G+TQ_1&~e;A=a*@K4N zSHIICQ{-TsJb}j>Tk$td#M_H9^K6N*g%>RGb30eCVHd2l1i*TZNj5XCngR%kC2ZSU zMVU{jBqmwmJ>5$;!uP=f+~%9=?}&|c@p;jDsEwXW9@}l!*w0^~%}k;i+gz2kcEJaF zuX~}+4^?t#oh^7M&1!HISP?262qB5F6K0hbae6ul9wn{3Os|g?dEqbr@Q$gbfsEMT zfUiFv_RpX&q7EpE-yY^0zHoW*7lcRavj-Q2sb*^)v}@=6*5}0@Dyyf#VINEbpkNAW zq(CMbF8lUCGRk?zT=h#h)-UOP1rm4U320PA|JyK`Fxj~PuTIVwcZtFi2-$)t=yv^W z(<@aoB?WdkHi+4s%wS(fYE0bMXn)UlU2g%a&TcOh9LZu~`ItQ@j& zlosjERN}v&)`2|>~#1}x&|H_$|da3Mw1Hajho$sle!b*&=^ z6hg8J<_jW18RBo?kl%wYDJv!3c%$5oOf;I)gJ9;>EcBavOuKMmXm)U4P`C;Zn zErh9|d^Hzp0XGz|X2*s~@gO8^@Kj5P3Q(FE=)iaK))>w*rYoCt5JxvbheY#Wf6CEu z)AEW}D+UVYsGT@#+|x<7ljy(a^P6O+7e1it>d=|D6Ei`*+8njtjA~cCRQAe>8Nz#i zf{6gJo&e`dJK!7J`#$E8j#lV9IZkwzIM=2Ku#5b8uQkbJ0JfD;F(vnaAekhnr!#20 zl!8FvMcA$(mNyiU-vN<3*#SASrT`wq>rJXgSml1>+Ej?j_7b;&Nwj zRt|4(XWsLHKCnu#PlyTBLvC+nA%z@qD|tnK9U|Sbpylg8f+|uK`J(V!T~PJIkX($?W|Jeh&nnNrB_Ij8jz^mNB zZT;{`LyGLj!4b<}^eJg!A1FJ!*z;?=*!oH;dl+TRveMadOTl~h>y4B<>dQQx(o3J6tM#`SFy4+{3&5N@V)%GpQ+k}sw*zn$~rt)x>C3=JP z#dTGyzbz^Ejsp3ty|(?j3K$@!V5&{;+uOHmk{P1K>{yR_k&Tm_UL1J~WHC92v|HyX zkf8Yo+426WX=tX+;Ti16sywbnSI~j<)Ndfg`K0l@S5VTOBeLeB&C7X@BQAyM-~?0V zs*JX&thbive;-Hqj~1?7jD3*ASi6AI6Qjx4aFg1$=Jw0f3HqXyH0ojZa=CIBliiLC z|5l7HePVS`UJx`7UthIDkLn4h3=L4PRa26?}AnvSp9C{ z`N*Bv)8WQ(opQ)~SV4uNIw8(W@n@3NXk{I=exY&q*T`Y4e1}*{U79QL{j6mXGT7h~ zz4SBB{fU(6E)%RNkUi*}bXA2Jm9irOV!O=9NcW;sDEm$rC6>S7`UL;B4XLGKdKHMOUjVzR7hfCk%H5?xBoZuA#Dg4qJ zexn^I34kK>LAd=a7yqcGXNO1E6J^f`8+NyCrRbnkYBBkqg^2!H{!hy?F2_P=<;`l_ zm&Jz;6?~%CT5~x-51)xK<;)X>lY|kRO>$mCtP9f3iSWyKrB@Jw!*Oj>3Jjth z2wfTQk&ZP`5jAPAdk&g<%Z!_(Gby(S^TL8I$Nn&6{}U6!ByNyMai26T{CAMuf%#%P zjJ)GVM<5HDn&l;d@Ma^(17@_>dwGk!I3+P~dM2H1oZJLrt}Tnng@kGU`==mj2kUIK z!T+)V3#u)^ERPtwNEdMVa04%*kpFYm>5(>?Hf5lZ?~@hP?Y`Pr#lNxqIW0euTiIs;Ltpq>NkbTr{BR>?>5~2+2 zs_ev(3mdz97e)!Z-2Z)~jjDcxtNbx*Ye-Qdd7mK@4i;+BF7tUBf=2% zK4FZ&*5gk~lSytz3JKD0T!$lgrBC`KQEW?X!~U%?;4s3Twhx01sbhb_pD8K#q*S~? zkQp3NFQC}=m5-N&aX`Ot$dH+g2)@OSHfk*}0%IZ>E)y&KQOV3RCH}kB!jsA%D#7vo zI|Nqk^IulJLEIS}Vd~ybrCT1659H{fzm+Wrl1b@OWzGTz5mZRWt)w1&+0`cY-xI$j zj@YXx;7R_o^Y_+r<)VY7qKuSiVClZb zD4}2Wm2+4gXW0ICi=IWJcG_x(H336g7%&PkAWCDHhPzB%Z}cFX~K2Yt#Q26ib1Sq6EpzA0WSLjp*nT9hz zIPNKu9vW@OtqdD+iciorDiydA3po#%3-=M6t5wqL_~qA~qMDqbI1H-e&iqvsst~s6?K0 znTNy=GR##Gy18IOpIspTOj+t3r9c*XuL2m-QGvoA`WebXy#?+<6-4}}9?_+}Idez= zU0^#xdv1!SAsUS^0TAo0g1oqLhfcF*5WX;h#-eek0^v<$pcIgv0PiX=X3Yd}=n2i9 zuNFj{P)qhH=nUtEGJLV3!bPq{FkxnZho``-mAIx23D&{}03{nh6HFzTEy3%l&RJaE zjy{#){x`Vwv`6=H))lL3tz!TQ83R$V9K7@8X7f#;4*n^pfX* znuu}pgwkN-^~?T0H-BC79&0yky8~n4-wc5(;B}`7BK`2KGY59Upfj-1j%`Z!fXAan z9o`3yKcxu_qLTJ3)`A3}on`Vn*UJkKU~{X#g^>B{n_b|@r$XK$hJ>9W7~nVaKGnMN z#kWb=Tp};w<-@a+!(P^Zu15l_1wwZ_z$N!q*;{pg!nYE&1BKK#?l!BSSpnaGs%66Y zzE65dNnK{|4w3>+{QsHkP5H!BP<9;0%|i694zwUu&4cK}X3(wb)9IBLHg0mKAPCV^ zV2OSUF8X`AbVp^J#KR$B$l_3WoDa2;OhIl_z)eW=Ad!KuJ(x_zbu8@(21KS^9`)*- zR_^3yNA!S3>-q4T570)THz?691a^bw8fy>WKP)yzs!^7~Aht`@*cTOSeN}*KzfEze zdkP&y6=>?`zD`y2Si+r3u`ErV{z9@wI}m>nc;yBz_={nEC?THfKo{@%Vshi)?6?GS z>8w~V)phK;MxE0h4BqR8S4pOQZ$2rRYWQH=8_|)OyL7+R3|ol-O|{*sv^E+&1=ky zWSFOQfcR(Hnt#&zxmEW9G?#A$iW943^PeY&i3t_Z_-J|^V!H!@3PiF2J z$2S#Ry^59qYjv|P`_pXlPzKB<5JDBX@|5NHLh-5Tw5F{8+q6Z|@q&~ACOZ!517!LL zHFYf-;@^;el#=QD)g7ox@|pgWbh6t z%#Et17|e7?BRs>TL^s5+*%F*pnZ~auAP6IGCj3mKlxb<{sAx_IZ+TzFurSLCdR6>8 z_1ADOh1+>1{LO-0PgCcwbN{YWYz+Uf^LsUF$+cFO7xbQ2Jq>JqixJ#Xjp13T*U;(l z%6(YBjumk7A7T$fxyLoBYF_M_OI_!b9i5?7gjvJ+*U|uLZCIRVzvCF+ZsT2_Jp*ZAhB2%dZ1LzgVg_RRLrJsm;C{=OEo> zgne+9!|G{HGGZ5*?0!Tsz5GQq^Ixn0c1S8Z!;yQzJndiMzbxw&?#I@5_PgxuXRptk z7~5r#U#LsCJJ6`};+CU@9Ly%&jK9bkcY;hqbIiLHIuR`sFVQc#Wo++lalqTwtaOxi zc*J|Q19bSe($}kec0;15IXt2!Wx`L_h`TY*0)!(czC*=dy2?P#VDHDJfb!3Qbb*N- z4j2uM#f=fE5qV(-MJ0Vm%diW~njC|1J6e{m{MFNgGVP#_H)P#La30tYR-c7L*Fp1n zngwME?m2U3TD-b8!wY$~0Atr5u93B>ky!obsX!@qivFq7iH3PZ)Pk*X?va%zM%FK& zM)BU5Y_P*8_(%-zt2I#d%czw;nf;JNVzb6uSGNu-JNaX#a!boPyyh*1fEj5#pEj=< zQgcZ-=N
Sy5IL63lkgen*3W z)_#MK+iY(NA85+j6x0;|S774Pr`Pl6t*HNxrtc1<`uqP!;+A!HDSK}&uB?zk zWy>riJ1gsQFS#E!hv#qxZNz$*Ue{;tEtATVir6=$2Z8av#FC;DKLho{oURcl~oNmi^>N zMe0ic8Fl`x-xvDqY3LcRDrm>nFN0wzx)>DsxiIQ%E8e$;=iv^5lmJl?eiDKx`gbby z0d_V^-ypZm#xqA}^sr`~;oc9wdA@0Z_v|dTC;jB9G;p8o{v{9ooFFGAOG0-0`cUxJ z*q>haovST3Bdkd6$FpF@f4z!322S?HQ!rT$!QbiT6ul7J@Y5Im7|cJHaEkLYK$)n* zG_?DvcH~=ms&vdXDE6f;1a5ov`0eMUJ6%2dI1aKTFFV|iB>$*cX`>5zR&-^LMX6V0 zUGHKU}+VNJ5$H8U4QkjE-hUH1$W5^cCPoakmw=pVBD zc^>ljqU`!p0RPaB7n!)j#s)u-a~~%{ut&4B9Rupqz|g*D@ArgxC$FjV*EB(babk-} ztNt==nr9prF?+Bz`#qwJI6njUpI4?4R!55Jl0lhr^FaB;z{=Pd3l4V245CSddjF)m zIz_3@HW4jn6T(a^zMfXRd)1h=)oSG`h7T!Me((2d^q0m4oY*TEM7dPE>I);qL?d@} z+ot8K+OLpKI0i>V4)J{hEIs>iz_dY7{wsyc=n(oj)kgO~3aD)rRSflKjAI8I) zcTKf3$nsM!wp0?-Bw|EhvY0OaFl=Buo?I+zTN5*{h`5;^CN02HX1=VFA+Z1QNk1s4 zjH*M|)Ww1p307rwBj2}mfQwT{o&!@2EB`6vxE6-idcxC$AfdDECm`e_Bjj^i5bp5c zDkebBIc_sPy&aB5vG@*(j8q4s1df#V$q|@9(=LTq=Nh969pN6D-%7^_(e@|KlNoZV zCDN?BnCuhwX-(E2pK+XR)V3iaGi+5~V2^)_M#0D7UCYt1pA*fH^~V``gc)K4(@zjQ z_^${z>2(yy^EDgeQ`sgrlcOdnKA-G)Mkqq+{iayn=$@=(qm|7D7%!P!p~cH>7FJF@_YX*JWI>0_ zKb-;mqSfmZN_V2sM59@rG_eztaV3U0K^;eyLMy5P`qV z(=Z;kfmt?@riFQ9h~32Dg6YNk7Bna%s`lMCOiqevZt$zI3a&R?7M=ztRAlE*CC%$? z;&X=GQOA%np5=>W`jQ1#1lKbtl;`H4)>Ex(Xy>?oY(r?M>NmJ%yAtY_5JiSSP@1%w z^?SZ3MCFZSJ`&^{y|>}FO9LrGYkZgK5brDwdaj&Oy?%*ygs`4wsuj))!4DY9IK>2W ztq?O7I`xy(up?M3%AIx~PL|p0a;~NKEhiN&J~0D09$1d`TrQHVW2`4>BS%?MAiCJO zW#3@QgiXfd8P_#&S5nmOZ7zMupl9^oRq5UE%xv$~p5x>PyBTDoe@9LeMI+is?C2fY zvy^tyT+nwlsl1MuL7pVOoGkbH=?BZB^ISELftx({B!ngi4?L(oXyu}Iy)9B$LlbmF&BBVb^3O z;hsibKt(NSnHV&Lpv96b5u?zHDFlYR&J!M1Vq4h}&iy(%c<{DVtImKp-@lY8H|64gx%YeD^-8&y@YtKpiH_~N@AKysuP%r?^Xyup7q zwYfZ8Ulz#b`uwy;@m!Pr)5>;(5%++d?;w8j_s6B=mV4-1Dg!?WW&c3NFcHF)2&Xs> z+;d+q&^U0&W=i{k%70pV=fTF<`yLZ}Law5&5yd{hjS2_5P||QypO?4I7T1sYG>N0^ zy0YRd=JR6&5esLCX+dE$GE^m3By+KXbE4HeSGMo}tmJrgNQufQ(kdPh4>fBbE57ga z5<{zrDd98TJVg1>Zbjv&Roe}|q1C}?bMLw!;=71Wm!|?Z^p|c-TA;pLJiEN4&vGkX zYwi}J|0CijQ_~|Q43aAPVg}dvir3*k;>o@K2U(b9-J=U$m!gPU#CkK|c^GrPBp&A- zFX-swt!5%l4UVRxGGIp8iGN-Wv6op+w%B#NdwOhX|D@xJ0dMy!*dJK$e8DT|r-Xqv zLC&~msJ%jDpe*!jucCn#`FOg;LT&8zr8EYE3q#D0?1`FH8KnwhC`)z~7v$0GJzfcC z8ZLguZ)GlQvw2;-`QwYFq->u;R!M#@&6X7*sgTcDROl($de%4yYch)U^kKSfIBK^~(WYar)Pj=+?Dq4obC|kZ16FB6<_e=G5;ZOZe zyEeg~lBDEs6DFijBHF*cEpFJQD~pvN7G3iB;gzk7H_bI^|L`lzG&e+tsn^?7`^R8# zexAUZ>QHYaffDJ!IWz8IcEw_-2$NC592GX)W zL$Xa#?37zWAAhqDkf#-gD^eJ(%3hi{2XO0m7ueJv8^IaOMD)dHWJCREbKya878y0Phq}K&)&EgpJ>oE`qeX4p zG2-QeRh2s$>87NH5h(#Tk9Pt7Tvz4COZARx&{6y`>WRbd*BlWO0Y5+o)tmlat5!rK zR>k_9I^#IO>!Oewv#U8@tN2P|n&GmFtTz{#FI`r42F11(2P9qi{TpCS@GddBjHGtSb;g0I2{Yt^@zW0jlKTEv<}`$*f^jGA_hZxK98OzD#2 zd52|8_L$?R`jtgxW0ZXKsfy1t%#iQ2fVeUUnV8g7yWT@usDMkh4Boy7gy?&oDX!(8 zpxjs*)?gx%PFqH7B)8GuaE#DH-~H~psA(F!cn-gU;n%Dv7I1-Z@Pd1pP-YwjnQzVX zJ8yp=Cq+;tx9sUt&ES4t$&#CBj@}wW&Jo0q?VUEHKng>jw)6wHzTik-8|A?9 z|6`)cB`I_@znS>>MaQ_}4$Yu454Bex{5CeC)iqCF06Vdo{C>gD zNgU54ZJ!p`>2dPQBi}|UPB^krc@WKRVEEr?c^6|$T3UJHWo_~2?JGp&%!@8;G^tq6 zRAfXqlp!(3>ZFp9BzWn$yUKX@afe^aK(wQpc}}*>xA^%g_0P`;!E%B78IZD1&Jb$z zB0&)WdBXbaHs)=%f!QIIH%drfwjDV(pN@64iYGGVM1(Evux`rYj<6cW78x=GYj#r2 zGrZ#SVcy%H#axHt2oKrwl6}`=s}&~U9Yjb>g*tsfigliol=LNJYK(Ldc_Bv3z|M~v zo>G3}$cXaDU(|{2aOXcY90+;N2{Hxgg}O}|mGbXn*SM-_22wk0b2-;8eZizx=Dv!_ znwvmWz;pcnXm|4TCgib5Grq&_^g6#JoQ59ts9Svi90mn;WvV_J4DK$cjy zx1h{ZW`p9SxCi;UhHd%~baS+cTC`gjP_ivgNYDF%{(9+*o`GCI+0An{nihwaIxYMR zYWre^c7=|>ZrTOLJ&fgHht(0xfE8wd*&%S|XoIVT_KFBa`J!0C?ixFyC3HPzxtl;s z?YS^H@w~rnC$h##E0FH6(~H3|g+P>dHgM%<-}2+?rrqj2QR9qbDIylisS5rCuOV>B zoOjn^>bnbo@Bgq<*72+{EiCvB&EV;6E2jOhs^?WHdjc#KoCd;w8g~1Aomdwc7Hbq` zrDv=g{o05lD@IX*0I~hVNG0=3HfuEAj+9yvHhGW2_PTnI1bh-y_J1$=e{ZbO9}irV zJ5uR;!p76~!SugU79hZlbtFeTfqQhbdX2lwAN_osH_X8j`wDumHL>ve6}IX2M< zyMq$GVK_rozx7^rwRp?~PVvI71 z7Z~Gj?{0NHePD^?ntSdf?!xIsV{QiRnQCOKS*zaDg!8%-3&QKE*BSsi{Pwq4|CanIn;5?A_N0u5Q*4=GfYYjougS?mbxePs_RM2yl#bVQ8o5(B z6fs@&_;kWh`Q@5p(eK$bgLK!7NQoebElRT#p3|+4@j~I=37kRV1mQa>i#-2P(a2I1y+!SilAZLUrnrW|UWhGx&Wv>wBqzW~U`ga5+W zJ8>rJ<-2|>z7?kBMp42o8eg%WKax}U<&KqKA(o>FN_#g|)1hO<^O(>v#p!)nS1Q+B z?cILgLk>zZS@Ndng*D&h zBZ=%oJ=(_9Uzmn#>ZE*EUih?ItJe;{v&)J;{(dlfQgs$EC$e9ilRh@5-fZm19(1NAWNJ_|^@Oid}T@n|xxs9uQKe&;3@u)w# z$8`F6$}7?nar&YvH|soIEwUb+4PwJD~@^s^kIA)5-MB?0(< z6-*;7OP-msZWT=g3IlyX&pq{9eAz#Ry6wb*)2!e}F85XDvD03h(;!nQoR}MoPi`K)0(ucwe@;Gp;3k>^<)&=4 zXuUBfE;bRZ;1NfJMOoJZB0oR(CyS?Af=#6f9nmj22JWB2L&kQv{}KT7hFHy29_>lv z@#n5HO8E#rsKhe=Dg?_`+u?yYysyUCu9<#YQgh=um7GK5Qjq8rOV-1*F;jR(rrEl? zTv6PcKZa2ub&FCZIuA1wk{$HmL3;IEH&UkYWS?J1^X6`VnuN<9K)EW!l%v9oWh$2I zG+Di}5xdLVge=*b);!5b4S>(`I+Db{+wL(_>u7C^*r}MfI>@=yE;pZctkXucNZKN{ z`sy>uk{^(UF4$SA5b?UapMU=?yp7bTMOI;Ri~#&+(Yj`$k|{lRMtg12nPvNvh7}i2 z%inJsSuJL4>KK=gkKEaa(G0zQGrpjj=v94Q3V5iFp#Ex`?&Wt|GB#F=l1~9-$7=a% z1C0u6xBDHJ1MMjrVnUagq@H{zp_qL+os^p%Cu_jglSMOsO3& zLI~RdLd`JuT{-YuM`w2OhW-ym+h>>TmwF1hx&phQ%s&2@=A^bw{gXga$c_tP#f0Wr#|;mnoT%=x=KzlV$3n+xQE~ zz6|nh82(qcVO)-W;cVQfUWMnkl|*|UFBJ#3r6ZU6B#Cb?I(e&&|i80mPL|0yU@8hAO}t{VA| zZg=cQ2Kc4s_q{_2IXnCrUHm_zrifF9v4@>sWe|8x8%n$R&MU`{_WIj(w+YAKXzQi6w#63WEi069I$`k9$D&^LAi;DH+|bZP#e(MLr_+h>LY<(8K< z)=}uN1NCo@4Pz|wErsWZ{yL zQhA%JgCJ|8+eD^L;VrQuvhz!WT8{UUZocb6^;dqBJ1Mj{O^`t%@K5EH`?gdw)Ft^y z7{&fe*}L40u=z_oCs4n{Rv2`nB`81k(M8lF(p#ja)Z>2v%5eLT)LxLAPG5bTJE27MI#qn_Im6b~Zw_-lbjVGI7dbgqQYn-uJWv zMeJ~-MsnUcj(j9`rss5q!^ zioa6tEL(NIlw}jG{~|&2ubaSdH2G#a617zA7nSw6Q%L9+iCxq?pNM~O-?VwTmp^ac zz2+Y-;p1V9St2q(%YJY1z7M3L2-H0Y(x6_uLA}nuUg!Z|Pob;E(9@*7&NYw;RB%0w ztpMmv!qGq!ICVM-u`vGQPA)Ai5r}{)hQcK?V3J5YLJ=eHLLPAwC38fO(wrEYj&N$3 zww-xU!zJ(GaZT(I38T7^%B!`HU*L1TW#65j{P`35nmr5zTox&)>vUUb(Sd5ew?V7E zv|N=BGWSltz1z;yhg-ep{zPj;A4Z~fVL-k`ixlmWKG=&90jTS~uhSa!T&K$febJUb z@Y(PhuP(olh<#fOJxpjm%#VIQ^W8r{{*%^h#K*FPMY$F#Ge!8KrU|Ju%^fL?47!rI zLAH@+dy6#(*CVvs=$sob9Ek@-Eo=8;kBzQ9Ui?)$CHs4ypp#U6J;G}|lqI(qQ(uP9 zp&88H?&HgN0k_*?tOx2s#Q2X3^O1;BgQS!q4#VxwomrL~9Y8jk==uWdYoPNVw0_PRKzFC!GHsBo^ zUOW?v7qYtW)%<`}W&`D%6f-wjoL)NO6O$4h_l{j_UhR(G=dNL*4NISh zp(`bp*M1qy$QPb=sCBMlHkWF?Qb#CD->YO(22xT9((|XqTJdGC^B8%vjc6FL7@qt~ z#mY2iSupt{n$u@{&TV3mk%E72Ohb>aiL`j0qC$Q|FGt56vF<-Vi_*4};0hSX@+S`8 z$fJV)g0C%0m}|1V>1zpcZ#7Bmn_)Si{P>z(MECDQj2r4W%Bg3`({f@X;Pjc3QWkTC zNUmX?C`jn89E6 zAndk{uuS>v+y*qB;W`V_=3?C%FpnP8*V{kbvfq*KM}BtYFIE}RIk#Wml$h52HZZjl zZZRL$x5Rcx{a0nWIUss%$=x>iyT;c9M-(vZn8RScyff#hW zTvAo$p2Nvd`jQ`KP(pp*+a4yu+cXf?$3&hfqf(#PkeB~1p;B=~)3_ZnsQ=KQXJv#NGsRKatul^ZGG zkm;*A-dxc)D3MwrHf)ojvEx0*=$tS*1aBopm8ZmrW8(7km^Gh^XPGdU-j8}|lS$t7 z_`ZW24dI1dQL*9SHipl>RAO|t1?em@EV9e~l`R|H)`wuOLFGQzIVB+c;>?&<(f&b0 z0NQP&pmvOXXZ7PokO|@6!3S?c%zBCMxnJurI(^Bf(>DekVndn7X}y6`D7}}Dc0?Xt zRSLsQzuQFuJbeW<1y_Vsjd}Tvp%TPRf)NKFaTjY=wSzdc8Wdbib4A=Qhn?$WF>k-p zH}**szJ3sttIi4ip!BDHugN%sqXR{OPf#Dw`2X>*9q+=-Q16!j11msyj%k+ZZVZN! zG5It0ot0ZA@UV*v*dTU*0#)L++IUG{X)p!-36r@xe~EyhWfvkWFZkH!H?+xmuMY8^ zkl5mzN;+o50p^{4vkA$+I#MP)DEB5P=9RZ7&OOujB`*!B9_H(RR3=g z5O||7SR?42$vew*3`0Bvz|7miw9GeCEL;kC&mJ&nQ&(QV+X7^0HFed|)&w!5ZGI3V ze%MA>b4Y}OTSof-76KB#!gZqc-Z5etggTs;>!AyJ`R?SB7e2A2i`~jc0(|Tms&={v zGK)b6>ZOWuUyH@;@dZ^I{r4IY7V@(7-3&$le`Z>e>yX!Cw@wKpo+_Gk$wzHd^MEhW z3Kgrib*K6=w(RNelDQIeAlH%BHCDyD=9DX!{wrF8uV^+vkuOFPNS0UVV<<(P0C~I3 zcj)Nnu#hp^@X3ph>hg^I|GJa=AofOEn84-SAVdhe?*D%M<(u;_-JJYqM~LX~jge)z z;w0RE{g7SO=!KBL*T3Sw^|Cc>N&zaSqks+osAho-*kLWQtgsmtW5PB_rb#*vLWNm9 zQT*bgTt|tsqMW-|p;oYcK!b^i7zt8mK`yJ5B+1&E}kxH zObA&D`FJKA+%BKEWL4K21PCYxa_1Yu0*rUgv$fO-=e04ka)!|NE7K}i>mXAp@N;37 zCRv8y!)T&z<-b6)>#kG10MwcT#tf&g#8-!1ni!&jio>@Q6lc{5qpdLcZ>5aL&P^Ac z%f1h3KW`1J)&c0wqYdK;a#;7IJVkPhx zKitTA-S}4-G}JK)jsV0LSEDd6CEBRyL_%cIku%B z|Bm(q=QeKoX-mo4HGE^VXDxy0;UFW~p_%^;O#TjRiwSy|1&C`=el@e=CU3DA^s5Ls zi><(#MAkL`GMNwD9~U+6Vql}If}^8FGCVUr>Tk2n*`+cT#(8ryos;0057T!tZv+5b zIWv~N%_9unU7qe!_(*|p)txEVKGtl$N;vS==M!fWZ5wkfixywKlYdMY+4?o(oCuj1 zE*u(E#Bt-ck*~*=yI;waOuyv?S|I9}7hA$M`fUhj{D<#v72+?1v%cDb2arz^7pBOv zR|X*-ZAS>+V`s=T49YZ=>j@-~OLo3gm|_}hv`8yB{t!-7WeiKs&nA(%=NL-zb!|fb z_`RF!F9KkQQGMbWAus{uYI^w zCS#0T$_vm~W?z6|F^dbZ+=o0jQhCM|In~%VxW#41rCO}VUPf-{*_^H-(?2t&jFSp(> z?Ngp~8OVR$vCB(RyW%J46q0n7S;EPtt@thPG%r|m&9-J@nxeSIMgF$bn{sYXY_p@W6Ggz;i zsQuyC&A8)l4AZPh&k!>vuW7%J+dz@aM=QXo#Tv5w>W);9yQcs~ z19Ev5POC$OcDpLuO(m|k@v~uDJ<5V^8AFFZ+k^%c2;+&`I#dNXzxlx69EUlI!$9rN zF&)c|UR=gx+xIY%=7%sVoE^7fZ?;OvYnU;W<0+2_nU@M=DrqY+aE%RifDr3$tgmWE zHEag2TDP(^1PXzDY$jQ|JFH-{-|z?>H*F>o)3K>4oe$`wKEjg{b0vYS_$fe$iqv?b z0lO2h4Q>yawX|9TKdc!rKX7E+2M{R)|MVu-X@Dz2Ggrgk0M6Z5-lYG;KPIsGbdKvM z^FD)(iZT1+h*Hjd<=n44ETb4}a9x<~%>ebWZ1~cw@80^DkZUZ4l4(>X=C5OR^BKd^ za7QvPR14mu%aJkcC0W8uhgYGVaPHJdMAY27K0)xC_4COeP%$`{`7!>U^@n@Uh&|t0 zUGx{ViDRow-3k_%dl}e!n($BPaHwB4a?27mvwR`;lyGLzrEk&{{Xc=H90TXWj((Zx z?={Y1MwlL{*^gV=C&u&tnL`^I3Bb$S={$?1 z)pQ|+YJmfI`Jx>IT_Ex*!$(v)d0xm+_XAJ+PDkK7MpPQ-?@m*2{P6)Yt{pe=ZYPH(SHhh{agYla&9u< zxlsg~?OloY#h-yUE0T6jB0;v!PD@xs+l$JZQ~v zP-pgO@%;UK6=3XaP;sBS1L~n`;mci7Fm5i~Iav0Ch@0(fhMDD0uUSbq7NvFUfd(Ur zKTf-#mh|*+L1rkJM_<;JjQWU?och8*!ogS_u#3=X=&lI0i^&^39oLi&7r-B9(@n)t zimiLc9BJ}cb2d-4h=~lUfQ=Isb&FE_0sV!F8=C~%Xe>*w$D>eWtSGrfA5;})loDzc z*$&D-@SfzISL2N7@EBD2QR3I5eSz*i9mig50~l)1)hwy>tf0-^^1p{)N<}j&6?x2d z!sdWO<%bYv^_wRo4rC@d7&VdZd5iOaGcdMcLW{sl$H*y3*LD9nv1(wsBp@f<{H7+! zC#SDJdRb*h3UbX2mJEu!1J0jg4ek9$R&?ND<(BVS|j5Q6S9{6(2ROv*_u`str z;urKA(4ZBV5FD!J!@U|lCXAAP6RplW!yL)QHxC$?AN5~Ep0BHn=D~+- zwKVW&;8lnW^d%pJMTN*4(O29Nrda>hUD zOOc`#A_w#u0(ufc66426u#4ulOl+7lh=ZalBa898Gfrtv=jpH01bzGTaB@@BjXS?h= zNR!KH>&LgMm^-LJ`lb)`+)^r5fQNZbRFnW-BKkw=XRaPE)X8k9bl~1P{jLDiOf%2n zXtKwG|2wuNV$1<{%!+ zjTzNR+h8X56IhlcjwGfIF)gw=D-8rQ+!M;fI}ltXVs@wW43JYlHYIex8tX{5WIouF zI9SaFtLH0%bJ&jB(Y;-`@2W(DU&K6ljc57Z!HU5DYig55O`Gl8zo;}ElKQk0nfyYu zBXLy@1?)webvR6qQ(FHOST|gIqVDxHW2NnMQ?{|Zi5OtO0Ud57YfLw_=Vt!B|GxjX zi0JpLmNAm#6a}NgVm@#iX z+`#6qk;`58GEI#YO;}%O4BR1Or<6o2=-MlsX4WMjqR$eDaNN;ne_05g#uJ;M&{JC= zx#XPLP#wBU%*RLn6s3h7y*e*>S?dg&%mhZlV1NkC{?$R+!{k1{@6|VHLCicm6lH_m z)yLEoxucU<2kOA%+IE*3Cyi+s*cV%$I}m+1Ua_+wx++Kl9(){Q5xEELyy}k4{qFSC z$}kL$Bmb$RGEwfiCn*B|7z8)$VMdbRl30T}r=&LWHjnKTOdRCCpV?rmn76JPE4H)g z-?xHz8S3m)ZLS%vYO%4Qz2lQChH4(vCfG!K&ZHCOA~|zt7&QHE?Yl*ow^%e7WR{Y4 zCCihv>?9BE4`3xU-0YFjldnkXItaF=fyN7x{a9vdl?s_+QH$^vyJjQB6(N%=0 zVA2a<^~h+H{Zph2swaBC2+Id5P2oJ$1C$tZd@Cs?05z(<^YbfT9_4BFvM*&V9lsvB zje~RsO&mjvDQnswEZC;nkj=wx7P%WWWsIr^KNkhWt4qnPEv=_HZ^WBKiAEd6HU>wF#5qCi`hvrtJlj`4(fi#z^o_gmey%tZ-Zndv~Hqy#OJI_W~$;%c-QQ*x1cmdB<86UX8TFRXjCWgqbsP$ ze!xpH_av|7b{xRBSPM19-dJ#Ipz?jKhoE%gX2xyLln;Mcg&t|+%bD9yry2Lx66?&=}nv zBv|Ch=qlfpf|myB40H77WTaLg3-nUTEk=@No^SQ3*hi!l?kcXW=AS~_%Xx5M@@r;l zTFY6mZe+PIjxZ_JgM~46 zL{Nj*FL6PL*18_|q_1dS|AL6PADGVFQdwMb41UiX#X>jdep~0zE!GH}Mns`gj2=#k zLj5OTz-NYQUVbJP$&I<=LYy=k5kz8_kj?BaZw{<+GWj~KVtF3@Woe~Pvzy&MLBf!^ zgGi4u3oHLNiB|-%Fcc0{;43aBh16MQQK0Z`@ISg0ic$TTlmR;fRK6e7s;pIvHe%TR zxQo_|jo#8^k!>3VlB8{Wmr$2Cw}Fu7j}3y;7Sh7v55$b@3|2@VN7&`>T|!*)ptiZj zx%PAkhHw1s55$pxXCWFDodXg^^UZ!SRE!8wtwx|fPNQ{guovjBco$JS`(0516kXu2 z+>fB|OHllWjwJ;zdr=U;f>w!XQv#=VMQN1Bj5T_bH6AbP#Jw)Kia|H9h4Dz;B%d(8 z4uxYu%8oHVCI-zyRS3<~Jwx4&N%5WKg^Y!}%l!mR>V-Gl!Z*8YQfTpi>7**nmr%b& zj-!A+V!?TP!#WE%$oalEY(4v@|a-_wmhwGv5PO z)4`9Z6ev&t=P7rASz*@Z1B@FoW-HQx2Z_0qX??#EFKwu}6(RH<6+jsUv0d+=Mhy`; zh#+5{bh{40Ky4cT_Zc0dIyJK_=B$+(;hYu3h(&Yk4avreT9t+b1L?yFT`Z+6uxaAR zhw!pbH&Ag?$6!J$)M62jzxn|wH8M(bWF zgV?Q!3!;lLXfc$<719ED@Ros=nQa{d{tOY19Qu_d?$9|Z8~3CiGy#0958P*CQAJmT z2RyjhCt8DX%`U48Y@IPxn5C?V_95>g#ltfwoM2q^l>fbq%)>}VCHLW@=*86gKOX%G##E_i5+a4G@Q89Hf5@WrUtY}Tn|wV<=b zk#^LHOEesB5z!1ABMHS=vAx#>)-=v9%8lz(8Np0xEB4*>!S52ZNefBrGGiMq>oWvp zhI!Bz+Lw2putZ&3GQyog^}xjA{BN2dYy^+a+bekibMHv5Tm#(Fq8cLR|jq6`&B!bV%gv%1JB^*s3;43PC0#2>L_U0LU!kh$^PCIgkU(jM^OeRPt(2(NWN-?n(3h~Sc{9Ym73GG16=2dYsQOj)5 zFcx$U;b8TO#lozOdzpdlfCf|1+j@r)=#fqdhPP;OH;}^U@Oxe$Iy?m)Og&;qqxGbf zN!V;NmDSBTon>Q* z9=Mga&p75Nzcye8P9OGJKh|2K#d37%Y%3vzcVOh562h5GJkTIZQLc7Q_SvTE8+H7w zZR4|xG{SYGw%F6!X#pslm_pCE)1D!m3L$g-isouF6pK!Qhj^#L5zd(|vrO}h&+xBI zKo)O{z|DMH(Py+TLu#FS6sHVgjYFEEXoTBb+IKHn#|}cf*;nD14nON@$B?*M+HcAR zFOw}1_}BBn_gXlX_su)38=Axcm+RwoVNI51^~=P_od$;gMtNC9Kc50NX*1M|ZQusH zZT%fFPV5G;8Av^|x1^gfMcXo=D~{zRy0T4ID86q%LGL%#JgG8+I$Mp+Wf;i>FsEfiWsR5{U0g%m z1>#h1dZ8StM_5dUU>H^W5_ew{W^g_Yv)tu{*OOId)yy|Hvzte$=Un!>WPV}73QKvd zPZ@M)_f^^eq69pj&j*6DTXqOtViJKmaiH=j;2-I#n@( zS`k*QR`{dR(oO|k4`BF$Qe|`=egU0A--g&tG<7ThN2=O78M?xqu{?_X?HUHo807_7 zsV%qWONmQt)OgfBZDxBwYITOzaV%Ovv|jWJijmk@=~d=U`{lzWg7DtmfgmQUQtL*Q zb8uTH$`9tSD#;FG*rT8a#s*NL*auAgbw$n9aGCqEx@LLCsC=>RG&i&WkmMO=h5grq zluQJ{{4kX~l}R+J{Bu)P{Nb}&41xmq=gXzk{Nuhr4QGX!sWQkjSUpE<{0?e7@-V-; zSEQGBTu?JAD|#SsASnCJVS@RKo7VVrYquDBSKz9}HU1~ylrM)lXq{nb+5lcDUiwXM zCTRFWY7J$NhKm|LzntXH!)5}umJE?)XY$rS-&;23WPv&QlpqLhI9JkCf_Xwh%_nP? zJ{IXZ&@p2plH`8mA&JZ{F;d8AQ%i+4=+MLgl=TrX`^73 zZU^;%hv;qGrtXjiO73}Vr@sk`Wbp#2HE#BV&4?1#&`q#*;iP?H!wm#^jXsG8<}CN2 z+27`G>GDBJ!bc}!T2KeLKLxjdteUx7S?ib((mi10Op}|2vBlo-k|elMyA8q zP;homaza6h#g$su<@EzHQ>q&2Kp2SKPDb~a7;Sc@ffsH>ebxa z=E*sYK!8{$`7L-Dg?Nm9`4XJS1%pzCQZmqCJOxCz#>ix}O$mG9@8a#N;>HuT){W=x z8-Hzo*YuLatCaXkXHAaA_?~iKw7`&<-i4EpqHE(qStFi5|Eh|HeHHZO^8A^SqJaK7 zqaoyR0eUugdw~o^%Zo~vhV*|#4Mox#PoSPzV#6PU__QPkHrjdk(rDa!%C=I*TG}EJk*#Uc7k0$!d66SJ=2csh+<){}&Iw z@i;Q_1?RG%K&J3IXZ@b@pshQ6PnTs* zAG@tMKlXwmop0@m(JAt_aASW?)FuX^{p>B zUtef(2fYQSjOq--_hY_W=~N@gt#5HJ8PqB+_EtvbE3_WPZh0S0eNt3UiXlnl?ZMuA zS5Z|ZC;aqxwikkK1lhmqI(KJK?fXb>DL?@$ z!NI}Iubmq_Y`=c}`dH7aBhg+Svott9KE7$rkmveZFo2iYZZ!lY7%i zT`j*%%OzRaB(v+&Q-_mRGV3^#8>Tl_bSxrhP8XaXEtK^MoBipZZz7zLFMlxKBo%GL6QU(jQS!eNg&iY_yzGow3VN@(R=QG`p2oL% ztqvCGHjDKc3?@lZwQ&4Bbm;3zA6>C9-p)_H{?q%^@5V~h`-Holxog$I*9&$AU)Ra^ zTw^R1wrFox)=ghuJPzj5`KD>_rghkD@ho5DyA@46FFUE$_(E#p2E+cDmCm5eOjXiG zmP*jkPU-P=tr5CSH)zYXF)!cw_1E+!?OvW33B3{9rqKKcIzpM(y8cDJst?iq_eHo% zykKYab**@h6t&CtvSd>I;MBhk$18t|J|*QNKXQ-a9>d#ak&`rT=u8~fN)Fr*P2~G+ zayB?pLzJKD_s6R`iEqNZuiM==%u@8%c+C^Tr1fz;NWeLL)QT?r-w>-Ujix{%%ZgW0 zo!pjszGcaNLGs|p+p|Q;eY5VxGH2dkrJ@)7^Evp~X=Lr4iQhVdkBs!{!jlSNY!S?y zeC(2Qmm~QmJQ?%0e4h{no|o`Cvy2`~Or_UB3$olDJDg1o#+ip8d>)Y5zo=M zS`Rl(ZC{n5xnEyvxlyPSBJC+Nv9bS6(`fYc!|XF@&h*jUtCN<06Z_cz#d{|XJ;7zo zsR~bT>+Wk9bfX8=>^>1qQXlra1_cF;QgQ1Hs@e2qYb*YE`0`s&nrb7)F-s#WQzu<| zZ$jHP2I8_S}LkFSn*q-HAX>?&6-n#ZB7-3?@#2d zy}Q1qhCF2pPg@Ti7NbxUGU=+@lWcsX{`SWqbU2|C68sDM zoGiSNRj5GaTI?J-G`Dlhs$h{ZntvW^p_4Sg*GGbTL^pjkF&$@yo{M}0^FT^Z#R=&A zXv&Hdx=_@GjBH=ZAo~2=G_k^}$kjhZR0pzhNPHWF_jvuQH@_smS)CGMG{PlrAO)z? z4qmXVxZGIr{P*?CF~yf!QeXgYIe`9Ti1Q8=gFk#OkG52~4`2B^UDa<3$E`0w;{Z7M%~oZ5Y=*6ScB@3qOF%Z ze07zTZ}Q6YJ_V!I?Fk*1D|6iUeGap%XzSzezIZY!C_5{PlVT=!(1W-x3F{0h*tqxA zZn3hmmJ#gX&Z56@%7W;uZWzK!chII&b9lXK%#|)7Ls3v_IArhmw4OWU+lbY;#Npi$ z@B1kWOWK!adc*2bJ(Y_8n0bTsoph4QnAr@^ZWz-okW&2Yc&dMg^t;svP2z(v&y1%n z??nG!M^_%s*7miz9bDWZxaO(EtW=GSp@S)*C~9t{HC{svH4{=TR}fPuHI%EOYD`T( zHKwhIrl>ZpsfJX{bAtqp@EzZIp7YQ7XRl}Pwf1_~d-i@;N@D}9#vB8lLEo$>-5Yk0 z)90PHOgi1X!uxAtFg)Uc6NqK~G`P8ud$O#K6Rx(_uXAQgEArm|j`!>7)qMg!gf@GuuGl}X%vFOup5 zek>2`6ivwhJDtkgs`+|n+p^1%W>3%JzisrXO*YHK@VIB$-U9y&r1G1MVZ_!)^T}So z{H__W`VBe{UVmHd{;|D(q9ofW@p16mO%dDUIOlS0*WT^Ik)X5I$Cd%IR2gxyp-{G^ zx8g-;vCbGUWcbCvG8-9~J({s=C=T2nPI@o^^lle1x(5CIs9ghIviD3|wf>&+{h@Dd zYRv^=n{JMd_^H*1&od-=Z{>o9B>siXvX*j{t(|E?G|o1|6S2|4@s{j8AMI6g@a(&3 z(9N2guj9};rL^y>9n1DlaO!*rSxd=9U%pGy2Loi9Zd1R3!HMVS6&Y82a0ja4~ug-=wJ4N z_Zg=KYe1C2u;Cjt-tqh|W)^d@%or}ABA&3royED-b2FGFc1}2BGPYBwUpW?&i8Y5< zcoZCMBpz3d86#l{tl#wN)8Z>tmMQ>hY8pYpxjnmg3%Q`u>f{D}L+={}+sw$lbnL4K z(^{N@p7-0QA`Q#19cF0i7xWnE zKa06mFOkmH!^1(9So0ss>C~{DW@Zm28c%}PQXxQ^@0}PH7`~7oV1i%?r zn`7ci0`<8A%=&{{(iW%Z#eR)Da`B-G{vJ)`b3f6IaK=?IyZ$f5sE+Ym?4s#Vb$nJM z#c-=U!C?P4=Js4*IXh%(+@#yEgLwpyx|*31dzKqA9~HM%IsSPF@fZ@)&5 z6PBY!|JY;{p$U@`Q;_eO7s4q0q%pw7GGYfBtvDdVy1x!4N9P2#Z-_ znP8SAQ&c4W1L09#f^WVYF20R}xk;7!XsSFDvE9)#KX<+K;UW)2KpC?HVg_!3tG^~k zs_y5+t83^8g&gBm2Y1@zduB_vmpC>I4ofl<=j1H1rHmYa+`;U*=Cb?nNXo$gSw)(- zv-BA*OAwwO_uJ83N3q?-GuegJoP&Oi0^~_?)Sy&Bqj_ z1vO=3WBWVzfFovo;pU%(aUMNuMho`g7wj!Z=y5$1WP2Lr?NstZ+<1J)_&UqU6hRM8 z%v$1h{B@PattwkZ3YN-NhgrY#%{S4Z!e{f{j%5Aq-n2jX9`4Zv8hNCd0rsbb{yQ4n zo(dCCFbKtmNEKRk;}M5DzxoI`Y^<4t+`o3-!?VSnf2TXC+2o6@*8!P%9(b#|4lk-k z|B7bZ8K<9^66zY9*3W=wvt6v%Vk04vVUUaAZq8him#0-Hh+At`@s1z`fl`7Es!(p2 zR!gj(Ghc49$-$a^sBqij8yugBd8Yu&NI9^USPmXCq!v+48OwwSg>P?c^;T8=%NFaP zC?Cz@db6aqVHbO^p4$bB7QmeEMl+voK@P)vr(C(H^a|6I++4Z7f6UyLZUmuXBkV+&;7ekdZUo;TDlit4R7nT>YhIRm zrlZU$z$LI7d5aK+Q4mzzX)`kdJOl=(iY}uC>+W_u@`?GZRFexmI`+klGx?{+x>yf5 zFh`3i-y;(ezq8-^+4!t+Dmi8Kmfl zOFRjEGw26c;Vr?p^vMt-oyC>kx-pScW}FZwvM*xRuVj?b2flQL|121p7DCV+dnEN1 zMn+sT7O1{j4FQgBTz18H>4uf6QyLmB86?PG5*+)lq@<*8q_j)RagZ8Nllu=H`9HP6 zY_z$N^n~Y$XyPZ)R2*Jw_^O3$EPOj$Mv*uu=?CNSZBQUvodjJ1YFzHCO3#Shk6?= zhPU{Z%WLeZ4H+xJk9HFnam%QvsA;&>aEl}eX;-jV2}H)Q|Iw2g zFw#qpeTX|TBA@N}8S3C&YhodfQ?Hi1dD+}+OK^SNLd^y>ORxC$&I9jn0%q>85j{g@~HtOD{+ zl+vjq0J?x%tJ1{3-8v=)|8d~y=!k6Y?2Ox5`3fjNqNHCCU;9g{5se2{WC)+({>`OF zZM)9o=6SxXGx}d1JQxRzFtJbS)8m;}N|tB8)!o8$#_(A5ek;^b4111+qPKjPZQx_& zV2is?E#15c`i(hq#HKMU+gIiD_LVuNF{{7n>)8OV8gX`P(;9~BjxL03MD=g}b^a+{ zBb~ajwzeh*C{o@soz~l=)J2CF)+{EaYP(7?Z&Anh)382f!V+>d`pI&$VF$iLd96XH zK!V0h_HbB4uA-eXdiZfhz9p7?}8#wvH98 z(RBG3RGn`;3gDan)CRegt7_VhY>f`ZyCkuW?NdgS%_t-dQ0ZYEI@QtBPzSRp{WuXk zoawdW{6k#)J1xFx^XOS?Jv8~(`x|$Ay{s_>pcx-9VwLzYMWayt-jz8S7zav6UQ?IS zWJA`oEuTM1bGh}QFlNKpo!l(5)bu}WZn8^zPmd8g5+hb20Mc-Fq^BAf7?c|f!4XO% zO4t!cBMw&%0DC>RhOul5!c)S#zC_8+p3?8lo%Y2;xg(h3$8@$dIM0F$@9iQr*kF33 z~9<1@dU&qs7?RSfXcSB;C)!@|q+_(U;~Hp(+J* z(ZfZ!1Gsy@4o1H6DVjyDcz>gG-d6sS0Y4A;vFkdBx$D{Ll3od>S`kX#JhbeA?~tB&(u|5R1#{`YkNCIT*ZXOVz z-IWt52Zh}Cp)N7fCE!hIrZ2w~!OnB-AjXfs7kmTy8)9umZk9bSWe^n<^DlJTtGGbZ z)-71Ms@lOayU^zlac?~2FW=|)OI&yKqJ$AFfP|q$-aCo36FiC7m}p9Mu*7=^_Gb_6 zMC!PDpa)*peN~BGbqc!M*EE7D5P`vUYlG~sJ`X=C!@l}hX#sP){byg&i&K^+yi`^4 zS|Va%b+Gt~o=9jf;a;!cBwyf+m6e>xNKgx3Hmf9Y>s6q*#DYmm@2vsGAEyN1nQ zQmD`sCQ;BQngFo1#8Xa!Oc7BJA8wjhWJw$@0x?v9im^4Fz7~Ruos6O2TJ>h-g1mdS zfsMuUspXDvhn5MZIN1h{>FEf}q>T`63J78L9&Ti$<$@E^3JIU47p>-GIC(vlXL_T$ zU;$j7R3ecW3b$6n{^}>-TD76i?`5I59UYAXK(+wGg1A~;`Em)8`(rZ-Z!g%Nu^Gi= z%2MY}>AD5righ|_*cIRFlb?r|2m(m7;AeUG&@-z3qF*`-aGTpcuD(9!&qR3F z%y9+k=Q^)BAzJMNa!~f;d=OA#3I)4{%q)7|l_wF}LjnKyuqaQ|T2VXhJN3_93xv5p&Iey<+1m*&1GSePfYFdO_r|qm745H+0%zsi_SOCEk~~o` zVmF~z)AF~yj0w50MQ$7o5GGl0V^p4?9lR%QRHsrK4goa{TepB{c;za+jF&Ml2*IY^ svp~)2=ty@m-N^aVMw!<1D};K&K?eTbUSZMCvjGpx%*M3w=KUxC2MlZM82|tP literal 0 HcmV?d00001 diff --git a/vendor/tauri-plugin-updater-2.10.1/build.rs b/vendor/tauri-plugin-updater-2.10.1/build.rs new file mode 100644 index 0000000..30f70b9 --- /dev/null +++ b/vendor/tauri-plugin-updater-2.10.1/build.rs @@ -0,0 +1,25 @@ +// Copyright 2019-2023 Tauri Programme within The Commons Conservancy +// SPDX-License-Identifier: Apache-2.0 +// SPDX-License-Identifier: MIT + +const COMMANDS: &[&str] = &["check", "download", "install", "download_and_install"]; + +fn main() { + tauri_plugin::Builder::new(COMMANDS) + .global_api_script_path("./api-iife.js") + .build(); + + let target_os = std::env::var("CARGO_CFG_TARGET_OS").unwrap(); + let mobile = target_os == "ios" || target_os == "android"; + alias("desktop", !mobile); + alias("mobile", mobile); +} + +// creates a cfg alias if `has_feature` is true. +// `alias` must be a snake case string. +fn alias(alias: &str, has_feature: bool) { + println!("cargo:rustc-check-cfg=cfg({alias})"); + if has_feature { + println!("cargo:rustc-cfg={alias}"); + } +} diff --git a/vendor/tauri-plugin-updater-2.10.1/guest-js/index.ts b/vendor/tauri-plugin-updater-2.10.1/guest-js/index.ts new file mode 100644 index 0000000..b651843 --- /dev/null +++ b/vendor/tauri-plugin-updater-2.10.1/guest-js/index.ts @@ -0,0 +1,155 @@ +// Copyright 2019-2023 Tauri Programme within The Commons Conservancy +// SPDX-License-Identifier: Apache-2.0 +// SPDX-License-Identifier: MIT + +import { invoke, Channel, Resource } from '@tauri-apps/api/core' + +/** Options used when checking for updates */ +interface CheckOptions { + /** + * Request headers + */ + headers?: HeadersInit + /** + * Timeout in milliseconds + */ + timeout?: number + /** + * A proxy url to be used when checking and downloading updates. + */ + proxy?: string + /** + * Target identifier for the running application. This is sent to the backend. + */ + target?: string + /** + * Allow downgrades to previous versions by not checking if the current version is greater than the available version. + */ + allowDowngrades?: boolean +} + +/** Options used when downloading an update */ +interface DownloadOptions { + /** + * Request headers + */ + headers?: HeadersInit + /** + * Timeout in milliseconds + */ + timeout?: number +} + +interface UpdateMetadata { + rid: number + currentVersion: string + version: string + date?: string + body?: string + rawJson: Record +} + +/** Updater download event */ +type DownloadEvent = + | { event: 'Started'; data: { contentLength?: number } } + | { event: 'Progress'; data: { chunkLength: number } } + | { event: 'Finished' } + +class Update extends Resource { + // TODO: remove this field in v3 + /** @deprecated This is always true, check if the return value is `null` instead when using {@linkcode check} */ + available: boolean + currentVersion: string + version: string + date?: string + body?: string + rawJson: Record + private downloadedBytes?: Resource + + constructor(metadata: UpdateMetadata) { + super(metadata.rid) + this.available = true + this.currentVersion = metadata.currentVersion + this.version = metadata.version + this.date = metadata.date + this.body = metadata.body + this.rawJson = metadata.rawJson + } + + /** Download the updater package */ + async download( + onEvent?: (progress: DownloadEvent) => void, + options?: DownloadOptions + ): Promise { + convertToRustHeaders(options) + const channel = new Channel() + if (onEvent) { + channel.onmessage = onEvent + } + const downloadedBytesRid = await invoke('plugin:updater|download', { + onEvent: channel, + rid: this.rid, + ...options + }) + this.downloadedBytes = new Resource(downloadedBytesRid) + } + + /** Install downloaded updater package */ + async install(): Promise { + if (!this.downloadedBytes) { + throw new Error('Update.install called before Update.download') + } + + await invoke('plugin:updater|install', { + updateRid: this.rid, + bytesRid: this.downloadedBytes.rid + }) + + // Don't need to call close, we did it in rust side already + this.downloadedBytes = undefined + } + + /** Downloads the updater package and installs it */ + async downloadAndInstall( + onEvent?: (progress: DownloadEvent) => void, + options?: DownloadOptions + ): Promise { + convertToRustHeaders(options) + const channel = new Channel() + if (onEvent) { + channel.onmessage = onEvent + } + await invoke('plugin:updater|download_and_install', { + onEvent: channel, + rid: this.rid, + ...options + }) + } + + async close(): Promise { + await this.downloadedBytes?.close() + await super.close() + } +} + +/** Check for updates, resolves to `null` if no updates are available */ +async function check(options?: CheckOptions): Promise { + convertToRustHeaders(options) + + const metadata = await invoke('plugin:updater|check', { + ...options + }) + return metadata ? new Update(metadata) : null +} + +/** + * Converts the headers in options to be an {@linkcode Array<[string, string]>} which is what the Rust side expects + */ +function convertToRustHeaders(options?: { headers?: HeadersInit }) { + if (options?.headers) { + options.headers = Array.from(new Headers(options.headers).entries()) + } +} + +export type { CheckOptions, DownloadOptions, DownloadEvent } +export { check, Update } diff --git a/vendor/tauri-plugin-updater-2.10.1/package.json b/vendor/tauri-plugin-updater-2.10.1/package.json new file mode 100644 index 0000000..1eceda8 --- /dev/null +++ b/vendor/tauri-plugin-updater-2.10.1/package.json @@ -0,0 +1,29 @@ +{ + "name": "@tauri-apps/plugin-updater", + "version": "2.10.1", + "license": "MIT OR Apache-2.0", + "authors": [ + "Tauri Programme within The Commons Conservancy" + ], + "repository": "https://github.com/tauri-apps/plugins-workspace", + "type": "module", + "types": "./dist-js/index.d.ts", + "main": "./dist-js/index.cjs", + "module": "./dist-js/index.js", + "exports": { + "types": "./dist-js/index.d.ts", + "import": "./dist-js/index.js", + "require": "./dist-js/index.cjs" + }, + "scripts": { + "build": "rollup -c" + }, + "files": [ + "dist-js", + "README.md", + "LICENSE" + ], + "dependencies": { + "@tauri-apps/api": "^2.10.1" + } +} diff --git a/vendor/tauri-plugin-updater-2.10.1/permissions/autogenerated/commands/check.toml b/vendor/tauri-plugin-updater-2.10.1/permissions/autogenerated/commands/check.toml new file mode 100644 index 0000000..fca73ce --- /dev/null +++ b/vendor/tauri-plugin-updater-2.10.1/permissions/autogenerated/commands/check.toml @@ -0,0 +1,13 @@ +# Automatically generated - DO NOT EDIT! + +"$schema" = "../../schemas/schema.json" + +[[permission]] +identifier = "allow-check" +description = "Enables the check command without any pre-configured scope." +commands.allow = ["check"] + +[[permission]] +identifier = "deny-check" +description = "Denies the check command without any pre-configured scope." +commands.deny = ["check"] diff --git a/vendor/tauri-plugin-updater-2.10.1/permissions/autogenerated/commands/download.toml b/vendor/tauri-plugin-updater-2.10.1/permissions/autogenerated/commands/download.toml new file mode 100644 index 0000000..896b30c --- /dev/null +++ b/vendor/tauri-plugin-updater-2.10.1/permissions/autogenerated/commands/download.toml @@ -0,0 +1,13 @@ +# Automatically generated - DO NOT EDIT! + +"$schema" = "../../schemas/schema.json" + +[[permission]] +identifier = "allow-download" +description = "Enables the download command without any pre-configured scope." +commands.allow = ["download"] + +[[permission]] +identifier = "deny-download" +description = "Denies the download command without any pre-configured scope." +commands.deny = ["download"] diff --git a/vendor/tauri-plugin-updater-2.10.1/permissions/autogenerated/commands/download_and_install.toml b/vendor/tauri-plugin-updater-2.10.1/permissions/autogenerated/commands/download_and_install.toml new file mode 100644 index 0000000..40858d1 --- /dev/null +++ b/vendor/tauri-plugin-updater-2.10.1/permissions/autogenerated/commands/download_and_install.toml @@ -0,0 +1,13 @@ +# Automatically generated - DO NOT EDIT! + +"$schema" = "../../schemas/schema.json" + +[[permission]] +identifier = "allow-download-and-install" +description = "Enables the download_and_install command without any pre-configured scope." +commands.allow = ["download_and_install"] + +[[permission]] +identifier = "deny-download-and-install" +description = "Denies the download_and_install command without any pre-configured scope." +commands.deny = ["download_and_install"] diff --git a/vendor/tauri-plugin-updater-2.10.1/permissions/autogenerated/commands/install.toml b/vendor/tauri-plugin-updater-2.10.1/permissions/autogenerated/commands/install.toml new file mode 100644 index 0000000..4c6a29d --- /dev/null +++ b/vendor/tauri-plugin-updater-2.10.1/permissions/autogenerated/commands/install.toml @@ -0,0 +1,13 @@ +# Automatically generated - DO NOT EDIT! + +"$schema" = "../../schemas/schema.json" + +[[permission]] +identifier = "allow-install" +description = "Enables the install command without any pre-configured scope." +commands.allow = ["install"] + +[[permission]] +identifier = "deny-install" +description = "Denies the install command without any pre-configured scope." +commands.deny = ["install"] diff --git a/vendor/tauri-plugin-updater-2.10.1/permissions/autogenerated/reference.md b/vendor/tauri-plugin-updater-2.10.1/permissions/autogenerated/reference.md new file mode 100644 index 0000000..938ca2e --- /dev/null +++ b/vendor/tauri-plugin-updater-2.10.1/permissions/autogenerated/reference.md @@ -0,0 +1,130 @@ +## Default Permission + +This permission set configures which kind of +updater functions are exposed to the frontend. + +#### Granted Permissions + +The full workflow from checking for updates to installing them +is enabled. + +#### This default permission set includes the following: + +- `allow-check` +- `allow-download` +- `allow-install` +- `allow-download-and-install` + +## Permission Table + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
IdentifierDescription
+ +`updater:allow-check` + + + +Enables the check command without any pre-configured scope. + +
+ +`updater:deny-check` + + + +Denies the check command without any pre-configured scope. + +
+ +`updater:allow-download` + + + +Enables the download command without any pre-configured scope. + +
+ +`updater:deny-download` + + + +Denies the download command without any pre-configured scope. + +
+ +`updater:allow-download-and-install` + + + +Enables the download_and_install command without any pre-configured scope. + +
+ +`updater:deny-download-and-install` + + + +Denies the download_and_install command without any pre-configured scope. + +
+ +`updater:allow-install` + + + +Enables the install command without any pre-configured scope. + +
+ +`updater:deny-install` + + + +Denies the install command without any pre-configured scope. + +
diff --git a/vendor/tauri-plugin-updater-2.10.1/permissions/default.toml b/vendor/tauri-plugin-updater-2.10.1/permissions/default.toml new file mode 100644 index 0000000..fcf08fa --- /dev/null +++ b/vendor/tauri-plugin-updater-2.10.1/permissions/default.toml @@ -0,0 +1,18 @@ +"$schema" = "schemas/schema.json" +[default] +description = """ +This permission set configures which kind of +updater functions are exposed to the frontend. + +#### Granted Permissions + +The full workflow from checking for updates to installing them +is enabled. + +""" +permissions = [ + "allow-check", + "allow-download", + "allow-install", + "allow-download-and-install", +] diff --git a/vendor/tauri-plugin-updater-2.10.1/permissions/schemas/schema.json b/vendor/tauri-plugin-updater-2.10.1/permissions/schemas/schema.json new file mode 100644 index 0000000..7f29591 --- /dev/null +++ b/vendor/tauri-plugin-updater-2.10.1/permissions/schemas/schema.json @@ -0,0 +1,354 @@ +{ + "$schema": "http://json-schema.org/draft-07/schema#", + "title": "PermissionFile", + "description": "Permission file that can define a default permission, a set of permissions or a list of inlined permissions.", + "type": "object", + "properties": { + "default": { + "description": "The default permission set for the plugin", + "anyOf": [ + { + "$ref": "#/definitions/DefaultPermission" + }, + { + "type": "null" + } + ] + }, + "set": { + "description": "A list of permissions sets defined", + "type": "array", + "items": { + "$ref": "#/definitions/PermissionSet" + } + }, + "permission": { + "description": "A list of inlined permissions", + "default": [], + "type": "array", + "items": { + "$ref": "#/definitions/Permission" + } + } + }, + "definitions": { + "DefaultPermission": { + "description": "The default permission set of the plugin.\n\nWorks similarly to a permission with the \"default\" identifier.", + "type": "object", + "required": [ + "permissions" + ], + "properties": { + "version": { + "description": "The version of the permission.", + "type": [ + "integer", + "null" + ], + "format": "uint64", + "minimum": 1.0 + }, + "description": { + "description": "Human-readable description of what the permission does. Tauri convention is to use `

` headings in markdown content for Tauri documentation generation purposes.", + "type": [ + "string", + "null" + ] + }, + "permissions": { + "description": "All permissions this set contains.", + "type": "array", + "items": { + "type": "string" + } + } + } + }, + "PermissionSet": { + "description": "A set of direct permissions grouped together under a new name.", + "type": "object", + "required": [ + "description", + "identifier", + "permissions" + ], + "properties": { + "identifier": { + "description": "A unique identifier for the permission.", + "type": "string" + }, + "description": { + "description": "Human-readable description of what the permission does.", + "type": "string" + }, + "permissions": { + "description": "All permissions this set contains.", + "type": "array", + "items": { + "$ref": "#/definitions/PermissionKind" + } + } + } + }, + "Permission": { + "description": "Descriptions of explicit privileges of commands.\n\nIt can enable commands to be accessible in the frontend of the application.\n\nIf the scope is defined it can be used to fine grain control the access of individual or multiple commands.", + "type": "object", + "required": [ + "identifier" + ], + "properties": { + "version": { + "description": "The version of the permission.", + "type": [ + "integer", + "null" + ], + "format": "uint64", + "minimum": 1.0 + }, + "identifier": { + "description": "A unique identifier for the permission.", + "type": "string" + }, + "description": { + "description": "Human-readable description of what the permission does. Tauri internal convention is to use `

` headings in markdown content for Tauri documentation generation purposes.", + "type": [ + "string", + "null" + ] + }, + "commands": { + "description": "Allowed or denied commands when using this permission.", + "default": { + "allow": [], + "deny": [] + }, + "allOf": [ + { + "$ref": "#/definitions/Commands" + } + ] + }, + "scope": { + "description": "Allowed or denied scoped when using this permission.", + "allOf": [ + { + "$ref": "#/definitions/Scopes" + } + ] + }, + "platforms": { + "description": "Target platforms this permission applies. By default all platforms are affected by this permission.", + "type": [ + "array", + "null" + ], + "items": { + "$ref": "#/definitions/Target" + } + } + } + }, + "Commands": { + "description": "Allowed and denied commands inside a permission.\n\nIf two commands clash inside of `allow` and `deny`, it should be denied by default.", + "type": "object", + "properties": { + "allow": { + "description": "Allowed command.", + "default": [], + "type": "array", + "items": { + "type": "string" + } + }, + "deny": { + "description": "Denied command, which takes priority.", + "default": [], + "type": "array", + "items": { + "type": "string" + } + } + } + }, + "Scopes": { + "description": "An argument for fine grained behavior control of Tauri commands.\n\nIt can be of any serde serializable type and is used to allow or prevent certain actions inside a Tauri command. The configured scope is passed to the command and will be enforced by the command implementation.\n\n## Example\n\n```json { \"allow\": [{ \"path\": \"$HOME/**\" }], \"deny\": [{ \"path\": \"$HOME/secret.txt\" }] } ```", + "type": "object", + "properties": { + "allow": { + "description": "Data that defines what is allowed by the scope.", + "type": [ + "array", + "null" + ], + "items": { + "$ref": "#/definitions/Value" + } + }, + "deny": { + "description": "Data that defines what is denied by the scope. This should be prioritized by validation logic.", + "type": [ + "array", + "null" + ], + "items": { + "$ref": "#/definitions/Value" + } + } + } + }, + "Value": { + "description": "All supported ACL values.", + "anyOf": [ + { + "description": "Represents a null JSON value.", + "type": "null" + }, + { + "description": "Represents a [`bool`].", + "type": "boolean" + }, + { + "description": "Represents a valid ACL [`Number`].", + "allOf": [ + { + "$ref": "#/definitions/Number" + } + ] + }, + { + "description": "Represents a [`String`].", + "type": "string" + }, + { + "description": "Represents a list of other [`Value`]s.", + "type": "array", + "items": { + "$ref": "#/definitions/Value" + } + }, + { + "description": "Represents a map of [`String`] keys to [`Value`]s.", + "type": "object", + "additionalProperties": { + "$ref": "#/definitions/Value" + } + } + ] + }, + "Number": { + "description": "A valid ACL number.", + "anyOf": [ + { + "description": "Represents an [`i64`].", + "type": "integer", + "format": "int64" + }, + { + "description": "Represents a [`f64`].", + "type": "number", + "format": "double" + } + ] + }, + "Target": { + "description": "Platform target.", + "oneOf": [ + { + "description": "MacOS.", + "type": "string", + "enum": [ + "macOS" + ] + }, + { + "description": "Windows.", + "type": "string", + "enum": [ + "windows" + ] + }, + { + "description": "Linux.", + "type": "string", + "enum": [ + "linux" + ] + }, + { + "description": "Android.", + "type": "string", + "enum": [ + "android" + ] + }, + { + "description": "iOS.", + "type": "string", + "enum": [ + "iOS" + ] + } + ] + }, + "PermissionKind": { + "type": "string", + "oneOf": [ + { + "description": "Enables the check command without any pre-configured scope.", + "type": "string", + "const": "allow-check", + "markdownDescription": "Enables the check command without any pre-configured scope." + }, + { + "description": "Denies the check command without any pre-configured scope.", + "type": "string", + "const": "deny-check", + "markdownDescription": "Denies the check command without any pre-configured scope." + }, + { + "description": "Enables the download command without any pre-configured scope.", + "type": "string", + "const": "allow-download", + "markdownDescription": "Enables the download command without any pre-configured scope." + }, + { + "description": "Denies the download command without any pre-configured scope.", + "type": "string", + "const": "deny-download", + "markdownDescription": "Denies the download command without any pre-configured scope." + }, + { + "description": "Enables the download_and_install command without any pre-configured scope.", + "type": "string", + "const": "allow-download-and-install", + "markdownDescription": "Enables the download_and_install command without any pre-configured scope." + }, + { + "description": "Denies the download_and_install command without any pre-configured scope.", + "type": "string", + "const": "deny-download-and-install", + "markdownDescription": "Denies the download_and_install command without any pre-configured scope." + }, + { + "description": "Enables the install command without any pre-configured scope.", + "type": "string", + "const": "allow-install", + "markdownDescription": "Enables the install command without any pre-configured scope." + }, + { + "description": "Denies the install command without any pre-configured scope.", + "type": "string", + "const": "deny-install", + "markdownDescription": "Denies the install command without any pre-configured scope." + }, + { + "description": "This permission set configures which kind of\nupdater functions are exposed to the frontend.\n\n#### Granted Permissions\n\nThe full workflow from checking for updates to installing them\nis enabled.\n\n\n#### This default permission set includes:\n\n- `allow-check`\n- `allow-download`\n- `allow-install`\n- `allow-download-and-install`", + "type": "string", + "const": "default", + "markdownDescription": "This permission set configures which kind of\nupdater functions are exposed to the frontend.\n\n#### Granted Permissions\n\nThe full workflow from checking for updates to installing them\nis enabled.\n\n\n#### This default permission set includes:\n\n- `allow-check`\n- `allow-download`\n- `allow-install`\n- `allow-download-and-install`" + } + ] + } + } +} \ No newline at end of file diff --git a/vendor/tauri-plugin-updater-2.10.1/rollup.config.js b/vendor/tauri-plugin-updater-2.10.1/rollup.config.js new file mode 100644 index 0000000..1f349ec --- /dev/null +++ b/vendor/tauri-plugin-updater-2.10.1/rollup.config.js @@ -0,0 +1,7 @@ +// Copyright 2019-2023 Tauri Programme within The Commons Conservancy +// SPDX-License-Identifier: Apache-2.0 +// SPDX-License-Identifier: MIT + +import { createConfig } from '../../shared/rollup.config.js' + +export default createConfig() diff --git a/vendor/tauri-plugin-updater-2.10.1/src/commands.rs b/vendor/tauri-plugin-updater-2.10.1/src/commands.rs new file mode 100644 index 0000000..129c413 --- /dev/null +++ b/vendor/tauri-plugin-updater-2.10.1/src/commands.rs @@ -0,0 +1,197 @@ +// Copyright 2019-2023 Tauri Programme within The Commons Conservancy +// SPDX-License-Identifier: Apache-2.0 +// SPDX-License-Identifier: MIT + +use crate::{Result, Update, UpdaterExt}; + +use http::{HeaderMap, HeaderName, HeaderValue}; +use serde::Serialize; +use tauri::{ipc::Channel, Manager, Resource, ResourceId, Runtime, Webview}; + +use std::{str::FromStr, time::Duration}; +use url::Url; + +#[derive(Debug, Clone, Serialize)] +#[serde(tag = "event", content = "data")] +pub enum DownloadEvent { + #[serde(rename_all = "camelCase")] + Started { + content_length: Option, + }, + #[serde(rename_all = "camelCase")] + Progress { + chunk_length: usize, + }, + Finished, +} + +#[derive(Serialize, Default)] +#[serde(rename_all = "camelCase")] +pub(crate) struct Metadata { + rid: ResourceId, + current_version: String, + version: String, + date: Option, + body: Option, + raw_json: serde_json::Value, +} + +struct DownloadedBytes(pub Vec); +impl Resource for DownloadedBytes {} + +#[tauri::command] +pub(crate) async fn check( + webview: Webview, + headers: Option>, + timeout: Option, + proxy: Option, + target: Option, + allow_downgrades: Option, +) -> Result> { + let mut builder = webview.updater_builder(); + if let Some(headers) = headers { + for (k, v) in headers { + builder = builder.header(k, v)?; + } + } + if let Some(timeout) = timeout { + builder = builder.timeout(Duration::from_millis(timeout)); + } + if let Some(ref proxy) = proxy { + let url = Url::parse(proxy.as_str())?; + builder = builder.proxy(url); + } + if let Some(target) = target { + builder = builder.target(target); + } + if allow_downgrades.unwrap_or(false) { + builder = builder.version_comparator(|current, update| update.version != current); + } + + let updater = builder.build()?; + let update = updater.check().await?; + + if let Some(update) = update { + let formatted_date = if let Some(date) = update.date { + let formatted_date = date + .format(&time::format_description::well_known::Rfc3339) + .map_err(|_| crate::Error::FormatDate)?; + Some(formatted_date) + } else { + None + }; + let metadata = Metadata { + current_version: update.current_version.clone(), + version: update.version.clone(), + date: formatted_date, + body: update.body.clone(), + raw_json: update.raw_json.clone(), + rid: webview.resources_table().add(update), + }; + Ok(Some(metadata)) + } else { + Ok(None) + } +} + +#[tauri::command] +pub(crate) async fn download( + webview: Webview, + rid: ResourceId, + on_event: Channel, + headers: Option>, + timeout: Option, +) -> Result { + let update = webview.resources_table().get::(rid)?; + + let mut update = (*update).clone(); + + if let Some(headers) = headers { + let mut map = HeaderMap::new(); + for (k, v) in headers { + map.append(HeaderName::from_str(&k)?, HeaderValue::from_str(&v)?); + } + update.headers = map; + } + + if let Some(timeout) = timeout { + update.timeout = Some(Duration::from_millis(timeout)); + } + + let mut first_chunk = true; + let bytes = update + .download( + |chunk_length, content_length| { + if first_chunk { + first_chunk = !first_chunk; + let _ = on_event.send(DownloadEvent::Started { content_length }); + } + let _ = on_event.send(DownloadEvent::Progress { chunk_length }); + }, + || { + let _ = on_event.send(DownloadEvent::Finished); + }, + ) + .await?; + + Ok(webview.resources_table().add(DownloadedBytes(bytes))) +} + +#[tauri::command] +pub(crate) async fn install( + webview: Webview, + update_rid: ResourceId, + bytes_rid: ResourceId, +) -> Result<()> { + let update = webview.resources_table().get::(update_rid)?; + let bytes = webview + .resources_table() + .get::(bytes_rid)?; + update.install(&bytes.0)?; + let _ = webview.resources_table().close(bytes_rid); + Ok(()) +} + +#[tauri::command] +pub(crate) async fn download_and_install( + webview: Webview, + rid: ResourceId, + on_event: Channel, + headers: Option>, + timeout: Option, +) -> Result<()> { + let update = webview.resources_table().get::(rid)?; + + let mut update = (*update).clone(); + + if let Some(headers) = headers { + let mut map = HeaderMap::new(); + for (k, v) in headers { + map.append(HeaderName::from_str(&k)?, HeaderValue::from_str(&v)?); + } + update.headers = map; + } + + if let Some(timeout) = timeout { + update.timeout = Some(Duration::from_millis(timeout)); + } + + let mut first_chunk = true; + + update + .download_and_install( + |chunk_length, content_length| { + if first_chunk { + first_chunk = !first_chunk; + let _ = on_event.send(DownloadEvent::Started { content_length }); + } + let _ = on_event.send(DownloadEvent::Progress { chunk_length }); + }, + || { + let _ = on_event.send(DownloadEvent::Finished); + }, + ) + .await?; + + Ok(()) +} diff --git a/vendor/tauri-plugin-updater-2.10.1/src/config.rs b/vendor/tauri-plugin-updater-2.10.1/src/config.rs new file mode 100644 index 0000000..8c6e8bc --- /dev/null +++ b/vendor/tauri-plugin-updater-2.10.1/src/config.rs @@ -0,0 +1,164 @@ +// Copyright 2019-2023 Tauri Programme within The Commons Conservancy +// SPDX-License-Identifier: Apache-2.0 +// SPDX-License-Identifier: MIT + +use std::{ffi::OsString, fmt::Display}; + +use serde::{Deserialize, Deserializer}; +use url::Url; + +/// Install modes for the Windows update. +#[derive(Debug, PartialEq, Eq, Clone, Deserialize)] +#[serde(rename_all = "camelCase")] +#[derive(Default)] +pub enum WindowsUpdateInstallMode { + /// Specifies there's a basic UI during the installation process, including a final dialog box at the end. + BasicUi, + /// The quiet mode means there's no user interaction required. + /// Requires admin privileges if the installer does. + Quiet, + /// Specifies unattended mode, which means the installation only shows a progress bar. + #[default] + Passive, +} + +impl WindowsUpdateInstallMode { + /// Returns the associated `msiexec.exe` arguments. + pub fn msiexec_args(&self) -> &'static [&'static str] { + match self { + Self::BasicUi => &["/qb+"], + Self::Quiet => &["/quiet"], + Self::Passive => &["/passive"], + } + } + + /// Returns the associated nsis arguments. + pub fn nsis_args(&self) -> &'static [&'static str] { + // `/P`: Passive + // `/S`: Silent + // `/R`: Restart + match self { + Self::Passive => &["/P", "/R"], + Self::Quiet => &["/S", "/R"], + _ => &[], + } + } +} + +impl Display for WindowsUpdateInstallMode { + fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result { + write!( + f, + "{}", + match self { + Self::BasicUi => "basicUi", + Self::Quiet => "quiet", + Self::Passive => "passive", + } + ) + } +} + +#[derive(Debug, Clone, Deserialize, Default)] +#[serde(rename_all = "camelCase")] +pub struct WindowsConfig { + /// Additional arguments given to the NSIS or WiX installer. + #[serde( + default, + alias = "installer-args", + deserialize_with = "deserialize_os_string" + )] + pub installer_args: Vec, + /// Updating mode, defaults to `passive` mode. + /// + /// See [`WindowsUpdateInstallMode`] for more info. + #[serde(default, alias = "install-mode")] + pub install_mode: WindowsUpdateInstallMode, +} + +fn deserialize_os_string<'de, D>(deserializer: D) -> Result, D::Error> +where + D: Deserializer<'de>, +{ + Ok(Vec::::deserialize(deserializer)? + .into_iter() + .map(OsString::from) + .collect::>()) +} + +/// Updater configuration. +#[derive(Debug, Clone, Default)] +pub struct Config { + /// Dangerously allow using insecure transport protocols for update endpoints. + pub dangerous_insecure_transport_protocol: bool, + /// Dangerously accept invalid TLS certificates for update requests. + pub dangerous_accept_invalid_certs: bool, + /// Dangerously accept invalid hostnames for TLS certificates for update requests. + pub dangerous_accept_invalid_hostnames: bool, + /// Updater endpoints. + pub endpoints: Vec, + /// Signature public key. + pub pubkey: String, + /// The Windows configuration for the updater. + pub windows: Option, +} + +impl<'de> Deserialize<'de> for Config { + fn deserialize(deserializer: D) -> Result + where + D: Deserializer<'de>, + { + #[derive(Deserialize)] + #[serde(rename_all = "camelCase")] + pub struct Config { + #[serde(default, alias = "dangerous-insecure-transport-protocol")] + pub dangerous_insecure_transport_protocol: bool, + #[serde(default, alias = "dangerous-accept-invalid-certs")] + pub dangerous_accept_invalid_certs: bool, + #[serde(default, alias = "dangerous-accept-invalid-hostnames")] + pub dangerous_accept_invalid_hostnames: bool, + #[serde(default)] + pub endpoints: Vec, + pub pubkey: String, + pub windows: Option, + } + + let config = Config::deserialize(deserializer)?; + + validate_endpoints( + &config.endpoints, + config.dangerous_insecure_transport_protocol, + ) + .map_err(serde::de::Error::custom)?; + + Ok(Self { + dangerous_insecure_transport_protocol: config.dangerous_insecure_transport_protocol, + dangerous_accept_invalid_certs: config.dangerous_accept_invalid_certs, + dangerous_accept_invalid_hostnames: config.dangerous_accept_invalid_hostnames, + endpoints: config.endpoints, + pubkey: config.pubkey, + windows: config.windows, + }) + } +} + +pub(crate) fn validate_endpoints( + endpoints: &[Url], + dangerous_insecure_transport_protocol: bool, +) -> crate::Result<()> { + if !dangerous_insecure_transport_protocol { + for url in endpoints { + if url.scheme() != "https" { + #[cfg(debug_assertions)] + { + eprintln!("[\x1b[33mWARNING\x1b[0m] The updater endpoint \"{url}\" doesn't use `https` protocol. This is allowed in development but will fail in release builds."); + eprintln!("[\x1b[33mWARNING\x1b[0m] if this is a desired behavior, you can enable `dangerousInsecureTransportProtocol` in the plugin configuration"); + } + #[cfg(not(debug_assertions))] + return Err(crate::Error::InsecureTransportProtocol); + } + } + } + + Ok(()) +} diff --git a/vendor/tauri-plugin-updater-2.10.1/src/error.rs b/vendor/tauri-plugin-updater-2.10.1/src/error.rs new file mode 100644 index 0000000..ca4d559 --- /dev/null +++ b/vendor/tauri-plugin-updater-2.10.1/src/error.rs @@ -0,0 +1,114 @@ +// Copyright 2019-2023 Tauri Programme within The Commons Conservancy +// SPDX-License-Identifier: Apache-2.0 +// SPDX-License-Identifier: MIT + +use serde::{Serialize, Serializer}; +use thiserror::Error; + +/// All errors that can occur while running the updater. +#[derive(Debug, Error)] +#[non_exhaustive] +pub enum Error { + /// Endpoints are not sent. + #[error("Updater does not have any endpoints set.")] + EmptyEndpoints, + /// IO errors. + #[error(transparent)] + Io(#[from] std::io::Error), + /// Semver errors. + #[error(transparent)] + Semver(#[from] semver::Error), + /// Serialization errors. + #[error(transparent)] + Serialization(#[from] serde_json::Error), + /// Could not fetch a valid response from the server. + #[error("Could not fetch a valid release JSON from the remote")] + ReleaseNotFound, + /// Unsupported app architecture. + #[error("Unsupported application architecture, expected one of `x86`, `x86_64`, `arm` or `aarch64`.")] + UnsupportedArch, + /// Operating system is not supported. + #[error("Unsupported OS, expected one of `linux`, `darwin` or `windows`.")] + UnsupportedOs, + /// Failed to determine updater package extract path + #[error("Failed to determine updater package extract path.")] + FailedToDetermineExtractPath, + /// Url parsing errors. + #[error(transparent)] + UrlParse(#[from] url::ParseError), + /// `reqwest` crate errors. + #[error(transparent)] + Reqwest(#[from] reqwest::Error), + /// The platform was not found in the updater JSON response. + #[error("the platform `{0}` was not found in the response `platforms` object")] + TargetNotFound(String), + /// Neither the platform nor the fallback platform was found in the updater JSON response. + #[error( + "None of the fallback platforms `{0:?}` were found in the response `platforms` object" + )] + TargetsNotFound(Vec), + /// Download failed + #[error("`{0}`")] + Network(String), + /// A manifest or updater artifact exceeded its configured in-memory limit. + #[error( + "{resource} exceeds the configured {max_bytes}-byte limit (observed {observed_bytes} bytes)" + )] + ResponseTooLarge { + resource: &'static str, + max_bytes: u64, + observed_bytes: u64, + }, + /// `minisign_verify` errors. + #[error(transparent)] + Minisign(#[from] minisign_verify::Error), + /// `base64` errors. + #[error(transparent)] + Base64(#[from] base64::DecodeError), + /// UTF8 Errors in signature. + #[error("The signature {0} could not be decoded, please check if it is a valid base64 string. The signature must be the contents of the `.sig` file generated by the Tauri bundler, as a string.")] + SignatureUtf8(String), + #[cfg(all(target_os = "windows", feature = "zip"))] + /// `zip` errors. + #[error(transparent)] + Extract(#[from] zip::result::ZipError), + /// Temp dir is not on same mount mount. This prevents our updater to rename the AppImage to a temp file. + #[error("temp directory is not on the same mount point as the AppImage")] + TempDirNotOnSameMountPoint, + #[error("binary for the current target not found in the archive")] + BinaryNotFoundInArchive, + #[error("failed to create temporary directory")] + TempDirNotFound, + #[error("Authentication failed or was cancelled")] + AuthenticationFailed, + #[error("Failed to install .deb package")] + DebInstallFailed, + #[error("Failed to install package")] + PackageInstallFailed, + #[error("invalid updater binary format")] + InvalidUpdaterFormat, + #[error(transparent)] + Http(#[from] http::Error), + #[error(transparent)] + InvalidHeaderValue(#[from] http::header::InvalidHeaderValue), + #[error(transparent)] + InvalidHeaderName(#[from] http::header::InvalidHeaderName), + #[error("Failed to format date")] + FormatDate, + /// The configured updater endpoint must use a secure protocol like `https` + #[error("The configured updater endpoint must use a secure protocol like `https`.")] + InsecureTransportProtocol, + #[error(transparent)] + Tauri(#[from] tauri::Error), +} + +impl Serialize for Error { + fn serialize(&self, serializer: S) -> std::result::Result + where + S: Serializer, + { + serializer.serialize_str(self.to_string().as_ref()) + } +} + +pub type Result = std::result::Result; diff --git a/vendor/tauri-plugin-updater-2.10.1/src/lib.rs b/vendor/tauri-plugin-updater-2.10.1/src/lib.rs new file mode 100644 index 0000000..8eba426 --- /dev/null +++ b/vendor/tauri-plugin-updater-2.10.1/src/lib.rs @@ -0,0 +1,240 @@ +// Copyright 2019-2023 Tauri Programme within The Commons Conservancy +// SPDX-License-Identifier: Apache-2.0 +// SPDX-License-Identifier: MIT + +//! In-app updates for Tauri applications. +//! +//! - Supported platforms: Windows, Linux and macOS.crypted database and secure runtime. + +#![doc( + html_logo_url = "https://github.com/tauri-apps/tauri/raw/dev/app-icon.png", + html_favicon_url = "https://github.com/tauri-apps/tauri/raw/dev/app-icon.png" +)] + +use std::{ffi::OsString, sync::Arc}; + +use http::{HeaderMap, HeaderName, HeaderValue}; +use semver::Version; +use tauri::{ + plugin::{Builder as PluginBuilder, TauriPlugin}, + Manager, Runtime, +}; + +mod commands; +mod config; +mod error; +mod updater; + +pub use config::Config; +pub use error::{Error, Result}; +pub use updater::*; + +/// Extensions to [`tauri::App`], [`tauri::AppHandle`], [`tauri::WebviewWindow`], [`tauri::Webview`] and [`tauri::Window`] to access the updater APIs. +pub trait UpdaterExt { + /// Gets the updater builder to build and updater + /// that can manually check if an update is available. + /// + /// # Examples + /// + /// ```no_run + /// use tauri_plugin_updater::UpdaterExt; + /// tauri::Builder::default() + /// .setup(|app| { + /// let handle = app.handle().clone(); + /// tauri::async_runtime::spawn(async move { + /// let response = handle.updater_builder().build().unwrap().check().await; + /// }); + /// Ok(()) + /// }); + /// ``` + fn updater_builder(&self) -> UpdaterBuilder; + + /// Gets the updater to manually check if an update is available. + /// + /// # Examples + /// + /// ```no_run + /// use tauri_plugin_updater::UpdaterExt; + /// tauri::Builder::default() + /// .setup(|app| { + /// let handle = app.handle().clone(); + /// tauri::async_runtime::spawn(async move { + /// let response = handle.updater().unwrap().check().await; + /// }); + /// Ok(()) + /// }); + /// ``` + fn updater(&self) -> Result; +} + +impl> UpdaterExt for T { + fn updater_builder(&self) -> UpdaterBuilder { + let app = self.app_handle(); + let UpdaterState { + config, + target, + version_comparator, + headers, + } = self.state::().inner(); + + let mut builder = UpdaterBuilder::new(app, config.clone()).headers(headers.clone()); + + if let Some(target) = target { + builder = builder.target(target); + } + + let args = self.env().args_os; + if !args.is_empty() { + builder = builder.current_exe_args(args); + } + + builder.version_comparator = version_comparator.clone(); + + #[cfg(any( + target_os = "linux", + target_os = "dragonfly", + target_os = "freebsd", + target_os = "netbsd", + target_os = "openbsd" + ))] + { + let env = app.env(); + if let Some(appimage) = env.appimage { + builder = builder.executable_path(appimage); + } + } + + let app_handle = app.app_handle().clone(); + builder = builder.on_before_exit(move || { + app_handle.cleanup_before_exit(); + }); + + builder + } + + fn updater(&self) -> Result { + self.updater_builder().build() + } +} + +struct UpdaterState { + target: Option, + config: Config, + version_comparator: Option, + headers: HeaderMap, +} + +#[derive(Default)] +pub struct Builder { + target: Option, + pubkey: Option, + installer_args: Vec, + headers: HeaderMap, + default_version_comparator: Option, +} + +impl Builder { + pub fn new() -> Self { + Self::default() + } + + pub fn target(mut self, target: impl Into) -> Self { + self.target.replace(target.into()); + self + } + + pub fn pubkey>(mut self, pubkey: S) -> Self { + self.pubkey.replace(pubkey.into()); + self + } + + /// Adds an additional argument to pass to the Windows installer. + pub fn installer_args(mut self, args: I) -> Self + where + I: IntoIterator, + S: Into, + { + self.installer_args.extend(args.into_iter().map(Into::into)); + self + } + + /// Adds multiple additional arguments to pass to the Windows installer. + pub fn installer_arg(mut self, arg: S) -> Self + where + S: Into, + { + self.installer_args.push(arg.into()); + self + } + + /// Removes all the additional arguments to pass to the Windows installer. + /// + /// Note: this only removes the additional arguments added through [`Self::installer_args`], + /// not the ones managed by us (e.g. `/UPDATER` flag passed to the NSIS installer) + pub fn clear_installer_args(mut self) -> Self { + self.installer_args.clear(); + self + } + + pub fn header(mut self, key: K, value: V) -> Result + where + HeaderName: TryFrom, + >::Error: Into, + HeaderValue: TryFrom, + >::Error: Into, + { + let key: std::result::Result = key.try_into().map_err(Into::into); + let value: std::result::Result = + value.try_into().map_err(Into::into); + self.headers.insert(key?, value?); + + Ok(self) + } + + pub fn headers(mut self, headers: HeaderMap) -> Self { + self.headers = headers; + self + } + + pub fn default_version_comparator< + F: Fn(Version, RemoteRelease) -> bool + Send + Sync + 'static, + >( + mut self, + f: F, + ) -> Self { + self.default_version_comparator.replace(Arc::new(f)); + self + } + + pub fn build(self) -> TauriPlugin { + let pubkey = self.pubkey; + let target = self.target; + let version_comparator = self.default_version_comparator; + let installer_args = self.installer_args; + let headers = self.headers; + PluginBuilder::::new("updater") + .setup(move |app, api| { + let mut config = api.config().clone(); + if let Some(pubkey) = pubkey { + config.pubkey = pubkey; + } + if let Some(windows) = &mut config.windows { + windows.installer_args.extend(installer_args); + } + app.manage(UpdaterState { + target, + config, + version_comparator, + headers, + }); + Ok(()) + }) + .invoke_handler(tauri::generate_handler![ + commands::check, + commands::download, + commands::install, + commands::download_and_install, + ]) + .build() + } +} diff --git a/vendor/tauri-plugin-updater-2.10.1/src/updater.rs b/vendor/tauri-plugin-updater-2.10.1/src/updater.rs new file mode 100644 index 0000000..81cb404 --- /dev/null +++ b/vendor/tauri-plugin-updater-2.10.1/src/updater.rs @@ -0,0 +1,1894 @@ +// Copyright 2019-2023 Tauri Programme within The Commons Conservancy +// SPDX-License-Identifier: Apache-2.0 +// SPDX-License-Identifier: MIT + +use std::{ + collections::HashMap, + ffi::OsString, + io::Cursor, + path::{Path, PathBuf}, + str::FromStr, + sync::Arc, + time::Duration, +}; + +#[cfg(not(target_os = "macos"))] +use std::ffi::OsStr; + +use base64::Engine; +use futures_util::StreamExt; +use http::{header::ACCEPT, HeaderName}; +use minisign_verify::{PublicKey, Signature}; +use percent_encoding::{AsciiSet, CONTROLS}; +use reqwest::{ + header::{HeaderMap, HeaderValue, CONTENT_LENGTH}, + ClientBuilder, StatusCode, +}; +use semver::Version; +use serde::{de::Error as DeError, Deserialize, Deserializer, Serialize}; +use tauri::{ + utils::{ + config::BundleType, + platform::{bundle_type, current_exe}, + }, + AppHandle, Resource, Runtime, +}; +use time::OffsetDateTime; +use url::Url; + +use crate::{ + error::{Error, Result}, + Config, +}; + +const UPDATER_USER_AGENT: &str = concat!(env!("CARGO_PKG_NAME"), "/", env!("CARGO_PKG_VERSION"),); + +/// Safe defaults for callers that do not override the response limits. +/// +/// Manifests are normally only a few KiB and updater artifacts are expected to +/// stay well below 256 MiB. Keeping explicit defaults prevents any plugin entry +/// point from silently reverting to an unbounded in-memory response. +pub const DEFAULT_MAX_MANIFEST_SIZE: u64 = 1024 * 1024; +pub const DEFAULT_MAX_DOWNLOAD_SIZE: u64 = 256 * 1024 * 1024; + +#[derive(Copy, Clone)] +pub enum Installer { + AppImage, + Deb, + Rpm, + + App, + + Msi, + Nsis, +} + +#[cfg(test)] +mod response_limit_tests { + use super::{ + read_response_limited, UpdaterBuilder, DEFAULT_MAX_DOWNLOAD_SIZE, DEFAULT_MAX_MANIFEST_SIZE, + }; + use crate::{Config, Error}; + use std::io::{Read, Write}; + use std::net::TcpListener; + use std::thread; + + fn serve_once(parts: Vec<&'static [u8]>) -> (String, thread::JoinHandle<()>) { + let listener = TcpListener::bind("127.0.0.1:0").unwrap(); + let address = listener.local_addr().unwrap(); + let handle = thread::spawn(move || { + let (mut stream, _) = listener.accept().unwrap(); + let mut request = Vec::new(); + let mut buffer = [0_u8; 1024]; + while !request.windows(4).any(|window| window == b"\r\n\r\n") { + let count = stream.read(&mut buffer).unwrap(); + if count == 0 { + return; + } + request.extend_from_slice(&buffer[..count]); + } + for part in parts { + if stream.write_all(part).is_err() { + break; + } + let _ = stream.flush(); + } + }); + (format!("http://{address}/body"), handle) + } + + fn install_test_crypto_provider() { + #[cfg(feature = "rustls-tls")] + if rustls::crypto::CryptoProvider::get_default().is_none() { + let _ = rustls::crypto::ring::default_provider().install_default(); + } + } + + #[test] + fn updater_builder_defaults_to_nonzero_response_limits() { + let app = tauri::test::mock_app(); + let builder = UpdaterBuilder::new( + app.handle(), + Config { + endpoints: vec![url::Url::parse("https://example.test/latest.json").unwrap()], + ..Default::default() + }, + ); + + assert_eq!(builder.max_manifest_size, DEFAULT_MAX_MANIFEST_SIZE); + assert_eq!(builder.max_download_size, DEFAULT_MAX_DOWNLOAD_SIZE); + assert!(builder.max_manifest_size > 0); + assert!(builder.max_download_size > 0); + } + + #[test] + fn zero_limit_rejects_first_nonempty_response() { + install_test_crypto_provider(); + let (url, server) = serve_once(vec![ + b"HTTP/1.1 200 OK\r\nContent-Length: 1\r\nConnection: close\r\n\r\n", + b"x", + ]); + let error = tauri::async_runtime::block_on(async move { + let response = reqwest::Client::new().get(url).send().await.unwrap(); + read_response_limited(response, 0, "test response", |_, _| {}) + .await + .unwrap_err() + }); + server.join().unwrap(); + + assert!(matches!( + error, + Error::ResponseTooLarge { + max_bytes: 0, + observed_bytes: 1, + .. + } + )); + } + + #[test] + fn rejects_oversized_content_length_before_reading_body() { + install_test_crypto_provider(); + let (url, server) = serve_once(vec![ + b"HTTP/1.1 200 OK\r\nContent-Length: 999\r\nConnection: close\r\n\r\n", + b"x", + ]); + let error = tauri::async_runtime::block_on(async move { + let response = reqwest::Client::new().get(url).send().await.unwrap(); + read_response_limited(response, 8, "test response", |_, _| {}) + .await + .unwrap_err() + }); + server.join().unwrap(); + + assert!(matches!( + error, + Error::ResponseTooLarge { + max_bytes: 8, + observed_bytes: 999, + .. + } + )); + } + + #[test] + fn rejects_chunked_response_without_content_length_at_stream_limit() { + install_test_crypto_provider(); + let (url, server) = serve_once(vec![ + b"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nConnection: close\r\n\r\n", + b"5\r\nhello\r\n", + b"5\r\nworld\r\n", + b"0\r\n\r\n", + ]); + let error = tauri::async_runtime::block_on(async move { + let response = reqwest::Client::new().get(url).send().await.unwrap(); + read_response_limited(response, 8, "test response", |_, total| { + assert_eq!(total, None); + }) + .await + .unwrap_err() + }); + server.join().unwrap(); + + assert!(matches!( + error, + Error::ResponseTooLarge { + max_bytes: 8, + observed_bytes: 10, + .. + } + )); + } +} + +impl Installer { + fn name(self) -> &'static str { + match self { + Self::AppImage => "appimage", + Self::Deb => "deb", + Self::Rpm => "rpm", + Self::App => "app", + Self::Msi => "msi", + Self::Nsis => "nsis", + } + } +} + +#[derive(Debug, Deserialize, Serialize, Clone)] +pub struct ReleaseManifestPlatform { + /// Download URL for the platform + pub url: Url, + /// Signature for the platform + pub signature: String, +} + +#[derive(Debug, Deserialize, Serialize, Clone)] +#[serde(untagged)] +pub enum RemoteReleaseInner { + Dynamic(ReleaseManifestPlatform), + Static { + platforms: HashMap, + }, +} + +/// Information about a release returned by the remote update server. +/// +/// This type can have one of two shapes: Server Format (Dynamic Format) and Static Format. +#[derive(Debug, Clone)] +pub struct RemoteRelease { + /// Version to install. + pub version: Version, + /// Release notes. + pub notes: Option, + /// Release date. + pub pub_date: Option, + /// Release data. + pub data: RemoteReleaseInner, +} + +impl RemoteRelease { + /// The release's download URL for the given target. + pub fn download_url(&self, target: &str) -> Result<&Url> { + match self.data { + RemoteReleaseInner::Dynamic(ref platform) => Ok(&platform.url), + RemoteReleaseInner::Static { ref platforms } => platforms + .get(target) + .map_or(Err(Error::TargetNotFound(target.to_string())), |p| { + Ok(&p.url) + }), + } + } + + /// The release's signature for the given target. + pub fn signature(&self, target: &str) -> Result<&String> { + match self.data { + RemoteReleaseInner::Dynamic(ref platform) => Ok(&platform.signature), + RemoteReleaseInner::Static { ref platforms } => platforms + .get(target) + .map_or(Err(Error::TargetNotFound(target.to_string())), |platform| { + Ok(&platform.signature) + }), + } + } +} + +pub type OnBeforeExit = Arc; +pub type OnBeforeRequest = Arc ClientBuilder + Send + Sync + 'static>; +pub type VersionComparator = Arc bool + Send + Sync>; +type MainThreadClosure = Box; +type RunOnMainThread = + Box std::result::Result<(), tauri::Error> + Send + Sync + 'static>; + +pub struct UpdaterBuilder { + #[allow(dead_code)] + run_on_main_thread: RunOnMainThread, + app_name: String, + current_version: Version, + config: Config, + pub(crate) version_comparator: Option, + executable_path: Option, + target: Option, + endpoints: Option>, + headers: HeaderMap, + timeout: Option, + proxy: Option, + no_proxy: bool, + installer_args: Vec, + current_exe_args: Vec, + on_before_exit: Option, + configure_client: Option, + max_manifest_size: u64, + max_download_size: u64, +} + +impl UpdaterBuilder { + pub(crate) fn new(app: &AppHandle, config: crate::Config) -> Self { + let app_ = app.clone(); + let run_on_main_thread = move |f| app_.run_on_main_thread(f); + Self { + run_on_main_thread: Box::new(run_on_main_thread), + installer_args: config + .windows + .as_ref() + .map(|w| w.installer_args.clone()) + .unwrap_or_default(), + current_exe_args: Vec::new(), + app_name: app.package_info().name.clone(), + current_version: app.package_info().version.clone(), + config, + version_comparator: None, + executable_path: None, + target: None, + endpoints: None, + headers: Default::default(), + timeout: None, + proxy: None, + no_proxy: false, + on_before_exit: None, + configure_client: None, + max_manifest_size: DEFAULT_MAX_MANIFEST_SIZE, + max_download_size: DEFAULT_MAX_DOWNLOAD_SIZE, + } + } + + pub fn version_comparator bool + Send + Sync + 'static>( + mut self, + f: F, + ) -> Self { + self.version_comparator = Some(Arc::new(f)); + self + } + + pub fn target(mut self, target: impl Into) -> Self { + self.target.replace(target.into()); + self + } + + pub fn endpoints(mut self, endpoints: Vec) -> Result { + crate::config::validate_endpoints( + &endpoints, + self.config.dangerous_insecure_transport_protocol, + )?; + + self.endpoints.replace(endpoints); + Ok(self) + } + + pub fn executable_path>(mut self, p: P) -> Self { + self.executable_path.replace(p.as_ref().into()); + self + } + + pub fn header(mut self, key: K, value: V) -> Result + where + HeaderName: TryFrom, + >::Error: Into, + HeaderValue: TryFrom, + >::Error: Into, + { + let key: std::result::Result = key.try_into().map_err(Into::into); + let value: std::result::Result = + value.try_into().map_err(Into::into); + self.headers.insert(key?, value?); + + Ok(self) + } + + pub fn headers(mut self, headers: HeaderMap) -> Self { + self.headers = headers; + self + } + + pub fn clear_headers(mut self) -> Self { + self.headers.clear(); + self + } + + pub fn timeout(mut self, timeout: Duration) -> Self { + self.timeout = Some(timeout); + self + } + + pub fn proxy(mut self, proxy: Url) -> Self { + self.proxy.replace(proxy); + self + } + + /// Clear all proxies. See [`reqwest::ClientBuilder::no_proxy`](https://docs.rs/reqwest/latest/reqwest/struct.ClientBuilder.html#method.no_proxy). + pub fn no_proxy(mut self) -> Self { + self.no_proxy = true; + self + } + + pub fn pubkey>(mut self, pubkey: S) -> Self { + self.config.pubkey = pubkey.into(); + self + } + + /// Adds an argument to pass to the Windows installer. + pub fn installer_arg(mut self, arg: S) -> Self + where + S: Into, + { + self.installer_args.push(arg.into()); + self + } + + /// Adds multiple arguments to pass to the Windows installer. + pub fn installer_args(mut self, args: I) -> Self + where + I: IntoIterator, + S: Into, + { + self.installer_args.extend(args.into_iter().map(Into::into)); + self + } + + /// Removes all the additional arguments to pass to the Windows installer. + /// + /// Note: this only removes the additional arguments added through + /// [`Self::installer_arg`], [`crate::Builder::installer_arg`] + /// and the `plugins > updater > windows > installerArgs` config, + /// not the ones managed by us (e.g. `/UPDATER` flag passed to the NSIS installer) + pub fn clear_installer_args(mut self) -> Self { + self.installer_args.clear(); + self + } + + /// Function to run before we run the installer and exit the app through `std::process::exit(0)` on Windows + pub fn on_before_exit(mut self, f: F) -> Self { + self.on_before_exit.replace(Arc::new(f)); + self + } + + /// Allows you to modify the `reqwest` client builder before the HTTP request is sent. + /// + /// Note that `reqwest` crate may be updated in minor releases of tauri-plugin-updater. + /// Therefore it's recommended to pin the plugin to at least a minor version when you're using `configure_client`. + pub fn configure_client ClientBuilder + Send + Sync + 'static>( + mut self, + f: F, + ) -> Self { + self.configure_client.replace(Arc::new(f)); + self + } + + /// Sets the maximum number of manifest response bytes retained in memory. + /// Both `Content-Length` and the streamed byte count are enforced. + pub fn max_manifest_size(mut self, max_bytes: u64) -> Self { + self.max_manifest_size = max_bytes; + self + } + + /// Sets the maximum number of updater artifact bytes retained in memory. + /// Both `Content-Length` and the streamed byte count are enforced. + pub fn max_download_size(mut self, max_bytes: u64) -> Self { + self.max_download_size = max_bytes; + self + } + + pub fn build(self) -> Result { + let endpoints = self + .endpoints + .unwrap_or_else(|| self.config.endpoints.clone()); + + if endpoints.is_empty() { + return Err(Error::EmptyEndpoints); + }; + + let arch = updater_arch().ok_or(Error::UnsupportedArch)?; + + let executable_path = self.executable_path.clone().unwrap_or(current_exe()?); + + // Get the extract_path from the provided executable_path + let extract_path = if cfg!(target_os = "linux") { + executable_path + } else { + extract_path_from_executable(&executable_path)? + }; + + Ok(Updater { + run_on_main_thread: Arc::new(self.run_on_main_thread), + config: self.config, + app_name: self.app_name, + current_version: self.current_version, + version_comparator: self.version_comparator, + timeout: self.timeout, + proxy: self.proxy, + no_proxy: self.no_proxy, + endpoints, + installer_args: self.installer_args, + current_exe_args: self.current_exe_args, + arch, + target: self.target, + headers: self.headers, + extract_path, + on_before_exit: self.on_before_exit, + configure_client: self.configure_client, + max_manifest_size: self.max_manifest_size, + max_download_size: self.max_download_size, + }) + } +} + +impl UpdaterBuilder { + pub(crate) fn current_exe_args(mut self, args: I) -> Self + where + I: IntoIterator, + S: Into, + { + self.current_exe_args + .extend(args.into_iter().map(Into::into)); + self + } +} + +pub struct Updater { + #[allow(dead_code)] + run_on_main_thread: Arc, + config: Config, + app_name: String, + current_version: Version, + version_comparator: Option, + timeout: Option, + proxy: Option, + no_proxy: bool, + endpoints: Vec, + arch: &'static str, + // The `{{target}}` variable we replace in the endpoint and serach for in the JSON, + // this is either the user provided target or the current operating system by default + target: Option, + headers: HeaderMap, + extract_path: PathBuf, + on_before_exit: Option, + configure_client: Option, + max_manifest_size: u64, + max_download_size: u64, + #[allow(unused)] + installer_args: Vec, + #[allow(unused)] + current_exe_args: Vec, +} + +impl Updater { + pub async fn check(&self) -> Result> { + // we want JSON only + let mut headers = self.headers.clone(); + if !headers.contains_key(ACCEPT) { + headers.insert(ACCEPT, HeaderValue::from_static("application/json")); + } + + // Set SSL certs for linux if they aren't available. + #[cfg(target_os = "linux")] + { + if std::env::var_os("SSL_CERT_FILE").is_none() { + std::env::set_var("SSL_CERT_FILE", "/etc/ssl/certs/ca-certificates.crt"); + } + if std::env::var_os("SSL_CERT_DIR").is_none() { + std::env::set_var("SSL_CERT_DIR", "/etc/ssl/certs"); + } + } + let target = if let Some(target) = &self.target { + target + } else { + updater_os().ok_or(Error::UnsupportedOs)? + }; + + let mut remote_release: Option = None; + let mut raw_json: Option = None; + let mut last_error: Option = None; + for url in &self.endpoints { + // replace {{current_version}}, {{target}}, {{arch}} and {{bundle_type}} in the provided URL + // this is useful if we need to query example + // https://releases.myapp.com/update/{{target}}/{{arch}}/{{current_version}} + // will be translated into -> + // https://releases.myapp.com/update/darwin/aarch64/1.0.0 + // The main objective is if the update URL is defined via the Cargo.toml + // the URL will be generated dynamically + let version = self.current_version.to_string(); + let version = version.as_bytes(); + const CONTROLS_ADD: &AsciiSet = &CONTROLS.add(b'+'); + let encoded_version = percent_encoding::percent_encode(version, CONTROLS_ADD); + let encoded_version = encoded_version.to_string(); + let installer = installer_for_bundle_type(bundle_type()) + .map(|i| i.name()) + .unwrap_or("unknown"); + + let url: Url = url + .to_string() + // url::Url automatically url-encodes the path components + .replace("%7B%7Bcurrent_version%7D%7D", &encoded_version) + .replace("%7B%7Btarget%7D%7D", target) + .replace("%7B%7Barch%7D%7D", self.arch) + .replace("%7B%7Bbundle_type%7D%7D", installer) + // but not query parameters + .replace("{{current_version}}", &encoded_version) + .replace("{{target}}", target) + .replace("{{arch}}", self.arch) + .replace("{{bundle_type}}", installer) + .parse()?; + + log::debug!("checking for updates {url}"); + + #[cfg(feature = "rustls-tls")] + if rustls::crypto::CryptoProvider::get_default().is_none() { + // This can only fail if there is already a default provider which we checked for already. + let _ = rustls::crypto::ring::default_provider().install_default(); + } + + let mut request = ClientBuilder::new().user_agent(UPDATER_USER_AGENT); + if self.config.dangerous_accept_invalid_certs { + request = request.danger_accept_invalid_certs(true); + } + if self.config.dangerous_accept_invalid_hostnames { + request = request.danger_accept_invalid_hostnames(true); + } + if let Some(timeout) = self.timeout { + request = request.timeout(timeout); + } + if self.no_proxy { + log::debug!("disabling proxy"); + request = request.no_proxy(); + } else if let Some(ref proxy) = self.proxy { + log::debug!("using proxy {proxy}"); + let proxy = reqwest::Proxy::all(proxy.as_str())?; + request = request.proxy(proxy); + } + + if let Some(ref configure_client) = self.configure_client { + request = configure_client(request); + } + + let response = request + .build()? + .get(url) + .headers(headers.clone()) + .send() + .await; + + match response { + Ok(res) => { + if res.status().is_success() { + // no updates found! + if StatusCode::NO_CONTENT == res.status() { + log::debug!("update endpoint returned 204 No Content"); + return Ok(None); + }; + + let manifest = read_response_limited( + res, + self.max_manifest_size, + "updater manifest", + |_, _| {}, + ) + .await?; + let update_response: serde_json::Value = serde_json::from_slice(&manifest)?; + log::debug!("update response: {update_response:?}"); + raw_json = Some(update_response.clone()); + match serde_json::from_value::(update_response) + .map_err(Into::into) + { + Ok(release) => { + log::debug!("parsed release response {release:?}"); + last_error = None; + remote_release = Some(release); + // we found a release, break the loop + break; + } + Err(err) => { + log::error!("failed to deserialize update response: {err}"); + last_error = Some(err) + } + } + } else { + log::error!( + "update endpoint did not respond with a successful status code" + ); + } + } + Err(err) => { + log::error!("failed to check for updates: {err}"); + last_error = Some(err.into()) + } + } + } + + // Last error is cleaned on success. + // Shouldn't be triggered if we had a successfull call + if let Some(error) = last_error { + return Err(error); + } + + // Extracted remote metadata + let release = remote_release.ok_or(Error::ReleaseNotFound)?; + + let should_update = match self.version_comparator.as_ref() { + Some(comparator) => comparator(self.current_version.clone(), release.clone()), + None => release.version > self.current_version, + }; + + let installer = installer_for_bundle_type(bundle_type()); + let (download_url, signature, platform) = self.get_urls(&release, &installer)?; + + let update = if should_update { + Some(Update { + run_on_main_thread: self.run_on_main_thread.clone(), + config: self.config.clone(), + on_before_exit: self.on_before_exit.clone(), + app_name: self.app_name.clone(), + current_version: self.current_version.to_string(), + target: target.to_owned(), + platform, + extract_path: self.extract_path.clone(), + version: release.version.to_string(), + date: release.pub_date, + download_url: download_url.clone(), + signature: signature.to_owned(), + body: release.notes, + raw_json: raw_json.unwrap(), + timeout: None, + proxy: self.proxy.clone(), + no_proxy: self.no_proxy, + headers: self.headers.clone(), + installer_args: self.installer_args.clone(), + current_exe_args: self.current_exe_args.clone(), + configure_client: self.configure_client.clone(), + max_download_size: self.max_download_size, + }) + } else { + None + }; + + Ok(update) + } + + fn get_urls<'a>( + &self, + release: &'a RemoteRelease, + installer: &Option, + ) -> Result<(&'a Url, &'a String, String)> { + // Use the user provided target + if let Some(target) = &self.target { + return Ok(( + release.download_url(target)?, + release.signature(target)?, + target.clone(), + )); + } + + // Or else we search for [`{os}-{arch}-{installer}`, `{os}-{arch}`] in order + let os = updater_os().ok_or(Error::UnsupportedOs)?; + let arch = self.arch; + let mut targets = Vec::new(); + if let Some(installer) = installer { + let installer = installer.name(); + targets.push(format!("{os}-{arch}-{installer}")); + } + targets.push(format!("{os}-{arch}")); + + for target in &targets { + log::debug!("Searching for updater target '{target}' in release data"); + if let (Ok(download_url), Ok(signature)) = + (release.download_url(target), release.signature(target)) + { + return Ok((download_url, signature, target.clone())); + }; + } + + Err(Error::TargetsNotFound(targets)) + } +} + +#[derive(Clone)] +pub struct Update { + #[allow(dead_code)] + run_on_main_thread: Arc, + config: Config, + #[allow(unused)] + on_before_exit: Option, + /// Update description + pub body: Option, + /// Version used to check for update + pub current_version: String, + /// Version announced + pub version: String, + /// Update publish date + pub date: Option, + /// The `{{target}}` variable we replace in the endpoint and search for in the JSON, + /// this is either the user provided target or the current operating system by default + pub target: String, + /// The exact platform key selected from a static release manifest. + pub platform: String, + /// Download URL announced + pub download_url: Url, + /// Signature announced + pub signature: String, + /// The raw version of server's JSON response. Useful if the response contains additional fields that the updater doesn't handle. + pub raw_json: serde_json::Value, + /// Request timeout + pub timeout: Option, + /// Request proxy + pub proxy: Option, + /// Disable system proxy + pub no_proxy: bool, + /// Request headers + pub headers: HeaderMap, + /// Extract path + #[allow(unused)] + extract_path: PathBuf, + /// App name, used for creating named tempfiles on Windows + #[allow(unused)] + app_name: String, + #[allow(unused)] + installer_args: Vec, + #[allow(unused)] + current_exe_args: Vec, + configure_client: Option, + max_download_size: u64, +} + +impl Resource for Update {} + +impl Update { + /// Downloads the updater package, verifies it then return it as bytes. + /// + /// Use [`Update::install`] to install it + pub async fn download), D: FnOnce()>( + &self, + mut on_chunk: C, + on_download_finish: D, + ) -> Result> { + // set our headers + let mut headers = self.headers.clone(); + if !headers.contains_key(ACCEPT) { + headers.insert(ACCEPT, HeaderValue::from_static("application/octet-stream")); + } + + let mut request = ClientBuilder::new().user_agent(UPDATER_USER_AGENT); + if self.config.dangerous_accept_invalid_certs { + request = request.danger_accept_invalid_certs(true); + } + if self.config.dangerous_accept_invalid_hostnames { + request = request.danger_accept_invalid_hostnames(true); + } + if let Some(timeout) = self.timeout { + request = request.timeout(timeout); + } + if self.no_proxy { + request = request.no_proxy(); + } else if let Some(ref proxy) = self.proxy { + let proxy = reqwest::Proxy::all(proxy.as_str())?; + request = request.proxy(proxy); + } + if let Some(ref configure_client) = self.configure_client { + request = configure_client(request); + } + let response = request + .build()? + .get(self.download_url.clone()) + .headers(headers) + .send() + .await?; + + if !response.status().is_success() { + return Err(Error::Network(format!( + "Download request failed with status: {}", + response.status() + ))); + } + + let buffer = read_response_limited( + response, + self.max_download_size, + "updater artifact", + &mut on_chunk, + ) + .await?; + on_download_finish(); + + verify_signature(&buffer, &self.signature, &self.config.pubkey)?; + + Ok(buffer) + } + + /// Installs the updater package downloaded by [`Update::download`] + pub fn install(&self, bytes: impl AsRef<[u8]>) -> Result<()> { + self.install_inner(bytes.as_ref()) + } + + /// Downloads and installs the updater package + pub async fn download_and_install), D: FnOnce()>( + &self, + on_chunk: C, + on_download_finish: D, + ) -> Result<()> { + let bytes = self.download(on_chunk, on_download_finish).await?; + self.install(bytes) + } + + #[cfg(mobile)] + fn install_inner(&self, _bytes: &[u8]) -> Result<()> { + Ok(()) + } +} + +async fn read_response_limited( + response: reqwest::Response, + max_bytes: u64, + resource: &'static str, + mut on_chunk: C, +) -> Result> +where + C: FnMut(usize, Option), +{ + let content_length = response + .headers() + .get(CONTENT_LENGTH) + .and_then(|value| value.to_str().ok()) + .and_then(|value| value.parse::().ok()); + + if let Some(announced) = content_length.filter(|length| *length > max_bytes) { + return Err(Error::ResponseTooLarge { + resource, + max_bytes, + observed_bytes: announced, + }); + } + + let mut buffer = Vec::new(); + let mut observed = 0_u64; + let mut stream = response.bytes_stream(); + while let Some(chunk) = stream.next().await { + let chunk = chunk?; + observed = observed + .checked_add(chunk.len() as u64) + .ok_or(Error::ResponseTooLarge { + resource, + max_bytes, + observed_bytes: u64::MAX, + })?; + if observed > max_bytes { + return Err(Error::ResponseTooLarge { + resource, + max_bytes, + observed_bytes: observed, + }); + } + on_chunk(chunk.len(), content_length); + buffer.extend_from_slice(&chunk); + } + Ok(buffer) +} + +#[cfg(windows)] +enum WindowsUpdaterType { + Nsis { + path: PathBuf, + #[allow(unused)] + temp: Option, + }, + Msi { + path: PathBuf, + #[allow(unused)] + temp: Option, + }, +} + +#[cfg(windows)] +impl WindowsUpdaterType { + fn nsis(path: PathBuf, temp: Option) -> Self { + Self::Nsis { path, temp } + } + + fn msi(path: PathBuf, temp: Option) -> Self { + Self::Msi { + path: path.wrap_in_quotes(), + temp, + } + } +} + +#[cfg(windows)] +impl Config { + fn install_mode(&self) -> crate::config::WindowsUpdateInstallMode { + self.windows + .as_ref() + .map(|w| w.install_mode.clone()) + .unwrap_or_default() + } +} + +/// Windows +#[cfg(windows)] +impl Update { + /// ### Expected structure: + /// ├── [AppName]_[version]_x64.msi # Application MSI + /// ├── [AppName]_[version]_x64-setup.exe # NSIS installer + /// ├── [AppName]_[version]_x64.msi.zip # ZIP generated by tauri-bundler + /// │ └──[AppName]_[version]_x64.msi # Application MSI + /// ├── [AppName]_[version]_x64-setup.exe.zip # ZIP generated by tauri-bundler + /// │ └──[AppName]_[version]_x64-setup.exe # NSIS installer + /// └── ... + fn install_inner(&self, bytes: &[u8]) -> Result<()> { + use std::iter::once; + use windows_sys::{ + w, + Win32::UI::{Shell::ShellExecuteW, WindowsAndMessaging::SW_SHOW}, + }; + + let updater_type = self.extract(bytes)?; + + let install_mode = self.config.install_mode(); + let current_args = &self.current_exe_args()[1..]; + let msi_args; + let nsis_args; + + let installer_args: Vec<&OsStr> = match &updater_type { + WindowsUpdaterType::Nsis { .. } => { + nsis_args = current_args + .iter() + .map(escape_nsis_current_exe_arg) + .collect::>(); + + install_mode + .nsis_args() + .iter() + .map(OsStr::new) + .chain(once(OsStr::new("/UPDATE"))) + .chain(once(OsStr::new("/ARGS"))) + .chain(nsis_args.iter().map(OsStr::new)) + .chain(self.installer_args()) + .collect() + } + WindowsUpdaterType::Msi { path, .. } => { + let escaped_args = current_args + .iter() + .map(escape_msi_property_arg) + .collect::>() + .join(" "); + msi_args = OsString::from(format!("LAUNCHAPPARGS=\"{escaped_args}\"")); + + [OsStr::new("/i"), path.as_os_str()] + .into_iter() + .chain(install_mode.msiexec_args().iter().map(OsStr::new)) + .chain(once(OsStr::new("/promptrestart"))) + .chain(self.installer_args()) + .chain(once(OsStr::new("AUTOLAUNCHAPP=True"))) + .chain(once(msi_args.as_os_str())) + .collect() + } + }; + + if let Some(on_before_exit) = self.on_before_exit.as_ref() { + log::debug!("running on_before_exit hook"); + on_before_exit(); + } + + let file = match &updater_type { + WindowsUpdaterType::Nsis { path, .. } => path.as_os_str().to_os_string(), + WindowsUpdaterType::Msi { .. } => std::env::var("SYSTEMROOT").as_ref().map_or_else( + |_| OsString::from("msiexec.exe"), + |p| OsString::from(format!("{p}\\System32\\msiexec.exe")), + ), + }; + let file = encode_wide(file); + + let parameters = installer_args.join(OsStr::new(" ")); + let parameters = encode_wide(parameters); + + unsafe { + ShellExecuteW( + std::ptr::null_mut(), + w!("open"), + file.as_ptr(), + parameters.as_ptr(), + std::ptr::null(), + SW_SHOW, + ) + }; + + std::process::exit(0); + } + + fn installer_args(&self) -> Vec<&OsStr> { + self.installer_args + .iter() + .map(OsStr::new) + .collect::>() + } + + fn current_exe_args(&self) -> Vec<&OsStr> { + self.current_exe_args + .iter() + .map(OsStr::new) + .collect::>() + } + + fn extract(&self, bytes: &[u8]) -> Result { + #[cfg(feature = "zip")] + if infer::archive::is_zip(bytes) { + return self.extract_zip(bytes); + } + + self.extract_exe(bytes) + } + + fn make_temp_dir(&self) -> Result { + Ok(tempfile::Builder::new() + .prefix(&format!("{}-{}-updater-", self.app_name, self.version)) + .tempdir()? + .keep()) + } + + #[cfg(feature = "zip")] + fn extract_zip(&self, bytes: &[u8]) -> Result { + let temp_dir = self.make_temp_dir()?; + + let archive = Cursor::new(bytes); + let mut extractor = zip::ZipArchive::new(archive)?; + extractor.extract(&temp_dir)?; + + let paths = std::fs::read_dir(&temp_dir)?; + for path in paths { + let path = path?.path(); + let ext = path.extension(); + if ext == Some(OsStr::new("exe")) { + return Ok(WindowsUpdaterType::nsis(path, None)); + } else if ext == Some(OsStr::new("msi")) { + return Ok(WindowsUpdaterType::msi(path, None)); + } + } + + Err(crate::Error::BinaryNotFoundInArchive) + } + + fn extract_exe(&self, bytes: &[u8]) -> Result { + if infer::app::is_exe(bytes) { + let (path, temp) = self.write_to_temp(bytes, ".exe")?; + Ok(WindowsUpdaterType::nsis(path, temp)) + } else if infer::archive::is_msi(bytes) { + let (path, temp) = self.write_to_temp(bytes, ".msi")?; + Ok(WindowsUpdaterType::msi(path, temp)) + } else { + Err(crate::Error::InvalidUpdaterFormat) + } + } + + fn write_to_temp( + &self, + bytes: &[u8], + ext: &str, + ) -> Result<(PathBuf, Option)> { + use std::io::Write; + + let temp_dir = self.make_temp_dir()?; + let mut temp_file = tempfile::Builder::new() + .prefix(&format!("{}-{}-installer", self.app_name, self.version)) + .suffix(ext) + .rand_bytes(0) + .tempfile_in(temp_dir)?; + temp_file.write_all(bytes)?; + + let temp = temp_file.into_temp_path(); + Ok((temp.to_path_buf(), Some(temp))) + } +} + +/// Linux (AppImage, Deb, RPM) +#[cfg(any( + target_os = "linux", + target_os = "dragonfly", + target_os = "freebsd", + target_os = "netbsd", + target_os = "openbsd" +))] +impl Update { + /// ### Expected structure: + /// ├── [AppName]_[version]_amd64.AppImage.tar.gz # GZ generated by tauri-bundler + /// │ └──[AppName]_[version]_amd64.AppImage # Application AppImage + /// ├── [AppName]_[version]_amd64.deb # Debian package + /// ├── [AppName]_[version]_amd64.rpm # RPM package + /// └── ... + /// + fn install_inner(&self, bytes: &[u8]) -> Result<()> { + match installer_for_bundle_type(bundle_type()) { + Some(Installer::Deb) => self.install_deb(bytes), + Some(Installer::Rpm) => self.install_rpm(bytes), + _ => self.install_appimage(bytes), + } + } + + fn install_appimage(&self, bytes: &[u8]) -> Result<()> { + use std::os::unix::fs::{MetadataExt, PermissionsExt}; + let extract_path_metadata = self.extract_path.metadata()?; + + let tmp_dir_locations = vec![ + Box::new(|| Some(std::env::temp_dir())) as Box Option>, + Box::new(dirs::cache_dir), + Box::new(|| Some(self.extract_path.parent().unwrap().to_path_buf())), + ]; + + for tmp_dir_location in tmp_dir_locations { + if let Some(tmp_dir_location) = tmp_dir_location() { + let tmp_dir = tempfile::Builder::new() + .prefix("tauri_current_app") + .tempdir_in(tmp_dir_location)?; + let tmp_dir_metadata = tmp_dir.path().metadata()?; + + if extract_path_metadata.dev() == tmp_dir_metadata.dev() { + let mut perms = tmp_dir_metadata.permissions(); + perms.set_mode(0o700); + std::fs::set_permissions(tmp_dir.path(), perms)?; + + let tmp_app_image = &tmp_dir.path().join("current_app.AppImage"); + + let permissions = std::fs::metadata(&self.extract_path)?.permissions(); + + // create a backup of our current app image + std::fs::rename(&self.extract_path, tmp_app_image)?; + + #[cfg(feature = "zip")] + if infer::archive::is_gz(bytes) { + log::debug!("extracting AppImage"); + // extract the buffer to the tmp_dir + // we extract our signed archive into our final directory without any temp file + let archive = Cursor::new(bytes); + let decoder = flate2::read::GzDecoder::new(archive); + let mut archive = tar::Archive::new(decoder); + for mut entry in archive.entries()?.flatten() { + if let Ok(path) = entry.path() { + if path.extension() == Some(OsStr::new("AppImage")) { + // if something went wrong during the extraction, we should restore previous app + if let Err(err) = entry.unpack(&self.extract_path) { + std::fs::rename(tmp_app_image, &self.extract_path)?; + return Err(err.into()); + } + // early finish we have everything we need here + return Ok(()); + } + } + } + // if we have not returned early we should restore the backup + std::fs::rename(tmp_app_image, &self.extract_path)?; + return Err(Error::BinaryNotFoundInArchive); + } + + log::debug!("rewriting AppImage"); + return match std::fs::write(&self.extract_path, bytes) + .and_then(|_| std::fs::set_permissions(&self.extract_path, permissions)) + { + Err(err) => { + // if something went wrong during the extraction, we should restore previous app + std::fs::rename(tmp_app_image, &self.extract_path)?; + Err(err.into()) + } + Ok(_) => Ok(()), + }; + } + } + } + + Err(Error::TempDirNotOnSameMountPoint) + } + + fn install_deb(&self, bytes: &[u8]) -> Result<()> { + // First verify the bytes are actually a .deb package + if !infer::archive::is_deb(bytes) { + log::warn!("update is not a valid deb package"); + return Err(Error::InvalidUpdaterFormat); + } + + self.try_tmp_locations(bytes, "dpkg", "-i", "deb") + } + + fn install_rpm(&self, bytes: &[u8]) -> Result<()> { + // First verify the bytes are actually a .rpm package + if !infer::archive::is_rpm(bytes) { + return Err(Error::InvalidUpdaterFormat); + } + self.try_tmp_locations(bytes, "rpm", "-U", "rpm") + } + + fn try_tmp_locations( + &self, + bytes: &[u8], + install_cmd: &str, + install_arg: &str, + package_extension: &str, + ) -> Result<()> { + // Try different temp directories + let tmp_dir_locations = vec![ + Box::new(|| Some(std::env::temp_dir())) as Box Option>, + Box::new(dirs::cache_dir), + Box::new(|| Some(self.extract_path.parent().unwrap().to_path_buf())), + ]; + + // Try writing to multiple temp locations until one succeeds + for tmp_dir_location in tmp_dir_locations { + if let Some(path) = tmp_dir_location() { + let prefix = format!("tauri_{package_extension}_update"); + if let Ok(tmp_dir) = tempfile::Builder::new().prefix(&prefix).tempdir_in(path) { + let pkg_path = tmp_dir.path().join(format!("package.{package_extension}")); + + // Try writing the .deb / .rpm file + if std::fs::write(&pkg_path, bytes).is_ok() { + // If write succeeds, proceed with installation + return self.try_install_with_privileges( + &pkg_path, + install_cmd, + install_arg, + ); + } + // If write fails, continue to next temp location + } + } + } + + // If we get here, all temp locations failed + Err(Error::TempDirNotFound) + } + + fn try_install_with_privileges( + &self, + pkg_path: &Path, + install_cmd: &str, + install_arg: &str, + ) -> Result<()> { + // 1. First try using pkexec (graphical sudo prompt) + if let Ok(status) = std::process::Command::new("pkexec") + .arg(install_cmd) + .arg(install_arg) + .arg(pkg_path) + .status() + { + if status.success() { + log::debug!("installed {pkg_path:?} with pkexec"); + return Ok(()); + } + } + + // 2. Try zenity or kdialog for a graphical sudo experience + if let Ok(password) = self.get_password_graphically() { + if self.install_with_sudo(pkg_path, &password, install_cmd, install_arg)? { + log::debug!("installed {pkg_path:?} with GUI sudo"); + return Ok(()); + } + } + + // 3. Final fallback: terminal sudo + let status = std::process::Command::new("sudo") + .arg(install_cmd) + .arg(install_arg) + .arg(pkg_path) + .status()?; + + if status.success() { + log::debug!("installed {pkg_path:?} with sudo"); + Ok(()) + } else { + Err(Error::PackageInstallFailed) + } + } + + fn get_password_graphically(&self) -> Result { + // Try zenity first + let zenity_result = std::process::Command::new("zenity") + .args([ + "--password", + "--title=Authentication Required", + "--text=Enter your password to install the update:", + ]) + .output(); + + if let Ok(output) = zenity_result { + if output.status.success() { + return Ok(String::from_utf8_lossy(&output.stdout).trim().to_string()); + } + } + + // Fall back to kdialog if zenity fails or isn't available + let kdialog_result = std::process::Command::new("kdialog") + .args(["--password", "Enter your password to install the update:"]) + .output(); + + if let Ok(output) = kdialog_result { + if output.status.success() { + return Ok(String::from_utf8_lossy(&output.stdout).trim().to_string()); + } + } + + Err(Error::AuthenticationFailed) + } + + fn install_with_sudo( + &self, + pkg_path: &Path, + password: &str, + install_cmd: &str, + install_arg: &str, + ) -> Result { + use std::io::Write; + use std::process::{Command, Stdio}; + + let mut child = Command::new("sudo") + .arg("-S") // read password from stdin + .arg(install_cmd) + .arg(install_arg) + .arg(pkg_path) + .stdin(Stdio::piped()) + .stdout(Stdio::piped()) + .stderr(Stdio::piped()) + .spawn()?; + + if let Some(mut stdin) = child.stdin.take() { + // Write password to stdin + writeln!(stdin, "{password}")?; + } + + let status = child.wait()?; + Ok(status.success()) + } +} + +/// MacOS +#[cfg(target_os = "macos")] +impl Update { + /// ### Expected structure: + /// ├── [AppName]_[version]_x64.app.tar.gz # GZ generated by tauri-bundler + /// │ └──[AppName].app # Main application + /// │ └── Contents # Application contents... + /// │ └── ... + /// └── ... + fn install_inner(&self, bytes: &[u8]) -> Result<()> { + use flate2::read::GzDecoder; + + let cursor = Cursor::new(bytes); + let mut extracted_files: Vec = Vec::new(); + + // Create temp directories for backup and extraction + let tmp_backup_dir = tempfile::Builder::new() + .prefix("tauri_current_app") + .tempdir()?; + + let tmp_extract_dir = tempfile::Builder::new() + .prefix("tauri_updated_app") + .tempdir()?; + + let decoder = GzDecoder::new(cursor); + let mut archive = tar::Archive::new(decoder); + + // Extract files to temporary directory + for entry in archive.entries()? { + let mut entry = entry?; + let collected_path: PathBuf = entry.path()?.iter().skip(1).collect(); + let extraction_path = tmp_extract_dir.path().join(&collected_path); + + // Ensure parent directories exist + if let Some(parent) = extraction_path.parent() { + std::fs::create_dir_all(parent)?; + } + + if let Err(err) = entry.unpack(&extraction_path) { + // Cleanup on error + std::fs::remove_dir_all(tmp_extract_dir.path()).ok(); + return Err(err.into()); + } + extracted_files.push(extraction_path); + } + + // Try to move the current app to backup + let move_result = std::fs::rename( + &self.extract_path, + tmp_backup_dir.path().join("current_app"), + ); + let need_authorization = if let Err(err) = move_result { + if err.kind() == std::io::ErrorKind::PermissionDenied { + true + } else { + std::fs::remove_dir_all(tmp_extract_dir.path()).ok(); + return Err(err.into()); + } + } else { + false + }; + + if need_authorization { + log::debug!("app installation needs admin privileges"); + // Use AppleScript to perform moves with admin privileges + let apple_script = format!( + "do shell script \"rm -rf '{src}' && mv -f '{new}' '{src}'\" with administrator privileges", + src = self.extract_path.display(), + new = tmp_extract_dir.path().display() + ); + + let (tx, rx) = std::sync::mpsc::channel(); + let res = (self.run_on_main_thread)(Box::new(move || { + let mut script = + osakit::Script::new_from_source(osakit::Language::AppleScript, &apple_script); + script.compile().expect("invalid AppleScript"); + let r = script.execute(); + tx.send(r).unwrap(); + })); + let result = rx.recv().unwrap(); + + if res.is_err() || result.is_err() { + std::fs::remove_dir_all(tmp_extract_dir.path()).ok(); + return Err(Error::Io(std::io::Error::new( + std::io::ErrorKind::PermissionDenied, + "Failed to move the new app into place", + ))); + } + } else { + // Remove existing directory if it exists + if self.extract_path.exists() { + std::fs::remove_dir_all(&self.extract_path)?; + } + // Move the new app to the target path + std::fs::rename(tmp_extract_dir.path(), &self.extract_path)?; + } + + let _ = std::process::Command::new("touch") + .arg(&self.extract_path) + .status(); + + Ok(()) + } +} + +/// Gets the base target string used by the updater. If bundle type is available it +/// will be added to this string when selecting the download URL and signature. +/// `tauri::utils::platform::bundle_type` method is used to obtain current bundle type. +pub fn target() -> Option { + if let (Some(target), Some(arch)) = (updater_os(), updater_arch()) { + Some(format!("{target}-{arch}")) + } else { + None + } +} + +fn updater_os() -> Option<&'static str> { + if cfg!(target_os = "linux") { + Some("linux") + } else if cfg!(target_os = "macos") { + // TODO shouldn't this be macos instead? + Some("darwin") + } else if cfg!(target_os = "windows") { + Some("windows") + } else { + None + } +} + +fn updater_arch() -> Option<&'static str> { + if cfg!(target_arch = "x86") { + Some("i686") + } else if cfg!(target_arch = "x86_64") { + Some("x86_64") + } else if cfg!(target_arch = "arm") { + Some("armv7") + } else if cfg!(target_arch = "aarch64") { + Some("aarch64") + } else if cfg!(target_arch = "riscv64") { + Some("riscv64") + } else { + None + } +} + +pub fn extract_path_from_executable(executable_path: &Path) -> Result { + // Return the path of the current executable by default + // Example C:\Program Files\My App\ + let extract_path = executable_path + .parent() + .map(PathBuf::from) + .ok_or(Error::FailedToDetermineExtractPath)?; + + // MacOS example binary is in /Applications/TestApp.app/Contents/MacOS/myApp + // We need to get /Applications/.app + // TODO(lemarier): Need a better way here + // Maybe we could search for <*.app> to get the right path + #[cfg(target_os = "macos")] + if extract_path + .display() + .to_string() + .contains("Contents/MacOS") + { + return extract_path + .parent() + .map(PathBuf::from) + .ok_or(Error::FailedToDetermineExtractPath)? + .parent() + .map(PathBuf::from) + .ok_or(Error::FailedToDetermineExtractPath); + } + + Ok(extract_path) +} + +impl<'de> Deserialize<'de> for RemoteRelease { + fn deserialize(deserializer: D) -> std::result::Result + where + D: Deserializer<'de>, + { + #[derive(Deserialize)] + struct InnerRemoteRelease { + #[serde(alias = "name", deserialize_with = "parse_version")] + version: Version, + notes: Option, + pub_date: Option, + platforms: Option>, + // dynamic platform response + url: Option, + signature: Option, + } + + let release = InnerRemoteRelease::deserialize(deserializer)?; + + let pub_date = if let Some(date) = release.pub_date { + Some( + OffsetDateTime::parse(&date, &time::format_description::well_known::Rfc3339) + .map_err(|e| DeError::custom(format!("invalid value for `pub_date`: {e}")))?, + ) + } else { + None + }; + + Ok(RemoteRelease { + version: release.version, + notes: release.notes, + pub_date, + data: if let Some(platforms) = release.platforms { + RemoteReleaseInner::Static { platforms } + } else { + RemoteReleaseInner::Dynamic(ReleaseManifestPlatform { + url: release.url.ok_or_else(|| { + DeError::custom("the `url` field was not set on the updater response") + })?, + signature: release.signature.ok_or_else(|| { + DeError::custom("the `signature` field was not set on the updater response") + })?, + }) + }, + }) + } +} + +fn installer_for_bundle_type(bundle: Option) -> Option { + match bundle? { + BundleType::Deb => Some(Installer::Deb), + BundleType::Rpm => Some(Installer::Rpm), + BundleType::AppImage => Some(Installer::AppImage), + BundleType::Msi => Some(Installer::Msi), + BundleType::Nsis => Some(Installer::Nsis), + BundleType::App => Some(Installer::App), // App is also returned for Dmg type + _ => None, + } +} + +fn parse_version<'de, D>(deserializer: D) -> std::result::Result +where + D: serde::Deserializer<'de>, +{ + let str = String::deserialize(deserializer)?; + + Version::from_str(str.trim_start_matches('v')).map_err(serde::de::Error::custom) +} + +// Validate signature +/// Verifies bytes with the same minisign format used for updater artifacts. +/// +/// This is public so applications can authenticate auxiliary release identity +/// files with the updater key before trusting an unsigned mirror manifest. +pub fn verify_signature(data: &[u8], release_signature: &str, pub_key: &str) -> Result { + // we need to convert the pub key + let pub_key_decoded = base64_to_string(pub_key)?; + let public_key = PublicKey::decode(&pub_key_decoded)?; + let signature_base64_decoded = base64_to_string(release_signature)?; + let signature = Signature::decode(&signature_base64_decoded)?; + + // Validate signature or bail out + public_key.verify(data, &signature, true)?; + Ok(true) +} + +fn base64_to_string(base64_string: &str) -> Result { + let decoded_string = &base64::engine::general_purpose::STANDARD.decode(base64_string)?; + let result = std::str::from_utf8(decoded_string) + .map_err(|_| Error::SignatureUtf8(base64_string.into()))? + .to_string(); + Ok(result) +} + +#[cfg(windows)] +fn encode_wide(string: impl AsRef) -> Vec { + use std::os::windows::ffi::OsStrExt; + + string + .as_ref() + .encode_wide() + .chain(std::iter::once(0)) + .collect() +} + +#[cfg(windows)] +trait PathExt { + fn wrap_in_quotes(&self) -> Self; +} + +#[cfg(windows)] +impl PathExt for PathBuf { + fn wrap_in_quotes(&self) -> Self { + let mut msi_path = OsString::from("\""); + msi_path.push(self.as_os_str()); + msi_path.push("\""); + PathBuf::from(msi_path) + } +} + +// adapted from https://github.com/rust-lang/rust/blob/1c047506f94cd2d05228eb992b0a6bbed1942349/library/std/src/sys/args/windows.rs#L174 +#[cfg(windows)] +fn escape_nsis_current_exe_arg(arg: &&OsStr) -> String { + let arg = arg.to_string_lossy(); + let mut cmd: Vec = Vec::new(); + + // compared to std we additionally escape `/` so that nsis won't interpret them as a beginning of an nsis argument. + let quote = arg.chars().any(|c| c == ' ' || c == '\t' || c == '/') || arg.is_empty(); + let escape = true; + if quote { + cmd.push('"'); + } + let mut backslashes: usize = 0; + for x in arg.chars() { + if escape { + if x == '\\' { + backslashes += 1; + } else { + if x == '"' { + // Add n+1 backslashes to total 2n+1 before internal '"'. + cmd.extend((0..=backslashes).map(|_| '\\')); + } + backslashes = 0; + } + } + cmd.push(x); + } + if quote { + // Add n backslashes to total 2n before ending '"'. + cmd.extend((0..backslashes).map(|_| '\\')); + cmd.push('"'); + } + cmd.into_iter().collect() +} + +#[cfg(windows)] +fn escape_msi_property_arg(arg: impl AsRef) -> String { + let mut arg = arg.as_ref().to_string_lossy().to_string(); + + // Otherwise this argument will get lost in ShellExecute + if arg.is_empty() { + return "\"\"\"\"".to_string(); + } else if !arg.contains(' ') && !arg.contains('"') { + return arg; + } + + if arg.contains('"') { + arg = arg.replace('"', r#""""""#); + } + + if arg.starts_with('-') { + if let Some((a1, a2)) = arg.split_once('=') { + format!("{a1}=\"\"{a2}\"\"") + } else { + format!("\"\"{arg}\"\"") + } + } else { + format!("\"\"{arg}\"\"") + } +} + +#[cfg(test)] +mod tests { + + #[test] + #[cfg(windows)] + fn it_wraps_correctly() { + use super::PathExt; + use std::path::PathBuf; + + assert_eq!( + PathBuf::from("C:\\Users\\Some User\\AppData\\tauri-example.exe").wrap_in_quotes(), + PathBuf::from("\"C:\\Users\\Some User\\AppData\\tauri-example.exe\"") + ) + } + + #[test] + #[cfg(windows)] + fn it_escapes_correctly_for_msi() { + use crate::updater::escape_msi_property_arg; + + // Explanation for quotes: + // The output of escape_msi_property_args() will be used in `LAUNCHAPPARGS=\"{HERE}\"`. This is the first quote level. + // To escape a quotation mark we use a second quotation mark, so "" is interpreted as " later. + // This means that the escaped strings can't ever have a single quotation mark! + // Now there are 3 major things to look out for to not break the msiexec call: + // 1) Wrap spaces in quotation marks, otherwise it will be interpreted as the end of the msiexec argument. + // 2) Escape escaping quotation marks, otherwise they will either end the msiexec argument or be ignored. + // 3) Escape emtpy args in quotation marks, otherwise the argument will get lost. + let cases = [ + "something", + "--flag", + "--empty=", + "--arg=value", + "some space", // This simulates `./my-app "some string"`. + "--arg value", // -> This simulates `./my-app "--arg value"`. Same as above but it triggers the startsWith(`-`) logic. + "--arg=unwrapped space", // `./my-app --arg="unwrapped space"` + "--arg=\"wrapped\"", // `./my-app --args=""wrapped""` + "--arg=\"wrapped space\"", // `./my-app --args=""wrapped space""` + "--arg=midword\"wrapped space\"", // `./my-app --args=midword""wrapped""` + "", // `./my-app '""'` + ]; + let cases_escaped = [ + "something", + "--flag", + "--empty=", + "--arg=value", + "\"\"some space\"\"", + "\"\"--arg value\"\"", + "--arg=\"\"unwrapped space\"\"", + r#"--arg=""""""wrapped"""""""#, + r#"--arg=""""""wrapped space"""""""#, + r#"--arg=""midword""""wrapped space"""""""#, + "\"\"\"\"", + ]; + + // Just to be sure we didn't mess that up + assert_eq!(cases.len(), cases_escaped.len()); + + for (orig, escaped) in cases.iter().zip(cases_escaped) { + assert_eq!(escape_msi_property_arg(orig), escaped); + } + } + + #[test] + #[cfg(windows)] + fn it_escapes_correctly_for_nsis() { + use crate::updater::escape_nsis_current_exe_arg; + use std::ffi::OsStr; + + let cases = [ + "something", + "--flag", + "--empty=", + "--arg=value", + "some space", // This simulates `./my-app "some string"`. + "--arg value", // -> This simulates `./my-app "--arg value"`. Same as above but it triggers the startsWith(`-`) logic. + "--arg=unwrapped space", // `./my-app --arg="unwrapped space"` + "--arg=\"wrapped\"", // `./my-app --args=""wrapped""` + "--arg=\"wrapped space\"", // `./my-app --args=""wrapped space""` + "--arg=midword\"wrapped space\"", // `./my-app --args=midword""wrapped""` + "", // `./my-app '""'` + ]; + // Note: These may not be the results we actually want (monitor this!). + // We only make sure the implementation doesn't unintentionally change. + let cases_escaped = [ + "something", + "--flag", + "--empty=", + "--arg=value", + "\"some space\"", + "\"--arg value\"", + "\"--arg=unwrapped space\"", + "--arg=\\\"wrapped\\\"", + "\"--arg=\\\"wrapped space\\\"\"", + "\"--arg=midword\\\"wrapped space\\\"\"", + "\"\"", + ]; + + // Just to be sure we didn't mess that up + assert_eq!(cases.len(), cases_escaped.len()); + + for (orig, escaped) in cases.iter().zip(cases_escaped) { + assert_eq!(escape_nsis_current_exe_arg(&OsStr::new(orig)), escaped); + } + } +} diff --git a/vendor/tauri-plugin-updater-2.10.1/tsconfig.json b/vendor/tauri-plugin-updater-2.10.1/tsconfig.json new file mode 100644 index 0000000..5098169 --- /dev/null +++ b/vendor/tauri-plugin-updater-2.10.1/tsconfig.json @@ -0,0 +1,4 @@ +{ + "extends": "../../tsconfig.base.json", + "include": ["guest-js/*.ts"] +} diff --git a/website/index.html b/website/index.html index affd554..9333e72 100644 --- a/website/index.html +++ b/website/index.html @@ -520,6 +520,15 @@

下载

+

+ Windows Authenticode 正在申请 SignPath Foundation；在 trusted-build 与真实工件验证完成前，新版 Windows 发布保持 fail-closed。 + 以下是获批启用后要求展示的归因，不代表当前下载已经签名： + Free code signing provided by SignPath.io, certificate by SignPath Foundation. + 代码签名政策 + + 隐私政策 +

+
diff --git a/website/public/fonts/shs-bold.woff2 b/website/public/fonts/shs-bold.woff2 index be6804d36551a0400a244943ff6e49b7af719e6a..45d8419dba7cd90256861a5d66fda5024b754784 100644 GIT binary patch literal 247880 zcmV)9K*hgzPew9NR8&s@1IS1K4*&oF1t|ys1IO+F0RR9100000000000000000000 z0000PfnE)g#y=a#TpY+;24D__C;*y%0X7081E**N1_gv32Ot+D7^i$&04TKyqRH6Z z&&{F0i~vyp!z{H_k0{AQJF_V7`T z{{R2~|NsC0|Np1!SP@o)73uf^ zTOXCWuF=4&`$I}8p}-n5dz6qKvm&erE5b?#JwE50f6VQvyE_u>j1^%;SV^n|{=Cyc zZ%|4>Azqy)oz8R4IbTq(-cPLe-TjoNs$6gDJu`t_g#tX^5E>yQ7*} z5muyYA6ehbB^R2i_dC1m-Z*9?Rqqq)?(VNL@#_7-zRo%4!#BjM^SOghOz)<|wrHqF3nS?Mo(f;tyYbLpZzqqD(wXB$C+Nl3NV*UnTlX^ioMo z(AkI!!@Vy;<82=UAs>4ma8F1Kn?y)>7Qb&#FUJ4vO?-3Y?%JdcpS$ZS7v$6BDhax= zyh@k$Ct0yZ)(@AkqXmXU+RYFlB+Ns^QXuVE=i2Ouh|*;Y$@pqcY_wFA3o<7yiT8%< z^Z8UamZmOiX(i1vX=Y|&h0|4RFJl#6|3~sP;4W|2Y7_CoJ|wK|&r(V^ZK@NJzdMGR z;@eTHCWdyVS8FLL=|d1OywmS!5TE!(nD&VAH7ga;$~v|_|IbEYMQC$!(4OccSeTlP zc9~LGkT!1jpIK`=K22p`~Uwws@A#Z(F`F)H+>-)$}I;Y0TJ}Er$zkf@5@|JKu+!SgW>?4 z>$bRhi1`(?U@U!G)au)+wTK0I!N1R1^a6i?ZAR+iE2_7@EMs+>NwkPawL}RD`oFoX zPTAIL-4^Xsb+m~0JptZ^sc{G^6=K`6zVs#8!Ga)FGK73vveTN30qbf`4%MjF=+6rw zZAcIQ+GM}YNE)8$5bBu1$h!rjP$>CXnEqR8|H;Qhr}8P=ug=jp?f_lpEZ^m1DQr85 z86_T)Mw%ub=pO1GWC2;W!@QeK7C4)`XPmbEP_r4;_ZlL6him13Tg^tZBA#*v53-Q# zPKt<5zi_RptJS?g<2l=#A*d1|}poAxad984!H% z(PuWUeJ*`2Z*Z>sfx6?Ak`$2B9z3fdD;9cc#*Y3U?pgDDS2o~)m%!@yYd#xO9`X=D zbNk&jG;DiK01%cMZot+-)dB-dr%%$KRIQzsK* zNJvN`NKipUL4rgTs475^wiS>N1ql+Oh!GJ)Fd&!`UKvK=5N0$y3PE6G-p3d42?O2mIwf8~Sv82jxV zUMex^lWzjkMH^I2v_c|QH)wy~YVfUV3i(P74@3au(50LtUNryy+x-5Mn%W^n=2|AX zm9X#a{ltDneN-cMB%%aJNCFW=TcLplLW4JA(J{9LuXAc5paNd}=V{G8m`QiDb@FSo z{irWJ8^p#4QHU5LM9g7G12JpFlWN5R#2|uL<1rv&HcDJ?)jnoJ0Mv;!ldUAYD4hrj z%;`l$x&x~34pAY5Kn&dfTvkrs&5=fs3mn2?fOe0;fiR4=3h)QE)|@aj`T2vU`v2GS zM$wMm`=nTZ><#!b6*%oBNP$!0G-sxCd&{KC&IfFOSNK>-j(MA9L(pRU(^4Y_j~5f<6Hj>v(|Zk zh4o4NJ!nHy(g3l+V@+v2(v+AWngAo$i7|fVu_#c6yt0nX~QbV=e=8mV->VX*D6= zh!Gw&+=LrIZutRWvjnIL!wDJw^lwf3!C9Wst3J(iY!o|KKt>@*i%M7F2qb~1B=nv@fFRgF@s5HO9Yp)!47QH#?R(kyh5u~t z?^AX*))<@M>lo!K5491_B}uM3{U{r z46-E?2rO9!$rQ&)t^Xu0*(#JU;)toBi_&7oIcSFvSPf#7NI$e_V|oy)$JAP$b;c9|tn+W-GewfMs`@8nal z&Y5l+c@a{ekbxx&2u27a7|o32BpzE17RaG)1H5U%4Pb#NU7(b%+;KuQIiiQ#p293E zNTMW6oKAhNcda(n4HlmFj_i6=th2qAiCgd!HALeJi@ zWwwYSK9NCj2MrqW9y&HvNlI`7Hh&~;0w;2crze2;2fH!94|I5oT2yw_vZBBNhc1nJ z5brM+{Ux)C^4*S52){^6Ji;SfF`9T(FIVivU%&dM_K*79m3$_y((a3NK*>=YB13G) zfI?o0cUM|T%Rjj{pDsod2Kq|7Ry-_j|}6>)t_XU#jw3YN=CC zxl}w?L|*lj+ox2hDM4B&8YB?p!l@c?so23v@IZih(iQ4I&oAeHo`m+#>pxG{@Fnym z;59^p_63s!^AId9WH6ab;@}CQ6Ndz1#LysKf=Qt*E$M?|>s6YQkPX-*6nbl3qRhrl3PTQYPk$rc-A2<&Z=%n&E( z5Of+GXbzxhY}fa5TvoN-;`+auj6)x-|eI zlM0{!NeIOmfJ%TQ2%)q^v`5xM&8fpYijpXtU+Dker)vMxeL%{-pzYL!Y4}o(*3p^K;!3)|UFC>S$kW=D?odORihdhuHyIMQd`Sn$O zs($yHrUA~SWb%MY#B(W^cpzm(2UJqNkW(w5Tn**dwEb_}VYlXgF#NM=$*JEYzwL&9 z_y&{7@2*VE(rwJ)2#}{LG^uw6vL?t#%DW&{5Mq0FZ`j)ySQ#!>IO7+P<9U*Aumq{X zJ7Xh;PR{Y}t&NP0oC%VTKT;HaDY{QTRTe6V-v(j+{{LI5mEK?Fr670Dpm)s9+2x7s zD4Z+<-uqA!?^RLc|3z8+1-i)((uXR@J>m!1BNo+5IL;h~Qi0we%_hyVtWgJvq5ryR zizj%N9suqHl9n_N@H-xc*F+TF!>fZIiwn2_SUkaSDOktD;KK^G6-Xcgk;4DSK2@p{ z`z1T%%2GyH!*~p=)M#Z&{>~LPUZD2@*mOk*08t^YK}e zF)fD)VMuwkl#WMtyQ~>SFhT6=>WnxRYT!!kuRG$jxaY2a>q(bRl-&d&EHk9t%vy%~ zx4C_D+E-d6;DNIFT>{liHnVw{eH8--1qF-9Cc|=bV=Tk@{oQxj&SXzJsQ^V1AV>=p z3!7qbTKVT{wEs(OAQf03Nl;(G<#vG zXTSpW=cHYnuA?@RJVU+}7gIk}pk_DvRId5Xsh}pN>#1N10RsTWNSyBEC}h%!^Ue?$ zf4ZlZ!9oki)QuE?Oa!{3dgSxYwDIE|S@`W{I5IqPK4FcNf11Z$y?W(KzOja18JNBd z&*}Q|-|-I?YZPwr^*00DK*No#2>|lwhjZ(DGi2h&9e2I$(+x9IpU2D@)DM^ifR;Ps zSAY4LI|Ul;xFjkS8OurCsd&pc$SGM0ta%iz8nnYyk@f+dSZJBDqg=>Zl?|z~^gD*~ z^jdV?T-m+#LRS+J1jJkFYnST;{j;L$xP>|Jd`bRd#?E`v^sA0W@P4M5f^M!(^orMF z+Pa5;%rJX}6NTMZh_!qkZ7+xGfY5`l7el}L=U1DBC1=##tgW|ucfCE$+D+Ro6})*d zf!RDHaEf!BNE{kC_mbDW<3peM+K+zszur`o6+{pXkC=j%i5oBeLI{&2PlXm3GZt() zapw&yScF)K(&Q*qrdopz5W)yYW^zS-_^YUz$YO{~Kt@f^%FaiSaAKq>QlrC=DFj>2 zkWl;t3Kt_$x;(`y)M?TNK#lNJ7EeN9L_q)BvD5Do}$) zw4)D0FcRZ11+y?8OR*N4upN7FP={WlrVuS#w}ZsSsi1X)K$sXJog zS=hO@Eg&W>ucl+@%(9xSjZUG&%>0td+DKPnF-dK+3(GrnY3wvOGCnCIuehSVO`X87 zM)4_`1!a|6_tN{Z6Q<2symI~Kt%r}9ICa*d6|2_nVYA_5CQhHbc;)(S))_c#^tdUr z<}V$lifUw>Oeb^0DOm-j)s3A)Vv^eC6qdK|T;DA?A}%?ru(G~&oxt$uxU{Cl6{`>t zWP(m`1}9FRyJ*F_O}iXAdi*xi=PX#Z{pvLvcC@p>n~$9^b>`fK%hzn$Zk-K=jNEwq z)LHWuZ@y)t={LNrkg64!I(_l%n6j&N&Cs%KW zXvwk^C{?9VCyAiAysDOwmA#9Xw*d@I;Yp3~1vOqM2S~sIAt*o(X70h@P_c<9sOflw zV1bTL!oYc8D0sr51}ZB^7@#1af*vefseI7c1VmbTA%DA#DrkqU=H<#!12?=_)6YfR;pv&yFHk@o0HzdP zAc)w;t04YWZw|x6R30mVVgSu}1^YN!l}Efr_kdVTDhbj!;q99i40o9@oabqlN{}b0 zk6Uvi!Zz{YJ!8!Q*kKQGfv>f?7_86|GNBykK_i(g^A zl`&940#T-A5^McJ5`03}kXQ$lbcKeA6a;C|kXiZMKJ!=~+r`axQ+$$F;9l=)Mz|&A zR^{FztR$EP0rR28ox6|i)s;7Bh0BZ9z@G#4PQuPZdwBH;7ZA8&P`4ELKUCXb;1l}x0$=F9U zr3^1*C`Gc|EVwA2K${h>C>R{Py@5UpG?u`V_qlqD8GDa=Yt)Go4BF#%ngsH}XRYz) zfE1*hiJFNYgcir$jF56}H5Ggr?ZyA?FNQBOhyD0X&b% zi90mum`@~P2vX9=ly9U4)gl(O3Tdz5)X*yhTFL)WiZ|Yo5 z-sq?$a(zP^rWn&RY^Z9&T#($5(FdN2QcWugB{hK?$M-vYUc^v_(w}p~I~Z1!z+R`5d!?uEr~CR*`0y#g{~vb`uHZ zXgt#o@9v0F)W`;F0=hUd&PGDqN`q+La0dFynN1*(W_43N`jZ$2vXT$Iljjv@7MfG{ z&7ms-J$v9u>xLX+p?$V9z1)V3g{X#_95rkqKGd%99WPS*0H-J34^nN7a2SA&$$l?J7h270_h{CNaA0Gef>sB)kD zf`N|nlvQIhF==E<2i6O=9_`6t^ShSzGQc#;(0kf&LX0maZ;Nv_W*I0_e_v8)>qtVSkqlKa#W*I|;RGxRU#T2)__=)N>DFw+G)1n?atp873(CswCXJ$|C7h-!4z`J=B8Ur_%DOQQ4}tI z;oeXj-XiE0P6AC~H#C1!0^py)UF9M^M7zPH3PVe`AG_TAiX(=*^qw*lliHL~TpwU$ z0lby~5a87^AqZwrC$yVc>giX9NmGoG&pbZFf(Fecp=~=> zyh7REB1MQ+DZ=#%?2tIl;M{u(Hz(6Uu{=HCc1r&kTO@$42lxq1v<8InfvFrvjDyYr zzn%|eK1#nE8mEyQ3eG9UtJ~|JVY*Fj9V{7OPl@;UjjO7=7Om~3ILqp^gDVP4Td~^@ z%aSm6(wi~1d+urDpL^8TFsGi3YwQJ4xY~NKInoj62%xXH-3 zVo63|0^2T2=2?^DYQv37x@$-r13b92IPR`?u7zQa4j%2g8>#^bB>wxC!#&20MpQ!& zc%V!qvbJ?`su6~Jx-w-1_t9xhSVobR?BQvGi{!`_9mtbJs2+QsfO`aBfCdr03dHpQ zEcY*mHlTXa_(5t*bDR;Tg|_y?2^p?l+IeVbS|6mWb34@Ta43Ur>yaUcf3~vYk7ab71 zPdCCVJ9M_0L8piA@vhoh+c3zrEtrHllzO_6qkrcHWQL?h5)TZUVs%jV^lvDSK{Lbm z3cSjQbe<`1Ra7uL903|A7xIZC3v<9vET3?bQgJ*07+P}zSC*mOu*)P%nyq0Vzz!sT zo~>kw#_e5jz|sh|ELy?ur$Flv`|02KceXD@wSXEwSKx$(Yltd$Yv8RS6p&i;w=)3& zhguG*r@EL~w%7TZ$&p|9Ip@&oeBvi_LA(6?lwhtS|D<^t)GwTn*{f+;W~0ZE=n!l% zdo{Br)TC^Czwx8Yf1{LSnRNm@*=&u_-i#F0F;KnJ=I9Ms+|0@aNV_NdAQ{V{iGzDA zp$Rg9eF$4M%dA~*RtB1YF0V-9wE1f!X^ns-;X!hIcja-keS-t2gPrRgg&(s?K1kL} zC*d`LGTdrSTOwinIM0}2Te$f)jW431GAkWwtDKN##W?kWZu-i$3%<#+vrm5(2(#K_ z-Zmk^^h4rbA=i?Jv{?!&q}*d_+pB?n5dzFhcsDf=dy6{nLXJTNVQWryNG89}D-2;B zX?LaNF!>l$Or2%fj0z~_Ii_@I&2-7_7ZG`NPi;}MlRQynPRGy3 z9Z6PPae*}O^@nawk)tbKr%1Eafa5Ev`xgL#a<)m+?=>Xu_bx~V5cB=@Cqi*hoxpMw zG3*bHh@J(xUExKbOva!Di@BuG8STSD-ni5Zjo)s&GC2XRaa!PWC}F#>2qlsL1pvw%K!#&MfCmY$Pvu7Le2AgDPwDLdtP zrBZ33v^gf#NNpQfSBn?GPKv5HJndfE6R9P7tVbJycqdZPCzTpf8{y!@#-&;sr{Eo5 zjuidhuHi;G05^E;fHM?-*V1tCwnKQwJaJRAQ{!a$lUZQ`aqsYToOi1pLdAX_bn?d4eAx<5ju21IV#*CYWoF3A27}*H zO<)K{$3Kw|$$1l`3(-39z^>AWIZmB_d>L7e9Ebmr#woOC!BvTyWvX+Kqbbu1qBb+& zgVUdRl4hlDui1n&sqHB#0TEv7gxL4We=FUl_BqS2(?TJTGQ0yIb_MgHeyqxit%aN6 zGI-{ynx;Qnf~YhkQ?qem=qp;*(SKZe{<0k;Gnih^HK{Yrnj9!L){Wgc{oe=~Qp-iY zh8c`c2c&(~tBu=_&gyho>G4TZnM)ib>S&ib>ayZQB^mZ;L`|LFd@H0;#>~`q)S7<_ z@-qyM)M@ASaTpXuyjlX(Ieh5&n(`r+Lr{L_D|Em3L9h~^uM}xd4^DVjfT&L>?>P0o z`-Jw@6^){9^SzHA#il2+b!Ta=weSJKkiw*y5vo z!TUKc`+Lm2i6d#iK$zwrv?SNPwHVJ1UOKf>e=YOwrY-e}ND2kH?HOD$(#M#$$)lyV zQAF!-M^+MF%!R31EJtC=K0oo8T0A_9;w4aa-hFt+RtnC|H+ggM$TBZFs(SWv5`!KW z9kH_H{n7j3`a1T)cVsq+Z~hpGc+gI#hw$VSejYaYM6nRGeb#X{d5hr{FD#YoCpu?Z z3Sro*``Gb4Rre8w^HjqbbL_^VUg9cR9133U7M{W z>Q6%g+SNx)|1-kiL?_-lbJbNqT~3Ca75z89*eUo}yk&on(GK`su6uAGR9(QIEE%fV zkCP4+@d4EH=SY}jaQDhwYogfZtF1Xxnz(>eiMBI*&fxBZf3Tnl;^#6T)jTOE&u76$ zQxNZQz46;?6P;K0a8Sy*dPl?NJ@;NV7ZaVD7NeO@z0ROs#6^D=KxJ*kkW6CkZT`Vj z$eQ6Ztl0w8;*|sU;zeobLF`Gtl=Sg7%$v0@5$C}2&wr)Tedzd1rii#psuGLPCDoye z^k>0+MQs#$jOypbB&Wq_7E?dq=yhbo^^c7vZr^G_h9Ljl@jcrE@1Y1dL&SBP%>Ewm z>+tovf~Uy**76tULZMU>qaAgB!x9vNWmdgS8$tI5LZ^?KS6pQA_A$Wf>%e-fz~}ZU z)f0AmWBa^q{GZ~)9_MLW8rPR+wcE@EjVW!h&P{e{mu*;rIw+$iQOoh$x4LR~)N95L zlb;>-$&0#{Hu;|ZPODjmlQcY@m1ml8-d^ZH|4SHy*IkANBTl#<{L7bYY z_ciCAX`YpqgMlWIWHeIrk*oTL4C*?ouC?km3-z#__}77H|K*8Me!iXlo+7(E_`Qs+ zY3kWEWZ^-947-~D#P7}xJwsXRLFZX}&%iFf_)QBM(xSAlt!uW0gkH^zH^=zC~LjMn|brBv^NJiomcD>qX{|vrG)}<`;BF5yplaP8(8ai z52wLWA9bGEHFy{x>srVPR$($S)A5!Rp(9MZ=Px5wIk!cuNmR!)bn6|grZM`^8J;~% zY%RXz&jX0-H84D;Q=rhY983y($SM;ej3GitTV;_egquP6Dc zHZn0H%NE1>jCl+`2wr%}*4MbR<0TuvBVks@{5W$~aao$Q#{KL5dtY%`+W?-XDSK9u z)Q9va1--R_6oeh%S=xvR!6ZwAa>6ugEu@h{sJ;9Jt|Rh_C*CdVK?3uku4>cOCnE4i zoL$>wUuk(Yi3WR)F0&B%-ihySqi8j9HCg6jO}5m$^FmJsi^{QUayX>^=Y}V~aJdtS zf4cVcA0D{Jqvp>inwIXrt9k>?y34mEQBpVBXU;F3J+>_R(~O!m;ThQhmSv*H z=788SQXQQ+WMPYK_MD`J3V`3|r#9%)$mrEsd08UJ+(WABEnAdfXcyFT#tdB*PoY{^ zV9BD{Nhd{gMe;v8j!!$8DsbmLz9M;t@AppACWxS$wUJu?>fHwx4PyL=Ll>q3^$ zv&RTu!pE#{_3K#Q;Gx){!`Fn)ad6O;h_g22i{icZF-*|dZia;1!e++;7o~HD25Tv@ zrk|{iD=0OwaQnbzqHw{OE}(LRo#8R7ibO&UQ{!k3YCxApJ+4Fh$tX3}RY05}yL^8nt)p|1fk)DS8k{J>;slZATRuC%3!3;J{J z9g{FNJ}Wg`{PA%(sNuT(!S?6JmZCU~bw#gFB^B9;T_KD!9-rqkWFX?2k%Kf_^+KAZ zSM04ut;eTEynTv&{Y2I}RIXHq+Lg9*7B{C7I!&kS)>fgmMlK0y)bHy z4Ni_<9XNCTGo^IUS!^5(&ue1SQ{!~AsaLru5nt_pa6Bu`D_7QZ%AZZ}o&CMxB(S=C ze3lhg_p~fZ4?B3UZiv~p)>j&k!pBfh$d84$(&D(R{IpPMimBr^$-7D`k`DPPq+DUW zYM1@Kx;WTejZirToFCOr%DF#9Ij%jm_(DnG)MwuUJynqvFgm1y_yT3QX~^#ypD}m$ z6d}^*vrG@s7k{y{^X>fNDE~N;ZV3qg*;S-%HY1JLs_rq+DAy>?qTJA7`U=nB-QRkP z>@p0riiuVR^iP4D7V+CT{^e$FySb*sC2FoxEX+Zlpn&>l@mpAOACVvi>CFe#ojoLl zE5s^*KzZQB)rGCbg&RU*TfOJd#RrGvnwE~7uBM-fNT(n;0$y&HAOh(C_5iRM01pPb zYV&a;_kmY?y`V1u2A}6-WX4^h!4%E_g%n8YuKq9HR20(zN?U-c8Py)Z)nR;$&!zPi zg%IQ>C#6UY(V>KxyI4Kkta? zsgI3jv+C1bKX4r3(n(7(rgJ)bz9%4`f*(?mPlOprpQhxB9*i7~TOJaGkdcw-XP4a= z*!(5Om;CI_F`|pk2puA(m^~?13PM++eR|hEAMuB$>(Sq!`ql!sqU^f$92UASpm38u(sif1NdoixJ z0cO?X_p=6zN7*gQL&Oj9csO+MPWv)3ix1C(sO$Xdi|1u&1F>dC-d)|Sz42PftZzpj zPkA$m4O!mUVuzZG6y^rN%}-=1KzS@2m+$eY+`A+^?C?lV+!7eBucs3#f&cSZmhf@t zZ09~C?5za!n{BV&2>UBL4hYghAucL7I}ie!8(?T%1|T$;c}0@GkO2{-qLx_Xe|xGG z(|}l+E*o^uVmpbwYjN8^9oUstiEl|6;=OazzUR0KBHx$o7a&(rrNR2CT zE7FZP(?d#PA@ehh8%Y!9ru_n$6O!Lh@Fy$CVV<}xxowiWvXSytH5efOo?%-82Ocxd zg=#bMamZ%cA}MB~1XK2At65QFky;JbdDfqtI}P>lJrNBiX$)3A)0zS!M^nA)RG_w2 zSMcoT=``sn76v~Q@pINphS|Do^*3ADDAe#&~y2$t}t){csNldB@118>5lDLi$gcKYdUEK`TNh z#>XYo$bn$S1eYXuF*6b>G^@gH0%6F^WfaAtUpR4-AWeZXeb$_L^5&~B3wmSyHr zn3M8d#)3@#LyPsDEXyff$e9pz8a8#$$fg9XfcQnNyHhH=RLu78P=+Tal-oPyrwzR{Vio&0|kB4CM6YXJH+0bs`x_tpU0 z5NwX=p{$IZx-U2qPk<+bF;|&1U67S{f}m`QByw_H%R4savZ1YV6W3le4x6gAUGnyC zA!UMsFD~=#Y8oji;*A5Bw1wiOp`r5@M3HsL_IH|URgYKZcZ!JkPGLR(kI7A+e}6d z_U%g+(>s+)r~fPnNaZ6Z5fv6!084yrrL%29R}Ce0yr%Ji|87t0u{M{05=b9X?SD&O z`K=zetB_p_6-191wQ#pa1&RW>4eT~JKT}p#P5S@GW&a=hPIML1a%J&Q?DF>I9}X?2 z^ogfn(YxX~9`=8TdIx+3egeFJC?E-V0B8UM!~m_p2rvUI1M9#(@GIqzlCMxY?1jiv zsmFvN@uxL$h^VAVG{TfA6i|RWN>Gpa*oA|vWKqMvM-xw@4_@#ZIERpb-hSw->FYq zWR}#n2~VxqZRW1p{fr&zZ-Evu4h=x`jJuQjC8B%SSw+%1vmlMB|#M_cSL~*7VCf0WDWo&u++R zZio4TyFY5t5uGVLYd;XQbakE9lUygvQZhMvIV8$crQHx2O*3b27>*?!u;p76og7o$ zoNYaUvU^-j)0Jm-Coc3j9=ZrJRX};hPkYpOus|E;wK(IG0T=ZJ{|uOjJt8~Mn!5~} zb%(ucPe{hlCW$-ru|4t%t#u8ht7Xp7&&P6luJLV)@Z zDHjPyq@Iwm;?CnQ=+L}6sA!^)5~@gb#N@WY;;o-@5Ul-yo)I9s$5;1V)w5&$0*{M7 z=fR|r;GBW7o=7yY&~LWb^3A!u`6C?qx;K~q3T#t^5*DJ|AZMchLiYXTEueTg&z>R5 zV!4}M3l?sVN}pAxCLBTqEF^Llb@|wMz?qHuIw75Ko-ATSZpEYzjvJc zo|;Pwg|8gP<>eMsj&>HqK9z`kSAFy$F*HpZ;FI#osFj3gR-QG%v~8gAO?odeXF#kF9CG^0cUqKN?m5q4Ht)Rhv~N1r`YW3&*8W6S5(t>=2Su!CJ!0J~|0h zUoQ0&cCb?FLpa^rFj)X8awO(UAw~dk#`0~!JlO1A>n(BF2;L~!D=1ffl?`P?57_|` znHGWyAu7ZN`k|g5nQknK(n|-~RBtMaFc(B;^Q5z7J;**m#C?RQD_e)AJf;3Z#7CZx zZryf6BZfYBcgLKxybuddzf|0f>gUNy+E|HfaVL_zMSh#jSo=a1i4i-nwO;b2U>-sR z?Yx`E+vz`&ld-6`Gs3D`n@P&^GCQ>Fn`vGM-BuTN$;>ekhsY)qXBBqJ)`0`Y=tO|{voXWp&p7_o z)kZ0jp^j3HAgFtVJHZ>PFB1DectI&e2v^!jTRLOZuI;j~w7Q1CRcUDanbJ^pBFt7YbXL0vHPkw1C z=h=*kY4#=kHXc8%bzFHI98mI0orzyJ@+hUj0;C8EGUZ5QAbpx43Q5i?49k#?B%JO~ zWb=*r5eA<0OIZ(!YZInH!qug)H}Q*xnh>z+YzDnO)q#u)`~R{lS-q~Ib4|p~Qu@nf zzP(s+`ATrc8SlL(T!)of>5D|VYZSRk>NoZQ>qi;YH7ht;x6N$LH() z-wcl0)s2Hb_tZSX+hx;^PsCeeObB1mCu)1TI{sYSMi5t*_&)CB_7eXdjZamld+naB z_vJA;4h3%i59Q_*6RkvkQup);s<`Gf=tj(ZhPKUAO;qcAq={;ET|_Ov`tqkJLHFE1 z;dz~=A#H?YYUnohu+j#;;wC$v6LqN_BY%Usm_9V{A~TFd(MIV&nz=WXMVf610sNY%%3G4>9={&L9zc@gTYiV|MSm!Zw)?{ z_#H2Y{J3AKBl|B{^d78(H8nPJ7FT8| zJ?1FhS4V?;xyDw)>;>@E2Az_oyBYEz89lU~6qp_0nQ6qRE@UY^T}9gFFeFOYi!~-5 z|5c23^oX>G>zl7ZwW|9BC357~BWLUMW~-);&KN`bjZTbNZ|GIC;mV9CDgg=$1F3lg z?dTGHBHmTHtm8b1Wh{#8Kiyw;V>z9-M6=2)+uH9jQqX(~epAZ8ExQb=)LkuCmT7B| zn_gT^aFfm#z>RmT=P6pB;scwv+`McJK`??k-PIh&Mmn)mDH-$g%5&LN!z{!is%qva z7BWrsadEaFF>!=tz5p->hr$%`m`a7nT5R+4o_yT9I?bU^=vbOILcK5++{kwG;`|Gf6`|6-t`@rPqN)xNt zGO{&?`z`=9ZYi&jykdk5?D*tw%Ie7YP=GNVOR7J=SA*ASyI5)Ouv36^UqGd+bF!!S z^(0Gv_)bhQXo>sfe%}1E2O&*uJCZ&toXd@;Ov6`o_2m_Wd`0bS$V1jrM0bYWIw4|Q zj9;#G8KmZSDTM;2VP^$*EM1~(ntjo*g~wMUAIWXa>$EPM&M|q8S}4H`+sQcTe#V)4 zuj<~BzQ6;-*e((nr${;q0E{W>7eih$nxd3`C*V-b?|0YqzL>gl?5m>H+_ciXMfR&~ zQ@mUE{Vf!&J8Ae8t$21n=UDo04LxHAgbisW5Vyjoi?$_f?LJ$+puR%Ne7cnQs)?({ zx0-+SxEhuQUo8f4#-URCnI2c729u+R+t#J1>z*~F*^1J5D#4km3ilFAO07Ix#UWj& zAFX9)2E)$PUDL5BeU4GWkK9S@i8|wV>@zIvi>W#U))`>}W`Q za-mL2vwF9Dcw4di?}JK+O1ag_i8oq`HCCxPeWu62 zVsh=8T%L5YtUCvUoUXP$zNUx9Z#4fTDm%K?=Qa48a^9Y?>AMV?Xc&+a5J_vRKlpbs z-B;X^<*VD|^hkkfVRF5tJL&lMiqFKPHqC{5a~nF_es zV=NrjmZi03xlUKPI;<)geOaIj2vS)xtQwN+RRjxiO7V6Y(!$+Jce^*9CDpisA^o0) z{P3{y-Qg_;tlzDqh;3=BJ4p6xO3yI&CxhqSInm|Bqq*(ZtIr7BQ9d&ebgA3h)ZJmf z?&cpf*pcCmgHv=WL#(IBy%XQme=e2eAW+2%KkN>R+{r!C-0|_gzrVw<#qvWZMF=6X z-|r|cQgߡ@#5cc^?JuRb1xIioai;vX|3}_PmwQ?-RAXC$|1F)$&#>ewCaZpmG zJv3c9n()CuJe#M_57+agp(8!0$P&SRyash?VHJsn)SM7`h*E#v)f4mvaB=yPmh%KQ zV^NoJC@P5(#7U~*WJUlWH)lqm#MUSX8L%fXf5T$zF*&Xl*xTt(N zp7Z2&l5XQ5#92@O+)gQ^Wf*uvH*S37oZg)#Hh~tgXiHJaO+;3u5|?)8Hnq0&f3vTa ziR@GT6s;Vo4#C{lYBQ>{__~t9kGV}d>fIs{ecmN+E33`~ES0TbYlrKE7K;4R?R zWBJm6=&v}#QVZ#nDb!s01lJMSb0jY^IvbKSwO1)j0gae(1 zHDMu3Ov(*}IYzU=mD%X;9f#zTwj7C&4wC$TSlzbY06&qx9HG@5T`M7FlN>k+9P#&y z7?V>2m#IZC|Fh%7<{da}0Mujje zw+h+*lZlwjjynaV%2!X~nf}_!eOhJlw7!vU|o+w6N(jzjO zBX%%~o9)P+l=Ig4d6i_2@dgpp9C*^Tmp)3xcaD?coMr$a^$xQq&^H53X<&d4MqKX% zu){~^!^bVa;!zfu2 zAH!t9+cK$CFj|NTK!&a-VJ~Ofx5Gp!Cxyx}Gg8%S8oNva-a2XW_cPh7Y?*fofY(z@17byOE9)_lIbH_rDS&|Imy`a;$ryOV6f_K6dGZ$`QoQwXz-Ft}X*Aqu<4rQvEb}e3GM}{3 zHhUJ{@SabN{p?SIk{Y2RLCP^Rciuyx?G&lgVFb>`g*^O$5hMyuicAajT6Av+U#YP8 zzL8tpdQrrdfQX!qnVZ)K3M1NIP5Mk&a^&U@U%?{9OOd5Og<6f;4WK9!5|bw~w-PJ| zIVg_;8eL$59lpk5k&KLX#So(bZRo{d?Z#so=3o()W4#Z?UK~cyXV|m_t9Bhh5vmA^ zP!TSk!rlXH<_d-;P&q=Gy|V=nhVpuqBSg!?J3o`U5_5-31!03D5DAljj0VCP1PTEa zhnSLzjvF92EHWlOIV%nfK%iieFz}gCTBW(;O-WtX(8At>_hK@N>e>cEk2X%8iApPI z=$l$Qd9W`cC9ABdYivN%Xa%<@~e|XBA#j7{%Jao*&sk7!U zS+V0T8#fy|a@?fpa~3XJvtgSZb^q0%3+GB)X|cZk399CSPr}{%_x$o+FUEP^@+i1>@;L75R78yNk#c z>z%>b(r&DK*bte)70ES-698F2roRBklIR?v+}>I527==#9HFf5-~7PUT|dN#EksXgp7^C@PjE0wAC3v z;wg{3m8Dv527iL3pyV?Sb_Q?|Mi9prSbXoE=o8UL&7~L=&}B_=|H4>7`#SpvWN zehBzum1oO8_PQ8uhM`v_LPxLuRm?*Il1*T4) zTaZu@qQyy+JYCl51qv1>e6+YpvT#ip3}RHqW+J9wW>=Dm>N>`j*0#=q5-!wqOswqO z+7*_RRnpKkHgC19)?!80WIZ-zTlP>;s#1*xg*~?Gt#Fx&)#^5B-KqNyigegX<(dsU z>uOA9TO7}6oXe$L#ZBDx@NwJBT(EqHwVMZx7(ZpslC|5eH+Sve|4L@sFdw`%PiXGSwwAQP$hpzfGxuog z>KE6>Rf^L?TBcL#(=C0Co-}LG;Hvd|95#0Hj0H>AZng7+Mva>`XVHe2+c%?3u$qlb zv%szgCof#R_2B8RM^0Y6asTQ2Z{Iok(Z!n&-bh1OQDdFAM&W5(se{&4h$t*BqoQNQ z5de-MGPq)czB0RE_Omuq*_vGgk%?)!WgTm}g+?c37L?bw>QZ>)( z2^sVC#Wk2>CDTt!8QAl$Jk5)|&t>lOJ-=hD?q!EzER>MYsV=U;v|xCd%!(rmQi!4{ z#=;b_xFWQq+aWwQ{fCUGc}2VJ0O*J}qg*Poa}&i_=OGv(oi70$v|eH;B9b!7S{7XZ zz%fJyPpap9=RD_EUlpx*)mF0d)fpF!Fh4zjgrNIrH5~@{Sk&Bf*8Up+CO0_Y9_PHw zdwIr3fxw{R5RENl^qQjB6RAR()yWvH|O0VYZt>pUD!<4TpzMl)!Vu%w)-j%6JX5=)?Q zgqi_iSjeG<4n{GLtq_dS;~-ArGHwF_2?Y)kG}vGO5)+6p5nx~;xR_?16@vX7<2-j# zS<$(lM|qw%36Ug6g$@%ooVe$J7)Ru(amtvzlA27Zl%#RZspyz)=uDUxiPGgNQLBx5 zBE?ISt5}KhXMk&X*XUW|WJ#PQb(YLo@@6TVrS!^cZ@k6!yYF+zQ74^s{#7^KdCw!y zy!`GLKm5L`B_RX{&fIwN=F0|vK*Yc&h`7cdw$xWp7xv^;{qBB0?CQL*F#18`_0EIelP zM!QpetAnc5q_m3aE-tU8Whk_=_fbqrNz=g8#-#@VaT!GoJyXZ$_w!#J^y|d6*B=jl ze)-nZcVGSd2gg6Y^68^@rL=8QQ<}~gb7~!xl#yTFp|&|VDls#!w5Da-`jN5e`L)fG zvX)w5TPy9+UQtFi{B(brW+*{3vX$Ni0AobM%cYoe2Uoh@Ik&kd&g)@O4?#wZS*2QM zxr@+(;lE_W|9I{jul(j8q_}mG@-+BoSt*(>HWxP_ic_o*vw|pPRcfVfD$-Kgmkvos z#isR?%Bh`J>6BiIj7iBU?#~!khO!__vP#yU4bR4oEw1gIU)}ta5t*2oS(ugCnC%Bf zpDb?87lUoxyQbu2gGs03oqtk>Mfc(Zy%%#c^E5 zeZ0qiBw6S#4!41Hxi!9O8B-$hOu6PBvSbeuCQ6KiDRRmfC}f0KNz!E(FhtlWagt;# zI$Aw-bgo^y6_l=AvtePYcD)uZ*+qjEy;#0hHFryVe z8xG(|w8C#2DGM~BFtTt8 zI!m~0mfy%!sY@EkRi>3L31`8x@qeYRf)!jftBE-h1|BI56PJJ>U@=K478DQykb)ZY z!8pvoCSa(bz(F_#m*GC(z<>z>6fnR=z<~u7eCW1D7B@mOD`!_PR_s_haN)s|Pftaq zl{8G;+ZR?bPtH0*M8<4+rkioLx#Sl#V%%iub3RzuD6tb}Z9@JF6u5vH06t&`1Q3A( za!`RD%t(@ml!Ar@8$g6HiOC1wD_=z9j~IxHBuI~ZUTJPz4WtUaY*8WM4wGqu0#DA#Ku)Fp;X}pcy$=wNtaEOZdXvU&7+iWm)+WfCSPT&3b8;OxJ zX_Js_$PZ6lz4z?XFMV|L;TM}Nk)l)~(Jbwx0rhm4&d@bFA%Y|_D4>om5J*E($fJT6 z9O5iDm^{GaJj={2zvqlMJYa@3F62uFWLNgdMR_f<qDlAZ zX}zVWa%yU%rCwG-Sq-$(!HOjeHf{@smTaFLvx|1u2$RjS(0bcg&v0YSwA7}~XR#oY zo+*m8W24wIc8J~LpqR#ayu{1#UHp;@vNU;cuJS4$^7ec*U(EOO^ZYyiUn|y@bwC}| zs_yHl?y3jt>3XR?sh{fqy=-sTyY`X2=&OG0EBcncs~_se`}uyWKkpy(jDX0wq~gmdf7py!7Qzz(SVEu8m#XwZH4auJ60{yX;+g7K|x#Df^b~ zIdbO8n_qT0=aGN(tXlc6cfaj*(L*177cAM?{=4E{@!x0vZT6eEc<%WJv8-5KyofjP zP5czUA5i3L1FpICfl9R<42cn56hL^pt5G1Q^F0!bK9$oBe@=m=EW1pDC(XJsXn43) z2WB89rIH3XWfV@FdMW}E$9E>Ft3Yp49hVb?@CqcbygHMi5Xxtc&&lnSlU~vrFOPuj zOfU-dqzYp+bbGv6rVT1|U_=xI_^3ms%9G{G`Y}j5n&(ioLthVIb{-+g1phQBl{5A| z?X8qmobnViQh+jOMOKLzflsN}<-9WzizVLipxda&lVK`m@venaE=jQ=mzdT#4`lS6r-1N8Ijy)6e=rKEQdv^0snh0Pr!Rr5d-iR z7TRIriS<6LID#}aF(~RpLWlMJ$+&4k8)=w9Og#>PvSH0LBptDUmYn)$VGuqZBYyWj z2!&9jfd7o5#Dwsnl&YN^Bb6tUXSni||6i{)sQb84egT-##|2*#l;ba`&`uTJKd&5t zsj=PK9lRJIiZlRj5#SLRQoW_bZWuWZ6@`-cxoyIBkB3o}!#m|iIF<^j0#mc)i%{F6 z6jkt+OgyWC-az3SeMF@`N3$eeMy28eZKWmaY9ic`$s{T7_*Wu{iVUKfsrF~nDH*_a zTY(=P7HI>Lq7b2Wbg_sN<*C8U{~ceNb!VVDk@LXS#{ET%WQaTd42qVbIYbQHCa(%M z^H^AoHsL&IZIsaRR2QKF+*QV1Xsy7m?F=LUc*bR*^v>Y~3Pu>zX9KCa9r2O20=h!p z5@brTQHIaN#$lY_53S=VVr;49DC;J2Ll{&Dhesm7h*1*aOqgLX=EV*@2Yx<~vA7$t zgkoXX*7vbx#3>5=J(=w`j*>4~XyB?4G)AnZX^O#DAP{jh2p%RcN z8HY!jCb0&o!)A~bF_Mxm2K?t>BqvB8Q;`p_cI?BpwY-eZX=8)yy46oj_hPqLzh1hO!7yCKr-$Hg_UmrL^LPZcR)sxX|Cz3wDtOnmF((u%um~ z|C?p$TOAIJQP+68wN$?K+$hS?s7q^p;Tfe|2SiU-`sO1Dl?gelU*XqWX;K>5jGPN< zhV}SMDp>3`?zAG{;C>W9^n7Tf#n8`N3CU1L5Hq+Qc#m1Lol8&zAN!;G@t0{OW!GF{ z^u&i$xBzAFs_m53K|q3RIamdTT^S_UR?bBlP>bm(Z>~3JbwZ^6p+t%|c<4&sbOnMC zX+oeQND*s-r30x;&i$u6PnV3qf(kc& z2*WAMvI%m5Nk{#CpSWg|d}WHmq)COf#SQ>hBM6IZP$ujSw7`s_oA8HSBMI2U$3Zpl zV5T(flUx-a&x+^99mBu6l+Yy z%8lLCM4l(BCSe)egxuh|%A{5^Do)A%g=k*06W$LSHMQrn=;Qo2pc?$_fTx)bMgpm2 zYlReKqh{vCMOKCqnbj_qX>F`eCjeZFoQ7SFGYM8-0amE>$#OlwF5-AeU#Pc-4kLa^ zfXW2Ix$e;e?50i;iZl3V0=**9RA;MkIozf1a@WR6AT*A7=&(l01ypO+zA05{1bFfw z(dSpJgQPq))R22n06jHu7^N9jKayug01~$=N0^)^Jf7f!R;Hqn6wwim)yszHbcu|C z|EPmo5c)Vzb+i1AUe(ruzR=+1qC6bKYJ_x1c`{rCNEDsJBQ;JT%?os0gAw;8IWT2rNW#mV#Ql?OHdfy8;{m5QQS{;(K3GT$~~^?d)QCwp~$I zY71rxplF8L(N8&FRFhEmSoI7;@q**!)jhB>G8AMsAx$EK&p9GREU!j-jD?(ZMk0bhZNe{YN2)ypMUo zG6+cTQ&|KsFa$dLGC%|r=?7FA0t7Z2M-h+IV@D%n)RXV^IsoL7$ey2tI}-&CzpgOI zD_1?@A0MfISh!#W1|M-xyugaae2WuA zni-U0;}x4=xA;wq#4ld{Yzk=XMN$q&p{ySlrK6HcGi^Dffb!9c?@&b_h*&^xx&nZP z$cR>cIEYX{{6A1gXbot(o+fn+9{V{WiULSfICLiC1D|<5$?4%Nu??*4SE=voZkKT` zn-D%0AH;HoGct536s-=7C=b{@c@64E75Ox58cRw8C`5MJYN6TcAxw1vs0auI6t=7E zVK*~WUs?E1BN!4deC*=0iOj_M+Ah0Bf`Y82Tf)iTUj+fH=dUnLg&hlFn7e zs|ANsr8U?2QraWX)6vr!4BK!%-?G^xa|dBjisp=8!IW$Vw1z;S2x4&^8)Q}v`mA;- zIv?&SCP5mfu2)*FG--&bh@n)duso*6ItDkVGD=f_-z!afw+V&-y^c0IprB@F^X0o= zY=t<%d?4>fS^zVGyA*cmHMR)~tzaghbiZk;y19;775Yf|0e7Y8Plz%YTCsDaT0e}G zJkUpZo=T*tq33H5&`tUeOo2gziS$Lto}yPJ<$%a)6faDQQj2L?8WFFdT$y&{qtt>_ zv?pBX@Nz%j4WNYDe6}vMMho|*Ue839-l=GvcT;z3xm8gST=j>j4ZQ~b5&UgqE+?a> zrwB-hu|*Q;0r~x9Ea|eWN292G*N2KiNWUNSeWQgE){MTQpkXI<+EfN3aajP-^MQOa z>v-=agbX*y#+4A*I27v9G*yc;vVXFu1clEP1uaraUyz}?1Vg*Ki}< z7I0y0OfC(?GaLW}@l`rh-tC%zBf+Ikb(IFDy05czx9k99U{wV~kBEjW);3ni*|eX6 zj7<&Ls<2|QfLR3^7$Mr6E!}vzv9rW%@QBo|Y}u0II~)}clwEno-~t0pdJHkaVnNo^|+OVtLCK#ro72!=(y6bEW?Mu}U(m+V{v z?W0s6r1oYGj~G0?EopzHp$mw+`ho- zLsIQRl8^VVmTzmn7A?VGrA*h9QNT#=8YK_$nyXc_y(gb1-*VGkcy^+zbx;6hOrt_o znEMZt5v3V#nZcH|)IrH;rgF-jlAG}~in)U)i;5to9So$Ag{VYwcuTrMTCfhFA3`P& zP#|uWFUxb|+8N1G*LAdrT?iLEOaFAr17iCiVgmHn%6)Xxh5qPMkm%AIE>)%foNHloUQuL1blrk8h- z0Je$Yom;9aC4k4^!y_>pA=Fcl_8AOvDk%wSa|P2dX9J%jCZrP{^(lnWf^XZWeU9_7 zn+Uw3P@dSAsH{>*Z0E&Wtp)Reva8ixxLaFoO=`&J<55xgaDicc8=z|ysv?>N&<9PN z&i$lMtDiZON4xZ1!iZE2H0(c=)-#VOEl-nso(ezh+7pc~`MQP*mRr8>=1HOoYE9D* z=Y;LXGo*m_`n48@)AB+I010)YAxdy}Ls!E6U zsQ`@ycq_yzIvQZ$XnXEhLC3dnbBxhyAYbT&B?}>f$GMvJ@YH$6jHb7Pm%OPa^C6Nl zOcE}|$u+dD4Ge+~(mr&6oPFxI=S;G>xvuJK_CvH#P9H4PZ`8?<@>DRqV3tsda+TmY z2_%@R%z`;89_I=H4Hca=ktqXIJz0j87CG8_w3>aUC)Sr}56eRUA4oz~ripFK zS?dRkR26zJq*@RC`?XC?wHp(pzinDG*eB2m!#q|wWiz!3N_npNRQDmL<1klPv`3{weiI?~8&&o2^I#8W<3v;n0=!c52M#~FpG9F$Fd#yU(EVs!K zXIc<}9Ct{izpOi-jVI5uPpss=D611mlB< zKAJjusiao98DMgQgIBMPBktwai8_MJPcAs4guoJJH`X#17}(BXK(y?L50?x0jnw-1 z5e1+xHwv$EU?vhdewt*esr?}JHj&Ho;Ohy16-|>n+em)Rb>g>xP_iCzd25GJr;}o-i zB$f7M*VK~=zM`0dKPfnYF3~w#4Fu6Nm%foC(cXm?JXTqmWMx)En@PX9aEy#B>HkbrMFm1vT?%<=y~w5wCu?BOW-8NW8;_ z*jzJtW>6%w#s~2k$9)0+1vQJ%zVBYJQEn5q$6q;4`@R2jx)y;4^87sA!)= z%ezA~JO(Jl)~Ksvhx3hxDuQKTK*Sso!fv!;oSkM7}+&aQE^PLy9p@jWap zfqi>|^tIMC^R)27f<~R_jBu=JwZE6?oujTM(aRx5l7!x`H3#xMlxh(~Tlmpv4J-7G z#L7$%pqE;IuYC4AS}cfdF~sZ-g$|ZuBp>sk=^E8y%SKLMNR?o^o)&vr?RYq!%$Z4; zUlk!rgE$Jl56Oo1fdC;F!+MGyy>gR+6mVJ-Ss%x_f{;zBCQmeT!1R=mHFQ==I07P` z#`U$gh}+l*6*}ACQ*XHRS=sQfvea5SM0G-=Igt+AmHSas+3a$bC(&XgWA~}^K-o9D zootXq;{T-5SfGni4ug_s99v)AZ%3RVMT%V=7J*4XZ(UPt$c*mxP;ITLm+iDU>g}kA z<8&KIwNEnzIcs{)R z2!tC}(`G&ik$i-%Z%DA3h$!>`z`6(CnO3(f>+PgIQ})Y20{t9^Ps#jh@`qxQhUX>S6N46Y9l3i=ly9o3 z@WRomvd9=xzC8>bmyWf9RM-?{O!T_c_e84oKrAlx|MzUyKLE14j(yE05MAG2|J&95 zZ5~mrpH|st^OM{it5XZ}JNVH_km?{xmT;C?Lr&@lB!q_is~R2A#gU%ETUPwnq zs~Is{(KGSq%9~D&; zP4rWP8nF~f7c?5(ytpR}FK5#T;A5*Ai3GT@zf)Qo`eDu>~x~(PPA72W)GiH?jExzlX$Ba*M^ymTqX!OKlT1BJ&ron$4RzOSouXTao zAn1}C3N6DVx`*+Qh`I3Rr{?G++x8r0MbA8QGhX9(1_2zOrjN0e(k1}%&-;BKiFXh3 z#f`3=1@FEb#zBYWfM!*1bU>Qy&76_CVqmRB7JL)#tT=i6toK}&G2zvd4hK~_)CBs> zH7CSixceczvsh|x0SzZ*7`qly&AtuvEKcIuYCjY&-2ob1(lYwE1~B9pdhB7C6k?}Q{bDnAy%@yrvP=-#56#Ll=zlUzDTx{LK1ah2 z&*u}vN35b#ak!?wFLm~zWa}@6qX+(bDSpU_EP_X7x%n_jN=7+HT2oW~$@$_n%`Eqr zwwk_l&tUIZ(A!+}MNSA0c9xSueQ_nG67ybZ_Z~aSH-eeAf4~ z^(iJ6f2np0GWSkSpG^aW4!k?G2|Wz}DSuVV#=ZFgA7x7IBz1~p!sF~oVnQE$iA0;D z^$}JqcKA@pcod)sTBjMxH|q%QW0q2T)mt@A#GnZS>Rz*6J`P7!m+3eeXYLW85aEZ- zK~w6{hW??gWgpQ4fo!vU{5*!F<6C8gkCV_8k%tm+mz7A*TNRrO>Sv! zXgOI)>^eVh4x^5l@9VvJ$X8Rhy&yfGCkqa}mY7kU=XO9%W2KpReQrMq6mrE)()zl+ z3@*%+`ZFQJh(=9dOuLcxRW#oWi!~Gdf1oyZ!18j2LLW%1Xr63rA%P?*x91YZ^e%(c zKCniJCf-q{yQ7RLvMU1tHo8@?16B;OzOkZ`N`?n3(D0N)P}oj`x}jgVv(y&gGSPy* zTlmGs_=|Qk7~ska@|v>(*JOJw;80rr-o>m&H|x_^kdS6LN7}w9rW|Sx{QKfZZ-6?yv&WG zi4GXyEjy{BCdRleQRd0hYbw5VH!JKsqUVt1i#TV$O??cyy!!UB`|M7q|1Ng|3TVz7_*CB_J z?$$n#E7B;*m?G6~;Abf?)(n zL;&H2-$S3*JEiOyb+aIel~sK%fKGFUWi`u`ic+%7RH)1b9Uao7LPY~c88?8hi&SfVY~yvLFc)X_?7fs!Dwgtm~>vRN%j@U z_Va~`ydO=HtYAsZi-cF9D6&yKq0$7v(4*5ibU7JF3}bk7%us5jGQ>AB+!jNPnF9Sh zfo8c|nVA#(+@k2U;gr6c1T{_MLQzsNiW$SvAFv}v+|li`)3bll3vhn{PW0M=IMT;= z;HsKvk=GFeDCA%q`t%P0NGI~wFP>Ns-_ z1PZ|Dn509yx4OK|S%&l7CTy)4jMLrc){BevIbqG*!FOvPZu#b9-%7A`~lOHf@ z(u$?~?pf>oc`CZ{BuhfgV|b^y?F;z2XG3-x2xYrL+yBkt^oK@0M3{x0csz{1+T!Pa41F0Bw8hns5D zsV5W1Qf*;uO}PD59dBae7#(yX4V1qIX%fvs8d%vU9Hmeoxd+WG^ys7G=3$lA*D|q2 zaw|kGturSwFe&IFu-&i5;#|z3gH8+_A8C9GGTzn-x-H>Crc2;jRwjn8eVx4DP?n?C zpz9>*On~}fMEO>;Lj#6GT{J3U@{5Mv45HTz9W#~Q{{NU>+43BWn(3YdsZRzZNq_qj>|-pm?Wc(1jG8(vq%;Hr&&Igm zGL1@o>bvf8DL^vCt}mPv-ynP}ZpN_8w;kTnRHG+@N8o9wgn1BQi1F4cDVr~w3v`{~ zGc8Jp2R-fiRuk-FtrQzSqJ;>p9IZ_@e|uVd^s?r=d7NH*sn=cxCmp6`VH1tZa26Ul z`WZsgiQfPp2jF|huZ5|-&CFgmp4l34P@XUOQ#@CUe}qx$Z#ET;8FGrMJ-weF-uv-zY*9LQCw$SNY*(0xkf>U)lcpm-?ap5)tOQK1i79 zql!Qs*aSI+F6B30+?%jzotMeAz{XD#`&m$nha1@3;gc=?T0?v^??TVR{8hCTh^dE# zjp@fc-d7a>JY&&Z9K+AE3SFX^kb8;SAw*8d9XCfkOq(F3wkbc}pNFLYeC^ZAJ4hg0 zA_MT-Gn1coAZ>8$fOL2ktcb@EjnPT6ACGa_T%)TpprHGimJhmg-&%h)x73yw7|Lye z!+{Js$>Xs73Q%`1X*4qMKRXaM5eYI}g?0Fb=Bj2m&LAHD)Mx&QKYB_gEjQ8Q2gHSX z;fPN^e#8wt&h@M-(`yomWR-i%P7pro4cyS?r|5?ov)JWiq>>6A-_?3u?l4WsxRct? zy}(m@JJY|LByU*({KEOn{v<~;r#L`C74ZKBUVmogQopEwDg2eQu)ZFtgWrC>r@qF{ zW%o>s&-sjA6RtCRUp(H45u`<%?s$ubR70UT5o~JN!|M|nu79iH{U0PsyXQuN_6$sP z+UJ-+f3+q+T5bf7$-=mxRDl`|bXZ5rLpx<_TSndBhShXm8NatN@rd|L zk$c-s%FR{svCWW8&Gpd||3>{g9?aodH!T>KbW-Kn4aDB5>fbQi)VgauR9{fnJyT;c-R@*PhFvu&0oLn#oR3Q+{2E5eF3~JGFYY$V&{o$uiN-bP zE!Nt^D?smf4}5{|uB6|HSz+{!@;%7x4l1UGb+|zWI57cP2LS_OfWI_*YgE5cWD^V6ajZJ|(bqNg`|8 z9>u;~5485E9!Hlru}Wq=$Ow@bZf?AB58Ilm@vL393}k{R4&)Ed)$~43JBW^VXZoGc z;boZMT5ir|PE)u$f~3sh8>;B(ca5-QAolI=&R~ZSF!sTP=de- zw@b$FMx)+_HEa%Z6}usYOL~H+i@6ZJxk6plh|9n*h9@#PtQmI zU_?M~3s3~b|IPT1mecrxvD(Uj}&S6C1 zK~=W^^fo>Z5!8^qWH33=6AOqo!PQqXYo=bg@zCPkzEO{&&Z{YKq35x=HPJn1w5G-V znd31-1o`kfxhTExeHo>k5D-ye0YSx+UT)Jv*&vL!TlM&jM#-(lq%?i9GPJY6E+t8+v!gkJm8G1LR4EKTNF$h**_6ZG*5UXA{@UEdNiKiX zAcV6ja^}k?>BF+GDpy_!otC2292XP@w+<)mMj0l~Y4hM{BCoc{UlV={l-{k1I$FOU z{?b`kwJz_dy?9EYUsk7E#zw9l2#?FoURC^*5cyu@|z$}q8kvDwF8JWNPRgdR}Q{3GrbIkx+2lcoMC~O#Xa9$WRpm(;bO}=nGQzM2%8wJEV(O_BF zYAhc8K1+Fg8TcGyAo9p!zNgwBUsSF_ieKmy3#7=NjIn6<0HgO%N8MBgcc(Iq#cz(0 z_&t&aNcOS&O08`&j}-x~?n!z%CmfKx^e{q42TEWfgiK7>rp2{Aig*zh-Nzx)-)6D| zL2jiyiM-M2EQ7@ushrgmeDf_!EgY<6kP3|-Cht6u*a#l|aWR;<69Se%uhvrp$#WIf zAc1^J@<{t^S+#?flJ^8HN5>uDwipnz2`SPRe$MTn@jCuM-K1P=&r@HsNX^>qq?4w& zJ07gEMC5`7lXVosJpC<{UrFNl{Zcu~cFLE52=OOFlc#TG<#6MWy4(1N>^7Oc7o>^< zEg?us5rHFZ{xN!&-;81~8C*26+y7IQrw=f?lse@mn}_$37Dg^n=9t#Inb^ z;4c)8n%@FmL`S3I-U^n%zI!$_UD_;i!d@)WT4KqWEETNal3<>`r(-%;`AcBTr~xlW z)Inhh>rB9Xoa@|kLK#jI(?0C!s5tr{tfOToOMttG>7N3?#&V!hGLotI3^UTSr2&qK z@DJs=gV(F)SBc8P+6y@cLqIm!KbB2oa%5r*n)$o&YPqPslc?W8J@$z=WmppbF^4w2 zgJGGz=F;I!vv&Az!?&Qox`q=NUWLqf^UiC0dX%#rdn7Fd@;h#P>Hhs*{bMPL7-rQ= zZoRM)-CK8Lb7QSRoHcxKnyVyCH}2Vc%3ghonyBAv8v!8EXaH^xyxWW zlrw#Iv8N*;Hpg7PDS~+y1C`7rw48E6MWN zG1v=`OUnW}OwnPb;i1Myj=6keEQjli(oqyG^PW~-=&+a>nnt%g%VZr3dqJoe+@mwN zgGnM-jr*wDg|+>IZ4_U}_e7W=$cm$oMdmD>Ov~G9S)Uk3qyzPnYAp5q=!#Q5wVrSBsu zj&GfV98&VPGq=xcT*h&qp@!!eU#gX_%#CSvkKo*57BoM; zAht5*B8DJ4-gM{Nyco1KYmTg!Spps0^uM_<7=@F8hV+xhi}+9}w^-ERMDsXaV7Z}@ zq6T1iCxsve@!oPs2^i=?}zXea8#cV6qdd?+Ob8Yd^uU=dw-7 z!UlJOyv7KwoJN9+CM_{Cv2&TPW@|^%6xoqB`tu=@y3(mGt-oif)Jl8tK($p2kSHvZ z{hl2lp`TLI=H_uY;w=s5BEjL+MDfzOoKBJHMO`fMD`YhK^E%|_4Qmd>Q1;~Lxr5=^<_RfJLgK_u08xZA zz=@E&=R0|zX1J*(B~*=Oj!ZV^>gG6Wy^`x?Ojhrog{qf^Z_b)=c%AwBPd=_eoAHUj zn}`X&>BY~1YdMVoc%Z?b52f{qob7d_;LFC%!*|Y(*?oque+Lz|G3Kj-B7E|A*=NBe zdYQYY-hFy%wa;k%Lp0f$3rN%FKY7*dF;j=-F|GbKX4=OYs7iT+CCFRg9NWsVQ*c7X z@Z#n`&{!ww4aqeCHITRyZYnl#MZ`1?3uki)kKo?#+ltN|C(O9E_KTDYDoKFq{q&dc zvdC$Nhl@Obwb}-F4;#tY$ja|`_Tl)e`n<58|NhlIu{1c4F|~I1Ed+d8ms^oQ1DA+s zQ{y#$OGs9lPe&BfQa8?j50oE`Pw(s4k3;*OBrE0Q6V@s>djx?iLJ6J{cDbK=-eJKUW za-}JQRwgfSEcDD_L5qy3wZag4p4#`ui?6x+a*Qpb>yEXqDz}8L>~y-fy8;wID4(T) zMY?OD6qB8;KqwoIm71QU7f1p;D4lSzE3hxb?@th~q4A3(t%8>y{s76lzzDzeUXMlr z4(VJ3ru1H2Ym9f=l2Q2|6rncHHgD$b=3@D#Be_#F)m7S4DV1G_Z1K`9cfQkz1q_2G zv>oKM|BWr+N$ktHS`Dqci8IamH79kH_{%oG`^A28eACLYEsJ&guVYst&z5FmiZ`60 zK}kSu_7w^I?xPPZvva&3Zd$i*?=toaG437BiS1rH9-jO<`py%@t6uO@Vr#-BI^sX! z^)`4azP1Q+{1%uvesfV>qG57aNNcIU3BbCOQ4MP#J8tKF1}?;mj9}U1m(I~C2-PE1vn^=S47b_nPg_~le&Urva7GeIF!$0(m{$@1W!SeLVpqj0J+2yqx z>w-v{SDk+B`hp3#e9prkB5gM~E!HYUpnT%9`>oWt{w3`$tnD%M_04YQ`Xss}%Vsn1@*H_|9_gAm~_K~i^Igb2ZJkQn@bPNQcLQz{p_l3M4CrL8%hc@~f9$&Mg$A1~K4(T?30D%nIa(>P*)3;?fbl2T3 zr^sB6^YcO?wS(yH@i}*2Bdt;w2yMAoYwNH`*P!|&T5QK%BQAun(f-{d`FAx=ChmV@ zz(xFFHN^5jZ~!3WTIW@fljoeU_YXJE24n9}8UiwWS52gr8JoI|jvHD%?^x%N)8A9v zrh-nLB`a3~`EoyePCgrGsenoP=qfKkY@ZV=b^?xZ)z6&;wj<6ptX>*$XTy1a4~MU# zVjE!1y&Ln|=0BTPhZLKyILL|2UxHGuCk59KL85z$56v#mtP>qvn6rnCk^}5<`c+1J)4+QctxJONMbV{LXq}noBS;fAm>#rB*g$i{=}=> z#F{d{^XRl=(i{{0sZ5=Gh&+~CKETpjh&ZbA4%~EdVi9=oLNFe|!Ap@8e$NYO|EuX` zcTrvh9yZBe>a#YWHvE+rB3s@3=)2lA)*m31O(+Hg>K4j`3}de&6w=!vO!Smo8tQ)pq~I zoL5M<#lI1_d!x;NAGragwqYoN%N{eI=*GG5Ry;uOR~Dlwxbx0Ws7s(;f6oEjH5%~($5_8&XC|@v3|;yaDs9V9i19m9bS56IfnU#d;;u2l zU85QgCk2F=aK8*<9~Tvnn_4u#aK)V_j>0{|K0{9Zhuh#LYY!CKb121J3IqNZzoVRwhDm31KQaGDP9_kvyY z`Go7iOpXmCUA0#0a+ErcEFl(s(>>Fc84d>@p^HoR3W!Dv=6Y_}_{amx6Wl(7_q26N zG@YJKtsZ(`KJr}mpC)K01RXy^U|Otb_ovqZ0YmV7^kD?=#E%n5Q`pHiS_@b5#llZR(3le(d_&2}QZ}ZDJUj}O-Fe4V?1cR~Dle$ajMboFSescda z)>5qU4VJYV?+O_tyNws_XxM?;SG$)^f4C?uUiR1GtXA$rwsI?dTZW2WF6Aab`34;hk_i9*A!Qs4=3Fs zuM3Zft6DanQ{>a(RE+qudsI4zZEC?lfw|(!IhVT61hZ1b7`JwU?0Gml?idLf$Khc<(F{*6rdpOgW!3J+P+`z%ZJjwU>52Vd=@ znIFK*eWaW6rBrSm0_w;2N9t`>uc>;2kbiehr?aqO!x3g%3j;&l!(`$5VXY9Gnw4BN zj0b7CSLh5FTWfEDJtLDv29otn6~)Z{mJ;Yd{W5*^yG}e}PjL8*-rdrvx9x8c7|0a^ zWV?wU?|8xioiZ~kKWy*aQG9qu^tsi?Ke4p%Km-8VMOWlqH|VZaMPI$BW&(A6O5iz% z8gb1uYvvy3?$w?Oe~8Z2uLQcxtyAvc)c9`#H=vJgTPs_I#^R9$bL{jV%xyrlO~`*- zvbH%-t(<}fV)?>}6{qs}&m*e)Qf&4Bj=6MX$qFw2>1?d&%=-RPaHQe)em-^hZ{wCD z-&PJL2FcP!*fVSmz0-DE*%zr*Iz_qvPc3|V$iSL@+~mQ;3vwzO*UB21K?AL?G;4a- z!sTY#fjVlDK>b=6Cn)Z-{r)?6t$eaB^F1M`Gg;+uV1EqycVh#5Z>_@f5MMEaHS+Tl zi6)c}GJ8lI>yk&fklz1rCyuZ%V#-9;XY*G7-DUG%y`K2qJc$cD>Sk-Ipp>@j-WiW; zb3O=kvJuNK_PPIkG3;31b@k>#^Uf&uG&X46{W}$*AZs*k|!CkTmi?F^%0?oH?*kO5aRiKh< zqD%ChRXW=KoP%)x)|cqBT=^K9o~vzIx3e;truPrcT~RMp3l|;vyVdaDZ&i<}mCtuq zZl|}ZQNw&0c@<_0@ZjiwmwRf0tiV256ZQ^=pS--~PgbSWYd%r|7;FVms_!Mu^UApx z^KCYEaEM&sPwr8`hTFwdTY7)Q3=|t!HgUsfI7{j>H$+;rd$N66e`9iXZ1gqjlbhq) z#5I|7?!mCTiKNqj=wN90i>|fZ1jk6Q*_iPxAdj?P_nb57L~o`ra2HPg`FNiX4R6E3 zotc$MC;f;EKIY(OUopyJX!HN!!+f+6`&`;5>gPMEd|W_70i-Q8sj_6WvY#jHJ!t7U zx=5qpub;bIHHcI5Gyp z%xXLcYK;$4hJe_lSd-z8o;n{K*ym|H8dq}7mV9PFd*XNRBs#oHvdHaGdHAM`Q++8p zU53V26UHu0DS#v1{5|27^}@+V^>(x!A9vwsjPtMM?N|RQcNab~+w<%(i(@QdOrQNT zY*#%<^|IV^AC>BDx$CYed+4J&IR=sq%@dMwN4En#LpR-dV%4!vtGvxTfj=+xZ(8=a ziChC(2M>JP%LfRKa#B?Qsn!^%7`*!xQg?wJe*Mj@`X4>lEcY~eKf8#QA8pzsj^>67 z(Qc%}$HqLc1^n~C@*hiLXRLeRwn7_gZS^8HcW43UBehGwI2%OztWDWO<3f}q$d9%*Ugmja z%RhjxCu-@+E|QM$r*;1guC*^>MwUcGuI2C9{q2J?z(FsVP0}7_Oaq^VRyq_K%{-V?#TwsG&pD<)&?nWM{(Bz zXa64uYM*Is4buR#f2gZypQK@gLh}Gb81ovW@A)E(b#LAAjjh$&i8Fh8pK|+u6&~Df zSoNwI*5k0N{0>n>F{|EuR|XyED{6Ek{QneVek5AAJd=U-hd0(&w^jYh!0LvFwk5=0 zwmy#0?FJ7>n6-!3*H*WPvwZM@jZJkGF!LzCqK@OaEc=miI zq|!*#=iVW2paNAM_I@7t4bavr2KfF`8~5*fQJkMQefeMX{jp5;i8ggNpw#$vp*(l> zyj2-`5c37|%3F6&cAKO2?tzFN*eOn%t;eeBLOwia_2sQl0fs{7IZu3BR%pz1bIqmF zjRdYvY9XWVK^{{)E?FidF7Tp0^@*vT$_qkQ$k;KqV53@^BS(JOyyn=V(>-CjAP!KlPg;byVYY8 zQ68TaXIc~Hawok8nFgE^#XR`0-bUX=elf406W8|2BP%>gqV^S6)Nb6LY3t8CdsEGP zZk0;=pr(Rd=h{#jfY!vaWExx<_V*Ypm1nr*G_f7oaO?(e!``j=wI$-{2axT@rh!4K zzX((5H-Vx|k5|tfA9D|f{X6f%TSbUna$=%%&5Coa)f|if*R~m>HPL$(9Tf&CGWR-X8z$$BW-j^20cN9|qupief8Iyw7r z3|iQxnV2baO2K4lAISbd@GF8+G_C)DW$h+pWSTUu?9?^2E#i=dkPWSKmZe|fV#ak( z@gsj?h(j3VW!rPs>c5ZJgfiPOfG~v!io5BNJK`0`57`i67bV?1jeM+SyKO?q+8m1R56R6#1u@X1mw&B# z>{~|Fg4U;ij~{%XzfUy*G_z)OLXAZhNNfBTRf_Ze?^f@V8CMWED~j;6>?`(J?*vVJ&0Z9jQ` zD<}H;4*vJZ=O+KEDb^@Yt_;{Nklb;wPGj$I11_)_NQEHWoIPh?6w9 zXLG|0hRhVX0rXyJP$WTKfLO9!q@fPaKEiy{qR^@VK9T+me0Ty-Dk zaE}<-`(63#bB=J=gy>1ok34kKL>6_S-kg+@n}6&$1ICEGt?Mr+idr}sBW3{@B#|-6 zNAhtSiD>zqMQGS9Ln14XVHyQm$PRk@P|A>{Kn)AlP5juoy#Z@0EE5IM{MG< zn4yV{f6YUnw!nJp6GRsVDP1arp)p|^m#M;m*WK(Xcc)8>kzrY4ZdLSTHthnrgiG#4 z^(Ch!Z1DCJs_)%;2-=`QWVh?ToqmpjKIV$Mk$%vGx(xVt;8oo)u>FgmpubpYnZ}@0 zW|XhWlOl#|u0YpA8;#xI-TlqK-MksNK<7Q$k_$bUtToyV9VE1l2anT?cRBU&GyL`S ztxTHPcby5JgZ}YddqVO~G5K*K5LA-9hnBPNWm4v%NKIdQM?BiJ`z8;hweZAopZad2 z3@7PeZQOW@cpBx(A3|0>j|Uf`b^O&ll}orbjN$YXF9ZrrH;9{uAT|1F=}>~ zGzdsKQRA67m#tgcm>x8qm>=4@A9$|g_c+-gA58w~5Di#UMf^sW)*;TAr^jk~Zv%sz zuB9k!v&wcXeO^+a3n{V<<}v!l*0T*c?8w@g7``n317i6Z+q&!fX6gO!qLrZ@nH{-* zoLB>tYi+kvcO$ZpKG{k85gd(uHRhmkq3N338OGW6^;-@{mfO1(aYB5~Rpbpj@pMg3uygzyz)cK`e?0y;@nQ^3Ft#SM`#Veac=6f z`y}6-y?j|{EMLf+j+C*9pFrc5B9b|KMv<93xzTwf-qfNSwNs1Bt2#!cWCu4DpHsIb zDX*$cK*OZ$(rLlah;*!`rzw$jZDeWkk>jOo<&m}}LJOGWkKIO*s;(QqAzq4U=vx_M z&gSsFr+LmL;^+}<0erhO`*qKW0*89>-117SW{UwmPfg8zCKO|fMLn?$$ zxu+qQXuLUxx#uMEVj|^3g1(!I_`eExc9d9uMa}Pf1Sa$7BCzwrNvtY>LK;ueXU4Y> zfWU^4uZtwqQ3aZ%Jei=UpmU{z6miou++;p=9G!efLNc-aipuYMVAFe=eK77N1+0)y zlL^)dJp@R<3&$v*0Z)}8!LN1wS%5Sn&U_??O*1;~JrP`ddXyLD?R#ZUw>VI6T_CtC zlrn$nN@}R1n2%n>JKoij$-s0L23A3JrLtTYo?8p~gc$-W3!*GPMmSap&EbI_d!u4f zj2^LFq%1e5H;YAP6{S`3*{7~t{DA#=!3KfLJz3EWDqT~P&8t?zia8Fg>?W`xcBo}J z>|V-tGFVa3#fsP~RC+T?J@hTHqPvvk)M=SDN6U&FYAcIe_yAZ?fc)iPg%HADxK;DD z;6b#g(8n65Go!|}8H`Q>lh*~e4l$S4s8-1viXC>PMV@az*FbrPXy|O_v|&O;o1l*C zCYZOFmq!C!wP#h6h&*`DOE&R@Py7xb zqk!WNoQDMexen5+n~JX&`Px=8L#MNNvadrQf&2R!%oIpBtWeGE9ZX?Kpk%sIaCdT* z|KR1`t^+LazjeOWDV5bL6AH1QFIh@&lr`dB;^vP|L~k%;68To$cehbuGq}dd|HvU_ zxRvpUlB}LWdXeOV<@aI|p-dQ@N9ce4OnHO)33$_S^mD3_zUw$j+2EL{ye^98=3_Ta zJYq}YApPg!WA_o94$;WXmC6QCV=y>zu2<$+JStwRY6fF`iJ%rIvjxla$Sgdrgq|7| zsh~s+WM`AsTj$oEt-I*Vk!Q)o`mV+6Yr|Z@+cM2O!y_=6XHA>nG}GjD|M++`;#UkE z&shtYC-pt~Ir=ty9mb{k6GN>bCdag_2?R?g;-~^Qry}Z)P_UM)Z#w`WEoFzNa!gC` z%$SV<dcu&@an!=hydZdb#p8dp+6jU!Nb%8wyIjyy~u_IE9w0S11=yzMwL^|16H zn^fV0Zp0^Bg`i~K2oEZRZrS{XKcD!U^FLE`#BieQ?G3X$x~6=-J}8Hm6RE9a@X=m7IByFy7-CP$_O$nWkiZs6_^QsKZ|Yz+?Nd`4zwO8lN99 zG$u63N!|N>Y<8B<*AluY2&X9g_*~BMMG-QxS%M1cn@VxmEh^e-XDlZ>)UfZFs(tPH zPI;{y*0SpT5Jco=Y;Rj;_!*`P{+5}tSE}IsSa`o%)e_v|=7~L+ z-aaN#Y#*|*^mIv)XbrI!hFF!)XeH|WLUg5a#SU<#3eb(YdPO`E#fX(~gkGWUBCDPh z9+{nPZ73MG@gosmBxD*R^F21|3I3v=jpZ(D;fNW-#0%=)E>TI5nI($6onWFCX8%;K zRvVp(-|$ExVJdT1?W3vkBP~Hm+~klaR(3Xk2D9Pfbpavz30zB=+9hvDJSBhig?BuOnvz{7mL04m}}|pdTc04{!E?U&_#$|JHHBX;R=(Komfa_~@;9dCB7Hvjr`g5)56o zYmH@H7JhOb*D_^ZhBJA}PVmgr$(W}eC)Dbiak2wF>AW{i$&U5Ed4%%&P;#6R+0B!E z*O`Tr6%bzdZWGxKRW1~2p}V0KNKYhrC`>n1Scb=~Wd9Y@4-l5BMGRpr=SVqjX7*!w zws5=>ymh)-w9jqFVp%IXC}ifBXxD@mJp0#y^@MHkAgU(bT18@DM^-bzilJBp0}6;G zd7RBAEY+hN(^)K|U0{k-vwU=@Bt@y3gjk9|rA1xxuDA6A7mCtxR+;fQVGXH` znDyj-a~H?er}~Nf7Dd3UEj3`tcolmSs z70zK6XcXR$)Si&^%io>&>N(o_hLo64GOEvSN*NfVAg<|j zrgx@_YQc1~+c)lA*b^mskov(@>deD^l)YIM^JGu>O!z4u1JWXmGi>Po2_Z0tmw!C* z*RQEY`nKcflq1qZ%({k7QI@4Oz`_a*%h68jX62Wt#DXYqBw>@HD9iN{m~9okeP43# zGKcA`T*K9SNFAlqrIb(S>%Y6qHw!!x#Q9|M#R)l7B;r;HD-jIsJUDNXjKX?r8tc>e;emQRkc1|3E4s^lpknp-UQ zgzDZ#KBI-6(rmek?pwNTxow8D9-4oKXBRkYQ7#O8Bv4;-gGeS&W+$0fI3Y4FnjBK8*BKB@~CQ#HnRrwVubRR}OFf?8JSL zq(EYI-^#&BQn;!^cVaQ<%*z8+qg!kHWIsmJ5rqxHsWu?Ed&5_}p9ZT;=fsz7iB0VC zZb;z8NT&)#3D7C)qVU8;@xYcr$DZUA;W4ds$B0ktrg&LVb4k@Mfq=uK30>rL*nydO zsg~LelLFZXc#A-vjHAmIi0X)W;|s1=wQ|npG4VC~DQuLYm3gf9{5L2lI-_ps$kl5j zM=4&P__6*+>9sVwgt)4a-EDHUG&Yu;ti1lJNl#({y#xW&akaxbz((LJ!3o4_?84p0 zRnR%WBh!dQoyZb;XG3Ck^W#5jMk{+G^Ej&|x7{4qI<35%v((E+aLSYu0!T1~@QG~4 zg(1ToBtFpKI<0qFYA5aMdH+!N2E^P$kss)hyQ}q)_{98fdBFIR_1D^!<%-a}TF4{C z!8ULV&+nlb>ItbPXo7mGT&Km2^v`2Wdh$1izl$eEigPq(lIbU^-vewUK@jKbPk)I( zy7Ehs>Uz0=RlFVuue`i$PhLT%nJrgtpidhKqJICL1k;%?5S_mOFcq=a5ES#FN}f?X zVh0vz(DTSE&BeGOXr(ceWGb4sS!c;JgHom#1(6Ef)>U{`zJx{28qHHJ zr^pbAln4i8m>$>bTX!tP8`j-Me0Y3ZB%hU(5n6$?xaE(_hc92Hk{L?551{C#OB57dAcw)gP__r&|7a8So>hQGzr-!NV9v&=*`kssGR zeuUD3cn*>O(sA@ls)45NT1L1r&e5{B&0euNQtdMo| z4|TM~Q#_>s7oZQQ<(J3cqkulHtT?75Zg5w^R|-cmzKG8-Mdl%i)m}_KSRuqFHd`4s z*UQXBN2jI5Xy*1Q&E-h_D~;tHK(hKBM5C10g37gDqGg7-en`rn6djwE(_kC3aVWDK z963-7)8B|Ak&~~`9`+7c;-+$E;kbBiGc8{0=GCyojjz(%u8=~^&;any69a%*PL2RfhCiMF`4-H zlN~3{a|H-3rs+T{N|KV&Q~)=~QG4LAXRNXhXr{~|LvTx&7)2@)Qw!V%`+${_-}XWR zOf!h?b+^<#PHLHOpM_TTaG?Z=q}M~yRC{#GJ*G%GApnzxPrE0-cuF;9J(ol@ev;=e zKWm&w$sZ2D48|;VBlvoaOcb)qUQv_pbMA zKH4v*bY~10U*8iXx>qSf|Cv+IU_fA$SUNF9U}l8n7CquywC~Kx@o3b8 z13j=c#qJ$_#vlX^FB69&V+wFm&nd&$_jz20am&Nq5D!*51*9>a+PpKvi=I`_`xD1o z@D~y42Q8L5KBzu1!ImE+88E{8Jbyf_s{mPn&w$Fdpt$S`R_+xcjzU45Buq>Am!1-V z5=qz1q6|cTNVgciY7vVOx5Wp*NlSPmk&P~v1eJW7*EQ?16nm+>(q8#@v!_LRsSIbC zDzYSGf0cbuJZJgM3W^nWD#};fs+1Ba6Hy+o@{y`2HJ{ZstBZh-RG+1RUqh@$ zc};gUHEVX$BB15av0QCt+Rb&i>KyXd83Bs0{;yXwC`>Ii?3Y{^N`p`I~?_QY<2v}$qJ_h&KSJ2PtJF` z$am@G3gcZ}^{jL6JM6Y4JY4H>6fo{IPwRM=lO#WB0kRTawe-5XH|Z$PyH`nXFS>VA?~~G8bl;Cs zhX>Q7Wyr}`0$qHjS03`tL$_nR?-9AUW#k?LW>3i@0+{2YoG(4@lRS~YyivfsKjnMj z$&WoXj=kWW4^l_ast26*j=AnQ9&TOu_;}aS zE%k~vceTx0Hg76zjNKf(HFEoid%-*H9|?|zSE5%*Zr?wD`}+N8mfp_*KTj-z{aJhU z-POA?0Lws6)aD}ViaayqqK)||N1=M^M#T{w(ROy@cQ>EzPDCi~&ig62Js!mu9DMT2 zovT0J^D>|OmwP<9S5kGY4@tGZJfPo~=MR4P(8G+|nEria9QRW8LLL==4*gY`buwE; z_6{5!Ia_db;`;K`l{}dO5A&{vzIj&eu+D;=gi1v&6WJrWSoHsVd(ljZ+;Km@Z*MC=IfDg2+ z-HeZWFgo~XB=E7MM?$reR}WXVziiLwEPCo{cLX8HnV-Au<_acW18*5AMS77 z?!9CC-3|sE&L)*PO8$Q?XU-qRepWqie9`f8)z#MPmH#uq0#rB*WeY=3+?0`9fMgET z7nnD2Z;&TJx*sylkj;YJ9LP(caNb?O%Au)@NYy@`ete?@ItkaL^{nTQd$}w9-V7=- zOvq?Q#=|q|&2&L#vorsfUwT%vv+>XJHl__Zj>&0f&WHPPwx3U973Xm-j?%oB=c@qw z9gDZDfY<`f5bB7qW}#MyoGyHjh$W(w5w}@Pw^&ysEEfC6l2zh;kW?jpw)iV#{(A*U z7%t%$+2>@x2@)VN04bdkpOa6QB$m`GX^x~lk}i{fK|vE~F_J4K50ku8iV!IsQXP=7 zOWJ5@Tcy3HVu`FbROOK2jqGR{Vj2B1&QRkaGg0PM>T<~Hm-UK<0?MoE^ElVDLw?=#9! zc7(Af`t&RRVtbj2b4)c*<%X&lVlnYJ;+e$zRi>ys>$f>-mZ}z@dXSn5H5VbA(0`RW zpw13;cUT6hAFII%4F_09XxyPm2LlH*U0@rn`3yTBG!4FwNN97}MHJI~2{s^jy=Q#^{?rFyl$A05iwUd>3bA zp|OS4X3dz*$Lv*e!p$|d#M6>CbGOVrneZy%ce*_0=~?PxX}5WM=1XDz$oab$nCcv| zV8uc^%f~HTzVKMe^Hd=gSy-`PvA2~S7C%mpuw>FwhNTWx&se5xO|oSxmi^0$vV83d zX{-phV)aUEYxl0Qw{G;RZ@2BN@3Z>*oos6+uQ{Lpyuif92x~K~?X`BpIy;+uY#Ouf zWl@p!?~DCynY!WcJzraEZ5+DsYN?KG!!|2m^O(&)AG+JIaLdbzR9jzF=G(S>y9~A) z+1+4!v+b+5U#fatZDmh|9W!^V*>R})eD%Lav39QB`MlP`z5x5u?aH!i_^vIxdD!i3 ze}&!Cc0b2^I1p=3kv%K+nK-QMu#3ZD`$z0QoG<(pp*G8(cE6xiy*lDdX@0HZ1x^*? zj?*LZJB)S-i$$(FD;Z29+rlh?0j@eLHJ{{Wx7XZx)md>hv{JKM@JVQ%FRYV8TSBg+zEMCQK-1Q+d83Gt)Un z;`XTb+IG&w+qLR(u+8aR<@Vj1FEcuw|C=-7Eu$zj>zt}w(Ew`5AAKtUaO!{gtI)bc zy~2X<7FP3~D(jX=vj65hsnD_NV0&xXl#8sof5L*;=O4Z)IqMVQ5C7M{9Bm2s%VMAv zsxiA_IFjw`yW4U)r}6Nw+$#(V9eNg(P?lZJH+_6N0Hhy%SO!Ps(Z;E!*x)6ONQ?71 zBC!_>N)GvP!Z7tfJl}Zn(H2Rh9m8X=Zqk?EIqM6m#(UthliF<8y@acU`mmx_6k(sV z-u8nBJa4`f5;AZwdaB39L3v*68op^Byx>*QT~IQ&qo+E$CZ}=bq&}3tZe!qpmhdMS6E+hvn*t7ti@T}OU6pa767cLP=9b( zc~dFjKu;WjXyf9d@eY%(?p5*WBa8cvrgOS8U2`W!PG*3=K@%P$VF1+nPJ(_)EQw?t z{Vx1yq<(O!=7d#J7d)@Mp!HCWWLf;sM|TTK)@jk{Igw|tV5H-mFr@}W5FN*m4txQRu?dS$y)u)@Pk#G_C3P_Nensb_!getcusc)cAMH-UclSt?b-F9$CpA;)Q z(p}Hf>3yyhTn(6kQcaN`n`XM_V-B~gn7ijS9~kMriG2*6cUs|Cj=#-6mh^ImJ#jss zW@Em}^yT@ zL)LH{LF zg(R`+;-59;LmpzA2Hz9Xcf9pX^8+W!51a;`gjI)%aN46JfRZzwcOv!p z*aI+5q-{XM_ZrMNrCbcpp>IRhppmg1oU?KGeoxFw z!5&<;-fi2)1qEILuxJsEDfH;#H{!RQJhRHf91fctC117rL`pWL%lGg10|9@=xFuEMLT#11F0sDnO1_2t7m9;H^i)zSmA4 zqC4&*=l*2{iHUqagaCmMnKP@T0om9aleJjKr6lEOFTpcS7!DC-hr*Qb?R^1ARcYa( zpuMvmLB6lLmld?pli*^hB1&TtBZdnCFS;^O(N3FKZs$=_?(+FlLUjU=OE3uoPgy|s zTqzs$61JAA@f5uGi~wuzatvvUH823s*!7SXeerz)HOfE#AB56j;OoESrtuPi*8+k! zyDT<*3%2xSDOO-W{-PM?L-gj)$~ys3_`U?@hqIc5IH{BSLf4Tz(iL(*9F)9zSN|mO z?}0ruG;!%3wWRu$C&1a6vZ%tP97Je^%(MBuS-5%;1S1l|Q_Q-EWc5~wB3BWID*pNx zIg5Kc_tR7;dR^>7q8?tx)A%j@_1Wc_tZ(#1pg}zEwA-&eglXMsO*Lk|%eDh=3@)cy z)T&-M|Lue$!@JER@K#TFCUg+s$f6UvnT`nL$-<^Rp2(XcwbF=aEqoGPq0@e`o1#O@~~)%IX&jM6NLmI%F(C>Xtkg2)><8+J9Q3%RD`Aj-%QRw zU1Mn^0SourH?<=9YJ&j7Fc+z)#eAegrCiO^*t6UHEouAk_e1;)+!@ldZ8~3^l+&HT zgs%ei)BqoiFcqA?CUVQncqWlB#r)1)nE064z2<=_Nk8S3S=hYD=}&;S1;l^W^{mab zadq`G6YmGmg)mn~_vL8`mvxNrwkjL8pB7^0iRYm6<{=Fv)w7v4&o;Jc^k)IGO>l%c z2}Y1`8z zXVrUt$$U**r+lFNFT9hEx;;`yFkvP#^tRL84t0T0p{?>sV;#qwty0)xwt6^Mz~q+{ zOQ!{>kchhvlh9(+y(9q~ugjQ$Kb>QI2l1`_Zl7UX3dVgQG?Y*IrrztIIGnDIF;^Rz zXcd46^=JVC3XDE_;B;&n9K0OE=v4J}s%Wuq&!$(57WGiGw(2;zsR_e<3_S>pUwW~o zhCbN+QQPz5m-7k69e9})le$rvev_#}&N<->^D+)D=CaDI%i}7n-8ZQWdY()DcELJ+FWN({8uv@H4N~LT+Rf}>>rato#x0lNa;=5rwR1M9X9Hs!gnW)S16e^XXm=EQrvUIwiQGA*=^Yg|PHcV;r$h zFa3zF1y(mxHJP(;t_rT>^5|BGy+aDi=Hu{&XU^9(h%@%D|D_g_2MrlJKzJV|bf`ue zUU+`yTUOcR^khi^?OM43f(Jb?XpuDTFEsqrAIqbpT%yOIGkj5zufe1OlKK=Vq?%vv&}HF@p@dhfLS zm&|^PNutWoo$5&@xKZ&+zn(pk&(>^Ns zfHzGeYte^%kN^C$3{%-rw1*E0Wzv!$=Q0yyvrM@0k?GXC(?xABoYAJWWII$Da-W1< z8WQ9Qfx#FR_7Fxf!5srMlF!2@-H6|1LPtK6?hw?&_#o}i)*x-iiLA8yVxVQF4;QSK z#}>BP=}>JNKa)t7pVaV+sSUS}zld&b$Emr6bFS@6hHl|jLMy7Be@^_QC#d4UYYg!w z0X3KFp(LM4cL_t>4TOa^*4rqC;vi*T%T$H&(0M$9?){PCqEr&(+(Bm)Q#q+o(|=-5 zb0Kz&I}iLcN*GzK5XMN_Fz6WSTsSu6h#dDn`^7kd(~w+-R3)cKCkwRb;^tI(BF@zspZFQ$Aij(?IICf6r>Nk>2}g_DT~{c&9Hj9k~`NAhVup>%76l5 z%?v4JK>ZZ3TS0LFj=Hn^;hYK{Lkb9D zu>ko2hCMi&C!4n>1xP~;1V5%z#6rptg1XA*3DXYV_{7G<&GnVSZrPQ>4+j2$+cfH4 z?SV{V%h)(qLi$FC8>D*F(r-w=M{gG%x8`|BkRpbu;eqo<5(w7^2ZEL-jmi#C;KvVLKwzyZJ2{b`oN zbkV_8n{Yu%_cL^1H~53?eN(LB|H7Qu2w)PoX1l&g5|D;+vmSu2&a}Xvyvqz4nX}TjA5(6TNbQ(S@#Nbzsl&f;5p!qBb8>0o)kIb6}xj@?e9x@QJ za&RPf#ICac_BhZL+XN#)>jvQ46@4crn^(yd1vXfP1{oJ|``0UiTMoN0VpX@T0YN<2 zmD&wgcNK{)Tg5P2Fe;JqHh-O>$F|&z>=*dl@aQg2CfZx)wGOmL-Z9lcrVCEAr6h^o z4aUpG5_%^OkJ2Z{ibKRO2t@%%hhIN=)Q+Y!>d~RjOpWiJkURk)LeOI~I%YO17`?NE zq9wAnLE5cj+?-6z+^kE_IN+m2X@}U(PimsUM@pr5f>ImLk&Hk~DDX)_l&FNHStI2n zS)NslhRQ!5GMUnc``5Ulfp5Z1hk`hZ1ZkfLj8k&}mOX?f8rEbr<8nz-fAbG!l<{2I zTN87*x@Bsc8<8+X0d?DwmP*5&?WmySLD^H1$RYM5iV6syP6MJ+5+}14`IvW_(Sp3w zm0+DEk`EU={cpRVokwpDUp*ve1_qyjJ%vwmDp&~8 zlqM_+hTGZmMag3ke2z%*GHGqf(IZEX&QG`(CFXZzv&CC%smC}38ycskA2Jnwp6YS- z{iMUSp1cr{CV_6M{F;VS6u)q#r6$c5teAKEae|s?*qGIf*lL}>w4x`Ef?4+vv$Kj3 zxfqXkV1qbVKyq;wE4dX!S)+6hg<5E#pR7kNv7T-I$c1XhYynx>n0Lz>9%}gAsfYbY z#^MuDTpSY_K>w>NdG_R+!~9GK!lmyLPfZ+T!~8S-qdAUezE3~~4CwOGf=;CSiT?@^ zpp1sDTPb6>e1BC^a82X*rXDzuk=mZLL>h+2Z*gT-Gd7U!G6$>zRe7i!D&pG4^J}N7 zW@FyHj~qc|E}=Rr$ua?X5=4KC6h3ld-DrR7zENt(3?C4X)&U3_Z)scpn!L^Mt z;H70_-XrQ+b;>_YYK>L9*hUW}BA)UzkHp>_Cw_|4{yI-sUalCP$1lNn?4|6CZZ0iE z7dkjgK1t|-0JrnCp;3boOq6X2tkD|2?`?8?w42?xOny)!?l>vWUvkf#mJOqi;GIN7 znF}FX2s;6G_$)h<<&3Re7~@K!S|(UgZp3*hmBSN9?0tgHDNo z-65G|N7(DprPK1*>dtC_kpyy-BTCiO|M|<_omcd46=)_`l5bn$M(1_4UFpY}{hP)? zDGwp4B^f{=`%-O(KNI=Q-XHbX1H}s=jt;u#q5^3KFX?I-0{4Y#F#!qjB)-DMpcR zQoun_&u-y^9(ltn(MQhW0$ymgW{B;F*8M?JwrHw49ZQfWSM4`>^r2EuyK0qmN3)Tg z*elW8RC$n&tPobYga6ni{#m-6A&wSMGf)pD;Uqdsa2`_K1VZU>FF~_i&1S`%MLrdx z&0ReXX(>t*t619#&(4sucdj86!iQ9H!gk1S`O7Ew6mDi9JtS>FiH|$<&%8<7%f+>f zJT8QyfIDe`sIY_15bB&6iqQP>p<@u_in(0&9F-(Ypwu5&A$+|*tI~<;rrk!xv#f0l zq5@ybtME1u(5A|lN)lUJf3C9(;tL^)W)Reepv!M6_PAQgn}}j4GE}eTEQIy+rEj7k3#B+-an*OA54KULuI=TXK$nadt z#QiY;g$sp#=tJ|HJJjzM=kB3_ww*KY20unGG*3KrODfDk#Tx}--nM3y+YeX1`z!B{ zcGX8|?=4j;dHpl#hMd$1rW{gX#ksI(ikSX^74eVZ>9z-=B3NE+XA$4?py(NE@T!yovWQ=&K<4_MKh!++3qG#= zqr=572C_?oa%|26oon6UmZ9+jUUMcnxmMpF!v+Uv5&b|@ZA6drMpF%3SgTK8;tP5w z7Ot|}$J9XjOfx%|^va7hCo;e2uE{&g4Bm__px-BAi&VDft4$fq#HoyWb?&=tm|qcO z-j_$wymTSbk-i<}KovlofZZVo8C72<44ECTIoYUAE#oVAlJey@CHWiF4Hx?Y0{#nBl|2ICnDBET+D{J zA%snbAeEl8sAf(8$HNraCTg_GLlMNC-H<2p^W>xl*`t&r+(s#at#(9;6vB&;QJAr> zIa9)8w-;`5w25k2sRnFovZhoW8VsBE4P+?5Tl*hwa8BP$%gPq_0JgenxvjS>)bMxU zMVCwK=Y&NpbsakWbJ5+7&e@s}11zjhX09p#c6M(ER{6~PlQb6)9##QbY z@LZg9RtjE=9FWG^lumcuX(FKzJw@=gkffI#C!O)sS(1$);hB~TlMJ4ZzJF-Rbmy6b zq%r_Lc_Uv-4xuNNleLgRveIZj4UkiKj{381;7Va|mPF+sIVh#^nUshl`I27reb#{( z&qtZU0_zYI(2wp@w`Z{MHI~!5AWHD-+1jfA!%2kKr=Eb08iqCC&(Ae|Z~zgWU;4FN z?!15%|5*^@1n9ftU=v!pEfi2yuo=4deBJzCv$we_ft6=oRqQd`%j@($_c6 ze_39H$`IGN7!w;WV|uMxUvpQ7?M(9A@~{6N%v}QX8<70?M$~>UN`@mk!EmGd)3nw4 zulrtJ4X^!=qAIZVB&X>oK@$KRyHe>`9veST_M${mZ9p&={!g_wjf1)J*eoIMo(>G^>!hcM7$_`J_aue*M$EOlT14Z*vYq}HD{@;9T4 zn~f|X>6opOdlWo+{kEj_w(@z`2I+OQLE_33(tkzqY!o$G2mTGOk2t@C9$Q}Tbr%<1 zcD_u%QRco5*wbUt`(L*-8n@TZ z2d-_&v=1}yb9u2V!@j35?)xuvTn!k`IDwT5BkH1mIfu?smG(jZIU}c>YY;LQ9CMUe z{&J*6pZ=!|#}u5$E(4l)^Oha0SHOi)~ab|BxO=g1yg z(dT4Yh3LOE*RV%CVL=rJBOdV>oUWxZM~k&oX8<)o%D?GQ1ZoQC>zp@D5_?~9Cx=RJ z8av!IsykS>pRKdQx*DmLaAMicE`>gQNpH{U0xR54XA;ET=FUEZ66DvxOAu92iVW0P zP1ff049b}(Low#~s_UnSh+g9oqxzm>3L|uBJ%?VphW*@9$qu1O#BL$ab|zt%mbJ>R zu3soiJ*^1S`BO|puXM>#fMdj;q~i7Hhj*QtpOf3)E7mI(!Sx)M%0(X6XK1 zQ0OM?{Yb#oo9&5;>Tz+DE1av`I$Qht=iKM&^G{vu#bYTT8#Re##M9Tye1MHwIJ)>( zZkl<+>jPPrwVM#R(LuJIoImBKeR4!`IR-|w2m_y$HoQ+UyZ%T zmCZgi4s&z0B;3kcMpWhZ6U!hwszvqMxU>6$XUS5xpc=QW9I|cj$gP!QWG|#rB}tiT z^Jr}w%Vg4>?&=#KLAyPiic|d5e=h`qvbR%C$`jeTCB+_0rDJ40^e4G)aL@)ndr2Xn zvG(>mOa$2tW?0V|koMY6U4jCA4HwWs-?FT)I{<=_LfN)!T|1^mJnJNkpZBC*v1D2j zTzNa?m^I`9X}ndY*}Iqffh?3fozeq}4fe23cg@Tqq2M=#&ZAW`pHAMN*0dl57xusY z(YC~p2t#Eny-I)U0QkvU`8TAZ=2kSRx$lYut~!5!>qqs6;LcHYIW$fGt8)z&dOH=h zcDOGbcvvCS4|%5i01n8JR6rLnZz9a48j=h%Zo>#5no%H&wL<&p{L&M}CyTkR3H<~w zMFncG(8t}fT5g-CWbRol==K>eQ3KFTT{Nvg%nCG1U&m3rKftm$#t=oCvKn>1n`Gz&$ zDRKKsu5|KII^``pR^h zx?qii79%ZJ8}d>U#hG=fmkT64TRvb5x8;Chbjs))@8oD<#zj{K5}O%Zz&T5E^QGK` zQoP!tSBcuZD(NTX41%EkuyRcK?636<*JLB{hx#gEo|RZ%cARp?QxZ_WM}<=6VVybQ zak<5&yj(~#E16jh#Va(V%=bLUS~~>i4kkVZkM0iBnCigu`Gxtp-~I&Nn|zlxUIb*% z`kdSFP33MIvOD^5QONCb=WYy_um17?Tl?uZ+&ig_!af=Z+?2gDPP2ZDlvu!Vip)pKt9%?SGos{`C$-*U zANEA^Mr(lNZzACkGg+8zsfAL4!qo#-XtQk2qPOYooMoUQLz?s!2S*zs!*WKy(VdG% z6si(31e{gueZ_Nt8#9W_4*oEWaG56N@A2mC@rL$9)^)>=2;bba zfK|lGas_HCV8AKjM-ajRGCm>0`%yvXI~nzp)4bowcyuY58DTC8VXn#%OY9?{L1->4Vo(FLbB<_x)XNH_>eZheQ!b zNt|Rh!VvNy*eRytIW#U2ssbm)^BA*A9G6eCAUj6)5(-W2C3fms8iR!vh-M;-!&JqoZUU)Gflnv+JzEo1TkQZQ`McII;g{DYIn72mrm$(C6Yz(?d#vz>iM1CBRzHEbjFo-55l4wiG4`O%Gsm;?97+Xby}T}KLUMfB_Rfp@P?INLUZ#~CnhEk~DyNMAlXqg6=6g57AFlb%Fw zkR>SVjV^_Vj7@bf>`5F;r--~7D;#aUHj_48#=C;sBdX$iY<;I`v0JW<5sI5dFL`!g z`xa{NZ1JrzhPUUuBU|-9;|Lo>rZo`skKC%a+wAsk$K3oy(T1%Q;UbQ_4V3=}$ygRI z2itZ7v*uZCEIpZ5Z(7z=(5gIvau}4>_1>Q4vde6YCWOP#@e1^h=*NOCf`b3kVmCpq z-z27>pIL6VPR5TfD*=Dm>_b?{`|~26pj)sEND;?0<`10E(f<(V`-SrP%kCGq-YmCw z)#o9!R(nR(l<%#=&%lXi8wd^UBI@S{KvxHY!(8}3qH$1wkn)pP;}Jd5Dcb4qpT|dW zr1qT0fe`8x%{k0C$iR;{&%jz_p9?C*m3&?=m3F6@-y{#J%f|x65p~rlO=*>na!q#}aXtf((SPn@Pe-&f`mnm zc`i=8*a#jGNcF{%MHiwucYffx5X}B89HD-n=HUihWbWdL20GCX!9I9rsu!SGiV|c> zQ3pc4aWv}Q{NW{Qx}W_vmwy|cWrERIhXf}WnA9qI02+@16H%dN7O2gj27>PGS8;;x zklp(Y3iy>jpEGvnSjP!zz89n5Dmf%;`k>hu1fGeDT=@+g#dq^@1q_BXGko9cLirT` z4@>F#y>$})&axpdr_;ou_tv5;C(ua!Vk|89{`s#d;GdLRN5tPbaE=F3A#fgW$>iVR zs-iv-82NZJ2ZArfJ41UXHt1ee5pN0T@AmmmVPr7HXF&%fSp4hvmyU;PEYs`@80rIu zwHo?Imr%58+yG{{yHEz($$lTQYqd<8urC1rOVK|P6#!HIRa?0NZUIwh%6jK-^kbWh zR>n<^%V8=6rf8SF|8)p&A~05Bc#h?P&xL0#i~{n7$8TCc9a4|)LkOI8Pc%FLI#*G` zP6&2~F&_fX5*XjP(8za18z8vGM8@jT1YcR=YTL@e11mTpwG|IUkcc`C0d<4VBT8p# z&B92EPQ!j3LPg#v1fF5MoI`T$1-NHxK@` z+Dj^F9`47sbGfjPb{jeY^m5e!;V$_$&K2-GhkQu@e_ZQa&B_UYJkvbDF$4+0|Awj` zet^CRH4wg1Um5V5^4$Hw-^bW9(T>WGliuetE#-W{3(L}$hJHpx+MUThKZ;)O*B(5O z8tX5m%nqppelzGl9bmLL=6$%tJAtv; z(b4ZV+)aU*FI(G-`G`%Mb5L$PB;E`e_#0MEhGyzC&;d`-Jp?mXxU94sU9kakJo&DlJ(Nqa3(qpay~|4|9s;+BXJ|iU&!D<+;8_a#{E$vMl-dqKwGN>| zR(l&`c$Q83Tb?3<@u0%D>EH7Y19{Q2F&Z?(6i6YFoM5h*fVQg+@|$bVrWgo@M~Hkq zW47OY+nJ05^Jcu&3_HqVi#prNti}kDMyJ~6B!dA20V0iz?_KvLn_huCm@~p)L1MX^ zifD{uhcZ5RK7&)DMe|U|0_=oioaGQOT`FrQi?iTKcqsP~c~35y`uNVV8=YImO@LS0 zp_ygH0~FFCpQzaymVlXzkeJ3T`q@c{!S{&*fc+|`paXa|cGe>$WS6B%ILgxP7+8!3 zSr8DQ!EDOb#p(8(TmTRZwJ&gr*e{2f7Ghb07a&Ry?uI~g&gxFBfy3woLOZJI%uGnz zhT!YvCxmFUa0`aGLPrq=+W`1``(4xnCC+mg%8123GvoQ&CS~2DURQ=V)}$1^SP=c- z(?@?$K#o78e;C|b7v4%_hTnyYE%YN#tW~)!IE5V%ZdE6$2V2=^mufkp)j0CQi{{6q z+u|11)kE-Lo(2H&Y{=v>WsT}FYxJvLCdR&l*W00)odPJ5H7;O|FD1x06omz2CD`GB zoOOtI_lTsyVR7X*6pbaT?L{m;ht6=^be!heXLirdWx)eP?9efB0H@7`z4OaTfqr0BnDF!zNxrcFNhCrQTB_598 z#SmMS#6i@@jJ@?tdpDF_sc41qSbfOOI@-nJBI!A_DQmH?l&+k^<9up&rg8|{W9u2x zl(UZ0*|s~G$oQF^LhVLV^U+T%asokWAk!~{2|L18ZiF&I5FeXAUOynS??dHm?F zdMpdN_2XdOOEma;r-xU#%;C>zPWr^&*$%WYx-$FjPouZdbMnsEK0mp2Vs4mSE`g#m z9fDw_a00N5fryNy0BY?Trw3ezsl7l)9dO~w#xJA!pX#%biSs*Y%$}YJy)?59Ah*Rp{~QJch%AZ(`8d~GmElmp_u~~P87~dF-24Fb^W7$~nw_X?-Zvwx$5E$?Uog=CeI0K$&jEA;Qam3B0 z4-+6w?hQ6@yg2vSu6YAhBjRb6zfE%`u$W*CSf-Wo@C)Gccae^N48XKan3`&`vgQ=Z0u*yd z-2Pyz>%WZ(xjmqhZmn%Hl;jouLi&Zlylr8lfN8lO7fpzz@mQd;n{YDg5O@4~f~QtY zWtdTTPHe`_ENZ=%V$P;2H%xOX76YMv7=w47Jxg8$<)9yHwjXj$agO_t@7NJI6e8S{ml=UaZot@aL#UAbwk zIx4rrNTUbJ#RDxj2q>GoyUd1)N~Sj^YX-0bV~KlsaLfi5_Y*%|nF)uABDGYl(G9&9 z<{4IxhkRZ7jhf2u=wr$7XcXGQ!J1zMMzmLc!fL-Ndmc`MbBknZgmhrZg`kj&+ z%>Vf~`=5p|`{bOpkRqH`B-EP9+~;R@vL*7PE5SQf0SSzj)8O^78loI|!n`h0gnq0n zr-N+~y2J_dsEonmp)(fxD<_$YcGv~#r}+)@@^4$n)%+Fr_2(~I+a8_!?N7>8TlT|b zi`>^CD9@-*9kap+414)T$Qg5i&c^A%sqn1A{5|!-4an`mN6}+h$g!ENnAWG7gi}Hz zc>KI|f7@Nc{1Lp|H8?xQ;FPMBEuXoUl}X1QvNV@O8LKwTc!h}$lVo^Jud8P5?iaUw z(`t28o|KOstOy;#^%kD-``hbLaq0AWf`Q4+q(?+-y?Jdm0-+42RBd)+-}$+f^P;rS z=#-;`{arDIJRbASVit1GMe^@-G)P_v>tpc#stcH{nfH)$Nlv)L-K=+eEpTP-Du}X2vxU{6uG}0 zziX@YJ880kV5^u7omtJGYBSW(C5le*Dca)fB_l(k*<(oHZl*;im`NS3H(v z*@XobqW|!xU`K=BeC2u!?8-;b^BF`s`Q+C322z;Eys_A%%}Ybl9Qk8AYQy)?IgaS- zruzev3Xj;>Lj5=-BWcP+DJ&Q)og6=ANq56+p-YYg@;5vqhkuOVN2D3J?xIOpY($#S zIl>JDI95z%izvcC452w8qp(qns$L;85tK>!ZDd35UD{?x7m33oho1H=6vpX4m*Eji!mn!>MmxG+u|Ly^=H z1DgG@!Y#kl1oX)mL*5%Yu~%hpx)81gH|B=EW}Ht>a>xQ>w6sckZ=w@@t1W3u5Cnc8^@~jEKE}H<`nE>p? zpF#qOTfBr^W9y0^PRODWWnl4Wd##gSRbCnn12^Wn8i$<;aA9FoIEGAsg@@Q3d#w$$ z%xt6+&ufHE&$>oUG62LVg90n3_jxP4k2{N{mho`5QnqdBOxO7M7usqw)K+S*-aD z$zKo99Ce?K9uN-jXCbi^63$?x8)AJs0&boVF(E$vfHU5SP%=#IIC4EdSlx&}wsU8I zOtz8#bPkeK?w}273zr!-@f#8hw*rMN*Tgh@ctV^s$65DSrsrE9l{*86wMr3KTnANa zfE`PR$ZCdb*^#H%#@brEYu*< z9hQ6kunE502G&pu@2Min);4x9R)mUm&H?r`*#ClNFIbtSD3EjAd%1|$?>;6^46P9c zLoJ%cmRcw#hVZ-M*`9G>_5;b%y5BDLpd(1KDRQB;{nNTwTEwFh>g@Tu>TlKh;gS34z*z!>$D~6D|nNHYe)`6 zdqlnl1;qM+YwUUO+&?yV7Bt48edJ+RNOZ!h3OHKpoN0*#b=LfAD+E7V#BP01{4m9D zK+tUQu~jGUdkYw%A1EM$&%D4&@Ts**9a1D11Ff-e3hyw)FWR|eVps=+Wa%Kr5NmzY zamwkX7UI-ePe(HguXAv$)-a*E;)K(nfqnADDGxxNO6xX}y;iJ+3E;{}Lb;nTLS0YD z)YiOpI#TX1gS$UWV`OVTrfW7-+Qp$PaA+V~1wm&Zi7Ham8!9hZA516ykX9x1t}(YB zO?Lr#{&va{6H1wuG`)?jAPc;wwwOo|gfU%a-vt=N%V*!u(LlxCnw)xI8721I0D@@} zZ>Y9gJ6w|;TF z#DcKJHmx=>yYTv95<;EMX3K~unM0_p$=xSD;k#86E+0t2Cs>~C(=FvjVYs;aE)?zp zXdjUGD))({Oqba(O^&0im71&>FzoH{6AHvTdjSY#|e&+I6X>U2tT}^o4r)9wE2Jld1LshcpAEvN6VL%ViO% zy?3DKi1XHMXHM_zIEhO5&7URn;qqLo@v43j3dbKFP?g`50`1dtz*<|q{Cm~ei;+m> z?)`leM7IrGy02O_Ts~StIlA`*;GAY@J{c2Nnpeu!nVd|(opSB_j3Ih!9KVyPN)GT&gQf2x*$s@jGL=2q*uOWFz?#0ItmyWF@eSx(gR*1CJ!Pp;a z74<6ph9)A1MunIhA6Z#HqC~3R8Z<_s6OzLdQq@%j+EmTbJmMKwWU;a+)^iAvtHH7O zcnvn%&fH376*evRurNByN=&+1%WvG5IPA!jAK`NAj=HiE(Yw5; zPYMC0Y>q1|EMkcnZ8^~IglVg4wwO`Y`9dw>LbzJ{`%oifbe>V2%|CP15JLjlfkSTp zpHl%@NGP1G!8nV=q*-)rv2kU+Nk<`r99kn|^E2eZEiW`+_+584%?Zg1Hf4%?YYUQW zvfSS$VZWy<33eRJh6P#8;Cy1e*z&Cny-d-Y6h1UJdx;r4Y^qhgR{OiK8*0u0mc~^l z{X{u4-XX%2Z1c^an~me>7Tx%&4zbdhZ%gxjA@qs%he2N}Gi#vlabqR;=3wr+4_OaL zXP1)9_iS!oNR&=KigH_f4Tec@$_$`DC$!7S;3%Ss4hl1I-0OdW6rKE^)hPL!#J&Cp zoRZyt-rMyq(IR0C+SC`Cf36AqX05|pQ)hH^-AAAmF6p}>p0{Y4_S7VM5LV~-3nJ^#I z)&yhX7+4mq&xO(@Ytt_0Z}ve}ctKWLxH$M+IJm&Rpdat{`}zfH(%uizPub%pTtGi51}Xek>7& z!Yq^o$+0FFIsmq&3!~<7_>co&GK5c66+M!JYX0-WhJ$T<=C(^byi0^oH($~&Dw0L3^xd@k=x!%M{ToSDI~NpR3vG=T!Dzc9C*XY!z)4;c=eI!Eu4fym4Ku?GV?5i#FzBjc6hs&z z#pISGc?VY!9Hz70v`tU)^ftJ&{)IracKvWm4P2ob`hL>M$;aeVEGR%Tk<63uyz|mB zcmxWyCpl=cTngxJAhQ7pIV{Y{t!>@2B6?UhhyMiaW+S9fAn`*l>dvCc4Wm4Yim~2d zW-W$Jt;vCj9ucvILrJ272>dLYg0!;lkevGa=>()Mv;jTcmVf`ig$)xe2b#P9UDg63gZn~S<+V~q_CpF)L!&Vr{wlIV z-smU};*%|g=|_iQ|F$rPe&{$g<%B$;d8kwD#S|(7M|;nWQIojxo6SZ@r4ZteKGZKu zNrs2j=%5}4xMA5EuRx=z42LCRg2<1{4zV7MgCTi&#A*=b5GizKd&vi~^X>f0P3A$? zSI_Z52Am{L&ngDT%*@BIm`IvVPOGwQ(ken*dCwu0X?FcBnYgECVVE7Pq*GqTa(z@#xyO8%HA4`i3C?&8y-dA*IPdrFNG7k_r z8N`(-<-$7AAHe&I79+VtuoX+jdDI}1boGCJaQNZ71WA_uF{WqzFh)2~|GePv!!g3h z6P}z+`2S#Mgta+Z8Jj)BYfR@m$)GiNF1z9}lhLHH)Z+Gy=t_}X^qZ|iM!xSDVHysZ z=x!B9FI{2TSa)h3vUbhK+uQ7DPg#D6rsNz}&s7xx@Q(`SGF5d4&_l030r66sbKR_s z3@S3}8%NH6GRfl$$b_v{TPmBl{yM}Uspf|4oO@^6MKZr8<1F2a4z|CNk-g+udd&U3 zt(N|khyAp2?Y=jPL@IN##{v|4F4!cBWm+s3=y%j`RL9=*!1LGjDg2;Qb^&Ou4hq~H zxt57^ts*+t#6-=>{M%2~G<+#z7I&$H6h~Kf#>2(3m`G5upaKq~W%U~==&Tq-$^?NPQ{xrYl z1>pB*>Ak`yZ3{-_OlzL!#2ZH;CZoP^;QXg!JRy&aPb?_NVza_8LlQEkTq!W<7dS}9 zJm(2H9g8DuZy7z5gyl9fb@zOa^!8qaL$q$0?;JhbsT4|GPpM}n{k3ot+h!6m2|EH%P z;>2wo*SpRCqq&mxIkDo|FqV4s z3?sbiPUgO+(Rj}ybb)pFqyP!Y58ra!Y*S;a$6m&mb|!p1F}Mj7(Au1>9vvDMd#MO* zF|kzTa`P2BuipmH4j-jk7-z0xSIlGbA&r%C@_f9G=8?nAZ<2TZw0t-=e=TxG6?~B| zw2>LklIe@OnmV~cAz9nryltV$L6lQDNdqYz(3x5jS%+BP4gJ-D*U~r|S?L@(8QyP5 z6zA$Qql*roJY$ezz)U`5HJT~1W5#%uA(_2Yj+G=}=SgP3&Xdd><_&nJ@sbzgdK$6d zuZ?ofi~o2K`U50rR_(LgMoPQfd;_S#(W}b46waRkA+mI%LS=EqR z36>hSpMeJ+#M5fGg=L)CRi~II{=^8zSTu??*Y_lg%zE9s=Rtp|ZkK}VKA<=j1Dz2M zl<*rKwfqJ{4-vXQQ+)xn_$-fhxND9pY#dOPh6E zFc|qz)}(bS6ql(sv=!!7Kx(c600BiiT>Ml4y0y=;o0Gr&?eoEfGGe<*`b_<4<;p)f zVVA`sQwgHne7TT;fL0b4fjbmsF5{$FU$EMtS_R_nrF-@wd|4fG8xK$pC}GKaonav| zXN%^}f2=--;CDR_>ev_)9+ab{h>Cngb0Uig_2eDl%bJiM4f1`1;#X{5qmIt&Fm$s6 z<)NmHWc*4%L0^c~mBQpE92XQz`h|zw?XGr$)Z!^~W8cMD<_5vbGeMo$v)W7Sw6!!S zD*!R}Y=8q~hDVm4g#aHF9KNlL@`rvSDCoPb!RtFXs*W6bcY}!fYNN+tt;qxow+;&T{ zCi$O%(Zs_yNds?CZM-}gOn-X4uB-RLO!Jbr?B$A}UiRZdhCPr6WMS7en8AAr^=at& znl$q6l=(vc8z34cTj-G7I8=@L;Z^hDsm>7#tJpN*gjD@0>>tyc%~e!W&YdW2s!&d` zN39OLMDxh&F27l$D{96xarhjn3LXF1}Y&}9j!t1+) zV#d6ln9SS%E03tf8t;4zl{SZUtf#4FT?^j>`>RG`A%U5Hs9cSQ<3u8K|Lf*=9U1I< z;Pst?vYZTYhUpT|jS!+Em!a6tv1Bgve(1D?uDaPVY6Hzu+cdB~^~YaNR~=S0wY4!{ zWY>TG%V$3;hb%9L28+2<+4KKT%VaXsS_>tFc`*!ZytPkAOJUDV?u&EVR|nXE%J7ks zVBRtI^rg?bvzdRmX=j{f9b_UtmBm@FjIS`DlvVXQTxcu3QFS{Xg%h927l*0KDli>j zxMMxwCB5l8YkTkLb(HxnJ75d>I(l8yp+BAq zy}r;NDTmYf%-Gm}ZgKJa7!R)ew11OgK>dn8NJDdo0dp$26TFr`6Gd{7JZT`JQkh~M zFtI61!f=?5m>GGG!*luTxwcS4BrBA}H{Yt`cN{rZ%3@Lmm%i$3s%FWyqGf0)hd0_R zVX5Wi1{R()0=dZf!4YG925U1{7MtaI64T1caWn5T%3O4nO*|H(w~Q3@y>j7Njko{k z>3FJ@Ja2Dxe*Dci=J;6hw)MENr?LCf$HKkM{EO00{ul(=ul5&}ga6nWQ1tG@z2WESxv?FiB3Z-{9`Mr^OV; z+bY?Loxsctz?-bNC6C3#**!}+EdB;S{|EsT$H}0aztNYEqlH;$+U`hiu`k<-6@6<6 zJ8UG?mbcvtiX$hjd_@k5%&OVi!r*w+xU9^k1(E{4Y5QhrSZGSjwzX;iFRe>lUYm)- zyNiXIjbz+xt4I5b=JvUXzj6l8M@l+5`dO}Ej-y)%4anB`J5#SR;j*S#>zv_$42 z>EpIKt6Dfc&L{h6!X9E^5x6%zJxoqfc?iA9N7L#oB=fnDt#sR%Z&SA=LYElG zGDPpS-0-yeO8e5Aq0gn+H#s-h*e()vs5)EI)fC1$Im4Bu*>WRFpFSiHoR>qh z^$y(w%1I4E@4<6_^TTg@A=e*lcV68eC>ou4VyuaMM)2%!Uf{3E`1$Xdpss65pH{A2 z66a#Jp?I8mfq6H;oWx}Z61#N5Vt!=M>jq6Y9tWuTgOh~l1wy%0_tGg=uwU=)ySr&E zf?@Ur0JfZ|ILLig(v;8Q6N|k{`1)%E{cCLxlnb`|@$od@gpya(M|g|wY%7-cttL?* z;9xd8EfnYiWxIW|wo7hNyL8BVq+LYGUjx$39h%{b5;wbLk78QD11i^oA+1-ZmL_zY*7C)^*jiKqV7~+ovIW zE+&$1FKWnRlf&XR53Sb>#?1dmwKJ4#-*7H7QCzgsP*5i=5tw9U_l6W?=JbOhL3%5^ zXtQqL-#}?~$8j2mllfo{lq1_1o|9#UO6wM0VGQPh{qccFlVp}|>-+Y901wcq5@D!b zv*Kl}4=PYLcEsm!nDwW59accj^g@pM)x=WWufC$iaD`;g^OKJ1KU1e{FIOBGEsx8n zDOh`a?`Ajc&Qi_fCNjcNICVi+)0#M)=(KL|R6fe+B+1Yx(@0QS2JaD{jlDEM_u&-W zYhz9nXXp(6=7O_gEE@DQeau85y;o$=FnSP>d~`Pe{V@3UhwEmn&BKQoSI_Np#8P8s zm?R3JXdi`D2C<_KVPG{X1g>xzMxUUcpIu^tfyCnVlHj;w7~?dmOGcc<*6c8xmXbo3 zV`9~jg<&27#|dsP0;XSsF>pLaQI%a7tUh?S=NOzxt>gW-W&Rwj%E~6%6 z^|9Nxy6g6pXl6E%(QSp(7j(7u_(6!XZgNxs%BhZ|`(AQwR(s^yjK_R7_0$C3%&w{3 zOzv#x%cgV9+++;4+RijDNO1-j69+D?oHv7$*JIOZ?-Kvt(yGa~$Pq32cv$q0Vc;tt zx{^YK$4K$I(~8leb9GQG_YBAi4=TqU)WXGTT?}6_i&$fXc+}v0zX*{M`?Jg8Zf%*fK0naR*Izx`jaK+t9>|APS99M=GXd>{IW30f6YFsEcQ*8@PwN+- zn4X;>ZLAhGqEEudY~z@y%etGA@`{^B7eH(Q=mH}aLceYvA;r6-DB8?t9JijKw5Ix2 zSbk@`w{R)%oAcNCo&kd`_~qMf zrz-dFsjY*+3Fu4*JVm^BNom5{XC%A_#Qf^EAY?Pe_>vBP-(zL#Z2MHZo#}uL?z3G3 zO-n%M&2SB7oNvNK)C4bq_!(AFe*72RG;XdktIc$ zamd@QpM_XYH-BqGS-?k{BeaO^rSm~t{MpOA!|MBQ-e5(pB~V}Y%5>Io0_&jFFa=8B z0XOf~W-1l2_Jg2Ut{Y=tUVE%mOXy|)ruf!0xTpMZj*Fp0;usqha^`3oNE}A*M!HpfY`L-^oah6-bcY{XjJFls$fk5@;kp4APBMDyKCFa(`i9hEs z+Rc)O>8R6M;-5|fdG6AD^ef^c=_vzo%=IP|M?BwB3t6;<=Iwt6-%K=SiGL2#@NaW^ z{wsp#Y+Oxe{SG10Xb5|G^S;s`!aZ&=>1P`Fx_o{9#syR}ZgU%Gq3KO6gsi+FahFYS z=?9YOeOoSU42M1J#md$`I_vbRbz_t*e(zW7zlhC)JZNC?wkqNw2M$pYl3ew0-1Pph z+h!(t{eOso_`{%Jt96F<-~2)9Swu>W8<%X)rxWDpz@MRQ*Wh1sH)ge-k}>5s%5|ge z<@IMuRWz0iov7_2-)j5-d4)rKAlLK+bq2o8)^EXEI>w(>WGaO9vu0SJeC@a}Aam z)t>vm*TbKtOw|weR_-(TW$lq?l`hAX>%8IDCsT&He*^WkpWx_p+hF#lXFOw`Uznzg8r-HR$C>R>I_^S|@YTX{9 zeZD0_OcdbRWhpz*irM-pjNCJlkX0i|`oojjAyp?g=lh9q(ndJ2#Gp~{5T@lNhn9w7 zHe)HxNAyO^v$1au>RA6D0ozUOr5^8i{Qe4u-~MANeb;IVcx!ml-Y@&H z7U1w^8?l+M&~;2reuhdXpNW0FU(0%b)mtY4`~LDjl3u3gsb^9rI{Gr#{9p63xgN^F zI+q^YR2A;8Jpn5;R*n-yUf2($({(hP=$i1VB(hPUgEF$2=jroEQTouB65i~kljN|2 zR-%MauM2@#N~_7d$nRj2f1V+=4cWKUQUH!j1$ zy=p8IbK1|Xlj@8=k#f4i4~A%wx2;${&bq@OIuhs;X}m=TMz@u{bceH~9;8czCZkvG( z3lBuJV`IQvJ|C(IjxMyMi$0B}xk3r_A6h3xWTqVyzf~{&_G|U$o11UTf`%pC-$v(= z#g&KKM|9a1#>-M`qp}-)+kWi4e+MvLc4ngd)NaELm%rw0&Nh|ye{a1tBpy-9;xJ6> z!Q0U*Ah6o42n5&z@RajklfcJ2dhL=_BWC~^7ioT2EWa&0@vAr5M13han%lgVh~MMt zpL7{2KISZ$a5b9^UXLYOF-V&wVLc5idN@lglDTH=L-&S#ZAz15fIm$ob1<4V>|EPk z!^2np&G`i;H+_5atHzyeFFA@abb_pfK+4~c)D^{qt$-rBR#zUvY2f)*mW#mx!@de% z(v})|pQRjBnRH)96_;amO^m*1+^mt~w!7S42A?wMtbBVnl-S)Didu53hvv4fVhq2D|WD zt{X`5oaBFeYrCGElwsak$324q#AHld3Z%a@c%vO`+qN*|IL1*O)H78W9M>6i*;d7s zt}AsZNXmf0M-SN(WpnnPniDhyrp|C$<3){3E9-TT33^lWsD86Uaxo+M<$Y?v2=pQf zykRq25E9<%@$JAhnKd3OkD`Xm{H|OUmVDT7l=rJTG;)nyKJWknXKC=J1`KY~BImBS z(B-5<^NHvXJ`;MvL8Fx&na z#_Q0ABKVGn@j4iTdY+G!SWmS4U_p&ROY3QA!OrqvYwLuo)tPf}wMIn|cxVC-1rU3~ zidtz%lG#-XPb*2%y;}Nb7l{nt{&gVeH$KELU)B~WE}a{Vo+dzwG?|OecvFtaSEM}e zHor(Xf8Ml2+p_7gP?(R#6keRemyW$^&2NcV-Tn!;|resd{bPy#4|o z@y=J!JxItYW@~haSl&5<^pFCKDkRbLgn=Xnozez~ec6-Do2>!Zuz+A{L?xM=Q_RU? zOVWqY2XJBU-pT&><3-pF5k4EqhU2x}; zp;Lv39Hh8bLV^A}NF?Oxm(KkcFos%I%LWoS2EY#tRgP?2)czvA1sq>>55!xJQmld} z5yvl=@&^w^2OaEjGvq}&hG-*ctTWR{N+%bQ%N;g`kvHV!M;I09G%K+lZ~3J{Orb}Q zeBYZR`WtwQW5PTOYVd6ju+8}dB_bCaSWgIhf}Ix29SPlJfbVUW@MpL1M!&lZ1j~84 zN7t=9k)3A}x&H4?uE|JJf5kZ)RMkKS7i>sDg$yju#A!P8bNXk=A}g_KXQ*Q1^bJh+ zF5)9-ouM*^M*^RQ{4|?>&Pp;irPx zRx`chr*fMTYCH@Pu7^9Za?Gy|YCX zd0L0B7Q?MK4pu6uN&spB6nvmFmQr)~rOIJGZcff9v7xXw$s2?fag{-*pw=t|7hf&mdpT=P+d5PmlwnVV6<)iesZgcKf?pqLhi z<~ZlmxO`fC8Rs6wwB&s7M;o^XwY9bS*JMo@$5laOdw1L3p5!{qG%rtK-$WsmW8G{) z*Wk6);zm$>Li@5jf}U1&ad+XA0W8|73eCG|6(0iGoMivE#(y|(Bq(0?-g2*jguq(H zHM=m`ivHLPF5(H&tGxtWt!f%8%ehGSZ86tIsM09DukQirF@PtXDK};T}SL<2UWqL;s8oKilD$Lf7b-V$SyH^o-kD3$WdwHV+51aLz zIz@HN&UB0IrYB@$Jx#Z6;g!pl{0hz=#QC*Tn5LdyfaC`WD;s2Nkh#~{HS(+ zPbyw%A+jrnCQG5Rl&vk=op9QG&3jt=jbAa8O;azC){gBA)}NysbN-YGr1-a9f$>FC z^U&|DN^Ri{l*!WxsJ` z91DU!RelzxY+J9G5G?Zwr?E4dHhtdQ@PYcwNgE8u(88O69~cWXHopE00i`j;=aBR= zA4~I%wRyF;L!#VmZ%TYL-qQxcb_*nz3$t^-$;4%Sa6W=fpU@gI%XPNf>dv2~vRN~kPRpt_pF_5@ z$@VZXQD2V7=GrjLnmxdeLFHW25(&d3n_jMzUO$T*tGW#>YVEr+l{4Py7?UgOZ==82 zW3}qg@GQ)(&S#gp;9QOB3GhIN7$Eqdfaz@$-KKEJ7Ui`;u~g{nikjKRIM2>%00I+^ zdTFcgUwvcpG-qp*HfL#|5{J=5LoIVN&)L2jhciZs=uC?p!ruN%zxjxa`wQ7W?td|j zl6>bcs7jM^;}}<@uF|NVgX~r&V;ekOiWLqisbh24Dka# z>)rbTpTfEQ55opWH)eTdzwxvb0Y;j-agg{y=_7^|2_5UsqMTw(dZ?SmJC0K)iwWNy z?hA^$mj_u{b@IVm{9@|qp;U&Afidx`A~kD4I3%AS1w#+8&Y8?aa8&Oj_Hv4z15v$o zuiRX9(U@0QNUT*o2Lf)O;wk*Saz!!B%&4jR<2tbSM;P9EsPXD0bK6ampQ4T3i}#JT zTQ@lB2zt{wvJpHeH#nxxn+bNQ5ArTP>HB49O+zr@#`5VDUvXG??7ryu(~UFIVhABG zvK;*>r03yBA%@%1DYsHCXRLNm2r4g4Uu`9MIF->DC6t)J9?qhB1h>K9rp@mrP_?N3 ztSsjvbcjj)o*w3MRrT8YOsGW$eC9}_EpZ^gy_S&IAe8JuvD`9*yu5Z#sgXt!cT*GL z3!hN=hB6RpN7z0??@%`-!SV@#vhDb(nm0|>hqZ5hhFranB4!SI;@1ARGYg_}O&?AV zDlH(03PIOyd}P*ab}d^0U2_^qlhq+@kJ3-o+|V~ZJ9|Z^LN@3=l2^(5gSfbE5>qs# zw?3<=v}JgOt7kU=*UHFo)kdgU1WFJvZ@Goct$;%dgU1>x)r7?9I-1pz##MtlwyM-~ z_l@n2Erf3N$9n66TO=QAx(oRxkmO70Ho*%9+@Pd>)JY}lrxgT$wOc2qp`-@-u2XFS z)$dRNb)#V3#N4tuY-4g1qD)1eX{DUPYp&h?ife@xm5SgT)CYy+fo~I`JYVp7H39wAfox+x_U!{)7?=&RuL9ajM)`U+xc;;0?a=vHJ zhs!F?zw72j{Zok03Rj1(b#d;i=IRT)RI6wJ@$Qc?Ep*aSU#Ks*;8+X6Lnt$ZDHN>*ScC}ggz zJlh6b`XM8#n18T)`kRuSTz~EUjwa=9sU1_oQ-M1>MXVk?-E_WwOKPU;ndDCx4_r89 zE@K+0WjPtm1>GE4Bs_e5Ldc)%g0B9o7L>1>eK;#O77*YbW0ZLG$;F zJoGS^&J*I2em)zdO1}<=w(I-Ym@AiPjEhEIh_K*vI1%_tsty}RY6bf|&afEqS6>H> zz$2qnAnv~k3v&Ey%^hMZe<>?YW>JL4Z!%BCIU58B<7p_K0{enHJGuwjTGCx4AzpAT zm11dOhfXvcE-u=OfLm*$SXWuC{?C^)Ga5MPQ+^zZ5I9Ur{p$dFN4j2V-cGirm!=u$ zh&i`7#F4F~tyDyRVTjwEhb41iKwTlS&j>gArc7<93YX|GhmC46(i*c5FoyU$O=NMj)noH-u~kfpW9NcSPuK= zU#B@Wnq{DlU>RKuc~FH#+Ny9%>vr|u{E_#odsXryLzY8eq=)LrahHvf7|Oeg7$)v5 zhrYA!KxK0I14N>8Ww~lNRz&-X*w{Y$nr9$eB|6K5*drC~BT0oTGQ7UH0JtFbN`v@x z*a7wizpGIztIh~VIT8d2G!b7F^UBN?M+sO%niWC1-u~kpZ`o2EbLoY2jMJ1`go)8h z&bNDJg&9u+nG&eX;Yk{LVu8WTevecicG+MSPiglN^OXIVqONhXIHeq-PV6-QI$>VU z#zP_SJNIA)t6%tyi~TlX1SdgY5w-gxGF~p&LurNq3zc24x5QqiC|LY z9eY&r@}Vsb@;DyRdj$X_KF7@k=E!&GClj6{-3L;qohS_DG9LCiovoBP?Gmr!&K=sd zt0&PjV+IwWxD*`#bn(@<-{eJ`H$d1ktPZS#`y&UQcH;}UZm5HD?#vGC^XO0%g*O(vk3|?T67dLi#yZhg_L~J;D73_jE z)2?wGIiyEWI}OXs>;^+5t(u&`eN*YaaWrQqR%RwAC0T@cid;q_|-I-b*R zSjI+Qre-|Qq1cLtWd)mw-2!ffk>g z3txhv4K9#WTKPvO_SP(>s68|1+=0eq--AS=Yk9eB)VPgICcB?s)LSeQZ5PMDFAfhj zN}q$4@H<-K0d+`jr+b0Mu+1d#ttXY9G@qg*ikBU7sj!<1 z9pUZcTMj%z=(IauXNDsd)J+;I?b>){F)P*F2-jmj}H zNGCtZ1ciyd8s;2G?&R?sy~1X%N8)(}aVdh-DdMC}aEB2z4Cqt5TH#m)KzsfC5YxymgkLkX$4aA4@gqXUV*+gr96*r4gcT5M zF4Y89bbOzZHC!pvmpIYXHC`R^@vZ#{o;JMeF-b09t`-0-t>qRFFN2SVWbcI z5Z(mwAFGRIig7oJIoQZ70tz13*0^yuGL<;=AP`9`6Q9DsN~ET_Mn_Zu1J7r$`5~9f@ama6A%!T%=Y_)wkd^*rn2_lzub3Unan&4YQwZAMM+h5HfFOUu%AhgejUAMK; z{SKycD4^?RbMS_@-D5HGrBhYyYbGIZ2fYUq{9OxzRu-n($RmMhpwEv~1=GCIAM;JX ztsFHP>uk#o5JHR{nohE1vEeUZy1?S@e~=AxuC|^e65UO%JQ^vX++sSupFWq<7taul z9pPUDA*E|t;&>ilFTm%E?QoP8puD3c&>W8ld9*$Xq(iKrH4(;yjhjV=M#T|gWpUKF zmstQ}yac04$fzK5pr{*2A+V!BUIIhfu&xkpQFO-YwJ)1~jl!sXtT5-NVb=tOdz zk9tJyjz>U{hsB30!?nD>?hATmK~CJrT+!`J9Thgj2wi&5KKPq_8-FPjd&VtyP6Kfn zC#Giy9;3dW7y}|OT8LaGCg(bdh0Yc@5sVi2+++;i?iw*}^$oSO=y@04Do}uBT zJ%MQ~gvgz*qbY`ZALaF8#(>bOj%w8h2KXDwjW(W4UHk0kZ&9JR-)!`<;o))X{b^Kg z(FASd+!5mL*0aJDg*lcennfbw=l9VVxaPZH< zP989$L23~uI?EevBAL1wh&_tm6mEED!G2C#Eq!N8wT<&fi6mCf3KyekW3ghiD8xcu zK!c}o;~o@0t^eW$wmw@0uP!?mgDy}q6|<8kqNfTTAaNF|n6bVF`b;3<6-o5oPyjCm zkpe*1T05~nS>$mw`B-X{RH6@VU?R^~d;!ST_mV0X8JWLvV09~?RE-%eYf+xsA9TeM zt7MO4Osoxk3EPY!U;H$%01Y%U?r?v*bRyJC(TQ9Rd2;cVF|W$V4O56NmXef$Ofvpi z9}rt2^+UR^PpE~4#p32;D_d+OX^bt(z>KzAzvaZB5*6HFt-dg=H5mbJbB<3UO=MRG z<2N%z%Z7|WZqf-ve~H;0c-Cm=>KuF&r@1ixa$a)jT_%i{y(POIwEU*a)r>7EJLm%n z_L8ZGlV@>+kxsa+qi*VI$@UXsJg50~w1ixWK^H672V_> zd5AM&g&R=Cl+B22(8sAUc}we~vO<=AJ|5+5Bqb~A6GiIv=be9p`_Y=|_AqlF)bd&Q z4YyTTWEjf^lJ{-Vzgov_g-$q?70N|;z!Obg`fsc|RlFDy^e ze3a_*C~bvVeRA3CH=Rbp#Ps##wQI5XfP-B~Rev(+&-hgXMg0Tb6w}q=_*Jj-h2PF_ z;A9GJ!GAlV`&3R&_EDplR1E+$`$`&o0Ac{G1GvQ?@T3mR3P6{DptR~>E18&096+m` z;(k0!TO6-r>-YI@;wCEgG-re=gx9oy<0@6ldOoPQ7|X*Th;iY}lvTc@x|Hq&2!lK< zVwMuorFwmG`phiKKKS6W(oGSvDt3K40Vm=#hiJdg8Lwi7&L13gZw;-q_7YKoMon%) zFN4Cf-zH zFHjY6mmL1&KSkdhSL_pHQU)%1tk~lkPU|l1wOWhLwr(0zwm`$mVpO_!gzuU}{do)1 zqsrI0Fwqd8v;?VPv?Q=mOPO^>rPd-)91 zdLp#yy)t}?P&WRsEn0AQ=frrV6fH3c$_Hrh)py?D5uxQqP2@#~`-W^hVCWwQqhYkQ zBvr5`>!xYd!p_1dt3+SD0HKd>nhMB8o}K3)h=>limdftJ^3u>~nDN-p;^sAksIX(S z;>1rx=0y!2?#M=pmoL^7@E+cpCg=ASBmVYch^jmruWGM-9k}H2qRz2*=TpN}n@F~D z4Db+{3*4H?vYyPBor|nzUA*Skuh>5%&1`t51iop^8%W!?MPHd_**SKsafh+BQyeNR zE@=-TCD%L_`$a=AGW7~aD^BbLVhyyE;FTV_|9au6;(4f`hx)h=ImRql&`DT1we?bJ zF!&0OWSy=}{vvP*I6Y3)-sde4k^h@!-OlxQT~lphTg;Mygv@qj{_TQ!}Pww($zv2hX%(Y%K zh=LgX5z`dc?j5`Ma`=G+OmAC>CO=F3JzTtq83g@DPs=i?0W-|b_&Z%ewesk%hm&4A z)ii4N-%m3TAE^Rr%}(b!zfYyMF{YR7iNw9pBLcJir0EXJy%mZgMiD%~0u|_`JN12V z^y<=;hP6UFU5^(gX@P2Nl;Yk93i&50SB*;;fQf1gvfG&c^6 zCLhq@mq|Q>iyP5{p>A|bk`8XSj0CpzefLct&rY6mQ*A)-mav{~9SpnUVOtsBe>oda zqg>%eUZn~0-@nvJzkn28KzN}VxtuMQay29`968WI<6Kodsrw@kqd<&xrj=a?o%5G8 zn%+^wQ+;PA$45#g_$XU~r9U*F1lUU>g?a zn4+gA!liJTO{{x8CHB>{-l_ry5K0To~aM#lvqc#V5QF*wj zwy!lnwgbhEX*?XG^Hs^xT2qY`5*!#bAy$E%nZL!<*%X%vd_$ZTSnwb$_?Gp732YXx z#pz%&_1GlHl^+G6qZXh?;X*pB7T& z2L_qa-T+qa7-GZ-)(%C z^U)e|iJlETlw)F@N#tdSDD?~w{-~-E?qzg#yMT8xymh$Or)-E7`^ z79_-}o-k}L8@UjJTI$3dFx^l2k^?(0=VZ{@7{o(O?hOLBTqo4wQy#BelzAxerzDv4#JZm;)^2~q zi07cDK_*M1{(mL-+#|PXA~IsNwU>x&{!-%_1qwnW_tUMp{Z^J}IuOSAMy%)_v#R?U zn0dI~?uJ7$BzoTXCmUOG+X{lL-rGsuVUXj(+Y^yePV7Srxf^c%4q+7r*Acy3qKkYK z;1<&`(hMB+q(TZnH|d|!3?u8o9LKi@EbWJTYeY=FSr7OL_=OIqX+LH$pRNZAPT$W- z1ZrdN4WX#zE7J#vC_#O^HK~pOZxoe2NH_15(i!69!3ZYBVsjU*u+-Vzk4QNl zPzyBiysRJ-WVDb8ei^q|zn7|v3}?UM;0U-j_w&|>#aJ$$Nuj;jEMWZA0Q$H^_p}+4mnL_4$&<+y{X0nVGIdY zbze1$m$fjXyVmULNAT~e6tl&M8wCOIVnO z??_QNdcA}R#9AmQ#`8S&tW(tzOJ=vEcXHjhzMVCqetN^@Rfc5k1=DhwY|A$A;-gOtXF|cl|!1DqdDoB0sb-=S?<67d4CohPSedPe()LN z9&HxE(9UcBe5arXnW&zZ+IUo&_Kpc z5<355EpHok`a$0*yxWT_xYJjt3gZ}yO`ABQ{S>TXViYO-%R2|UYb}+i#?DKlcx$`b z6C!jhUTPp%q4Jg`b$fcNSw1LtaAAg!cTL!;cuQ^;+uw{M&_4pvWGx~L-DLjoqn5SB zqK;i~l^a;{;{p;|#$u#$il5}e1}xBHpHZz3;fEkznH!Vt%e@!&!ZHmT1mV0FjJ&kU zw!wQUM&3*UwO~;x_i+Q;&>D0;23;h#7e9vM7D`_O`Ia(Kq-Ef@<8>kZP97H9H!3oW zAdpJRdXV*Y&MSRddS)?d`N48e(i}@48vqGSzW*~od#^@!Ec#gIW0v?>yhH!2Vm=}` z+pqC-!=^DVp%GW{s@BgPLV6WuOu9E8~4qvtcdh9|56i`IhAm>yn=qqQSy{J*G zwt!m!1_eZU@rW-GXbiFl079%b0xD=TvL%@68!XQ6C22pDLk>8Z9V+9s^ ztJKLw#wCuCeEDuzyEJ_L0S3c7PUk4hx)_5lqnRrg{SY*-=O1)QbT9oc$0NHh<@IZN zhHF+S@D7ffDLgkQUr!K6dkP7&@C#{(nsQ+UVbQ1rlmo+IlJ!b#jmK>D`Tdu5OpS0w z7#zsAaEX&~9w|7Na6{EnIa@0BB5%xsLR!IXp}#Z-6N{D$pTL@^>0=58Ku~g zwq9X*H`d-{$prkN44gv)OFLEfQ6NA@3G+&53w{5dLKs5j73Y45*MfZfEst;!kws&dW*NCE%0Itx~P)5SPz!G z(c+6cGp`rg7SWE?H=8U;;0#m2?oDb85tOg^p|{vDZ(FZd^(H>1V^i$MvL>yqxK^pO zNEa*8sawqx|9+D=bjc3uNx4ZDdz-s=6!2GV!qZDEH!UKHT>Y-~7^ZTzc`1KGdR>17 z55YeG(&KwcSP4#?zC|m)a?z8z<rzETH z$dA3+bNkncF`WV^syWXnt&PgvuyPlQcD^FBIb;=+i11@6hZ~PN^N;A=XT!)6QY%O( zJLm}lTS?csAF=6$xgnx2#q}qWCm!Cv7E8I;k&40iZtP+96h~krCmd+8;hpaZi!<_%q2iN>?G@qiUCmmp1KhH! z0rBlGGX^WOiKABw5i3&w0-j(QP+@dse`TRK&wl}C5V%1cR)Bg)?qFMc%(3YHQ-9UU z4DUDRaNkVa_B;MNYdyrVD_6D??lg$VA9`Nj5Vh^Bq;6G*VJ!1~xCCOMfrS!OkCOqD@ zzRZyr|2!b1L)a$>+9_ovMlI5enfa5 zecQF$>_e%676VD~ox>z=nBVFBIn*|8n}dSyrYd*{;bDMpZp}_MiYzUH zt2dDR7hVvU>7xRE%PK6+{P(6;`biQexMBfQrLd+F0?S>+kmaK~d(-$L=v?t#O-!T3 z`7yVqSs0f4YwRkK_Q`6wfyFaeQBc1^!7%OdIR*tScLmd>*kc~ZK8?!GT9?z}s#eQw z;1-cJ@=j@yKAS!7TXEvZwOriH9yXBGUbW7Kr_>xliUH{1Wh@4pDX; z{@W#dTN>VCT)^=1V#M8{6E{GzO*2pKInbHk`9cc;%3y4;B4ZP}_;RrbSUQ%3O;MMGt zmknNPVtdu04;l7oQ5WtKMsPxfm;5_iG8*ok9Ih(!40Abu;8GUT!h$vhIo^k;Co<2Z z{4=RF4OLFA=o)C(gdTgXC8NLahUY5K8K|u~r~wWpNEbmq3!-X~7IC_1fg5LQMdfqk$kmg4 zp`I{o7#Nf%aG)%^?kQcwU)dA&%>>JC?nNy-yjD%Bgrm!EyLNT$j17I*F)=VKr21%h zmhi^+_z!l|$4QR13Ksx#zSm@-PiTY<~qoK~->T^5oLI09u1Pg29G`}O3%SZD+ZQrhjjbL6F%i}V4f&ze0;25Hc5VnW z*>;bkjF=SaUahggezNseBZFp|l%Mi&(_?FErH)s63WzZo+rAm9pHZlzqYW0@u*N#bN-^IM##;%Go~$+xj&j#f`N2k zd;VFf-meNICxS1A8YAV-NCF9OiQN8=rZ})63#yZ#K7Ok}mFj`|c%U(g?k{c`p}6jyxZYz$X9vx$Z+3ZjeFw zlZYMbUAWe@!$IB$23wkq$`W`ea+b`R{8k`0!B~kTy!RIraYm{GV#4fuH`yT8PO_3o zO-v4=o8c9mw%S1TNiKV0uYd7CV{IIQ#Q|(Qd8M9OB-eoP%@?Sjxe^G4@+Ci4iOb1; zIHbxWHkW&&EO)lvSyuMRYOR4~!N5wX6$0;bv-|+NEgug{f0l;*N^mzIGLGRd3N)2% zBvE>NyK^pay-oMDUH$Li{x7G**5*d`*R9=-G1yB_ib&UK-?j>U= z=q^7AMACzK4O2%^#ld`6xv zmCjou<(;n*vi0p}BlnfqG2Y`UjP#fP=^A6BObl>H&l9*We4vnS@Yh6`RpH`lwT*)^ zEg+R%*wO;~aAf@Bmwnj)X2OiPZP20XAmku?j#?b-h*iuNd4DjPdpA;1p@=WJNQtUuJ`E0&>4 z7H2))F2eaM>SenJq1@?Vbi)|sx@t!iBeOm&Tjx<5n*C1l>h&dMRcaH4;v=`?wuACk z!+P!1%1GPzSBRA?gd@AJ$@xu=i-;093CZs%TH`0j!<1Iy;*<+fz(*)! zRfG&CwM(tU5-P$26%ohZ`$0fR9sPy+;+ce@7aAe+2GwH!w`nP$PEX%*$axS112|o(n8OYIIF&2y z?~Yu&>%t+!@dVvBYu|aXj~NQ^pz4vgu zq#>k|y)VoBRzwNTPb9+es8S9r0h=ax85;Y=zSnEN3i@Xc{OwLZFtY(Iw_u6!tZPWbpEQ7EV)>0RjiS96I zDDCNz%})*4*0Yt4=u!#&k%`U_7%@OOmkKVYf<=~(e3#Ic5_#jWM<$!(TK+5k#Mj;LGz z983zyIrxn;cu{4COLBaQ2hfkq-05m$8B?`m!kE9ZXwzzHIq%=K`}$!Kk>&l(C@Cuf zzDY25KjXeG(!=NXj2a4Z^D)M#)y9DFy8AcQwMSm-GUutEo&Wve;d15CNIt&2F)i*k z`$Q*-k0h5Ri(n6Y4xfpmp&>%doVL3V?<}sWYID`IEZ>;8a5nw^=GuWd%mmfHD_Bxp&5eZhlm{t1DKk@Bqa}l!2VZ4i>Y@O=bcUE`ID+ z-Tx;yLL0Tevw!jZAda$24=X_0d{b!C7@q&z9&+n|ktCz+sz9jFwIJ6?xrP*7NkqI0 z(^@@@#I32(yl0R(qbK9>1pn35xA zvZit}NC5l2zeZFy z+BYlIBmQ?ETVYq)_PtU}=21-MYulg7+m?-N2v2Uw{|y-}<_)v3aD7~g%Rup+_#M|2 zPo&-Koj?B(i-L8-75HJrW;0W6_dyE_5#hdJoyssh6QquxMi-;opg+au5-#$np5d-)S5CJ0* zmtRG`+=`5INZI*>@0DRqOQD#p0yn*Dprdv$g}#T|Ya^=8ktgFn$i}#yA14|RoA*uX zdl3Oz<~+IdIzipR6(T*cW!AQ|6}JG@EP9_F*LjqVMNzS3935CaW5oQp`%o1E%>2FL zT^{%hTF`_w^$m^IAi%94AAHhkzW`?rN8WcR91*EOa8toP>Gd|B^7|)CAT_~Luf*^4 z^$NSoU0^d4GL15wTrLy^Z`Ai>P2$jrATWm$biW-IGEu?k2lEHc+J(9hlHlaLm^1IL zT^qM5?1=7HNRIo<>r`59Ng)={o#%KQVuZt85T6}A+s@^Zv5-u1!ky2^HVh)zrRx4^ z$hLQh1Ghm*yP4ifDW#^4A@;E$ zASguvl0bq000}tV`VnRScfAY3A75VNHe7?BS8dK^8XbOUp(Uj8;2+NTR$vD3qQ|Ya zdN_xGkzkJ)1pCK;jLo2(_{)Q=7km@4DMt0qPPl^uD>HkDXhB_kW?ZJ#Dwhw1!RrmZ znK*IeWDwYc3BJz;iy60Y+~XyKmvv!F2IrJRZ;m?l<&R&WIy7!H98f|m|5ul&xWW)Z z44|9;E_zjwQ=`XtqH#V~OkKB&A)m;)8YYsgbXk|Q^fb>fqT_ymdKb<@M%#JA94x3Z zBtr(u@5C`q_R+p6o`7JysJz~aCE|e4q-^Y!Gy9*iS$zx@mX23~IX;UC0EB^*+_A)} znzL5g0tA_7-*8OhQ8-inb-i9=dp5|O@v}{k&w+(b#(7svAyn8>u2|01kvxabW&Wj8 zeu=N9EHJz+A-e*5wnfB}{)@eaDVXgbIf!QSGYm|ZEEMWtPz;b|NU$T{+*X7EpAkUW zS!Yc~8kPNk*r~50f5k%VoBuHQCu4jA9{|&L7Jj|(5At_{K6zW`6F&8z10}Mwikzug zYXx6DFf&eaIWZ?%F*k1vm%?=GGy*rd;y{y$V2hP2gAd$~**qz*&=s!q_i?q*z+mgG z1G|g#qgCK0Ug8Q@^g6JB@|1G{n1v*(86W-)UO?du?59i$V|PJZtdbows9h=d#CYB{ z@@6^S>_YkRj8V0rnvq_u&fQvRDBSSuBw#>mEp^*h>jc zHK*@!Lu{GBAW&1$zwr)t%2aLPALO4<`0Z)znm*-_ITK1;QGv$nk_HhB9PZ#uCHOTEcS>J4;^6zgU#G-Pw$tt(8l6Uo zQ6b#Y8&<0DSSh?33`|C$56m&LoQh&25ftv!y535u7w=lFJfd~o1FvSXMdAQBd=vRq zMivb@A;}H7qld>o0x?9#k=@V=opOEUALO4=1ng<(#(l~mxfTMqG82@zzZG>)BL`1= zW&9T>%Wn?{CSgJOVU-}SW%?I2b%=Zs3jD1vX+;|NAtNdbt(D!y)#jkhCRmmy ze$@c%9X^%ub56o!VD*&j{XLjSlj?%JMX06k2iP^&P;WHd9{bSTW@5(kQGQ?6u^Ubp zy)=kFLCiHtW3&i#E|!LZ^Y1U$>OIxxSY>IR;&o!i*}Vd0cz&DnI$@sz{bhP$QT-R( zf$PWvhC1F?&*p_)k&+;}T6EsJ!Uz)DP|xoyjz~X{A`cv*6d_z6fD6t`Wbqzeq;bZ> zw@P>96uZmcO9yiHv<+#zk=y0@T;O!dcaX@TY5_amLJsX$=cqnKrB_~n0;iv8^!}iZ>u2 zACz4=J9U@f#oSsS(Vf}w(B9UU*vwmkzu`<=;jUG@!8`3pyS9=F{+4h(&)kv(N|Nf; zh@b=Gn^O(uzs~RqQi4r-Ug~G$c|MBM9ij*as(PzM?0ye?Fkd69Pf^*;(8B0Mnp$Z+ z*plW)5hebb#Q%{Hs{p?O59SLXrHSAc&IvwCo4_Ix4LD~QJ#mM8{Lm@yIa3t1o3C;L z1nviGPyKe?#yhc$fcH3_4e-<=+NvPLTYocNHpN;&U{+p@b_ z2bVpJ_BDlCjk|I_M9a|}sQ)|cpVJVP54C$TQniu7+no#i#Jh<7=2Vq))eJAWNlu;*B@;u?;o*TMAC@v9`?1P%e&BnPPu^{NlwpXw#mfKbph-M>6@UERyp}k zH5BA0-Og|W?#H-t3$YP>{*7xnX-~Ex>m2*C;P@~dHqEjuPsNzmN>0Ek8CHVSgwXN% zrq0B%x4uJ!xg=vQDS8*@>yP^s%Ky1AbI{*KX6w-h14`JMH_ZY~8MDRCOpNMC?Psh* zm@=V1SM6rs3^Tj}(2o{-s&NKAXs&`L&LzBBy2rJsKDLt$KlN#vZ0E~r9vS#p9W_I%!7mk zH5%?ZjqV<7_KCPZQ<+g9v>umW%(lD%ff^D-fJ!Ln7)7f7%Dg2TonF}Df$?e8HY$z3 zg@0SeKzF^R5jt;kwuEtQmLW-x7 zYcV~*iTR8qXxZ}zh%69|$2;j`Mln|8lZ+2gA0Ozw!;7O>GJE4-&&fUrIEWTGRYxw6 zOL0n+C=HmgAcUId}q3XfCnh>2UYL8+->&-k^zWMIwrwE;vB?twm`d0ZU$Y5 zZe~n%F;7U~&YdKva}>9tr^X{iy~HMHAE44#*L{bF!2!iyx2g}Tb#~x6EjQ{S724!0 zvh(?F;9C&W`%Uyg=oGfcv)srZcKEYuFM})#F4bS!eWeH4xjc|$4ep2<(nGbMzaw|}#k-429(3v4k_N!b_wplSAj zc-Ehv*Pm@C`f}Y?xcd#+p_b`#@?6Hl}D1~y1nZ!Z5!`+`Q5=YzZ z_tPKh+g)E$J93Zk><;d<6*O~kcNcP1uo_F~y?-x65T4|J&=!Fm z*z}UL#UkR_xT5{qG2*dEp^7t^SfDKQ3D(9-)m2b zluOgTEd_SRtGO4MqFGL)*8lKSv)|aN^^+=(PiVpuEti-0Lc=rpD1T~}ALhBwEcg&N zA-yoBOkhR;V`Ul+GV`LKH=#CRFf5;59uHAHK(OAPg9GY$otsQ$-`Tr(ON$;W4bU?5 z)dL{<`;K>4qt;k)^?GwAN+`B>FvsXSBFc?+n|6%F7dO+L-Zb~6PTV+`wq_YBQcFT^ zTZXm?4P$*b7qKiX%l+>WrN)P+h37@-ZgQHfa|2mttYe&`AUeC5ZJ*;;Vx&y+{GD$t zwIk?ByyE90Aoo)rv8f}BU8_`Tv7V}CN<{<_sWAqe>S`+In}9sGuq4f*eLr*`n-$FFle06y#dStQ4-bF)9$%2+1mrRvS04lPrZgAC*Ho z@wSEl-Kn4JTfnvbmA3egrw>3vr@T3GSpY>qy1zY-qpy7tYinX(-Eg*&X4ikcg;QcW~H%JO>Hn?fN=Dg#Dd%6FA56XZ1S`}ixdlPGK z9MVI~lzNJ;bWNZ#mqIx6mL~9|<7-|JgUJBM#Rdd=yUq{JsKj74JmHZiGfA~dAjb}afSl<=vT5I zd*xSgQBc>93$nQ43vI75NQo|4PGLU-$rD%V`4*_?)Pj)xmYcM)o%He8x77ZQO zg!sxtgTeG(s)NT}cH%h(*41<{CyhM*ipP&A<>k<2&xl-0;19~u>7J@Dx9n7!3~UQA zhWgw=)=hYr9+?~Tl`+Z9gxVN!3l>8P_gheGS;NPJkR@=@5_RmXlShCgP}lQLJLB-X ze5a9bImRKoqUf%<&}=fIl9+6Z^c+O{Joji2Wu8%T0_hzP(O{BzDDU?~d^bwQd1lV{ z(2(SRkcbpqi*Jp_ijguKpCzCFL!uNjYqcq?@?uiDfu0}9q8b(s`LHq6XD)8U`jE8J z$og7_kihQ-bfGt@IFTWcF-bftQ}FkkwoR@X_FCSlUA1;eE%H`% zM_B^62Ly@rYLwG}QnE(kRj-U*q>_FXB7Cm9yPXivDLR4FP6%l*T0B(n2O^wxu<)B1 zb_bc0d=C*(f~%UwNURj07|{|u&Fi;|#OcCGER+3Hc@(XH@pbrV@MYzZ_n28PPtCm3 z@3XoNCb)vo7nv!G!GrAzq`b8POG|*1BbG^z5DH{%RrXk^JA@CT~CF^0*pQ>)Lr13jzjwiAiYE>j+f z6i{|Co0#>0r$r;R3ejPk+f1XH!6NMFzcNKsWEe9w-*(YI5L+Xq^uv`>D7yzG~}9Gd1BqrnzA`D zd`<->ifd2+)NTPCtH^)`6y2nQ)^|CPUU{gK%e4ZKLVE(GXDY$G za~VuYQ)rHN9lPVOsgLQgsl0eIS^&R#Ijd6pMYv+$G;b>)Hz}iE?#$DRoH(>*YNWys zjp<#C6e8gHnAp{iY*53}Ji1>|`HL7P$0;rqT(jERJR=nKUI)e>>`)*wU-Y!4jSVk9{4$>lhh*zmGN+3i<#;%xFmtKV%v3mWj ziCvEr9d%FB`N8O-qhW12xA)Q(2o7OA=XT~DYM#;*dH6BipO4g1t@Af3^7&1*S!5X5 zQ5~jWtv{O{&wcx+$IDY}=Qx<<5jau;TMCAo{Lo68tUnz7;6E8(iu>*_WJ#dIFAmFy z80bA1&j?OoJXI%g_+Ba@LzddBm4It?YZw2pO@_BB$xsl}GstLM@ z;cfiF7pLw|k$Awk9*-$AC)gy71n`bCP5<&w3x7m#SPw~dWq=~w*>+-cO-vxfSlEUKB&1>isa0es5xD>OQe9(s8((_shY>032tLZP)z~2z6IvPAGrse5zWYJ- zq&HvVby0aJLh8t+2DDZL9Z)>iY~m2s^Wnp3g;0(LQnbk{`NY1`#F%f2Pxr1Wl8M-%lUhIoD@nO)uOWq3wdPuqqc6&i^Bmp`w7O zC%yIxuUkm%{1ph_@V#&Rs`)hmmp7+l=o?zo3VS`TpnpHXdM!2RJj?y%E%IoAJ*>|I zqJLN8eP}i*;&CDQVxkXA6|opv4~n0F;LtyVG?tjy937qRj0{z!`jj*-(o~*IgHI3k z6`$q>??Bdo!u}~lUQC2xDUyqF2-YE;LI2D=+lx{B?{7sfTR!IOMu)Oeb?V1uLX9kh zGT?nR3YT6O@s&AJ2igX%ltl$Xtjg^;>2NqcN?R4*@PnQYRQMrTj1flruEzV6FM89y zYs^Mw5}-5F>2Qnh%S|kDd;4c;-%z%>F!;RMme&>5@`?FBRGi$X9Bb$P?LU}!)3dyE z+E>88vM#@fhw!fWzd!^qRG)6sg6;VP0t^4}`>%SZ3CpRV%%Td4t%he_4L&^7mw%cU z%0nC$(|>|(<_dM9mz&}hhSFw#{+V~sUN@dT)DZjV;L8p$TahTUlk|1kKuOfpVU zljo>kH({iSH|7Wv`jbH+{S{ID{p>97yXGb{5ja*(1$hG-#awX^3rM=%u7K$QBwe(j z1om~BWqL-6vPJNOk~sbjDFWYmM$ymJL~V2UG=ZF>xDjtojB(8r6>vq~+AFm4AhjuQ zOP}8|V--TrBg%=Mv59CPq``;!WtQl%jr0+4uZ4h{hc9m=VvZu>gelw|*EG*eT&`h7 zVT4uvy7gP+_^K7~#_L7cQSO`SSZTwZinnqQqg|$^P!jSJ@o7aIz2kfDWs8EY~#9VTcuaH|KE>w^Xi+cHYIZPW*{3Ll7kT|K)ow?~NFfxaI@_M6ERr9XZiFHo^#(p`~rfQS0LK(T`2nOIH-jCAp9cg#9woQP~n3ed0w zvQLDWaL-XDdHqrF+6-TV6q`bkf9?x@4pSGgZs?9^TWK975?uu@F`<-EJ&iQ(NjB~= ze&r9Hu&}Q={zboskh9O^a#&Cf2R53kZ`a?CWtE{j{4Y@RH~h^IHKoNtOd|I6<9mCL ziRiOZi*EXU2H7)B&rIQ(L3{l}|^BK_d zA8lK4_**!f%kt==sr#LJF-0fOhFU8N;#eAf?A}W{%Dix&g4l35+i*@_a#bPap66sd zknb~|Y*QLTZws~|sgVAYUgpcz0Ynq)gjDHLBIrp7NXAspDJB!j0^EA>CHyVweEXum z)WgyY%M*1vL^Q#x!h)}r(i>U>lv)75QY6eKyrMmEdj1pJBnrd#czgs#3aiKFF zbq9;0E8UL?J_c~xcW*a0$+0PF^QUevFg-V!YpkxId9fZCP29^LdUIF`2!hd}m6$Yj zyW$P`oabpyU4379i5ysnF{j+ZY3(I{?bf##zO)O=(n(q0SFc;B)7%+SP8yxnu`e>|lpE z*RmF~0NK^%;^offrP)ZO4~gmHn6*FTrE^A>1ma)baPdIDr+`NL>*Tnu6q5LolK5)c z@7|6^Db{Z60K$-WA210%>6^;gkbUN_U0iKfaA0?O!|iK$8t*{ z-Iq9)0gJv%qLK(yF39wjza{Cl>aAt4$`ST=de^Nn++In-&PFUJzf+W+5-#h8IWW=G9Gw0l!mC63^uD!lobIvTH{30&8hraC@E>hcb zmnR@?2;3Ukp|C;&{Fat_K*Qzq?eUO5+)06%0Ibd1`U2xBoeTdH)3@Ui4gd&JV19}Y zNWWyrSW=jfHw)T(&5A)ZEXuqV%om90`V`gMH|e+jpeu|0$`bBlnlMFk)Xxufu-W4m z1Wrb;UAdfFZ#_R(nx%eT10+=Vc)I?2oXDFMR`Z%akCtoR54^rp*gvocimif35v0l| z-1k3Jd4p2~bdbe_aCErXp8~R22Cccx>Fee07yWM4f&e~1V?G89g8iXO==*rKDupsisMH?%w0kJe#_5a8Tw--8CZUf*meP~Lfv^)O*$WX} zuW7%4ncM5sz{v^1EyD_!W(-FVa3l~%IEe&Tj1@YA_nQGayOa4~bV3IkT;W5Z{vEE) z9C64OWrxEA@9=aru8IwMa^hG(P4kPb2LeaQT=n`mfvHTmPH?8(U{z3Bun4XWsdMLR znKnS1TFR1C8u=$enSJP%i-=xFcA{PrA6H5s?=+R%LpSe}?L5)q8ONv_`=hbA!fnqq zR%bdtR&Y*BDQR$FyUMYjBzJhXKzqxPY7w@iYRa89fX>bqT%7Nr9?Zl$K+F=LR_Bl# z=?e@=#BhIDxy_q-LG}W zBhFH&jc=H%Qe3EcSC0ywM#hqi;N>}PMVj(#cRq;w z?X4eJ?k62sMBPw!0#%+!0*?rr_jKE>CEylEB0UQ~6&xyZiF9E-?}N_VP{y7aiiJOKK$-G4l*Q1n1nChdD824?{E^-LAdS=B@e+p3*=!lASV{M z6{huf9sJG~G>b8BT+3rtOleRBRs#Nhq)Nw&ZsG$MLm(RZstR_9yCbO}1-V4?c=Yvd zW{E^cLrj=7*HCtR3_>>r&ZhhMF5G5Q>AZi3dXh2Okfe4|)t>eE`WDhA?k=T<6vf3j zeV12uz4q-4A3HNfEqe3rMg|tddWb7ap0vFYJ_pf;-;SGqsN2F0`>(8CR6o&BXABtZ zaTz))XWUztOI{~}h;KF=U*X&ePDL>AMv?Ty#X>9e_HNTEt#7pdvNuizNWEU?FMetV zZrvY7@hkHHICb_m3$OncyU~?$WszcK;Bq%e`bIDLKH!n(X1&R92Nd*p)S=GS>;Qos zkz})`*DP%HrMQ%=3Q}i^k^gyr1((EG?zM19C@m9&Zf}} zZ{i2(&CluSXColJ+u6MV?x- zOMOZq93b$Li(H}1k7+>E4fx1HBYOf-ovZGHNZ4Y@-OdnC_T-^8%Iv(&wG7C^SlEK# zaW5aj!|%wLQ!~S(wJS4wE~3un#SWq3QORH zMGluq2+ur0`@E8ggGRFio1DxjwnQJCe@8HoHl4dkf*4p z1M!BT$Ian9C{p&>P>II&5Mc6%h(ftRSk&4gdJ2omnI+5 z73sujmEf%^{*iy=GR52%^MqZ9yu0!__mH9A{)SeG#$DuJgQS;T7$2&}hy?cNInxd1 zddd}rk0Rcx7Th7HUI_};iq`G)XZ=^_O5a0wt@ai$OD=P2FfQVX>qYC~TDgg>ugW*N z`V>`XErrFbvj+Qow+Wz{FhG#>4Vip-EcV2gX}IaHTHS%q-I)Z%1A&B2qof#h zLU>%Hq%xHt-wvfe9Bbc5j3r{82yvI|{?@`0uU8UhH~K#4OIS~I?*4}ispxKC61`m{ zFlaYyNR$H0=f|Ge1$T8hqvE!~cXvG`}3V>?Viz{U_hI&_JdSi-IKGf3#6^rXZdNdfJRVbmu+eY=DzzX}YL^E~Y`I;h(R ztKj62P2V7x-+wN$j?0%7pAV;&?VQobMDFCM zsfmGZqr?j;Lg>eEIa@7ijL@OC0OM&<0*dhBCEtRK_*wF!de<>5y(32x6Ct%x6GO&c zrV0u{!E_R6YunrtaKja0Xi|?a_T)^~hD1Ka06#hjp%nfy$iT$J5RZgx@syT(qw;Ey zQF`gyO)bn%&=S_{f|3c1DE^9xW$+E7dVsI!9^}~~+3^saQKdgB)E-5_VJg|hLfSoO zXWV{hOo7~M+samOGYV)c(_E2NXeLMo1cn7nV7GxjEq(*zuYv2v@Ym+t@Qr>}Sd4t( ziU&j4-0n3DP)ER1`Wv5>AM7qOZ|-RqkU#^YIibYe_~r1KpU% zB-t8;zZUByXX}hH-~}^3NQ4V%#bw%JMZ!mA2DI_)8EYkG{_{ugCCZpW!9}X6u)_RM zF$ZJ%FKN7pl;)gy)bYZI>mt|DQ%skEKU?aVWQYXhb;kS~^u%=|ad=bvA^}S`?mGS8 zqrYVbtCY-~k-o|n@YfFBPb?JJhNe*56qH*a5*?eJ#;SqoNvZ*4L}MDr{la@|z5;f_ zzNuN$hnAXFTEFsM(_*cZ4!@$+Uwwqo(-!52$=gKyV_ zs0VjQN)H&x3xf-Ep4k3J?kMT8A1D`O(6yLmXt7U7ksqSEf_Bc-uu&!5ROs}`DB170Gx%4$G^<@hWpLdRo57z@y4P1S1X?JZx%KQczbp}nzU#(>{90)j^#9}SIF?hta)W)+%fzD zmt~9+{ovj_FwS=2mLA{JIMJmn9 zOPPoIANbN&sK;D)wsmEdlmAze{IJ0I4Wx4re!4mz)&~+6Q8D^IG_T!%!Jfa5R1vR6 z&pWOa^uWGy;LD|Qzg8&jNfl*rXG{dL4WAQ}T$`>FCJC{?sL(OSqR`dABeYJ&$!`HC zr)g)*A-Mn^LRr&-gV_%p&G?GfR`);Np%?#iHQ{i;@2&6hmm_a{`C8-Sqg280Ylk+% z3G>E7h>KqVcm}kj^@^JdE(m;3?klwY+bVh=IaMpIgxX~| za8`IJ@kPP&FiW)dzXojxG#!6QQWJp%~N4d~L6OG6tyhE79HH@J?D)*xcWfaWleTjh^84Fzv}?BxRM z>2R9@Nwjrf)tLJ4cg<<(qS`9ayy$?Rg`NDMxl&LnSLG_Ob#)T(eDy+(^m&HW66Wu2 zw@#mH{^H{7Tbkh)lb+@k@=yg?lUZuW{rJkBB(TUoS?u+Q0;3|pM_$Su7NP}`*Kv6g zp_@&J=Ubh+KvJ7^HoOiGf+vNLbmim$}1J)rCp4kZ(`LY}*RzETWGhwBL*I zAQnQSjmUP>pze!83V+!urq|RFpIWGA&K+Uki_-9hEueb1eR27)Lnlh5d6|;o9}kmO z`aXCF+%Hy{ zJ9NBMT=*AT&MHh=?f2jwaPr_npos|pf`wKc;+xPeiYYLMX^%5aYx;B0>iZ~Q^C8pN zPvVF?izs6W)>IljUTD-!#9xBPrGNC7B=C5J*^N$bGjm3W5Do9ZUrncrP#$~R;jDxU z`iu$*U7)aI334yJfTVtsMDct+y&&c_UJ}C-V)hj|A~&TrytKss8TaCdz44OB`<%Bh zN#B**7YL0%WVF0-^lr<-1O!T_pU~#dCLo%VXBeUFQPBtbaTn93!$*R>0K&`uD00UV z?VQmoS<#Xbl1boZ!c>Ok-k))hHqBFRT(bnxwt`hu?Z zrsWTo-u|PQqfIOQ`tv}ES}L(8A{yh_35k+Pk*T73;c1iLM@f?C+0zn{|PO{;z)tdhD*m;oOw7kLr zrjc5gMuNIQ>(k}abJO`t*;c=u#R-kG2Z^^^H>o!YYdld(P-2Yo16tjU@$wpdzziJ5 z`hhW8NIs74yIAfaT%Ho)GTZR0bxDbMjF5icV!+1+#X-Qeko!xk@{ELMmCrB($zhv0 zD?$wEmJ68rALd*7fA$E|N-jJvePd-%zRK}h#oT{moZqkCnOM_?6gj=66(?#&2>2FrSboywu44vBK)ZpL5r2*?Z{o6XV9wmSHx^KW0OgRhdV_5_=)DQg8xOoC z&dM&BrJ@_&vUL;J-JFn?fuH{NlLjR^-FscU%bg(w`4+NAeZO6OYoKkR#SDzaH>mRILES1!1mbG-5#cBmpT1lrIGZ%7U{4;3gZq6j0Xu?YDkS7N>#s!4EUwcPolyj_xjg=q_n`> zO7VjsA!V`S0}TGpVOs2zyR<->;{PrYCAb-_88J&yceJ`FcrC9t4z@i@^jRmBX&xEt zC+}#r)`Fw3^OfPITm<%5^97oxU)upQ8YsvrLFV)dWLF(5C4pZ{BD|lUte7B7k@%+; zig=#1TXHKgb+PPWrZCc3b?lhSvRIr?5Sv#qO+6Jn@7^L!_TNt=x|f%0)2d15moSOh z*mHkKrGl|$^M8{Dews&N*_=rQE4PtDSxIGbZAJv__T~%3cj9h*bW1&c4eqG{hszhm z#{+AiH_h>Iv~p&VNJ6Bh*e_9rghy7OH;v3A!vd1ndCt^W9`}mGEDD=i32E4u7@W6r z><$s(utvm=<`xz;P@t4;FN>Pp2=q+7%rdGI@g}hb8jAB$4>>4*2{jjGbbH+e5F4EZ zMk6zTkt&AiEmN}LNosw>F&&6>;>}k(N(I~ETZsA+xQ(Gt0{$Ulh65D|6{O}jhE&J$ zx}VJlVF%Kr(dX3kKHlR(&_TRjV{3$Nb-Y=JYn+Zd zvyD4@?qP9c%>dfCS&mX%nhqr zp-t)T?+$sO*KZ$Jmq0GgGZ3UjhE&=qRZX^t7nOa&7|IJI@RoF)`}wUMZEK9y=7o;y zCw5&X?xsDtVli6;o8gc_FcOD+NYF?j!rSK~RqujmSJj|fbyk~ELJm|L#o_4EcZh}` zSFAJgMMNLEi1%GIo@l|_)AG62OX`58az)F*#%gwmmt^Y)U6WKjHogE3;y%QonI4Ja zB?ki-B6Iys*d3Dk82q$QX-rO1sfyOVWHP^a6owqh2fFk zuZsc-nK_TIu~KqAlG0PP!7!}^Im-=?e3m~VI2F)Y;*bi=+iLg_!rM9o63&vWH=5rE zW~Nuh`EIkz`y*D<^a3j001mfEWNI)k&fXV89O_xgwE4?lFuZo zfTQ(phX$gG+zl5yj*1ky6kS#NYCDUKoKn3TfF)&C7uBF&>_Am#u~@#c9}0WD{)2P< z;US9LMD7V>(QBD`XPvuE@HBU1&w3uib*3^MQ02t-1%iw$#WxY9uN_tVHnj8_2 zEZYTT(m9_GD&(;Om4AG(%H(hEPYYHzte=YROug0-GN<>AN_9+>WOm2sea&)R*bAtk zNVik$5k9LT?IF0_0OgfQ!@Kco^`W9?u<#jRVsJie>5gR9%mE(H$jVFi2&S5^XLCKX zA1pDUfg1`m8iMPxuvI$OcsbqG-w_IZn#c(b|2d3yE37LuE`FlIaf6(c~MVn&ZL(;4R_5s09B zCXbTiS3TeT_(jp(lSle1qkD~_-%lLHKXDA5YjO}5uS1Isl5}Hnm>#yRzE`eohx<~a zf0X4vF(*a5WCUX^rHbRgvau$ZcuFp@eGc*VKk(MBB`5QM(Gq{kC91c*uHk9F{aowS zqfI~Hxj^`{ZkeI0!1rBQJAR`JhqsljV`W-sRH4fFD`|F=;=Y|K;X<0XVbs$Q*+;Zo z_aYV!@wI`XL~qFuCofNiW*%&Hxmw+Irn#PT@?SS_B? zJo)2F%r@il8tUv+5;4fH3q&CFo}WFq#AsZWVVnvxyk&NIKDuOChfQC>0}?1=^?+Ts zj&P2kMxJ0>!5jzeAXSD4&$+ehB^NNTzz2T=Hq6fav*r-*089?)tc; zP1PZBk=2}IdOc6JZR0Ni4Ut z;hnW9iCBdsHvk+OnQtSQv~lfNitKjOUh{@BB*-5Pt5ie^9EbTL1^!haGY@b+eh`gB zFE+6t)Tc-2H+i<`QhwG4v(d9d$dcByDxc?blV;YvsF)yy%nXLDGnkXl)Zp2@t|@yE zQKToPY8)W#09ach=vBj8S6u;Z3LKiEyqh&MCg?-9)^5zGIm^e9O^ER6U%~6}axSAW zd_4vg@KKAr+BMc{^>Zrz5t_>BTuXbr=g(piR+rEQL^( ziglQ7@2vAbtY+45Vcs@`39Z-J_f7Y@g5`ZPe^L*sLN9Z<#1(iW}H*hQI&O zt&UYTiiNJM)xyWuq15L4?fxOP*tJ-U5Zf2zZGcF0LK~jWHMLDT9=#<>n*%+Po{tv) zrBzpb&OeD+5DENZS4X>GX+kdcjm*c+m(+^KU&-K?N#gF{?Xx*(b{P|=Hj_3BlHv3W}10I(l$<* zt3h=2z4i1>%B%Hhg%D?`=AN%NxR0+KtU=Cq&tSsczwOZg)83dZ#-^-#H|&mhm^fL| zW~ifTcj5_85=+_dD+D-@t_#fi+{>uMan|Pj@_8Yv&0~TK7+On;L z7-M})xoF#;$w+JxUTi*2C2cIyaOzetMBO|*^J|j~OeG%k_HeFa$e-D9yrd_X2jWKB zhB8H$C<}gx-%eow3raLpJX+VjGVx)APNl&SKhq zo*dpIIW{(#>=xgROJtW91gX$6Wsw6%5UZCLFgCO_Dj7RIE1FF-x#!TBuSTcJepI+1 z<{u7Eb^gwcehy)(1-tS!BMEGfxCJ}(%=xL)554B>tm;UY#@*#q_ zzUvF!;EZ*98uq6|)2himX)R+y*@8|L(b!+7dS3LoRFhqT3Mx-)TM)(9nuOZoXdwbxhgd) z3z0RDB6!p%5>XWqEByrdHeiXk-QrC{n=x&sX zAtrss4*kZBcoFf9CmXk4rI`?xY4Fh=YB~h9rfk78>vt!XPR$1V6LYlNmr9Te0?d&j z+7*id``P1?2(z2981kA@Ox+Cjs~__^b&cRrv-8JpwxEc7o*6PZ>R^3`@ts#0kNSed zut3aAq6D$kY3b8$@(cu;7KpxDOTL!XD!aDZSmyi>0CfP=Yd;D7@s$zxKS^tQ;g`ZZ zS?oV`1~U6cX~;XOUVpHn6jh*|c`n)k_jKZQ&883{FeKkVpK5YyghAwx<@1`asWx$N zXC3pFjBkzo^8_5~Pzn7{KcEqmE(0gQk$O61`M3KnB&A6W?b_gYdl_YiU;A6QD+N~k zaGb`+KqY%GdFhfaXl6d0I^{2`Xm0tFrH7E~%h9{)e>-h}!y@$N=qBrdj_yg~0gab= zoB-|;0)bK>XAbj>Hv3^zfHph}uWO5VM@sJ0NZ^3qk1}xK8b<6vpfN7WLswyuK!TL3Nt8LB?|J5FdKhs)NOFdly1(|eM%o9 zLqpt4w&|EIIstrg7M^FPD23S8DxOJdS z{%Y?qputDVdVXisIu^Y@N)ILxmj6~Gi-vYJc&vTF%CJY{er4hC7pT{(1G%5L)$g1x zZHCvdFv@&M_i-~urr((`4-59H#D8VDCWTHVCdbTRo~`>R9x0NJYO> z1aCcf$*#)?y$Np0DJ}IgMyXCls%lH`9YOUF&zD!l-K!~YV!#`EvOu_N;zb(;KdPL< z{=t4RDMtY~C8n=VQFdpyGYDX|gB~>bxc@zX86hJhVz+d7aJ`1b#e0^AlRDjd9Tf0<>kEY1=6AEbyQ9o#5V2_`&fUBFKQ@3&|Rbb17lExf*!<-!Cv z`PSqIb`a=om}nKcsnPXa^s9LG2eWPBiw{vM6b$<7b%pon#dJf|iryK5|s5CqN{Ik1QhCI@|yC*X*v zZFH4Y`72AYcA3Z6M}5c@;BSvenJ)IzO7O!Mb=X>Fc?cX0gewCHvq;TkOIXVvDN9GMy4MlacA`p+qPz1G%tdiOV5p?U`PB%G)<6DO2 z#TkKb-RX4?HGYWRe>PBYG67he(g9oRcmA7&vQtf=6`vVQ>L5>WaCIZC&NPgF1dg%0 zo&PxaLxB00=(7mOcqMfxX{4PflUJtY*(bhlm9#oUN3!R z^9P{Ym5$V{B4)4aaCO1jgnyAfPgpl+1(g@C+%(Xr@3kRG5&md8~vX>tNxly6iewstb8wbQhia6XM zyfOhx^AAzIo^0!21$J?gg(rT@(&h!{Gx=6?)BWK z^-;UQ8R_pQ!Slt>mR&c6rD0ORJX|{tkXJ#EW$md@RnEDf6YXxL}iMb^13!uVi&>xSkBWB-4^J@}|cU7`5B z)F~ail}`_7j3OzdINAhCZX9i2XX&#&&2AUl>|P_$)_5O16>3TrUEg3e5ZHje0HOb? z97b!j*fi-7krp3eJA(ZaGhE ziOg@&i@?gBRdY~FFS<~vtF1ocahLFK={e=CbWEdslwD@F+bc+nf?#~mdErwPxbbd+ zM_E26Uj& zZ*(Gp>8{;ow&z=D#;ORa7mY!u79L$FuYvF$>QNAew0^X$(yH zlsb(%_ZmsO1skuv+w5}6n|8`Jna@4M_}Me(_evRwr!u9N=bZbR7>Co6ME8EheXftA zXKN^)CCUF#kP1rO7>yRg2B5kCc-=ExHJKM~(4b&go0Fd9Uh%i}k%bSmUMecgMz{{j z?4m>wWZPTxR~w7gs#SZIEPaOBB+BNaN=U2T#0UX3dnnz3TDwWoErDQU?JOb*e8rDX z3Uzi-wv>5WNuAlVki)rwNz80YwzyQM=Y-{YElWY81Pk-Ia7QC_PnMtXmbrzuU2fNl zC(#Ply=slPb&Vy4p{;k3!fl|6+Ac-J6m0?CxZ=pD3c$6JNRJ=j+MmPR%f>{2B{?n8 zvA{Nl9h4gnA{)^gt!u=^TMQ@}-WG25sojEb>nmCg8B?X$t(TP|*bvPtaQt;Z@kWJe z_mb(%Z??-T>~6LdZ@kneZ)mmtwuU&-V&tcfJ_;{QLLm3Pf?@vhO~e^6X5g{4hq91d z$V?9MsGh{bH+d_qoI68z{^3oIx~Kya_;7?cb3tWs96-$jJa2Jv_EIhLFV7FGL)bo$ zDZ_K$^^dhRfxI3(dL2B5`kvW1|7*|XrKsSeX_?(zV!OGwkRV70_7Jb&>mRF4qpW`B zE&(Y~D!`gFVvIi{PjevRPsL*gF{Jr7{POSOzrZE70?2T(6&(;Iaqe zh?eOkj*{+Ih|=?tJLv^hH}~LqADA)V2gR<~ifvg8v+%QHdk)sEwziCq?@eaFLRqPvQiVAcUU&#X@=N%b~5-ffN?1wHJboF(@p zX57Qr?U7t_8uGeF%MkJc0H?J1spm4blDBHRG}*l`qWM}UTU&9$H#KGBPZq7^e6IFg zH$5pI%%1%Gpdn@ zbiCt2j3wG%JolO+*jMv&yzf2wUpr{s<1mZC-!%VR=K;5_kE>vYu~~gQl}u^Hr+xa$ zf)8hgZ4OuRO~en8E^&z>Hbcln1uqcdCzuI+gV^d5%#jPf#7q@IBi5e)ec(7NR^qF9(I@JgD_qc zy%qZ!x0{xUkB?gQFh=Imer)PPS5#m&%bz2%e4C==rVgCofd&wBKX&a!c7rgKK$iAi z*u7xaE~O7xq;eoNfDs1Tq!eQ@O7ckD9CD$TGkct!eB5&Yf}e3FV9q0m!9b-QP1B#a zfw7Vwa=}kZ55*iIug*Z4QLqORf`5SN&6m?5xgx?_LH*81+lGX;5FVdx++RwDR!<2s z-YBy@gzFdLkCH2>2@mS#v?7 zY$uJN!qKv$Dx{h(M<&Z&)cb4Fj?4PtSMdcV*1x4 z!ax7CesK>-J^Q#{`)|l!)iux#kB2O}|A~W|Ip{|1%QTS5>zWB)ZT$^J7$sr_Qu3cg zI~Gq4PkBTJ7H_Ln%mh$80Z{?Tqm};o{!5-^k=Ne|WDw{NHO!#6ulI^NNde&&99u?= zKdMQJ(x%~o%}G5G2C7qNEqSJj6ql0#cMcMXG7P+Ww+dYUTxVoy_Kv&LO_*^TQ881M zSAR+FuP4(MLQnOr4ko;9K zQ`$aWG0;&-H15nN^U)kaCL}#W+d}MMWE{g>!7@MOqGxzt4)v0DTIlj5mK;LQpqFBQ z&}gH9+nn=k&!z`%*&K5$u%faQ)|P7;jo7ySJbgOz7=`S|t0l=Ya)i ziOri~emF7H@S$8OnN8P?BFZjv$-?pFJ*J_ZH0Bl#IA7dsjO=qE!O+K7yAGr$uSLM( z>m+l8f}HEsHk0I1F~qa{{X75uhgc(T$4i592C$$Yrz;!>f87VjQ_vvR3D1O{Xcb#~vEpA`j~hRAqh!1r$s9t4wKY@Ih7v&EdIqL7SX_M&0tkjW znH?;!SNS1++Mu4_?Wm$3%A5+NZ+Fd7G1&6x>4LJ0w zoCU6U$M8VM;$;rO3aS>khOm(bNr_1n*r8&4RQyN6E(p&j0AJs_CP@sa=uJR>(pj?9 z%jf%7A@ffD;o-}=gQC*fAeF^H1pG z3dbd8Vo=LME!`jQ!#jQn^VOs2dZ<~ROa8{=rL}`ZobKFH192BWU{sEEn-9>1&@rL-wID|OvNGwJG zL_oX0b2x<2ZN3e{Ql_YHQo6mm-=8&dpuOHTSM(uzJL+;|;y5OEx`QUa^(DgLbr=GjV7ZNg zHfK3$7m!(JlS`;dzOZIUD05ssBTS!z@!uvui&2PmHtp7p;Ba#=ltm;dbvBtuhIF2q zGu-^x>C^FM({9YBi{{_gin^)Tbs3Ld_iGKPc~EVIKAk>>;HBI8$SQEycFr ztrR~h<~PIs>Y5o%=X}7SbRcbCSSCbju*pBq_XOa=+wkknX_+{n%lpRh=F3tyN#K!| zPP%HiZ#|?^%KP$uWkVM)DIo37BYI`d9v3&s&XpdoB{cSWWx?J+rpSiN%l~(+zyc<) zf?Y(=NL-K03ar6~#*?T~h*x|Eji(rD2jALSFgg*|b>=1m57#%6)hy7))`6M=QHT(p z6?2hXKVY~Hd(tBF_SX1YaWWnI=LJ9p6Mssy0%1-8C->Ru&!4WH)X^~P5{Y^;$Wsng zM&`zr9jaDaxdoCPG%w!PM@xdnu}kOD2L(Y*ggB0t9Of>Hs=IGu^_PUwH<4_Rp>b>| zF4l^wlsV#KnjY37NVv0t4~MX&Waw&;&_t=N8pp<~yHs)KfQ5DE;+b^p#c(Q>-I;~T zDjQC(ZgellS)!jMJ&HIklcL9E`|zj{`Ctm=dKs7R);FB#r>{35e?c4d$b{RQbtNoA z@eTsCsq}i(Th3`&MaAdWAnTb;tZ#+Nc9XnS!n3xsW@=Z{&enmFY?=)d-pZwtIdg{@ zcsDILXKAutta#cX2kS{LQSg{OScOO#1b&&2o@#y``1cSl9=Sr21r6jWg{&jQJ+a_a zPSdI{E_{1|#M?g#BZ8m~DG{$c#ee_FIkxnYCg*BwPeF9bzO|uSaC?sM)Pl#hR$N8v;9(VW^lHuwc(WVUs%LB8nQqwiNE-7ZT}*H zLWK=0@t4N=-=}=q6AE!?mQB_Xp1sqFHC`6Wfnqu#R38@lC?oP}!+J!IBJqD9T&!V+ z`Hl<9>s4LU<4Crmb}ScYH5AQ|+gcW@!wboF$25!Rax1a&0>?)QtMV}tgu0k$_<6&+ zX3WNTx#+J)9K08)N5k@c&XJ5A0zNw+JK2#=_AH|P>FiZqx~M;`L0?O>*wOpX<@BxQ zLW+{4Al+tk2+R+aJo``MGB(O)D_O??CdG(4T?#Qk?)zijSB)5@uM|Q|!Zi$qB@|ne{YO#Tgk8K$3zkQCB zY4;fU?96kj&nHDEk~mZ&U2YiLN9XJ^88B2fymi+B@?G|Iyva|VzVzWKKr$%mxfK$qy|HroD(!-3l)c${m{?j33OiCIB660nEU+tf*&;QQSYjZ!CU!7h{{{D~9HG23$WF^$cyM~ZqGE}&SvDFfA^0{| zu*LDX8#Zg>LOir$rAvW!A~9?H5r7y~t(V{`tBqrEe&Z9b= zwg{Mq!O*unU4oZ9mUU$U7|5~% z8(5gdP9P-BYJ~|z{oKY&%c4!a+h+>WOpUl>Ag&m=_26|)qA1t`+&W{i(yOOxTGl5a z@P@nrQ!?xxb_@M1MtbE~O^e?Xa0k8v6Em`Tn9tK;%FTftf*H8Y6#NFSbto9cA49Mc zoIt5@kP!Auq6~Ab!WSmChV+CINYhWUcC4fOU8a5f5a=+41BrlrQ!u;R_gIqWEr?Et zaXtz7)uP0hWu1HZg@{Ih7#iai<}ghFm=>%crNd9U%=snz1?^>mlsQ%iXM>2oEtz<@ zyHM*Qk=J~@rZowxKt_uGJWPt?+l%CVK&|wG@|WP|IFE|goT3Sy3iB3Xb3Gk=P%!{E z7Cd7KMQ@$TmzOeDXI963q})5P$HYz1Q)x+}CCmXSD~RN@td!Zf-n$eQ-ur#$Y9ET(@z%S3Qw z0o_)xJM9ho0px_)?F(qn@P%P=vql@dS>ARtl#GCV7XoR1$hijO#=IPRGIlPJL(1Pk zx_A;u#!FhjIRvh0!Aer}nM~ZqS+2C>=YntXqUkHD=C%1DhX*Z6SHqp=5nNi>Yz@bN zxL_q*k?y6J9a#LHEYMLh~pK_ynkcB+MCAOtfPupFS}E!>E1r9 zaA35_j;CZ7f~D+y`X$}lA~iCsqtLX8 zfr&7`Ee2}OsPgjoc?le&$;PNTT>Pc#H>@={nRZyYhm~l_F=Wt~PtP9&BkmeKZ z$GP))iYPTNXT=W^zK9yw^M27Rb!;Z#25@Y)+Av65DTr_AWLHNbq=l9R!GW(B`n$|u z8y`=5My?a&k22`Gcyxi0vuDZM`%2ICIA5lUD#a$Ol%g8#cPsbUw1vUpc}dId-e2HV zR&mn=G@}Q<$vi|~MC1vh{YRrpNJb{RJR9nAPd!72050PKUOB_?xJ6L?hV^J&|E`rV z8n)wN>gd03HAgm4r!v;vddH5w74-D^XIa>Pc;2oh&N`hAMo;?gl(bb|B70uxQdFR=#Hb)bUZl3cU-#n3up%Tmd9V_^b$XOtWCa$aX zg{j!|%R2_TD=n3HifAWoQns~fu>>W7U>d(`!B16oLB>erg9;*k56Qh?bbg`kS9;81 zJ{mq2TxLWxyb1m23{p;jd8XpHvo&pM(PxLs^Rp={@#q8QDnh!OXb9oKTlyaH(DvkYY_+)66(YJPd$qo@do#^vI zzYy`+?dDS_7F)&yU5EOJf~T8~Fz2)tiACPG004~okailREf6L^p5_&4R=VRk**FfnEc6V#D`rRvjaGpSDva+K!t6N0CB_jy^={|761c`$R|Jsg$?&`Ek z$j#hj6?aS^3;@~}EQR<#fIg1Esp($Tp(68p@tdqyFKGHVSov06hWZO4;{_1{f!+fO zEhzd~ep8n+-al!TjP5-n@tlGVRt*2oR)_APT0eIr%Z9cSrb{?p|-AM~> zCv#zIww;wI*)gS1UaH*q&UpeZAXq~#kMn-q8#_Fr%v~msTNP#`cFq4nD z);gws&x((rt+^D*%9<&3sXNY|du;*_?%RmhKCNkv>+SmJ|2xiZ;O2ls;SH;=?2sF- z5;+eDxx`2HaMSor{jG5fZ)+NV2wMv-Qdy^$)ltQ(R0HB z=K2D4xHZ%cGQmbx#JwW+gwVJPq|7I3|6wso#{pVx05`Fq#V?S&TnEeM+m^W5X&(SP zYR#M6u-q((wCwm7P!6qs{mU)j%`Pyazg$pAr}=3K&o19!=;G|Rh%8!nIe$Sos*8Kl z{5H^$TxGmm*i|$n^eBNbiTu0&FOB7!03H1uDY1$oO^|OXl4YVnkxA8KU6 zAYOZj^Q^sxm6@RI=*;w-;8IiupcP49cy$o;iOkw8Dre zcoROMa|!vLu=z7S5ngxdt&jIv7^W^hOG5w$uWwtTtoPHQNcbJ&ZReg;O8!ZZwt|-k zVRXDqtxCv2>n$F_J%klU>Y0YwEc4l_^L%J>Mo%FgqU@}F+#UBgOW;ABjlNYYwwlw# zW&gal{8sihZQf$Z2Q4Pb_|XBNteGp}DdkIyKL2d#mm5o7N?{*ZbZ4pnp^E4TK>E+h z;TN{@&}5YHN?}*toHU|%#vpu+|1TfPcbxxq><=mnHwvN?aF~KCe#hW`b?DKY^z%c< znIwo;*c1msreYh2%%_>&;|84?*iSYfH)zEaf4B+33+3y|{@>=H$T0Tb+w5fzb!zFF zO=EiUsI~5oc_S=*TNc_i#K%4fr{&D+rtQz(9~2Fr6az!k!Sh0V_*7Nm=7$5VZsIVO z>4?l*%J$6;s|L}WQ`PUs;~@iA_7*aYrQ}wD9^$%l41#h+hdJ2dhHWeMtq2&4DWvk`3qmfH1#xY} z&?=7gQyJE$SE{PBEFj#sDc<&W(FvF)j>0n1^gj$3CgtLymt@LE6Wvjn;o^y?uOwoGb*i`?VBeV?Co^hnNeGvAk28|_|VXhqKfO&GVQ@duI^(7}QV1@%1_2sAP zTDi^wiV=x(_J+F;ouoBcK~4-LsyPeULy8n`uwAo`*OkrXUs>yy4@-L^d+LOQDaO zMS~=A4_J-f`(9+Ea)*1)m{rKtc1u)@`hC=1iDM~pe8kkGOj2w zCB!x}uP5@3;13tFXiIBZ47nVv$y2nS9*rObGmB>mHuw&W8q7PNZhmRf3`r93%kbV3r$6F|NcK{d?mQ>5J3-aA%yQ$U zczR*>Ww5U#b>o<=n#kMCj%Vftm20bEMx)d#(D!H*4S}!lk=;irMbXvcqa-Ug5cej5 zc?mFX4FOr!&5xGXz-z+j=Zx}3EJwnW$PBzx{Zfah#&?VP;b$l`B8Sjh&J3Cy2R}3N@*a*DDX=;>O1CR}DdlZ~MlOJA ztEf_h%!9kU^uaD$N<_4t-k+tejv zZe8S`4<;KCCK!2MNa2Y0mXxKPasub>4bL5+1)(kGvcBhWu`SaudLwvp50pWb=A`E9 zAotzQ9oha3Mis7$E3j+oI@+)4kC{Ru7XSGlC>e;f>j#K?&^`ux6asqCUAV|%cI>B6 z1Bc@Y@bq2rtO=0D=<%mP;MreY*9xB8pTGwetGJN8=YXva=~YJYD?y;kl9}T(J@N5b zV)y4eeMvc`7Bbsj-ML0{w-@8dMei%+^|<9*Mx5njQ}ebL8p6`GiX4r4Mm|rF{A*$c zo2d0^FwCKrOm^p`V!{alv*pOA>lp_hBKadpCJqS5Sf+_d)nFaeQDg9E_d-e{gZi;o z;6WT=yk*gYY$ZE=mQGMfQ0fpgnxL>3*Y22c`P_(GI8t7NcKcdEq$Nb&2V9S_=Qik6 zJXx?-_6Ke-2ekesolb<}_b&q8pZuaCHHhL0G=)!gmtT!Ibe=z@(gIgUT5@r=FfXlv z?+?b54y^Df{qv{hcvdBh2z%F^kl_a=O04fDv#keF$q(Wai=@shKVWA|2+J4er0h;e z_bxRu$xJe`IQbIz$SiI1xU(MOoABhe%MC&4+FuaxMc69{nj#MiJ28c-hc*4MW?51l zGzy?YrgzJnl?M_v7G9Y$Wn8@GnoTFD+IP&(li4f=m8=Uo^Edm)!hi<-WJABs# zwQ(hX1#2h2Gj-F9s%18Cx82+JmHJFcC6Di+r11{N#z4GSAP4g%WHi3*ogq`M6@Kbe zI~kA{m^ajeo#Md?(y-_V&0j0~8GoYjr(=!+nf?jryI>`|nmf=iy$`D;7AF6Uhsbji zU46j&CK;Br~E|#(S=*o&Bv(}QAuv?j&+7>g9#anAM%2l*QFhzHeasuiv~UrKFTM@{CMyu zTkW4ql`os;T@|4C8y|2jBYXyLh_xbN>?2XCY z36Pu?IbZkGN_N?^!B~z>eD&BY&Tk5y@p?Er2C$FgZh~w?;-IMut~du{%Glp9@x}SS zN}c~50kY0@7Hk~{_nO}JGW#d(30qu5*sAW-ByKyT`4$>EGapZOg3p0< zaeBUs&PW3-bKR4nw3^iO8IIyuuW`4O%*6Z+D$FnWZHM3KiwaG6v~jJ-&RqTQWb_Wg zBpp2=pYH6%d}??S!4|?}^)-`Ggh!M)l*U`Vj&_ij0A;FZuA>dmgTwjsoBt2vwpO0} ziCXOB2UfxDYlV`@F2vdmNgX(BAzxU3kBK*otaOrQQO_JwL0ZdEoN#o~7Jf*dt?O{U zb_j)eKb@y181TDOgoJ|YO;jNgCXMb-j%&Xn{)oj}vqGMb>w9_%Rf~XjeFFV`-%#*t zctlm4+22yDX7nW?9@y0CVPGOhW45w9``@5SwQ*)x!z^AdUEwAvXvPpUw(78(Ec6Qw`hsw^xA$u3XJZ4q=CpbB|a5CmT*GJrP+szfZ0k z*SZOrmWT#8Xc~s()lwpXTG|H1@n&F7iTAk=mRA$pqABRB4Q}!3{u&?kWhN1^-D*6k&%*YP;%JlqU{A8`;1mG;E#|a zYbSdt*Fn0C-g_6broMV4x@0qPpOzFgz;)6XEG4ZQ5dE$JV_4YjHMVE^lh%ZYSiwa` zL~c8%`FmX6ESl*B|I1+ili+)HZ+e2Or5||@vBJdUfqWg1DpO|zYlrj^sWk{%2FSUu z7W>b`nctzI3W^52yBPHjxSs7kH?R(lK?+4XLLmy(+m^qHz_Vc9G`$$_7%Q2y>eTF* zdy99q^#l)=KL(yI$}jJgu$B zSzsv%5_Dj~)fw-fuv2BDJsA)gMsNhr$-m7qWSftEK7!?wh^@6zY{)-mE@X2_B!56} z=UHF^%OTroHlt=Lo!{Zl&g|hf-`X& z(<#gdA~+l=gKzbLylsJ{Qbw` zkqNI0AZ{l=?{$xf`0h8q%Uxyi<8lpsDBXN12wv?$b@oKnF&44>XW+KGa?<2=C~Slx z**+$^wGbpv5^`iyCw&6V#RU4tmt*t8bEK;eyeC}sE#R4r_cisFd@!Do%2?YoSLb%1`AgIhsA1TbKv% zsy7)d;gi3-=e?t_l;Q;EQ4g>w)+0Rp#3UEI;`Hkt8`0%dgJvZURa@u~(|AaPVzE^v zEyH6zq(9ti@(B9 z944m!W5$nb;|nA4$qyd*4Z%k9AHA)GX?Y;-Ukx2qlyP!0ohiO{8XDf)qtE0&sITQu zu9n!@s~?b5`ZC%s;I{%F=m;izx&0?Qc6c1V7}tbuGlPkr?J@5llgvwAmHCX%+fIGi z)LQ`0Jc}BHrG&iN4&m^{_ZUJ*siY8jo^VY3i&{RiMO@j=quGUCrl%XWu%wTc_PttW zX+$rCXvb5M-0*T-fIJqWM{UH;vQh3Z=NYB>VWz1W4I-J5x%D+!`9VA9tpqzHX=;Qfh<1EmVHng8 zvTvHzj%g4Wq4rn_vkfv{O+KC;rPb(x zZ4Clx$RY$b{1W#PS9lr9*ta+;qk;;+)wE^SBBc1d_W{)ez~amJ(&%I6SV)cTPyOob zM*~+OuA-+L7L0-`iRY}-Rfx!cLU}s~GFm6hX;}o%>0`Y$YUT&&l?f^6^>9#8;PbcP z*yB(6D_9_H76)gw4}-UW0W8;iCw_V&T8flelM`|>UtRMp9y`f%k@2)sC?wv)%Ehz^ zuQ^OFy;|a2k!mtGOLU1g8qL9o@K1&FP*qJ03>C|h<1mwF6cUI=K*Pf7Pa7VJ~xa_{T2*(M#20^#~XF$-a1$%-^56KQRHl90LIPK7+7kwT{nIYC-rt z?gpr{*XG{MDMSRzCIA<5d+%MA2Jt2L^OYk~h7KOf^-@jXury_Rqp`6SFAM2Ev^-7= zSo7AwXh1@rTia`JJTsTwz5v3`ER`y`upn~StftG^=t(USihm%_f{uc=HN;{@)BvoM z;b_kNxglS$ERXxe`Uj( zp^xu)5-g%qCRghC%!1G4Ur~fi+PY|ZyLrg=CQ-AL`C7qSH?pIduzNDuD6Efe)YbBB zIMC7KJNedToQvH#ez1+Km?jl2iHGKV*XiSHJb0DKjYmr&lgZSbd#D^0=1@;xCZ5Pid}NzmM`dw{=pSoUVvxALv1mG-Api<58N-G)oU z`}|u-LZ46vuvPa*5=0=*W62yqP>4=aZRLYMd7dCYvs!ty=4XzLHKtL`?WQcKK@TQ6 z&e26JOOcig+7hwNyTUWL!@{ct?pJdk2W$PIR-1INCR2%%=y4eidgNE zR3M7gwZel-KPmYXH(mfYEnui0TyWYJe1bWX|**j7NDU569o2Xw<~6w1zaH{33HA!hG)whLPkSCBW>#fb4OJUtG`6OGf6Na6zQ>Bwy8gU+>O-jbXa-)-t{#sbRmF>GY) zRpKITqCtUV?R3!RPE@fVE%3TnKKI^@30>W4QDU*+X zvf9RWiCXa}hJwp8%{x}ST>3)2K6l{1wpzGAS_+L>8?74$j|aPNH!IiY+IbbmcS zQ|uRYL3>$xp9REw6^}o8DH=?w)vMFduZkeDS7Bu+%!C3-J*%-Y1XeIerH#Q2kkU(u zNdnIOw6}Xp<^HjLYqE*{vYhwXRK^obo^w)PTm&Km)KCB^OYqV2FP|w84kB!npVg@n zn4};jORZzNWE*f)ZwN?10>))5!}UHBMd2w!&guC5@CYEp8JgwbKC924WZo1mWje^v z-+dE7V*W}W`)OXe{}p2iRK@sJH9er4Lnd)5F(xU_K;p*sCO?IPCyKm+fA5*I$c( zFygTLVdVXjcx5f{vH~dqG#5$n6gR>5GHX=EzN#eo`ZJh~mGUCc0R~z<4ZS#(sD8)xU`0_3ctQ4#j$9 zL&J@CUcyauvat7jsPXxy8-MPLgqw+W$r%b>{cB<@>PHrhF(fo!p>{uvB9L06jr0Hg zZ!AOhDfDhc^!(*9nx32w_c@U`usGQ`8ws6qkPx*;WJ8`DGERbz0ipC3MBTUO70DnYeyp}%%K*e2 z4itD!Uvx|3PtI?Y-B|R8kO#mXAl2^WuK%wcAN{EPzkj35eu8E9^#s)3W;9Qg|G3a{ z3ME;LX_v~7fv}Xx``t6fqwB@>+;(WcBmmQ}^d{o9Z^+r7CiV=)P0JNSp5v9*yZosT!EiIG0btVxNP@WY0DU&X33|Q|5A~KQ6$`LbH(bT%mxTM53BK&1 zwPRRATak-#aGI>zQYLpOpR_yxt;BrUy=A0gOA0&BvVXkz`YBT&j=$l$#2wE7s4vFA zwc?40y;3?AMjDW;qa0x-RSHhT!c*&;(x~_shMJ5Vxh6PYd!WOZUsWjEE#sQ?k>WCY zB({vZXZih_&y-6<7(W8Le{{32Yi|)v+91$$j#K`lC#^H}=VykCPE?e3H)okTuwy z$J2PTZIL@mv-JB#!n!_BGXdP8XeyA&5rV$AXYEM+*~ z`vB>a=<2Ku;KY`SDUlVNM{i=f=fDKw$UV(Jx>m$~woJ$9f)tf&b-4+A`>@45vT!RCDv(?kSLVvV^4wB+eX%gGOL5wrVq2YG z+NDcAxf!%U$w^VH{Mt^%8XDaCbcj;W$(%ebk?v{G&{rj6yD#Vs0vQFSiD%P9Sc{^L zWE5|cEGA2B6p^&fl22NAw&UKsRU|5qXT+YM8zEjR3G^1^iGFO6V9}li{DgO;rYzYo zTfh#g#iBm6#d}lR0<#zfR#!KY0lJk;+GShi7w7-6DvkasaZY~*`Y=w)kpAYrwaj_m zq<1I6J4nr<=H{-bc|39=e^u?4`ONNcdpChsG5Pp>uIWlgpx_m1{EFbvpurt?%<}@7 z6TUi!i6n=JSqYLwHb5mCX;z0)p#l^uowP&N%{`$59`#T4hobR+uW~x63^Lf1P&yoW zl8SfxU9g8~k2BSi53b7R1mixLfkB%0VLmq~=kU<+%+iRPuF9m{qelr`iRq{9gDki2 ze-7Lbm1{_f!`=!LnRV6%qB#tT1#}I1ojyE%Fj}?|U!8gULe7zOaAIcjF*N^)QsO7w z=S%g9Qoh0$aLstccqNz5*$T>D+u~hScg2?AGM= z@{bbq?Tf!gfTtjO{|y&SFpf`6V>BEPKsG}G0JI4Z`k(UVM+TN5%)oqSur+MEt@NOb_$E$apsGQq)H}I$8@~}D9Rq|m4t<@m5lSM4p=crh^#e4_j(-YIGork+U zX{iWk>(3bCN2eoJ?Y2d@GmrVX(GB72z%3~95t2#MoKvFlj7JnyROW~q6p2e~^x*dw zd^BWa@6D#iCDW#j83AgWX3-D=E=Fsa9a@=6z}~xw1-{Z?HFh?6cBSfsfOCpKMLF9j z{aK8|n673x&{o;;h6P?_Qr4Zd(LoarFyt@>s=Wjar+T z6__>$FQjMNN*O6KjIakR)u5l`)Jd~Z?;NbZm)R)T%!85W*Fr18;Ij3hm{8fjI}nYr zyF7jWn`McgCzy}lSX=&HxsTc}BN-3~tUqOKM#JYMk-Gw4Xt9C|27coQF$G({QQ(~W zp7t%w<_zW?i!klnIO{m`&2OcU1?@{EGAx$$CLn9v_-%rj19PEaIioawZDCf5ZZ_eW zw9tw~daVL|T8P|R5yvC9(GBF_E~6nKjSCEf5(Wbb6DcK##^w+Q zhVvx!c23!k6-h2pmnR%L?-898X~|avE#zm4{#$ARAfo@V!!EK&L04XjIqjpnZhGLF zvfJ}$1y>(v{vH<05efI8v<6E9*fKC#30r=yV@uR^=TZ2D=G-fq8>|w@++Nyzo8#9S zrRI)G?%GG_rj43^V41*rk=cMD%6!N)d)syQmMyZAT?1*S$EsIVQTc*r3sXxtkyd3?=_F#QTtb6IU|Sm_R3dhyDw*LgD!YyF>-ltQ^_ieWIM3+e#t24=r6c&C{}#W z2@d6xY$3WWQXrR&HLrC|jyz^77^g=$I<(5h3LW zGFT+c$f4YaY6h@FQgZV!Hdpiw6V7WS+<$}!iiO_+U*<% zc-eE8N0oanOLi-Q?XtU5Rs9m?WeL|926jLPFf^#(P$LV(K|p200*wSfVER)JL7)9j zm4M@WN1KhiggaM^g+3~z9gkF_SyXzFZ#AVxkz-jYxscE0c$3{xgV*u&q@lQv*?^%mtND~Be{mg8*2E}Yt)PY49Ch(<-)rlA7FkFNP z>W;fpQUCix%Xt^=aG>bK0z^6`u9H@1l`Kw+brgs04H}4h?=KMt0!&{zzsQ@xYWjV` zCXS?Rv9$+Hlw{(B;WaX3KMd#8V=1jB zW@C>!5yH_&Q^sUdr+8;F!iEz$YN7UZ0W;7hM=C$w@|kr?Ac%W()1$+Chtbi}V=DmZ zZORCfL`(4D%5m2;-sZ9F*@3H6v3@Bu-AB%mq^^WS_*cr9;^g@YvYYsZ;TLI!cgS}J zwt{GREwG*WHWu=vUJDML_ZGwL+y(S$19>#R7ue_8LfCF(I?O zfqd63+)A2D@WZ>8+^jXu#|7OD#72VfKcI-lW0Wb9dRrN^D@EBnjy91PlU99(;#g(w z)sT%*h`pJ~p7)VmI5EX)?kshLchBU=mp1rt`fVOQSvco)eEU#WBIXkh z{*RlqzbY)<`F`ZhmiW%AkPrz$2*Ur^O?%o4a{(>0Vy*eS`*o#a4cj-mworrBEDefH zL|y{WA8gvxxam`8vSq6AHzkP$4ccgQb&OfsH0*KPnhG0)v_e0J44e*FOoN+8k4|^v zjgAPQ|3bmDr#m{Wa>aa?CtQ2Wug2TT&cdCYbs73LkX;zIv!>rG8w!qD?1t%@JfT%} z7fh5{E-IPNWCut`6dZLFCeysxffq#Dw~^`~<2ZiP-d21q6Y{(I(Qy=JUE))|a9nG0 z%L4`+LcSkz+^XBiqBmCa^#xL5rkUF6Vgk{J#f22k7y2_IeRcj(3M}}}$oOgfJ6_#B zih+4QUpZixP$otNvDn8w#ng(P&V!ivoXx}Tb`wi}8Z?Ozzv9PNhZriC0$5gr<>vG5 zuc$fm?)}obQunNnyDy55mvcuaNmj9LtsQ%OI`Xl4CP$suYw%I7Ye5}a4gwJF^T~)e zu8)f;byU8)+XSJT;!b%WXP!fiS>dK~H~P-G;J@_0XVw$jog9fc_dKL0E!x8B?koV1 zaaw588D0=fW%oAU8U*??{~2xqPo7;~s(D%OZ@*Dh)8V?$Qoq@*^*0%DU6j+CzGot{ z$Y;V>o7z@)NZg7e#&%$swv#u?%wit*6nh3Cq(&bUW)ZH-eqOi$Bxx>0z8MW}$x5&x z<~FLY&K+qu1(rDDqw6LTFR`Mz1C3#;6iJk?&f^6yiSk;MUZJS(2-ih@e17`~Uf+`0 z4TzP2x}~6{T%m!pRRwpFg>Y+^tNeU7-7qT?(+6M156A&YpqXhhdSp<-^~8C1aD|EK>?aH+M!yCt*Ls{j7(pVRHGg`Doyz z3mm^=3g;KT1rOlKz>rR249MpuFzvJ!Sl^oicpqOIv1m>#M~{q29%U4N$r=N(V)|tU z#{top;ay!fbvDI#0v)U`q;-5QL%lQG>x&JIrU+S-t}q5ZWdFd^)1A#cZ4|_36uPlK z4EhOA&lobx7iFi^o$$!xVMkZ!yrwposp%6QpqXE6t?D>T7HV5M0ji}Q9mg9k&tMge zJPB1e2L=3b+|+*CmZmwy;WFYMAcjfhe{9C@oqPGf(BuHR9ylsaFLu!`aYQxWWXEe% zxADhX$A#363nLVDM&Gr5i4z;bps(=Me}=8n1=%GFs}K>cCN&vdM#hO*l)dlEPp#bF zB%$5|-DS#wVWWz~^RqO8;~nfVgcYg7xGyp9FpeQtUSM-u!&nHHk}96TzwjIab3|87 zG9E`0(p~gOo#a+Vkr%JkAr{Wq0oV(Y#y%htYkYO*Osf&G+V=6+6f(uFunevxT zWrJ&@r~2`#qmYUsSPhkJBfsyx`XS`E`p4TH=D5Aqm+7(vAUV~bA_!zu-zeQpFaE6p zi~I#cFn|upm?(QSxQK$xG{~kzSwR|rB0zNR$GPb^r=vAW^}m}mc~YnBrV;QGvJPS5 zlXyfQbZRBC;UFqCjavL>Zt1S^D(gr9sP-i!G~c$o!YpJgie2t68Z{%*f`|zJlz9n`}w9`$gG^j!5Q+0?c+K+X!Y@uDlIo?lCU4Xr3-ZZFdJ`*NfMzLqwV77k*5SALC+?W z%F?enc8!ta>=)m62R?l|l`g&3OeEcTq$1dl8m<1;XBdb2^E!b3{bsCu^PnH%9-Zeg@YjX~b&GK75mI&AE4kK{8eGLoz`D2LMTenIUJc=A6 zszEirvQWI?y6n>@d!}gOec1}SlTut<=4dIfe9*T%fQ^EcoZjO{xIri%AAQu&FbLKx zVYZSiBw1#~G)P{eiw9wLU?-?Cj0^?}2}l@EOqY|9>6LlXzazKhWR(Dc9|!5#&ETCZ z2qCTv2T&hC1ynN&B9s?F-961 zPYtK4I@wOM#_N^d=z3hPwwqnzW)>b9f5sj*k6mzhJ?||O?v81i`o@)Ezv?iiyh@;j zYS=qfPPxQVL-3C&%=<;eW*R@wHNnv^<%}(A{I%(#}t;TLDT zd2S*ckV#eq&eICD3QTkvP1Gi!vNqdpMjt%Zp_>=V$rmHZ;3_Yut+vEK zjX+F;GVHQ=H)eJF`#+XUM_@<(&G~XJ7=x@oZL}EaL!1!9wH%9r z(gPH0UqsYx#9Z_FSAei!-$OgqKTmJnk4O6J)Fupv1i$lMrWI2ukWZX)C+pHrFIjq zI9n!2@3>$FSvUM$)x<3LVoe56-*ET3D3Jp#M?4IS;cF>w{kET!YErBmnYEM-oy8hnzODM#zbI_0qZLX4e>gQsp=k*}(Ikco<#A=|1_SfTdl^U$)+ zt#KO@#5*JNX@(X_>mX>WDzU8On6A@exDtsX-9#Q5&MReBBc!M;c?$(EwCToBhQ9O~ zBSZY@+fXKkfyH_t7Pqw0$LiF~RhR@^e(vN)7Y&cHPww6c!m7%l5n8mOEi%5DRL<#L z%WfW(?bNMP3B+otrmjc@YWw?^NGd1n(V0MrTh|TYQm0{e&9Wi;_#}ularz$=t-O4N z_RhWIRDd+KVzggai0IIN2DM7%@#-KeM{lRSL4hy-0Ib$ZuoVoW#gbnxG`Lng#9|8g zHpi!Vl_M6^mw9F0V_8q?YRIA5lN)1wk9!lSmwqjX->w^V`yVpihh!f+rrb`=$ClwD zyGzl;34}Fr{DL9q^b-QP?_z$prbDa=*z#22vP5#-mvlSNf1z3MahM5lgg=!;YV{&R zb3lQ^8>%cAkss_>v67NVYTt@{Sd#${xCXVp`Kjqsx4A0MUghRq>|T1ycfVTHYX_0T zq(RXgOcrzG2Zs$geYGEu+hJ&eLDj!kN)XWTmy5w|{L}AmrJ5ePCs^VRUh$$t#&GV# zDu*a8#g|}SycA?_AE_pC#xT3`-CPzq-sN1TQ4)S`zlv(-S`O_DI>DUSovolOa z_$yZ!VSus>z~}x&DA+rrFIF1IPB(dp#_8lNfoni;ym0d4c_EPix)HU|sVdL0;Vi(3 zm?JaVBd~XVdYLT`^hQzh)=$O?Ccozu_C_cYSe{^|+ttiZPXL#U!^6{+rSB}?ku}yJ zH{wn3yGsx_OMK%Xp^0?w&M8h4{UkEju# zzBi%9wLqR~sQSB1#atuRPtO5g17gE61fr^FsWe3)!uBMKrLO_ohk-m8}SKvb5WDTk%76$AoSt@TPf(owAz>VO)y zZAZ~xN}*Z#&UtqEe<+M}Fc1zT6Sz4XQ7>I(1bAQm=YJEV8rg#?AbPq1_0EzH#@273 zYMqipxr`H&)P{&R06l{NP< zTU5$uC4O5aYqKR|Dbx7q6mT>?Brv<{nLJKjzg&Munn5&Xruw}v5$ztoq&vB@GQuW4 z1i!hMWz#{Gyw%8m_bf+R1>Ff~+NVn!n$Ua*rukS1nA zFxrp%9KH_XUyj1o@&PzLZBMkFuw63y< z+XCr!DfdnGY;#Z?dYg&C2S}--wiS6va%jXO817f6A}(Wyn1Z=kZV3a|%^XYzn#2=5Lm&%F z5wluP)vG?%7sQn1MeS+%sz=>>5?e9>)EW)7{(Z~NPakDMm2|ZrTn_-~ritEmt@6ma zqpC@8KF)cSyb$!pIc>Q)tI6l@V+6vQa;eFzP-&{DxdHN%rpT*OAfaY+?#k)$<1WwiXO) zf3!6VUhIM*hqg6aAI{ymunv2z+dhb}=UKsn(a8WIe(?Nqocu_yyEK5h))%lO%Pn~#Lm?>_x=A^i7E4p!w? zJemjSXFpPQgrsa9vsI#~WU)!1bm9x5>hi`XbaTCSQKRR|jc?IjRl?brV(Kiyn z1^L_mkU%uAdo0NZMzTrttB>}O0KA;_ZCz4&VOk}2((utiba&y7^HAzP3Tb72yS^r| zsu<^jgDyd(Z+-^w*iTEj)D^b7b0^4ATD`{vfBX^R;)aSTQ>R^9^(Xlhw}eSfN9=^z zp5avv%0hocEjyb+kSqjdM%{^y{Vku{l=z&{S853T?a=7n@zWo2g_N{j;I{mVXMrh4 z*Gcx1Gr-mOU@1F7%r`P|;;&||t&kq36kQA<5|3Ci{t0wE(^HXjl1=_s2U%GPLU>os zo{4-tB`<4`S8F&NOt%@>>eQt>#mwG9q#kQU-->aMtI=t5U-xk=3SqsYdrHBINX0n4 z{FoGtr4rfHvH8kIHgu>Lq&ZC6t3^xBmHlGT&jf*MEQQJWE^1e9)j)nMp&*!<%>r8= z3Waa%o$Tnnl=mCRmTjk8j0@;elOv#{#!S9LA{*!>sN5$Id2eWyRO=MI(jLPD@*A8 zP=hCm*ZrT_R;h!7l6YWif-mmv#Pm`DbZ_A%=&5!za?5I}jHR+?J!TGxoG#_IB5JtR zD8v>stq;xsM-%&dYvoH<+V031rvkK%8RPx#r-=4V*`k%3Pj-i8CHfGv01AA~Tfk1> zdm~Me^E;v?@1nSinL2v0h}HeTwGu4)F=$N~V@zlbW@mH2&JKm6o_Pgjx(uPjYbht= zL>Gf7N5%b(**bu(Z|?d4KEpu&aYo}9M$zz0PVZz%Aq;jFX`9WPbq>5)Pe<{rw5+1p z;|_&`=}j88#_O$4DYLf}smI&Vw-Vgra%3jHuk#odhQxbE_Y^NP8s#P9+4M8>Z2w1H!o&$O|CzGH(h#L6CymJfm&A=Ez%`pYmrEsRzVA84&Hc|th@9Hf47 z*Pv(qoB%X_$0a1c1sGGw{=w%-Me4=f#^LAhIkBhtdU}4P)z1wms&z4F?XCv974ESu z{Rzn`S2=Eb2;38|wU4PSNqKK-hyW+ki0oFVzb>~IUzgkv*!Q3TCbDu%;c4ll(7h8# zP$ElMRSh<)AVoJ5oN_11=jPIGJL;HaBgfAF_o(k2z$FVL6fje?jXJaDl%-e{)N*bo zp~u=&M%>QxZ(O&A__^Jp`#URFqlW34h!Q9qxwLgad35B7qPv&cBLC!gMEh*8 znBBNy)cK3^QlrANvZFpuTLT3P=d8c|ujE(~IN3nH~RU?GcBR zQD&hW52b)YdUav>0$>z54#90WMGogFW(r^#S_wm}`c-jHIH++Rqn~{Bkqsq73W>Ug z5AZBZlVv$LYQI56oX1%#c2eQLgpVuf{fL0!r}rcPTnO|yP~HD)do_b9lNcDI2+8Bp zGp7qZ_0tfDF{LoTUyMN9n|Q>J01px;AuG>_Qv!-);dj$!26V00;Hy(W&Hw#|sd|y( zB?r2z65)mP6D=#OJd;BmDxIB>iEK37eG?yfG9To)JOi6=TmL7tOD~S<_x8;ylnX3s z%8u>@ni_Rc%ko zaY=g1LM~@M_|x(6(p8V9xG_B&*y$U#>WbAG%gNwM&6YUlPfe!LX*22`id2^6h%XU@ zv7YmBJ?F#MLYrJ{WJG3gQJi}qbtobkM&ue#aPB`ciDKOYhe+lWw#oB9oK^>2dlEgQ z_7!rsA9oQZwk-!M;rgKv<&nzS4=<3cCmwbV*a{$&ogNfp`e)DGCt3|RFgHJo&Z&(FTjm|`}VZS>}4>Nm}i+Y_G zzjJ6MJcS;er`C97~5h{8yGhT1}k<|5$1 z_yarMD0$>=Fqc!z==SjxDU!RHXb4_G@1+Gv_KOu~+uQYg=vE%nwLo_7#&!s##+>Bs znm|?s!Q0ZEC98?nb9XD|j9C!D+&Z}RpC6TMwHJnxm(#zecE;?+aWs0Wozv!OHnO#` z|24sLx$J`nvpbfsOKm7YncVZ3fk$(KfhDwz8GXjg9cq9Vku@zmJwlIeqxqUv*!MqW zBExEVo5&j^!dzkq01m;YnwPo?tdScfY2%vmA6N2}w<2RT0I|RAd4n8ZHVLR_BIVDO z@NJKhaf39xzCRWUMG?8u5QaitY;?3fx?|~_D}5!YKSo^75`7eo5bUGR>q;8M#YRP* z`ZZ>hzFlBbRqq2JW7Mev67=XN8xpObJ`+)q2^;l zz_ny}tZgaWMP^1E7V~6m-nTGSsU;*kmPER1D9fO7qZmd>lc^|XgzTh2$|CtCYJ?lZ z16(nn(h_$DV!~^q1=L-&55Nnc5C&X7!h^H*`9JY4Gm~n-oG*cYq)ytTLaMoml-_v+b+L7vFkFzu{~?y+0V)u^gnKw4cs{3HUz-pf#XtJjCx| z)@5%d72DQ0fVgAD@|v8cMRjp&*uk4UyvMM2=aRC5JS@1T{GAHy05R}fFWk>Lutn`G7rM@hhGK?Bs%y-@L(3KNvdQ+mx_8Ut) zm*{j+G3=sH3LqQYV+?x)L(h{n+U?dav+w1?*8Xctm_iCdf_&;&6Ws!P${?j_ zuMH2C*v&X%VPot%e(-I#3MXpQWuT=_=sy8!dcWgx`;U=FGDki)Z!P>J&YX;g6wzS; z2?^PK!QJEyY?q35t8#ur%H2YKVQSvRY1C~&8EW7Hy}`nKj%M|M zfR{w#Q|X<9{?Rx!K8NUvD)Jvf{`tfnrV%nE9JOpSbzaCcD0|1Ty0-LD#d$7~w8eH6 zti);&vp{8kwiS}r1am4Dl0{%pld~rW$@BX|jmpsRIMjk+$CRPTPbr~n;M8v~xw<(p zIz2bi^}^N*osoB6t3Y6Xfc_WAal_2|1Z19hk)9V!Wbj(TGCNpoI4humhjkaMX`EQ zKYrkiE{2X3{cmonzeQR)BqLlB#F_w#e#v@LuS(BtH>>SA4;1STwudG;uMXN8qi63& zlbtR+f@cnlC&0V37ti>n;S_R+N>au)9{Fm|(|G!iO$p#p%{e*p6b+qc>&3D3zo7G* z4=;pmR?FmdiRO8S{gHU_lE?fWhv!MqhYS!InAWF+MGy1>Z}iK zGBSzcAE~<9>No-a73>1XL#w@0(I?azh6N*QefH$drvHRiB@o@^ouSp>cX ztP_;?Lj2qkSA({ks|s^0UNTE!)Vt~RES`o7ccVHCUIC$K2pwUWymBls>j7zwslB_z z)VS-cKe&u!%p6v8#!*;iG+_8?o@^YDPIN@aX664*@-dAI@LJ znjGF&Ve=paH%Hls!5TbKKF`k!KpWI`-@oMqlX|_POe>OQ`S54im`^Ln;DxO+&+8*p z0Ld_oeb){?-E^i2!nl$1wsK|>nWcbMnefdD;;J8J&$Y>jCxTTZW8~1TB158%wHx`* zb#|SRuq&>jdD{fJ>Bnx)*vM zcwApCQRhl27ukkloa;gUX-5lnp#L4sz&;|@-dvusMer|kKDr^Futp-t-Kt=ln7*E8 zrVX&3oAa?R8@VSE?BwoCjNLhI@G# zyReJ5{d>!MRAIjsnJ%8}Y{I6H__7GfNKXZ)$jMlM4y>8t zzqZKX#Y3=9s#jxOep+}WI?rGyZ}@zE46vTtPDvsO1>*y=ld0?2oVYb|1Xd?-1Oe5gzhq)nvya+PTo-(sLIFTU!{Dg8Q+t~Rg;h7ygP%dR48 zFj(m4=&+bi1c`U~l|1W`W-yD8#mX7Z^m~$Xg4pi7R?MdyE3U+Da${_vI#MrYqvP`m z)t9!Oiq>t21boqRW&T-tIT4U%Th)vNNnOjIdioagfVgPk%&{V907FyeJfYNi993E^ zLrrG)bvTit&DqR$4$Ok6{PZlvyB#ceMzC}} zI-wM$A{*NbnxcEsd+#!*^oF~U$tA9BgE5)%1!B3VSD=oAi=A&J)sMgxsY+*oqVDJt zsD7eG2;A=DrrQk1rHT@#q2Aj;H;?m1;E9LvEsHkbklO%lB5L6>BUK{t@6x&1nYS~B zA?4be5wCRY);1}Is%PcMtOM{yf6(hrl*c?FaH0~jCg77kDs|U+nW(R@@QKH&txu+B zQx@b?4f`9!TDJ6gd`4Jtn z|Fr4Gfb>dPpg56Fq!ECV#(49_dbF25$HLxv9^D1kf!@EGWdJZ0aG4NRe=$gfBx_LMK3 zD9Kar+;WmBoNB!8A|N_bA#A0K^OW8zR9dAta1@S`z@O8X00~p`_Euy1vKE*zJ%>Cf znni^x?uv?HB9(posb!1FV@}>q0-KX+K(o!~$FO^D3$qo1m-?n1#=(kJEHrf2--K=DIrMIR;4DB5Mcc4OB`A=Gm3wPsLJRQopya42Dv9v z`HT94LCAr&d{n_?BG|b3e0Bd7bRN{pJEQmAjL_kmv!R|)@CEag2##~Bwn|O9e4V%& zn`$d{FHIvEeX~Aw794;eU4TL9m$i%$O&8a{h5_3W+;i-7N)=tUm2Q86o)`fw~c z5wCYQ`68b|Xtf+T-$9}VU!574(3hxwZU`v&F$s{8820J0w#@kkV6k`XjKZCj3J94+ zk=@2Q;e%@8h%gl+d&~zbzp44MGz8uqB z5BP*|N%boAoQFjoa}vi3{_hyyvH1nB>Odmu&7W9)5H3-rr zwiAniV{A@XhOz9`mP}>-Ed95!+++&37RrJorUD9C+)YSB$E=4ikCH1o)kVvT#y(dS zQIPrL-XmNaOSa8`7tT*ej^9RFrd$duxfmBiC5eIQ+C8(If8`cB2ScuXW*N8NdhwEr zUZ2bSx7g7{nc%HL8cWNN&8&YYt=s?tt*AeWg(n;p_7Iy*->I&m;ex6i&`Gf>8z+4q zgbBR|JgawH%4{hCv__9=S(O#T7CFesfRsI6iNEJ_cbS_}LEqk-ffK-T@VdSu{-GwqVN%eEii z>j<_n@8wJp3S?ruzz(0pRSg&K$=1kDq49RP-MSw0LTC35qfHZ=RL=vX1QbbQU8c9@ zn!Mjxy<4oz6cdJIN>cz>oF7R%%ocWWmd@+y>5+>(YN=*3zz>1Y3*r)wRYWG%op8LbsZ)hzg9h0>B$`J+j(q#HX>}fR%a7pCclTV z=|1&A%k2MR-IQ!3xee0=q>KYjdYL3risQGNM!`A*wYL$6Mi2Jc8M9&sl9s#TD|51> zMd(SL!N00JleOM8n}bphxeND6_@n zG-=LNCh+Oy_y``l%d_emItA3xm6tAX#FL_Mw1^-vT8jN$0T)Tu$AoV&=OJ!=?lbQ- z3o{!7R1`|SwV#g_GhqIosQ+!Ht9l04@)Ja*S>9|33P)n?jS-$eI6IocFhv0-9O6V# z!gw2Ai5j27$*a1DmrCscPDral@G}7I`+LRvQaZYv=|7+4cNCDP9IcGWNl0B?RA0(r znYI~}ow@rNEf0fM+`9!UVXFmv%WALNX5&IWTN1vQ8!xl4^AZt!|enOOJbX ze&L)e68H{`sBPq{sF7t#t!GaQy<&{P^0nBwnwJY~jPwAqebw_H@;IkYYW0GR3iLtEs`%I zuG7!d;Pu_nsWA07rSa)5RD97NmH?)EhUr}5)79U}_XXRMn8WM?z94-hS$rfgS61N- z)w`YXsD6M78&h+JBLFbk2sCZ@BVa3l={f$*3r;NB{8>Am>lg8-c2%UD+6CISEL05h zBEa4V1XyQ{?BpUyPh;~d|8Bts(bGYXtU{5;rRjTE3A}^|Htg7b6_!XP+3hSAWcIw1 zgy$T^-T0Y_7(PskAX%46Z(aLs9xKT9uSMPBmH8ATbV3LM{f`efE)puw6ls-q6AXw^g#N{O~Uz}sTyPw3;)oF5Y~EaMvjtw!uC4GZ?2^eh}%a={?0vOC&kvYK<1 zD=_T%`mm##T?E6BBohi%bS0ixy<<#Tze1*sCD|Ernnnp>L@{({IVryb)m0+~4jRIE zjpt&x&a_JTk=CFpN1wu1K%TFCA8a1+z-Am`NQ>?^g45<%()EZ!zcOMczWTF;;UpS! zsI_d0@fyElvjB(iv$+ewUOP&lbVgGs+Fq3B(?^gElVKYq-}<>gSO>F3u(?Fbc?o8S zmg`nrv&Gp4nDh`SIC_roIyiBByb_roZLdcIe{+=gIsr)32h}R7Q4cA*o!CTvgl96cnoxPn@Q{uLoci;FpZpts}`;#72?<$~@>@ISh! za{Zfk!9Vdd$;74gk36uv)J;g8?l1@z#G&+AotjmIkuVT36i{48|R+tGB*Nmj3g2?&RU`<5_Gx^U=4&V}-(mZ3uRw*eSN7LbOA&|@F#OuFbj&IU+tM(T7!p8GDC9?=a z+R?(i39}tzLJBGELqWZIdKO)aXK-9*ras#Mdwi(LJYgvhpQw`<<;RUG=N7C?fXag&m1=XTaY^j;(mR&UQTQ@QR$ph}$eXSPb zVJVr$cO&yiZ@J~!LUIts;7yXy-7+Sw`>=aur!=m0JuATPyzu@$x*8F&36C~ktlJO? zI%~o>I>|s%*k!I&mOP2YcVzjZQ_+c8B4N()n4r#mp5S$wX223=DYw(zD^ix7@>Kan zWa`cMT{X*mT4ry}%$XR^9uBv%M-L*MfcpY?L*D~ANc!cd#DcwSD_o^Z>6OK()>BDE zP>UHP*t$h(g zqrKMoNxf+wf>OJ9yVxCHLHsGdZ}pq~VQ~W1H?P!LIqMYA7F7sPI+}h-aE0qe#1oy2 zg7-b^tmKp)*8D&*i}VRHuklB>9kNMArrC^NmCMY#X=&|FT(Noi{B%Dh9qA^^lg(lcVRXfRCIwy_pm_ zkLN?1_SaPIT;Rttkb+AG$v$4iD$c9{A#otzh<}FQ`u;TAubS7WOSULGmNA&|0l7@= z7h>{oqRzx_Th*uW#C4eC4eZk69*tjk*5Q$iIYXi3r%P4TzjK354i)A_Lw*P|p5X*l zt|%1Jfm=C@+EK3$Mtrh;;`x|)aUZ}7n_xTN8DB>1mDSt5R)0)vz=O?;Z99w0gBY?A z;JJ$bmX%rF=wx(kmf&@2`^#ftSw__N_nq@q_#vf!2^eHzbD6b%hGBb^92Wqs^a;VI z-P~s8B3+0pQC^8FZ8rng_=FjZmSD3myY~~`>@X|ooLn9QKx4C)o3|f0>r9iu)wHs{ zJ2RZlF)RzEVUNamo=pfsNLrQ{6=R%+zp~J>qdiPs&~|~ohcZKixf{ZYt^h4LN#`%5 zokR~Gg<<`ZT@d4DzVc}z7_?;8OxA0|!5wh!qAqA0yM+X448It$g=2HGKk8QX3B{Li zmeuagw=(m99JYOZai$nVVN5xc$S?;mMSZyt%~=igl^0L@tGUGsmju5ZjQPCVw@JGf zkQ7RHw&8UDYw)196_(OzV_JeEcJmoMvN4&8@$`M%3=y}0JL6@(kXC%jGhB&B-r;nE z>@p>wp8ysCIt3B|K=gtso6W-q4O~4bC#EMewxwZ)Yi^}$;s*E#{s4`1mB58z=ZO)L z0u?fNun7B>{rxX7Nlcj!3pEE*FfdQ18(6uB7y@<`J$a3ypr7ub1q%Hr_)vNkypShe z3|o(=YSZ)QDcGrjl$;lQ>gd=%#dG=WP!q2GY7B2|OPIEP&j3#h<Z$xO$Ag6aJW{>_lgfu5`l2{*d(H49qPK;E*(59!yjV4o?rPw}9Vi#!KB zYe;?ibkA8lvoD2WnLPX~_z;?xjGGX;-zB|XShKRGK}=ub4Ti%`qN^i5c*~X0BDHow zMV;8a;xWLltBzuu7Fe#dVWBUZ29j5+$FSxWttUkA*tcO_^Iz54GZ^3D{9T@nZKY$^ z&S2!bH~S!?m(rZRhCKRZLhM&$DEAi!i_G>;?VNrp`DcNQ^jK!;i}ngDv}4{K!~sX> zfKXKt$WM~oR9f(~3WM7mKNlDlR?VJzx-{5z;3IX!6$T6e^w(Elnw9fcWV#akxX~~aW$?m- zC7N{}buqAbhSEyNRVxuR)?1)Hg1;-Dx?=Yxrx98zOGk-H)X{_#AfydMYmOwMwpY3! zh=P~vp#-AV?tzvjQy}n28%c5Y|6VT`ykhX1l2`S--0*A5R}n`>FTv6JD;fllmC1(# zt&V(oe%?Wb)%l8C*oXo=t?U1w!C5*$bqjsiC@&2iHf0fI$s`JDsdhk&{ye`whjQ&C z<;x;#;SI?JL1>4w8uiI1#qNY}JRX*`yO#8_AU(ks^!i5U%I-B(Oj1iG5H=G}-|n&a zqS6GcYg+7Nve)QhpoJXjKwo7|W+38=fikP%R0$Zq_{*}yr(o19x^+eHY2~aqhyj3q z?Okctl1SH33Jv3a_OmGxnGe?EP-j91&Z07ekLGhX`wP|kWv|O32dZa@MN%2_PBIzg z^iU}MUa^zb;Qta$;FPmQb6CAiBVV}6e|Jd&y1&*27?GdkPj}ks^i_%&Y>}YW(HG}o zJ7IWDfat&cIMgBJGQ+4dggCFzvm&Kj3l`+cY0MM%T?D(1q)kynq`H&UeCqkP`Oqe! z6P?87dVi22XYoU1y}*>`f!UhDZFp}Prf1N{1;EfaRPqO$a1OA^+#HbI4+^ntk)Tvr zdD36bH;+5~5KWIcE?;#itc^!K43D|B|`S zRqoS)z_u};7%lHP3>E9XyVapqJl@|wH{UmmKj^PRH+0$5A556E$)#s^SIRKHp_{PW zL_yrvQg}_$CcfD?tP=L}C#CL4DqA}>>%)A>@%zT+s%}pzE@_!8;K>a=x8h!q4SmG^ zr;YfYH4ZuEV^X*FRy%R!$B*pH-YudWu+%pj-`z8RfsOyrdlY%3jHh|nrwDtf8aaW? zjp%KWTXTFqPXms>i290!RUy$-7n{ca>{?sSF!m;F;GE8>^C4kJ77ThA1wi@om!6C6 z{diuBp4%qNCgoJt;^7#togD@_-_3Vo8~iK5Aw41?d$g_ut#5s5d5&q}@-WUq_Vu8@ zvO3Fecuat|UYtQL@&_w0O@oC8_=D-zmd$DpZn8 ziXu}?Pj%zXh#x2^k9GYHI!Qrm85VEZ%3g3&ZeE^&f)bE|NNaQa8JxvBteid{b*O@) z2`m6aAJN}4A(Zx&Tax1JJ)}Ptlg+Bp(-e*{Z(SW!KHxA*MzDa0NKufx%QJ=RQlm?- zHV|@`!4gYjMu$3p<0O&s)6Sd@4WRy80l(`J7jfZ&*v&fqhAF@H9D#b_d8S=)&R24x z0*E6vhQ==Wx4o~}U7M7WU07REr1GV&4nN=w)5J&_B4rdXb8l?>Ue&wo$S=Gu(9o#m zhxCcdsTllVCYc+R9=JLS%9FZIZO~0sMN?5MLBOKsOHMApY&bX*yR{i#FxtRf`A?;} zcr*)vucXamH;NmX{OkfurTtx^fiz{Gj$1yC7H8+t)zgpHGN>@1#x<(N!Q+yW&d^hxCf|>m=OU}2HD+mIv%qV7)EF+$C6kC}qb~j^ zsYqUmd~g?s7jtGY`MsefC); z319fo6jizQ`auZf^k=PTzqO)h0cC94?7S`Ei*7i16NmUH@dEE5F5_hm|ARA_pqydm zs4~j6>AHj^I znm^azvUU`f?MwooTx-AVvPY%B+{cOr29*vPNlsO-wAfNmYWILA-DRiyfztV4F71^Z z!{oFpGx?^F;u_k~3f&kS<`>ykUZNyK`b_b_8M81? zk*Rx57jUe7#`*wkB8zf1&{;*mP*?zUlTx(gRew zMB`{$>TTv7^9c^_$%4^|wE;OSdb#LM`H(F!+-z(xf;3evEM*&bN+8Wn8eJ>)2ZvE_ z`8tRfZ#(P3n4uX3e|05gb0M%}qHUT{DJ$dbzU1_83uzz~SIn~XRga>xt-KT*EcNRCY*>}=@!iw%5AY*;8%P@rAGc^wj!?LfX-Z(Q4^S%lMe+5>;OP1wE@$E`+^@@EB4kLZof5+YV9zkGwLKY z8Z2b^oY|n0?k_jkAPpJw8%LNI@8m2SRhTR*j`{T5!o_X`2&S@BaR+K5brAniVOPbz zOF*F^HCrvP@p=1%ueztk)=Xhr}-T&jvGsiG}3EwLmh@Bzs0zZ=m8TUZM!H7nI!L3H?COL(ll` zSjR_5Uq^2j0kOAYTwNblOmJVPZ|y1}krYZ)QBY%uB!wbBfKn8}MyLtx8#$;UWuTnW zc-r+5c3Z#is$T1(Kai6^P5?6YVBco*GM;v%ADNaK{l|Myi=jVx0Y9J1aACs93od9w z|82C%56F(pXgbq;FeeuIib+ZWtva?0n!o~vLePA)T7WMLd^?KUI9U$-J_?4M8{>R8 zpYeEYSF7iFfV3m>K+eiL|DNOC^7PYFX9$>4q+aWlu~_2Etf0i8Izado80(aR@{9sY z4PjQHsN||yvjhm07=|87LxsGGADq8G)KEX(w-oFye^Np~*k`vCYeHz>VeeC0AcWs`>gFL&0@2!!E zk&Zh>1l7Ar;9w1Pmz|SiOj95>>%3$kel)VpepnF- zvmW2BsN*O8>ocoqgG8;OAkW^TFVE`NsbD{>{tdDUi3N$rYR;Fk@zk|>kY+25Uod5y z^nejWZJ>bFARDNtOt{xc-s>UCW3wYJ%ba$%V|Y=xB>KO_)OQ|lBdL6aOGy8dzm^Oj zJC!f({ghF}-|I)1>QdriVR5#_Sq7nt2&bT$D%3M}X#?2t5NXd?+NMd(l&i;-sFWg9 z;7tL8KK7zWHpzK<`eI=IjE2bMZ-BBa+)hQ>2H>JGK8wRRAZf>xnA5w3#57&?1` zKH15IQ^esW?8O=7WD2R(ohIINEBEfDOp$~zwFnl(W z?#pzzLm?QdQzeV>h#52Eh!%GY+_={bn0(!bXIVZ^=OKK_q&oQFBfspwiux^AVfE`T zW3?!Lf%JkM;#wui20f*w6&vYKqK2*+p?86@YA>O8fHFwd@#Mh}iklNgn#r?vf}Jxq zax||Gc0!@$b?FY)r1~dl?=Zklx}hvRHu32lF?ioUtJjKaOXol`$Wwfu54wxmxiIXG zv5zYESsb6%G8i*v8{SLWXl1TeCs+4#xT&C352X#?{L z3{Y@&x`*AjuO6E2y?=nstrQ4d?R_9`tPZ|QrXor`g{gbfIO{}K&1v%6WcQ*IqXYM1 zvi9t>FVSLRV}Aq~^)eW;pQxh;^l)#MO6^*HIqYlH;NIG+_3%H-rehgj(&Ol&nS5nL z!u9;(vPm@&lo4V`5P2%WbP0R-vOq>ckgL%9^#K_9&ornH4;X3LumXY&*&eUaLxo=a zH;i*ZCekOf45iO$`LwTg==#%4wYYf1VI#q4XSoyAlQ=y-I@gU3RnjQ0N{J;p847|Q z=MHc73lhZh1Q=g+efCh?`gv?HAZ+7>1*%B5a(;0-M@vBukIwP zj#jX=_k?7nY2pudwW%`Wr1CjQoIZB-I9f#7!X(4er;E>?_X9Aph2)YLn-G+)24SyNL$C>;a=x+rH-)6^Y>&+~t zA4TxloGmM({q+wV;`K`+A1&a@F6!oLGg@TE_`B+l=Zl;nsq7YmCUX*iIUhu~>t6}6^M zKw`AP>5+=)u4!9-F=ZJ*axYh38s&+i>pvudOr@lxx~eZ!pbNxe4EU-!M5K_+d+y}Z z!yb&6kPXf=^a;gC1qOOwrph2Y^fZa`l>5g5UxW4(Td))z>p0X>7u>I~ixaiLvX$9! zZY&v_SV7p#M8#-h{P+rIwi3-#>%c5>o;pA8QBU=s9@gdP}Ke!R<6y#jW>%J^=Cw=P%|2K9z4I-^`@B3_DXB4HWeo7@UFweNAxJ zIeI}@Bn2L$HNa~Rx{%_)SCMcRWnlPJnKs}!Uar$7lFtE!5a{oNj^0bNdv{Zo59iaiFMKD64Np0#?-Gq zpM9WSsLko_yRxup^s&nZXEoj~LDSrrlT)5~0_Z*{Q{bsR)x+Gh;jX^k7^!G7)&xgq zBo=!PnaeMyYm3?vr}dO-0cx3t7;_03I?>43wCca>$f`r%0ts|oPWw#&H9*S0XPwD1 zeoV(6IB)7=rN=KzzM{V`hF2gzy`gTD;Mkqzo6JE%Zr0-kF2Vz{PtooE>_|`t$ibdW zr&zO(IYP3_`OGL_PnJ`9E-C6u!cdKPv2JK9yj(5=(?6|`nLP+eP0-P;i`Y4EFW48n zIqiw(`_zv;b}7p}$&E+nj6F7O{TV<9AW4U-_C(xwe`#=aEeakOkRw&?vNMgrg}apD zWk(EZHF&TjqRb?4@TX4SPJ6zfIdNJ`X%;Xxy7~Y|tluKJy9EPCziK_H-$>6a3f!6C zPXN&MR*0Q}C15(;UBdU|Vt?IHFhAdwc~JoVM_XPxhzL73$W6L9_DjU`JoF|EN|!@% z*{fSNY9w4=>L#d^qf_~*0=vvNUwgTh>x6GFil}>UF`ycw&=@gPhj1?ddg*0B`M~*z zCqqx1GudmAb`ee}m~dw4eGQL)Wu)DZrNC8t9DD+|7E64y!U~TYYe`2JvIAJ^*=Qc$ zO@F$uE@4VLw<~!pg|G!O_7zjRr>hm<(@9{UYq^+$C~&VB`w?FdvqlsKaN>nZe;B9 zve%l!iF+5n&fLeET#BD8MxKA-LZ>(d0@(K&YJJahAbrgik{$n?q5czW15~>3({lED z$3~edAVoEHSd3DCswq{J2w0~-(B!+@0fNY>1C5s&ztMzU=vEY#fY5Yc?jU*Wa60MN zlalWdMQF0z=#*CtCzlbiZ`6Tt)_@z2KwbnjHUr7QC;Q=?_<@%B7P0%%|)#myDDF%J+OD-GS04JjOE?%Hy&jAu|~-JUYK;YU+2KoG&HpJCy@Mc)2=e3C+A| zc-6pfd*6hTJRmbq#kEp7MI(*eG6^_FP3{sx^^iT*FR;lfSnI8Y+PrB{15&5s(%KiX z$K~mjKPQF$KMGn4su^R{$0PVYd}H`sg$u#rK&Fv`m;VV4R;f3BN^jlb=%VE{Y;$w| zSREkR1}UBu^rY)u_n9y0HLrJw6hiWRXltBk6jvxb{B-%i_JHN=1;H=^0pa?UyI4K$~ zkzBBDzTl#B9eE`7(eY4%r4hHEg0AE#7ytj+L*H2C=X<{}WEFdC8%Prg86CF6!s>>s zW#u9d8n%?{p{ZfpV;&J2ep<7%;9F4s=;FAiv-Y2pIOvz8%}JeN8ZxS)zq{I8x-5p_ zI`dkby;vT^BxmPEEu-e*Aqnpqk3u2lIKgD1{jX|tH* z5F_0I3FtK_a$(mf@sCBD|HT+|ft0C)(R5c3Xr${^_SqtVu?XS}1Euxg5e+t=&wCgsciqeq~mB}QGnR)@%Y4J_w?KWV%Rcpr$PE?lh$F2Q;6dHR6g!{Q=}wBcSNN@J-R*hi?cqJtkKvV* z;D-PW+dIY%aD;!l8(wzX=e6sg5nXs|gCP>QrkA$mHLU5Uof{D89a94{uo^-17JFUl zYlpD8)9a%;~O?|6a`J5}^tmG}n|>tfP$H=cuPu5?P=yztkbdPeA9{ueM+F1r!Cq9Kch<+MB}Io zMv|=7Z<;`Q4P3vUwCQsJzhkSpl^114Vt7W4dc(guBYnsc?T`A{<_gSV_nZU&*V}6} z=ZD41lLpF;w*j9@@NIZqq$L(^#;s}n&bm~z76wvXBOca`4h&%Fl;F9$O>#gG$BynIt%kT!Jr=YhI5A3X@R5sQqg1oj=?)a6e-PQ!i)P@&Yo#HVg~( zXVjrsK0LaVc3@W8uhz3?#B(J<$h%a$YlQF9-No8o`#^A@TB{lh>B^?yvv*UvH77r^ zbRLE!)tl$PiFp!lU`KYAwX0B*j`qiGbQe~rb)EvI?Iz>Z=#H3tR*!B^|KhAil`Az4 z%|`e9SMf-$pHiR)GhZRXTb5~fz4e(j)mA!Se0iJCaRIap*~+Tji)ub9DNBY26$|nd z@OnK`ol^cqM6!W}{C{i$eU!gS&A+*3ofibTB(|sJfJ0>|v>~B4(G)f$HS;$YVU#p{mOqizqtrw(<9RtqiJaQXXT(w{(3Z@vZTMG z^}ELXlLnXtuVIrjILzg+KZmtfH7AK#nFr(xlGJbW0WVtl<)3G7VhWsp$?l@)775m0mgVc70+6C_w`rAeyqB$J{_f7PKwo66#RS^#hu?LVkOvAfaNTCm< z4EpEYSHH762kxc^M@3Cr+#4)B=HvBCjcd^iM3mr}ZNXcLCZ>Iu3MmNPY!1rCq}N78 z*?5O&J^Mwi*Isai;FZx1Q547_ake8)eu zmWpf&cJyk0LQUGu$K;ST`x)p$Z!oKsojWBGv z!x63sV$s>gc+n5@Vi+#I{#+;VMuY*QtvGzF-5!d9TdNn)OGpRYmQ7dM77BuhB{ z5)S(vKP+Yh2mzXyRbjxGD`|S=>gxbY+G#c5S3%QvC(58NX|Z4QR|QkbOaJ<&R|^VS zd_NIQKD5_{!mOPr)$o7m@9MyBL9E1@#5Fg=G%tRW)j&JJ0Rk5>k$lAKxiB@*`nu5U zaqv-AM!Y1*P2o6@x*e(fy!#0p)>nXbFGX z+e@E=jB0l%8e{_l5>kvccmp8VfL;Pd3K9Kw5SE!zPWqLDX_QgEr!b#tq3f#3dq}LO zxl4q&a(&la2gMfXLm}UXN}R57?l@t0Zg6(eJl052T#^nX6~3B|1Q&+b0{nInh>_ty zo~&95VXIsB8ugZdm@~K%%Wz~_qvhxw7W>g&?Vbj>B86f_nKvTAAyVmC zWKrM^ha0J@94NaM7hS(imj}5YZ+#0kve9avQOLe5^Au;R1~aSX_2BZkI|p z1+dtnfX|ED(?(uD;;qwqPKZs1cjq6%q>y;e*nTNeRj63^6hF*Hq_~>aFJx84a!HUj zn9YBcTjaMr9CSwWZz|*~Mc6bIW_l%F8gicM;R=0K4Qb}R`tC-3rhy8~Qx3M;O?OY@ zm0_J@nEOaZHr8&beJEusdC>gMGwam>(JK5rf1_HkCHv>&m*($Z3tel#d0PTjV$?X6 zze7HTMeLWs3pRtG)dh=}^;Ub0g(=H=49&*9M^|9wgErZ^=%VlLHmCM7;7Z0%MLH>&&SctM3QCfPJ<>`7A}!{J%}Uy zRUnOpQ($KpNl(}!-iizNBq^zI=){`{=WF zz9}JpV)FR>)a>bYWtnWU@+umnKYL7;wF1>(&U0xt4d`stVi#PoYO9u)3z-~U0Nk7y zLi7EpAxWaw3c(EHe~Z7KSVX4Gh9}=Na6s=vJvNm7z+3`89uT|l+mq^}YN&g)t?uVXI*7xwHf zDn}Lo)d8mnwyP&6RoBZ9%}ze^pj(|9en`7(Q2?j@g9(F98p#xTu$*1NNFW9j2$qPN z=&C0;HfGIGA1U|q^SSrSR@L$ALAMd-i1oM)AtCYcA#fWG+7O!&!v-A-<{I(nGbHC{n6=! za%qX)(IMr@GL+>O=Xv-ST- zsU35D+NGe=bn%}k!eKMx#+@;)FLfg*ZJe`{ zES7@;0j^dXB0pJeBxsYpNW+oJAitRZuxZjApJu&}44?J1n4_Vv7&ZChRB`s)^TdEo28;KgC(9g4i8le%T&&6jD~^qy*| zvCQ*iUd{bStH6ROo<;XcW>#O)N7iQ;$2?__3>)CKfIR_%Y!Z4sgr}|_I06YtBqxgT zTsx2#3oAEmviyNAXF8QrZ7T9vrh+PqQ{=xJ3UNL~8zDIX5B->BO)8n?}Xt=n($N9zXow zg8xt?(MREUk8jMYZn$O=K?I4!*1!oC-6%T*kN4gF#q_gis&gp1S+P%fVqLw<>~_vZ zuG8>VvMZ-=b{}60Vez4hmY{nr9<$TOVyevP3$|PF%WXWxNe=u{wcHPe>D5>CvGo~7 zseoA|LtU0a@$xJ&SwD;=B^spkZ%{FK@0Z9$yRjqQjS-J(lPi>g)_Q=+8Mm zC6oqvL%IuWlr@iULz_UoWBj*e_J#_y-5liFaHkdTN;-%b^VyCU%%YWdB3&%GT&!Vw zdsgIg;A|n0L*9$ikmUP1--H2~WnWkDH{p)7bz5WL5Lh^EHD^yw#lMJ zBofEoct;jC6DyffeTAhoR-_oFo=XR~2k_^Bk@aC4&FTG5@t=8nX9RdOjljkte&`D_ ze$7MYdVUVyU$GZdwX2seH&r|Bli}-icrV$LH&&I8tp~B#&?QrVzmz1H^qGqeCWmBN zgQ}7Pzl!h!+cwkHWGeo&%wAK0=39dAVTS|}jmYzx9 zlP6uK+cSXmG6YigUlhn>@OfZ^69w^X`3cp#P|x^7&~H?4FWSW6vSTbk z*Bm~5kGX*2u@Li%#f982_0@f{f$uly;6HSo?6vN0rP^`Q1QyPXYkRM$Ma^>yy_8WI#LrSf{j^_uAcR}6Ztc9dAB7M>7u~3W4VJ(nbwa^#NH;o zc}FiA+;ZRq{vQLyjbArv?#HQzz27zXAr|ne^#YM02Ryw9lF6F*H|LoE^~R4XO@b-g3>t(~M-QFuCT3{bPVtT;PMkB|w5(53+ zyW4Ne8YF18e;^bQ2qGoBJsKqo75%%nwo|#GI=UtPDe?d`r-c?^nTkr{mN07Xdw^q4KHy@ z5=chF%qMCzx!5H$>@LyAmtK1$|TEUoDqgLH;1K_e_~E7G;ea5bD9L{X$X=#p-LE z`UkF2@Z%&x>w9K4LhxLn=-^^FS}`UJQID-j4GPeUqG4p<kHV}?&9c}g^_$!uO zk^JQ*&@n@2Ug1Vf|t*A#mjGu%xr;t{ba}y_))9!^-L=Vcb2(DT}uH&7zD*`B5 zc=;a+xfJByVFj1)(cVfS7s(n{0`Y#PH30%d<0r*Yv`3TX;*@3DrW)i`gZkkPGZ zDuzn4GEOl7Qtk4LrBM z0wo1otLJ)yl{6$0W-@au?^hxwyhRc@d|D|<^4h*b-JfThU(N(UOuI9-%wG?bS&eV( z+LgU$kJ*rI>V9!1mqiSzs;N3XCcSXSW_QNbFieTqY31pujRT&+O=+QN{cjUh01Q0@dy4?F&=wv@=CvSD+=x?=rWu>;q9V z2-5Jc-ueOJ@>uH6bh&60B-zph1q6TX%I0)3f~q00oxiKF!(P!UH>w; zwbZdGO)>hal=(XnNLmuXpU9X*S_(3m#<@Q?Ctiea3{FJ}RX)4KJW9#8yV% zKArZ_`9=k#YJI`Lv~SMm-bQ(nSe4Kzc%eapUSbD&sj~IJU_$%?qMkP>H|OO+5fMa* z$rJ^*j32r>gsh`Tij>(jO`b<#;ByjUJ(&TGXo%>ORj`pIA-C&@$hw6$_1fZX zG{zkqbv+nwyo!a9eGt5xBJNeg%NHyzMF5=5zXx`;R&PiuY11dIK0AB(^snH(Fm_v> z{4ckD67(0Vg4j`Z9NE_LJ0K-TRG+fnYG+s`+K4oYnyFvX-R*2cx`eHb2Ln;xYdzU; z86_d!9Kj=;ltgq$W8vHMl~&R-{c^@vARQT<0fW5Iq`Xz;W&CEpsO9Yp^D>$wNEcWt21O^cqI}kr0LhKwYn>O zB`R;eKWYlntNVK=@mO8}%Hs!_@;`9k>te0++-1+|SBz5utoCz*lfFpLMI(lJ?{ z31}LwUqRpm&Q+p+!3>8>2q_6|@0}!moSj{Wu2q-LE_iCB14WQxAS{#0FcsGZjy)YN zwx0xZ8c{7AxuQ#!g0;8+>rcjtXW+K0RnwyUBL1=!5`aR4+(xG!Q)B5FJel^=F`8gJ z|C6LO=dV7l>6)$s4iIRTJs9*kLumLp=UxkzR)d&H^b)9gcy2h!PfVGhX1<^8*`10$ z+CWCRuUQRt)RW>My^kWGev5+_T)q{P6Yjwou+k`qoF!EI0vy8AF*c3T>g<2(^_@lDCT9}yKzC6w{S2S_iY;DoKk{ zMZLLpU6ugYo7wO&oeE{%YyB1>KA6;Bbwt(*Eg<)Z%r*e?D{IPisE z4w3$HXTJd*wI7!=Owg?&<#8lyopC3BSWa}N?Jm=Qcad7$|ojyhPhCfHNH&U)4juWP+T#XF@-Y|4>Tq5ooCaq``NL z#m$%sw*uO^3k*yF*YrnN%ZHeAE%F5gG0!p)ewyTteR3r4mDwTwkJf3KU|)s7?4hh9 zR_gpuz#w#cYkKu5Whuk_6DrC@SpYWDxWWXkvlTwG^H)oV1mqLMbht@9R;X}oA$KKB9JHqld{uL4Z`~% zl(*Ve5hZluolQ}Z!04d^k68+GT@ZF3yPykN{e^*q+nL9ii7!ojUb~8>=__kd3ZtxBX!;HUC$W_69koyOuV1O84kBos2ICF!4(gW~Z zIk?tNp$?bROZ12!(5BgvzN=Sp?!B{w+3N&nXE(29*IHDkU!DBGgE>&tx6e6^O!@%os@Y zfgx17_{*hC!46m`w<#EnfxRIkb@yaeMyk+fZ@?(^m6HK??vKVG>s_K~zD>eX`jJU; znILx_?)4`I5g$Pb-6eeS+!-6SYW;h@=jK0KvWv(cQ8xC_MvmT2{OTO+3+F*l&Zb;#xju#ZOe8c>rCd9JeI*Z*Wfbh~5%b2va~HJsk`J71 z^L{s5TUTr}bd>GgNH2V-5!~N_=8r*^-nG}Q?Q$-aWA9Jw*kWU0)7hQhtm{IlIU`4P zso;K;BK^V>p>EWCz7FsqFO)*5KIlK_{=T8>rh6H25;IfTR!71q*Kc|-q%y9@S27{t zHo&V2z2gHejO}VE*li1QGglnLAzZ5H9~MVk7oq2;H(s)FnCm>cAV?j9qF(N7xLscO zh#0k63gX{&b6$sbDzWooWV{01+jQx}T~|GfPPy8!6zRizRJh@~cF7drI@f{U%J%%I zAi7gjzIe{8 zyuH-8m}!)0P6BA_-5z%tO>!B7l4E&_-*7PgmZE))f^o=bG!qUD=3@ z*=-im7*B8+^*<8Pk{$;ZKzknCFQU9pI)f1zM%#Qsg>PNbRB4wRu1teW^Ahlr@m-Ga zK*El5M7T8_#=Fwlf*wc6ItCscu52o8rK$_Hsy>ZtSxf6C>xK0(CDZ_nKYq3m9#p$d z`{4o*x9hE1{4dPpk`_z}r

nvuJO750Q%tp2I^Pp$TN4^$0HNNB;%x#5h*yq*j%`7s$4D=#$}T_W+9mIsta9lvUeni81^KQ()N>(Z(#V-Z~t4g2K~&pYTV z%CFQ=OWQr~@;(R(T!czR#36;T(!fqcczRIpy5g^XeKo%4{9!luhI06(a;KP^jLNmPw`zp0zUREDi9vA&DJ*;X z*~O$)%$yzw8m8%a`3bRwTIafESR1CCG{um)TgAlZ;HuAx{|+?pF9% zv#Y5&XTV}56UeRLg32N!F;YEJ(a5D)7YauMM7f=SDpVp>s=SbQPnu+`R_iLQ+L+Q( zmJd2MAb>`Et^EN)7x|YUW|Y_L_g)`Wl&}CYdb^gB&p0*HWXM4$suydOe}kXYLg0g< zUr0)5BVKFKc<+VsQu7j`=5G92D|8su8BYwn&P)K! zK{w*u6-(T{77xi2nA?GOZkYJ)oCQNZ5ic|{WKDDGBoj<9C6j~!8yUmdy*%(<%QVLGSH6K#Q;1Fo7WrQe6FE1pC`h5DxfA#t1(?1){|t5pRJ#v-;F1-Du`S`T~WAx}b1LL%&_f zGoJo&p2%1}?eDtjT5FFK&eDig@nPy*uhunH7eH1-n5_JuD;(-b8 zs@{)~NlOodHC|(YT1&j2eR!96BEM?HJQ z&bH$r1roA{xcA-xrsMG)>?I zkj0!Dw`cvtXsr^5dwO&oHXFOr?Bv6zk>>+BxUbdteW3!z+-hA zHqVNMq!1_E`^uDM+23!KTmeLf1qH#&Mw~Xe@K{#P3R!T$Ca5$~B4Zk352iWAP3M(|X<4%uQLi_Uq_BR4TVmg*_Ej?%#A>i78*Av-K_1DX z3IQ>CZ+>`7-4b#9KKnnA;&aD?ZiK4Wd~F&;IBm@j7z84Wl*~w9*q;@f@L=^q#=0^a z{Xdg^E%^J0W3tWwZ4nf9J`i@<D&$B#C-um~xH`v? z+xhOwq8qn2bv#n9#`8KqTj(`YVT^jMANA>aY_U}?NM^|Gc^=!+KL}D$czhasOIDT6 zw-4-fw{u>70c18Vhj(ASrCJ_o1lh>D+60)W@_AH2V!`t|_ZQTCNV$ve)gE>q@d_0f zX}5w9O!6wJWC%)MuCQ2d_GmVDhP`XBgpcL57Naaaw$!JMAkbU1pxqygMJ(_@`Xb^y z64V+2Plg@1tO!<+n=FmaU4Rer>u&5j8~Vp4LdbmyHnuu5COI{9BhY=vkz646w%evH z{Sf>6&dNrP8C%%)h53ttbsG(MxgdJ8)PCWX@95Br)gh^qfge_6 z08g8MgA-&1S5}qxT8z?stT8Cc5TI7AsQ3L-!AZ~TT!ylwh+msZ57WO615Mju+IBv^ z_;_c2-Cx5k`&LK9Yc`<5QkLv(Ifve22@}2<@eIK$xzO+ZtL4}}jEY|3N8CCL%|^aC zvNP#^r_8T=RG(A_b`m!cItH@(>}Pp1galf?Q+;cTHt=xZRxh|0y7?sg$*r(B7L)-| zz-(+c@;$KJNjir_pGH`yM*3tUo^t>g3cDm}cCjxwxY>XmY9udqOSnN0R4VN52Q8D* zidZ{556bNUUE>ZqoHobEwnbtK84ncFagKM)QdX-h6tP_4Hug3zdSpGbX1QF$Y3!#eBRM1QBYpg^C%rrLE@^iWxDBy^+0%ts>g%h%u|yXMj^vljzYof} zB<<&@-z_dDqs!IH*e&M6#q?NjURBeOTW7k0hY%eE`T6bioh>BI2w5vjNT&tdz%WETaivAp^ zA47_&O3DRJ%CYeI|DR>kJ(v$7$M}Y_+R|D*rPxWj-W9AAWHnF6hzYt&G@7RS&O`0{ z3yoEx9ObB$<6rl3Rub!>UFiL8f#M?0eXhTW0TOKnYwScWomgsVy zJ?My!J(6}_igr8jgXdtvY}SXn`;@2(i9K^}*b5Bi#%I5pgWP7*(1{i@5BI$MAXWZ> zV0kv1!!1lGx{e;$B?Y9a;b|7KAPa~Ex%sFJk^s{UWKIcKNjf{7Tez8TLVAXiA?a1^ zjml|Y_;-Guhw@tS<#VS~W{IRYx$5qk6(NhgMs{7WPIt=kQ~UR zoFl!tfj*FSwm$vf-)0>zEd?vVD#F-q=MADVl98-5wF_iJSj7DAcZ{HzW8+A$dW`bgdP0P z@V##jo|xbXxv-l1_0!0cFozX4=_?Tn_?(c;681;sHbFZ$5J$;#ECM=!;fsUyoyA(F z89pF;g29%1VXIVq(lK^|nCNwsJmi__csZrF(DpK(FeJo>7>Yj!pC7*UC~M=Li1a_6 zO=3;b<}VwgmI{se7SS%m9u%oSsItK*1bj39<&vir?E2sK$&cybfW3Ep8w5h3GIr!* zxf{rjDv@}~%4Sd2Tixbz=B7+@vLnAk5GRuS6q%EToRiB1pjIde_~rO9e`mUjFnf#| zvV^H^uD{)+R;U3(lrj{-ldWPXF2nk8g{`RNScz=fDqzEfbALBnT7JGmz`y-&X2e+CZlL*7QTf`qV$uB@rS4W&+kL$ zgFmW{wuk!dKo9=4Z~bT3UJQ&}viS2tNQRTOqstRpS2yJmGpn?UG$-EvDq4+!oD|t| zium`0Av2~9OyXUPn7swK_uf9;jHl{+bM`Gsv+1+4@p>#EpOCu~9(a;j{DyM8NrN<9 zAm|HB%}u%ks02AcfjiID3oOh2c~9d)d#>yP^F$w9-16P|cmf=4

d09?Wt*n zjTirZV(6Ty0~LaczE|RabMNgofE?R7Aww6YWnPmUGQHy-Z^XRfNqZ33m@W8A>ZG3y z_~u><+oK{@Eu2HP0Xy{9p5-4&|Hwsq zuAdO_(2B&)bDPSjnR_+GNy_{9Hk=iulPbnFOa+}62Uou3zLbg~_La!l>`c@ec$4Q` ziaC)J^In32b=l*BJvF}6dLlUN_q3rq5{;w?P&h??q=FY;6L|J;lv-R0PT-#8-|=A5 z^qYfUm&}Iw4`cWb8G%dm7row-wq78+L~Oki2a>VQG@z|AtrJAGY_+iWD)m{{-nuB_ z)dAIS8xY5K&DM(0AVM7M>LOP3ZiN?;eEwi?gc{_@1uKJYLSHlAhazA16u@q_bA#h8 zA!%9`&;Z9`WysiT7EakZNIHSr$(%02lUuu)X4&(<K4;Um7w zE$b6C5$N3VA6WKf zm4Vys-w+usB;ghDN&xG+tS&67`w38nkvNsTi$evg2^F?d<>AIF z3@nPhjKti6|Ms;k{s-uc^ww|E6kQ1;@%CY>HI+sn&3LkmOerEo!*0Ykc?a$st$|Bh zly{)hM0h^cTGTK4zcO`Kv_^0R98423F;X{@A69d>xnSu>yTyi>3b%icFgTYuL_bSrfD~bw&lu zVxX4YXyftB-jvO5K(UrMW=aq`jM+{1GKu60&*cPYgxU+F{l!=PGSofGmn$L+jwJd37)c*KQi2-?|zt3H9vU5`&IV6g}e~1T7 zKSsq`{0l+l_2JWC+G1dyd9H4f;j~EAR&%7#0%&Qvh@&Ad^60V>HWT*KC?Bu^s3kJ@ z33xhWhgm%?RCo^$LcA2kI$~HnkWp<$mq zW_rL3cbcqlQ3U?&?wjvO8f5s}K24xgL`z0fv?&HE-yC?BN3nyg>-+q(=G^?f{Pp2J zG1v5PdAce!8DlcoD*9wA=AK11#%+odTnm40sgRwY^eChtIyj(^6`rxtc^C2_K1ev` z9(NruY-H@71?f(I57+n6Nqmtzhz`QiGC%Q5J}Qbqudi7yn|>n&zcUNCRq zoins%*zMH<`$STdczr!tF`#>w6%7)cx>pfkqx~cdt<`)W?|uH<(i2*PtKmp4m0H1f zEcwfw-tqe_jBEccGG7Ex`v#LdO3gKq>Q^=RIdFn7nCbCoF;e7`Es70|7d{YQ*K2fd zTW>$uiJx>bCz)>zmPVvwgg$ImzEYR{4*k@OZkQ_1Ra2s=ahqg6721Bb>xdQK1h0YU zC+GJkL2fezrApT-2#BDhEQ$#gzkXN5Lw472->Lh5tSwc9Gj0=|CXj%j9fk3)~goOpZ@8C810V% zm+7-jt8{+YS(cuJfHZ4Ev!DDNu`bR86JGo@P2J?OVW^#Y+L12|IHZk$U5K2T3gC8L zvSpAQ6ho?Kw585<)Y+B%c>Gc!gx-`1e-L%Nfqk-CNcUKIC4#x)oQb+)c~qT64{jw` zv{U5K4sD%1!XE`zh`O9^t8-xD^&bhR9Z|n^z@`*Oe0prCs1p{beYM@t2Vj`m0T$!u zm%CfA*=*wmL3#ca_(&iLJRnf?bS(vDTulSazO0j`%7Q$i1tfCE1Du8-0GAB|PM_84 z{-)XsTyrjz&_lo-k4s>$;BXQF)#Kh7QK*|ZXDq3M8d#9!35JwgBiyyiV>3coEa+=@ z!{|wvd)uNe-XMK)fH)_1y>L%s9c{pl^*KH)@_;iwcPO@H z(Y>>Lmww( z;1<1Bw!%@G6rR?m5+n3q!X-xQ&D%!J#V6bHizLBM7*g+!@Yb%5&G03mpswByqu;{Z zpCbfMFi2kZbJBrknRh(lVX4q)M$b0u#NtiQ1o!zE@X$m0!+vkTU7#vg zY5+|@vcK}-_~!078o0j3T6cYkJKs?7#AA^0i~Ey>F6HWRTzk?y`a$@h|?=F2px?3ny0-TFAfJiL+cJpRmE>QIvx9 zW6h`EMam?Q?s{U3J*E2uKR`$dcr}}_EEBLUS0SGvy)&b%&Z->pN`hBSj{okqIKao> zB9wt?j!Ikj=`SJ*jJ(pekHr_CY%45;2tGk}=F4;Z z$(1qM{2r=axCJJ@iA6uBjW=;lj)&8D{kwWhHXS12$ogEeV{(z6%>;jTKt2Ukcn<5K z8Z61z7%zJ#Pe6V5HuPvt_*p|6%dKHx$aqlienca?R4?ZTco<~t+Ra$xKltq;xo(Ft zdtNQ*(^|){oGDjE#NS^7@b%@;ShLL0q9Zs(g6`y_B_z}`pN^V%ct$3IOY3eSU>K5N z%FNoz`gpMLA^+P|vK#c}0Dj}7t9Cr9D!Cjm&DPr2%?rE;#En@-UV4;hrLKEE+&J08 z4}=W+W}S83j+eaOjQmDEgBr9Uqu|jyf034~2h^$fDD#)_LZkI*+ehPz8+RS%E?ZQD z-G7|pO|Fbhu|**#Ej+_2#sTSPJu%7$Lo&wh>3#T&PHddu9|hcla^y;wW^!r=-sq)j zHctpJ?8U}1g-3@{2;;(kB0aHd3{(oZWbt0`T@PkxRqzS|aoS*p>gUC>h%Yo}UXvU( zy<19e!~*I`*{eHY`~q!ifdU@gOwc#upYvWH#u7tZEm#_Nrzw_TRwYd2DT^I&y;Wj_ zzXDwIUS{G@BqE{X@-r%kgLD%b{lTZ#>fwRxENKOuv5&#ShgvInHQa= zy_EPgCO*XT79^}!tcnNC{I}qd3^~38t0h!qru{39u#9f-COidt43Dhh=L<_N?eGR^ zZRwv+gCM80*v9BI!Tm$5HdU)xXdMLw(ao@2$Y04VCp z!YIOf**&!nfBEh?>zoCW)XA-qAT0AHTa02KNa;cr^uZ4ZvV6hwfG=}HeGiVr7n-v# zOOBY{bxqbH)5=MyI{}=aXqLF5Y;PV5z~7W9%z51rl;>(&;<);Zg1cr8k%-;bP3=>eg;3F_glKqxejLa8_=x|MC0P{p9L5oSYVf)-Emd_1r@We z`nUc^C2Pzi@{=L~#giPNK4$q7M)+&tMfX(zj$m( z=G?22W2O(?<2A!0o|JC>#2T$9wu?a3GZ*kr&3WBhsHC#~=fBB}#>4+Tk=PvGJl8`sqiN*G`&w z3*Xmj!-0sDlh2_?(-f6yU{sGm4gc^{{pDUE2fl9dIJa z1Of@Rw{H76*J738o|aNEp#Io}P~fY&0r=JnoqBNu-BZ+ZuxJVKC5bVwT z*0IFm6K#d_t_*wYQ$IZ?m|VFSuEZDB^*tE#D(3w>NKkAJad3w6-v_fc!uE(_+L-9K zlB%2m4U;0#n?xf9%Mhk*5bguz`Y_l-Uh-Cgo#?7BPl``zkwEIH6>9i_P3+(-NZn~z zjz*JaCizUEUahv0s4{o!2=5RS30Q}<#mn(8u#)&oUwb#(@HY{5R&|^puQ|U$fNF(? zq`w?LI9&Cc1Z65YLZ4V;+lE?6S>+D+vrw4^r?l;ZH+4J~SApRlGb^W0otbc}43jynO9bKq z2EIydS6iX#)`Dn@ylXVDTmHUE6>X4!F+qD^|LrV)MDu_;dg3V_{#E(|B1qA>|@0fIO%Te3JG4{2Bn)4XQ5=f^yFv z#KnKaOQq#Ty0$W4z;Nnt&Y9_u$zNNwQ;M*Jn8UCV~wD z&k@=alVKeEYd}lz&Y%B&3OHeI7GkdM%4G(Nx0R5`-guSQjnh<2@m%l5dZ31YU4lE) zO00E-c|vq>Df|QSghE=u;Y)43ylu=}e7uG5OllBy0`h{3>A*kpzNurMFaX2u^MuH zSp{sh=NXr=gl`h3iDRXn>(a1f2UeZDU0?w%^xh}60cHGmy;&&m2k4*CQD4J1_mCGz{$-}Fuf75BG&*k$^}%{D-O;=7-V-u5XnSaOz(zl?Bw za0Ey?!QO(3GorpZOOWIMAEf8E(PvVc`uY%#39{deUFykAF(3t{ zNA(c@+RPKgc0sGAI1#2mK@^=kOt%;G7V<>V)^JC8-B60-wFr)V!%Zp0I*&S=Q;soD zPsX`VxIjCj{JaOF87j=Z4xU)X`J8}8H4JaC`e>P&TN~3&J&r^I%vOgsMIG!~s!gpp z(621JJpD|Y7UjX6224Zws5gz0KA6{w zPIUL37#OMMP2`IFd~+tslC?(em zgk^z_Cv$E$B5JxYB`HJ>FSj3M-rP6#m#53{yTp4=NlJ<24A0P_gli3@t$DOB*!rVPD!S=fN?v~1# zjm!Qm(b3^m#) z=N^V40W)xcWC!j{ol&M#pmTI3))~by5SrgH@5)(N-|9`Ecs3T?vd(~rSAq1Z>1V*@ zML)?1jOsc~`jNHBv^teMYwh?{UN0^zh6pZUeIK3WO%rpMW8rv$Lw<86`be!3s-GKH+^A4mU=@%^fGx_xd`hbm8KhZA+v=MWv{fPrKX1 zS1OM*`$Q>vGjjoQ_@!{Hf5HWs9Yu7C5}X?7 zffm_<79vTZn>eH=U-xF#$?lX&;8gUJcuL?h9QZh; zW?ZTLDy_-z+aLI7@}G{&1UhaMf~$9IjOac{`W(lB(64@sOjSmbN54GozjwWpN*AB6 zh1S*5t%^ntp(%g=y;5A@Ej)&WXjz);Xf~q-l8Mwx=}w~_dc7aY z!`x(RqbX*7&<;{v8}KRGH2E#Q2noy~;(GWR;^Z4F4Wbvb3WF>qt=hajt~7vU-VHa2 zm}go(eL1msB3RuC@Z1aGL=ki#bm9HHb&?LXej730Md4r@g!{~)QiWev7j_cq>ix3D zZ~|}}vmwxkf&|qQAEEycUSPyqJnwSbN6p12+Vcw(!Fznx-#W)%yE-<-6u6AoTfmv+ zcW3FQjy?vT+mC3SL@NR7B*(hHP386$HM|MEpS1$%zVJnW?&kR-Rl6mt;xgZd14O1T zpVGe-|JV{uWz9Yt$tXvNfw5OS-Wk}iX0~md*F|G=SiViGT)Z-P=K(v)6T&kpdH;X@ zj4&`(A>v2ek~0~C$p9#l$gNNTzj`B_c*@V#A`^iIQ0U0oh=241Q`X2!dlAA8al z^O&W-+W)(knyv3Il^iNngbR!|s%*=rkEgDLh}v{7AZ?=K1Ev^A(6vPee%)nzc!BN+ zyzaoaj1?)}xFK7cL9=o*2|RZXzCV*o~%nx z<#R!|SwHoQ^BP|`EkKv1NGdZps68nn68$&CL@Z}SYHWodDgFA_zs~Q+$he8EQUF(; z7EAv=ywHfV_8aQb?==@UI&{)Lj0iT99ioeDMwoBnywL!dA%9%>8*I~rHwz_loVJ`= zuXF7F&k$Fvl+6jUC!4NLMOFTo&jbknae%JOwtkMrH^ zR=83`miXU;LslM~i(A@JC1E#@{8jLU4 z--6E4*Q>OP$n#va2{>(CFQ-*oXxb_^P4st+$t|t;wc3GVQ5I-!)6mVGIPC!_wFx4*Uv*zmPgVNeSSi4f6#!Kt)BatM{@_P9DPO@^F`pq|+x ztFuc;4?oo5!v4X~`yM0nh6s%kIcC}bVL2a)(*pr<`Q<<;BrK_3zy5)Vu5og-Svw4C z#H<(=UJ6TEOP^UQLI2Ko8K{8i^y1t04@dS+2Jx&rm7x2N_1RHCy8zJjGvT||_`7qU z-w_QT;}@&m#4!Drtq@P$Vjka_v#PeqJJ*ROOVd2qyt?!{8#EpmCwP!0lCleL4}!nj zoQ3*+R0vq9r>aU(2Xi5f84oaUNB|oD&$sN&Yp#BJIDH(j!9Rq9#eQ~Zz2l3aZ6(7SZewiJF*-~E5+ z18G;zw?=PI!TX?V6t8Sh2a?u4L$NvEc*r{;{JuX)_A8xw;wT>nWR(R6B)3~00RyJP zs#(9nk1bH{u)J=*t9uG?P(Dul7`|)C#<#r#qml} zYw%w(dv1-2Czr>j*aDjoJ4-mH`r-1Gr=gFIh^P;0vAc{q%3Gx&^xtTwO^ z1|W_-J&RI_W6jGpCvJqK5HI}o1F~-fW$o|w8VRn&Mpa1$T|88#n#l5K@gZMb{qZS@D3r{}{ywBW$5_M>t!3hFI0AHsU z(O+?ip=4f0&KiJC3(sv^&I`Q#JvI|M=0gjql6Rh=JyFR$RaHuQ*>y4Ffn6Nb{~}!> zCKI(8CHHGp_(raowq?XQ+PVYH!cAdw*Gbkafr``uXKzbCw9GP}|9<#WL>Wy6dRr(S zc!L=r8sbWGW`DZySF7^ShlSA&QqH&2+nx9y1MClD76v>kKHFI%cKaPCbd5y&rsZ_f89>QXQ zjuH0|*Z3l_s!Fq=6{E8fV_UQr`>B{6VrPs`C=+Otf^X7}dqZ$AZv}kL|1Cpo5dKh1 zgIlAtA27t>=3X%yzkUb9%w*sA^(ExWN<{C|;$_aUMiA;GL&GI$vtmYXccL&>s*qMG zAR`!Z+v}lMfukwX?cU=_U7w+@8r|@Y_dHX;e^j9u!{4<1s&_Id9{?We+FzZ*=uyBU z-*d-MWs=1X#G)nD6ot;LjU$Yb*+{=-EF-uAK})4iO*=NCMj6O4(U3OOEAR7GjXF!|1%4 zHKEtD4{pYcS3=fghTLzl1lVO(n}P2O@;4iNlMS(L(lT19M*mcN+Vg}!6r6BpH3uTf zSLl^aj*iO|fZCLQicW-rfDCum@@**Q{`>40Uf-6cdhhCPxMj#&eNZ3~D?Xb@$4q<# zffzUy!L15zAA&2~&{}&J^h1b!Bt(Z)IS&hsM-#M%gRB8Rb0!mH`mso}cTQUaL9l<& zAaK{K9RHz4kBz1H@A7CAQ*Fj>$w30h0AZ>*%r-3`>Q+c`x%ch_!J=O7{w14#_=&;h zL`J+3`{d6LI)mINgi7N-Zbk}<09UkTz!)W(_t-Q_{r>s8GZInX^he0?)jM&2)L-v3 zLMUKfVwCqEf#d%z-Dt|cI-Dp%oZP# zO86rgZQc7hd|f2ISx;T_7WB1wA+%kU{irbLM2h)#hU8)b1LH7c)d5WBvonK8m z0$~tNA;=j<|9W^k-1av9{&{^I+Ln{$Ssh+RDT+ID<<@{n)A#nzgX=##Vk7blIV;Vv ztwb8RKL6fAien)$BZBHlaLqPV5UUTv?9Lrh^ZzSl7wB67MCEG* ziu)(Kf=0APRscs255eM$`_%DDV9<^7>GPu3?Z2;)6lD?00HS*=XRXE$Kfhl1x9zGb zMg8fx@)`)ei|^(3Q6?30&-(72KyYjqZarP@377G$%oB@Z5n>uvU=C#ESnWWja3RoMx0E2C+=rxwYs97lrwA=%pCP0Za(Dt+VLJg+_y58 zj;5Tv$BCou&8n4iq9OTC%ENgca<4R1aueYnw4IrOAo2X{6aPMZG!p&(lOjBqaEfNN znh-ufz9ul-_}ocAdaOn6x1?WNH%9yemrY@_Rfb^Fwb93>JacK(hjx3~i$4n=O!7hY zlaHVBnVBdx?fu%ckgAp1C}$LrXsp4N*Pkt<>}2>qi&AqMV3^ghR(z4sYPQ*;nJJj{ z?;n-^;$^qrZA@V~0gPJRHN=m(JmN_hi@zy(GN5@(X>uLo?3>^3Ki-yi*zg<3M-F0J zOh0momA(w{&w7G<=wH)Y@XI5@?wos@SX51O3aNKop9#%aW7X+}e4Z%)cnDvIry$LjP4W6+eu0^YMjiAw0)G!oyq;aGo196% z$}ytDzDzt&xO>H;V*>YMlFsethiVxdrx#g4L_ktk{>zBLNc8wmitu8}ty=Z!zr+z* zX8*A16oX<70?Ui&(S?LXKx+?euxIs@#E&;vMlxm^=s1g7B%n}q9X)UG>(}BjHY2WK z%KDk%HCbl^Y+_eoXc0hQG?u%OPeI;{Q^iM<+^^lx7J6lrjVcZ%?4;-5KJBKj*bp}K z(CkGq8ustlvS)Wr-4vMpFsPSW4=mVVS~=ww_E$U&g3CtGPf=Qk>W_NOhbaVYg8{KM&wBnE^5}=?4zClGTg+RtVrX=YZJZu1V|y={`IIu|{>YOSl59G=(*2{zpi z3T-u%MK>x_Gbs~$N_Fy<27q;e=KV~w)*gJe#~_er16- zj0(VhbOZD0?-Kn7O>C97T8-VWEsse?Plteo6dy*W#)QYk8l~}r`m&TH^u_xF`uUcH zz&^uoXa7rMnAQ-^<2(D>J9dAGExnk%yLYInhK(kFb_H$Xf9?rN;u@R!0>urLvYT_; zeVD&N!yHF|0Db`fTYP|ukjB!#3M(OAeYFb~RT*MT1iH+As6@zhFW~hT)1`NTFaN2> ziN_<)ATlD`u=Hnwz)R6+eni5b-6O|lP-$Ln@ZnhgvjB#;4@*Xdkvr>E0O<|)YHX3? z{Q^9ov-EE@GsbGlf`nN=qIqTdFylyaLV8je1^Llb`UqWEPcjig$*0B=bQjr>Sw4(^ ztDLY(OK<0eoz_z4f0V9l-+aavI+;R+4b#$Nqf?g}QLVznR*=70iBhkH!quup3PIq) z28UJ#T-M&Dby!RtCu^xPv}LUdT+3b971^Z`PiL*!NwRll#XBI@EXi1GV1a=0H< z4&{@13&V0J+soz|$1JVi=n1&*@rnl%|9#2$>}coNTE53n5}cWr+|pdUyeS5J3uv2( z81(OaM%JNcRB>yW$=@#ab6O?&El^?O?Ru!#(&sAp9Xq+)bAkK8jwfBPZRJ7Ib?VhO zr#AcuOf!61g48UsAoPU_cf9B;4cD{u%agM|;KLwY>d*(KVU~)rXWtGyV`Fn9yn_)a zBqlc%UTQ}RXI(<8giV&R?TmES`)&Q>;2Oru=YI$J#;1!KD0Q4+m5?a>1@MqSi(%^k zj2|CRUPE0}-(X_iX|BJRUi%{ejnNY46Cn4bjSTOVpfqzVC@P=2@=Ih6@AbXhZY{aL zb7R})B6~rlz1B+AX{O96Rq7)`-XVj8r#UmJ_n^^YpPu%Ce3GUyASc>UI$u9-QLGO8 z_bgm<`^A4=(my-$%-M3b%c51^DKELJy?lOE4B!@^=_zDBSc|YkeOVF-hom*JG3Rw2-R=8rBsxmtZB1wpS~D}(M{v@>eIB2xhgw#LldQ7bFW^`n*!?+B2*Co67D`nTnwcPAXU z87lJ~~GOx1UqbF1^ z=Mzk4l%|H$peVX1cFRblsv(Z->4eVoJrtA{x6?Ew^BRZoGfC!_t5W1r%U+XR+$A0+GfvEu zQ%%GmE5wL5P>@$9)rAJgHBmH6C~f)ZhiyE!g)AL5dnDb5I9f?3960zNLsvm50*5v0ey&Ai6URn4zQXN!Y7Cm8ENhK__vI73fRU$kt9<4^-hBOkTHGdX)R=) zN96MH?M}udp^0i4@4jOR*Q2dW)|S=?Tu5T>rn+8vUR@x5LBiw+-JJ8U5;1K(TS2RG zFso||t=0HSNAHdrApm1N4hgV_d*+GmW8o^0w~LTy3=BfYAwX@AbuV@h%tzdIiI2iy z`0hOfzB>N~1f-ro^#3!Ne>Lf^;$KOf2cc70)f)(PI>H24ql~hT_%;zPyJtT-x_eiv zuoa)heI7jRC_>a8MPOxsumq$`1L>Y8*3eGLNx3mxy~nxQkJG$Nf%yweXT;_(mZ>mO zk)bhUgcECMPnUF})Szxvl<~gcMm7=X`gV%9JyvjY?)bZ{B}J}21zXqUnk?OuQ=S=@ zr_I2#siuOa!JTFDOl}t;x)80QR3XBi{OGdY0+C9=D+rkNu1PIV7yIPpj@@`D42)}RJW3JHSsQdn z5Q!*qFK{37W!N&@5Sg%&YMW zuaoseguV=>`b~>9G1NnLrpDJJtVFjOgSs#*9#crOJF(y;%9qbd`L3JcFF$KfTOE~n zp}VgU>HT^SkP_RB`e%CvS`0m}`30T*sC3fg=N-h`>C!Kddwajs!UcJ1$H1NJNtO_O zwag%?gA6m|(Ktz1;jnb1qWojCH)l3^g(@8`6m;QX9|L`M8E{QLe1W6z_Cw4hzB9Mx z$R`?yB1uzxMA^1b4lqJayMJobT;A3eztIAK{CxhYk)S%iYR|A;eXB*Vz7k?raDOTsLkh687|{s8s8=Sm5juE zTE))Nv7sn$?qKq+4B;K}9n*r&rE!Wf^r*$26lkY;NO&)z^j;&PJsG1ds5U*Gu?k;U zT=`3_{awt>3uUs=y~T6yk>?u82di^SR>31o@H2eyz)k~E;N!m?mlG))?u{A^cTy4( zmf}4u9|grB-$g6y<^rH8A%9jQTLXYQza!5s16R}rgeF&u8q3!N#Vrt3wdJJlBpbUJ) zljAdJwyZrF*7*fA_y2@bVWs^@^@__0d4+<)pUd-kI7PI3J&C|kP$KRTag1CFuINEw z`RBg|>by(zL^=yT`(JC_7O}d5+IvOmS40a@mGi1H)ceTgQyW1!T0EbmQ(A@jsx^(b z0dJAek(YO6T7=UmcKKeHr~Yfi3l8fEEv@9dyr3Q5S1Nn0K`bAleRuO)45zY3yynU+ zPy+N7u=l|AW^GHL@o^jQrSTN$ND@X@;}s8E{BC7~AsfF+2N9n4o}kF~xbTBY@4D{R zQ7GDv0xlvZ!8Y<&1}?>*77ErIqS@C>8IYX#NLE**r`@kS^o*r}?`mhQ%u`Em`Zy-~haHNFU<&8FiJl%})bkuwha}J5^ zPncH&A6<*49XmK8eYS6!t4F!Uk5~dAVxH;}tIN)Ve6>;@;rPX#vWE2u8nq#Dx$N3{Mzl69vuG0reV zd$lLanRcJ0iQf7rmNME)Rr@*8=&UOBVIk8&vQ(FZ^4BV`Q@{;{bbr@%=svFte4JyU z=V_vj8$R=h;}i>%(ki7=49+Ny$m@@5NoVem@jk&JUTw1vYkUf_*^RbI0K#6qvQQk#tgS-kU?+i(>ekhER|@|*PptNYwcL# z%oo1J7?ya^1~GR1`A8n)Q8t$y;yEhLA!3uyFor%p!~2M+)PpTFTDd?ft+bu)<15v0 zB<*lD2rof26Ya>LAdhsEkS5HiBuIsO9>dcphPS-79jE(-J%c>IJ(Aejg2S!M2A1^C z=UOgxB#MisLLvSfbHukQiz4d6437k@k)EpJ77-hNhB1_QxR;3NRA!XNDCP<26lI8F ziASl4?8@ePscj(67aJCMT?q2A%|K1y86fm1?ktLm=GuwzHLd~3`vkpBn@JPHn-QIp z5aKL^Mz{Eez=;e9{R}rh`fzqH8>lJ_s(z{4Q$7RNgu@+=6+@m)*oH0dB+ZyY zRP7eb_aYFNe+as+-&r>WAMN|9uF|t)jiHPo0i()vQUr2oDrryr{fH)mk_0M|wze_2 z2;r4^oFC?w=I=ryh>g^IHC>55N0vgRPr~0K)29+zri1$z8+O$O@X^ldC_Y>C?Y;4! zo=;CQCZg@GFT!b0&!x>df_hXmSECZRlOrbn*?x^^f9Y9@VUb+kj$cQuGg+;NURG|p zyaw%#uT#SCYT~wv(KCh+QM(1>{V*hS&d3Ze+;yL9>vt#NuOf?tKZ8rb1bLz%Cax`k z!V8P`JsM5YC04m;>mTF1!7+EZ8m;4TXC4%kak&TSlCqtT0Y2Lg$G4D_Tp{IJP?oxXIX?8#!(FQxwM zFtkFfDH~% z{YN$Lf8uP{VZVega(`pS62&mhAk5X4SK37u&=t^rwrl?vw)QJ8j%b*AtSHsOJ~_nk4)C0?REv!Y-@1AAVo+Oi6WkMBB{&1|AYxk-NSN``{giO8 z&qZ-y$&`}8iF(k08EmkPal9;_V`Ido-L60|8-7Qqky$|QMdwlW0}(750F$Uq!KepY zTTPVmW%xwECD4Zn2nV2){J8|O@Z?Q%!4eh5@;SqpqYxoxit!U%W(D{IU`$@z)_n(z zsbJx25-uSyuOx-j`yo%lqUc|S{4eQ6J&!uCW%QTdUnP-Vhj7UPL4-NT+s}1Kj|%Me zGo~|48=jQ@(g^joYyOl)8doc=Q~(Xo?!w5;5Y+n3_pTZ-+8ziK_dR z5XXl^JwLjW9SXJE0`-R`D~FLyZdwR8Gd)Dk%s5tCDf2qvx5wi4q|huEPl}sSn745R zn@=T^QA=VaFbq(3XHw;_NpCA_ql?5@ik{ZCo4o1$@=&@Ut_&G|+X5)kynO~F1b6eg z$P5+X!SznODR8}`0ckBMl7?&-UXZ@`cO`O3JB?EET)Y4v!!H?I5E7uVFpqC&f>vB^ z*AZi*1H7W;!Jh{1*zYQVv-J;;l)RjO>F}dX*TiMAz5$<;CT{x1wpo^Tna z;k9@dnJmPLXud_)70-p&q8opHd9pVUE?lbf6nCsGxuzzc7Z0k-_;vw4*PmHPZ^#~r zWL^_bC+y3zl_W_sAkvKJknd3V&ggtB5cwFnzVO!4UBnrlL^@dza&Z1hhd0ksGMs;9 zupn(;Oj%_~?Bl*bKg&@_P~d?pxETY&gzb1yg(p|XZPCph=XZeN1NaS4{Rq#d2Ohz- zyJG<<{%`Vw>awIH)Nd!dtyF8mH%Z>R3665BzwcQd^BG7VJOY1v`@q$TltSEqrEMD5 z)N*Z%pM$)v7N6ia0dUt7fZ`Q)7(*_V)fQ7F5OTID>^tS$y>UCyMw8uw$*Q%zXrV=J zVfJV$G;%M)yJZP#^1wt%qt_4N`M0Dn**5=ZkaKNj)Y)UI7RLgW z-E@~@h*ayfL5O$s={nfV-;nas#{At3d*PX4<^f^0h%hZ3Aw`t14Ta3T;Rk4cUtrl_ z(iZgICZ^lB?9<*Kv)BWaQHuu(TGoudhObA3uNVlpaT`*erf6_IjA_F7-gkIfe~IJ2 z9CWooCdNvoQD$7-S>a}|F2GL{y64oP)~b}i81%llIr(lz8BIGI)6{Ndi!EmuCd-gT z6k`hMAA)b;BDrDcmKXUGh=A`6!z706xWS1z13#I?@I_Qpg zAI&tlUaj;muSMgqg$AhA-KXkc1eul*9G(9;I1MuDla1)3VwyJn+b-g*5|&0Z>c$r7 zT-PPt-Mu|lICyL<93O`8NP8yTG-0ILY-HhH1~uSHfsGer2*`NsT(vM-J_^6+ zaB3fc<#)yPst*IMfB;VcS?@i)&$rXtew;SFDwS(*N{Gb4zM3df8&=t+Q*%e-jDo$w zA0<)bnQa5t>(eq(gvHmz@Rl}Q&yu~bqZg*U<0y9tb{2=_0S)5kp$8{OYL-LqZ4VRl z+#WP1b;uH>Bl7TlhWaNi3UaPnC4MGf$Fd0Z9p33ZjpwDJWwiA|kQNiLNX7B>YTn;Kj=z`WO%g3aFUJy=8n-|;_spK&nFH4MM}adHU=TI-mqooE76c*iqH zKk+)?qoj;s(_acdOkNgM*|{!JIM0&Tihn4?dP*xjOG~O>k}RVu3KZt^GwUvU>3R}e z-%;~}uo#D`2#;w{4Z**<3fycS)QBlV6)pmr7Xo74*_w`~xwh2AluCrv`p{-;cCS(n z`o}HSS-D!X^g|RmTPLL~-zsv&lNoZi2)@^G*t2&!^zU)LZ~A;RN7QRlWW00o{&&>H z-VMKty&HZPd*>8ONw%4*D390WjQuxl8xn|~Y#83-R|vg{)1!57$9BU2ukZoF)?O?- zs4~?6U;G)=k1NbBH2vca;*Dxs-ayWPBUKg`$DTXK!}FvcR7Oz`DYS8{iTO*{SQBuF z^uu6}0LiC@=Tx1ejDd5gg4q!Z8H(>hdo87AEgwcUBap_kraIOx2>t0C+iP;VxBnAq$mW<59 z`=iEiwrV1=DuxAjli4^d_Ozq|J*(u^T&&Mx=k%qU=b$l?S0LtvJSN5V&RrT~jhm#9 zZq|*?9frGy(_JB_;zzi9oT2Wz+Z`RMVoD*NHT?lDU=j0J7?xT%>qvZY{#O}6wvFKf zQGM?MR~{^_(AmnNtFfTD>VG-k6lwJFzx2(sXE>0>`rKXe20Slb;Uj|PNE?+N50%Vb zXSHM)3T`$yz6d4CKy%|Qlf&BZ>z64@bMWA2ad?aEm!q#4nRw!$cX;R3h%lOpU(6r~ zamkfeM=H%{?gNv4ug8`Dn$;m)b1j>GmhnVO!G&oPe(j%UNALe1S?rg)M*}XQ*7if$>Y}n)#(qMM9uQODS?w#9VS0Sk zbbT17N;ke6?~S#Of`roGaF}fCgZKwq?ZXB&OV{B+{uDf8cewUu%iUIoh`4kGeM+2+PL$S7&HSA?R{$F|p-ynhXdukiS#aTIa7@JJt^- zxG{g+zxK(uAwUhGk|Xn_4uluy01QKB;DFQDhFI`=>KmD2zht#WvC=>8ok)pxC~@o8 z7+VeX`a3+>5{}XVnLmq&8zE!3p$<9AV^b;|`|mHZeKDpCWhD|+JPVV?)0n+JE^lyS zEy`zV`&Z8$`iwrq=h)|o|FI_M^O~O}gDUo*-C}P^+JQAj4mF+c`G$&D0og9#%<`!boq(y^yw;A(kVAzt`{H*u8(k`N^>F)wNaG4tX}y{#zx?-u*- zV~$_5#jU`M`O`8dwnSE(n2KhFruj~ibFfELSRNKaG~h=qqkIT`3S(PBxj7I1@j5+r zwdF!#@6U#hP%U^8r1-};BZ=Tbg`MnEW(b)=hkN}+cnL}SvO3B) zx8hg&r?sYi4#xn9T1&bqhgjjYwwIJQTCrAvp{}K&8t%o0TiT0>mcF0@Kd+nE|o^yUi@uU109FM1S{D0~lG_c`^A?o=L3Odn@BP)(_ z#>dN(=-l6wjvgoTtPR*g)@JA+YGtJxzAMXZd*g_R^sv{XYi&D2~FSO-xa|j z(1I1{u*9c67#HJw0*N_Jp2#$rTc56DYF>k@8aL$HKyfSZjk(Ae+6?Tqu(4~>LOE|; z=Zio`cHS8-pF)>~SjE5Ka$iGTc9%OkscNFdFQPKC(tU=Uot_2c7Kv6~vR*?10x($GT1WNmv zZG|EV%HdTRqC?fzGppM5asV!oJIe{bU;<^=FhWwuZ32QwO)9qld6fdb&wdB?4zPBA zQ0o6m$^$qoySt}k$ z;R9v%;fcH3el`}zRvYR9tOQUlfQ<#_INn?n`N5ZD zM8PAYGKJw2r;=sjV!6)LOg0UQG14p%HXUfJ+Zdc9SC$ju8b-s=gq19fEHe>ER8qM` z2>tV0z%sztu`E3tQUDl-yc+`$rM`Frz);1N=u)vVGGB=J30$Xz)@ms#e=1~7N23^p zfnPaU0uS6#^GtB}yiM0>9|&60@eWV=`zqXPRrn)kASo)-8cO@hxsG1?NV(Gc1VZDu zjaOHSJqYYW&Gx75&e~s^w{vs(%@#c18t?ccm!^^lWu)McrbB}djlO=KLcEmGy;BM$4}sDa$)(8 zW5C_;JpeC{?vZ7RkVEqw!|mnxZAG7cq1@lBtsPH6COb;uKO=b;5M{gwOIuUaqtZ&gkVRMyysH+I%N$JB0GLmbVR;p|@SN&cS_JsZhMq1$IMRBC8Has;)a^{li^JD z73HbU1vFCML+Hcv?Ni&IZs%qiyr4|*1GOx$#S+s`M!NRNw$Wl$zzP;|I4PPbDI}BU zLm|EXnbI;)NUV&19GYOEn=uchVTPPFu(BU4hPUMZUK@FT+?k7cZjUELI6Et;q*{34 z4#_g^teo^nyyq#|)W8O$FJ&29y%ujoY`{a?7CV{zR%skP6_}VEvZ25C%C{4d3x4pu zwpABkTIck9aZ=U7X3bsWV;e*!)3FqLD@nPqxYJ6u$894!bzl3(>pgz{IL`r$S_gb! z9a%Z>m$69G?zhE4bdiHE!VQ8dEDMD!x@mOnG+e7!qDaxEWy~OT=(buvIlt(UY7K() z`S#A!J8o|-?r}%Hd~i5xjoMtDCfOiSIgg=)Uy_V-UY(S#Zpd}I*g@8p#&>^5a ze`gP^Z2&3R^@7E2xfsP-(Z7*wYm9-E>r8c_ZiqZL10*_{i_g@Dx~-vt83qSsN-PWZ z+f-39+pLcfct#1~`vITs?l`gi-j*0JeKmIqUyx@OWzT<@Mo=<4*KlJ#enTGw^39sv z)e17$QHs8vzAbvfW7}`KUeH%5=(~b+JViG%xs9{ts68t@5hbY6Dx+)(oH-Gq4$++a z!xynL#aDSTNelK~CGj?P*3^|A??(R0oUnNPA$ooEY251oJ3z$0LoPJvjc8{J``_W9 z=b`;hP8No8xuFYBiC?8q_}Ak>`;@g@DZOWc_MQ-@$X432+<~6lBHI;a3^5zU>$rHl z*Yz;|svcWQtKyfD{ORKt+k2K}_Pt&et;`h$iXRWy@Bsf?OVblvUSu9m4h2={*?3?` z^2rOqm7cKoY6r0xioT5`T}%`rt*F^Z$Lv)gf~;%__$Rxy%X27T4{b(qif7u20J3gr? zsqw!XuoZ#qUXvNP#@AAlEYgC*IYHXVX9#1#I3r5|@K+h$C)sdaB~WkY#Jb$9v;W>n z?Tjh5!YgHEhdpf145J;pOW6*wP+MHd4y&G24<=dV&5zt?M#dNw@ai?7D@!5MTw0gd z4`2kjHW=pSUQKkp)A@f+wcWW6J!d?>DNFCTu_SF{_yl1FOl6*no=z`Cid>BJrPS`g zg}aw}SmZ^##m|z8Z)`&eDZjN7@Gv(yILonI{*vL2WN$Rot`Q@?(dqo=lusn^RA9Am z#q=#2`K^yVX1X~}1%gI(Sd-P@Yai+*wph#DO1@r{Jh^qo%C_b{ZnpUf<{wyjqczT% z?n95W+L1lBAyOA{?oYbkAhsLxeb8w4#g*ZRCQc|ooFQHR-Q549xkZ-5>qB#+&m?c5 zAzA?9z`~!zHL`-%YBckag*cT2J!EhA#+_rdC#*7zY$icvG!VNQA3y_uQiQEZ`h2fs z={R|(l+ItTVy)h8IVA5-G(qs7{?m^yl$TY5(k@ei0MI<@-J*X(GHkl@b{uUZ%?365 z#CBDfty8{E4YiT#1BCsg>wlZSI`_923M$nfRUfiKtBVCCj6$0<9^ zxLHNOSHC8+gk0rQ=dJjpW1rP<2$rSKldD*oPhe_Gd(E4I$7)n^!MtK)Rxen7GdK^4 zKJOhkt-RV^w4qsPlPQ6}{iCpFHK={~XGPga;;QIHWCG&SVe^iKVz&kyJC(cRrt^fs zft_5Lh9j$QyLi1^vrqRC1@(l^KK&4=w?NV(B|N&TW3d2#2z)y$mg0l4Vg4F82Cnrzl5A*ml zkA7c_ZlP8IC`s27BZO1JxVrWmzPE)0%)I(Q4;lGH0wt;_GU4s&dS0WU+$$xKDw-0+nGKh3Kw- z5aK8@bc;P?|FN6r%9X>_C_Na{ySzu=1KO2d?tJ#Zx1Oj0B2jqrgGXizAGPe!y*y@Y z2YT+7w|akRsy~%EXu3F7dinU$eMgfJm?Klr>VHQzSd#$fAU3~nxC0tBl3Eq`E88>K zM)SwgSQYkW1}ml|MABp~&rT+;#?>{uK0=&$ja0R+m=B`@qsY=j@a0F>wpB69?=xmX zk}vxh$`K06zVigQ@JGeYK1gAJkd4nAQ*9=f0%z}mrrl4B+1YqwG>gYz`>VIhH=FfPn3QPCvkhrW*M4O$W!`(MMbmKT) zR!-mKTybporw30K8ca?*{N!bzU&tI4SrnOSTfk12+6K&44;)KG5R6!YNtql!jMcQsx8sp1M3NKyW9Kd=C8v|uE`-PBDuBLIA;`uK z^IU^kZa6<1mFLE$oYnrNsUg|T$|;mCl3xW#l2b&|i;Z8}%gz1m8oZh1sp^*u_4-s87&g^`!I|=qA z|AYo_LW+zs#|**2kFIU0SJ9_S^rfFb1wxpW(_qUBtkM{ihwxeyBqa&ot#%h?s zx*eNd7I}AthK=BwU&<>mrS?C(D7=ycoy8mXidy(yMHmO>%m`ASNj)Xmj`1dX~ z4sh%OoTo##wD1@+7w-4JASn(DHFIuPp;kU@lHh?bdBl^ zbG&6Ds&Ns4*zq^|q=Dl?l1>8*P#b=YoP~T}Gy5+$;JyMQ9*#K~j}pbLRyA1%SRCuc zYke5#5_V)8Up%rPdR%gakaQhTpuBKy!wp-v(-)28wxF$aL9ezpz-vI+=0sZqy&Y67qcJAArsD+#WYU?ODb7 z)r9*xeHH0L%&w*h#|OAtai7qh=QUPS();f5c`@2cRdLKkG1Eqlr}Z?-&Um`bfN%~H z7rR{eH|felHWp%{h$(`-;%m{&7;y%U<0SMdC8yh^-jiIK%mU=u3|@6uf;6A|*`UJH zLknuoM3QR!pWA~KYt$<(z>PkH@j^2CT{g^yZc!^Ha2X%&7t%uuHjQ==aRu(0 zl|t$!6DuU6L#hfBIU_@*g_;q3yv}AJlB;lO1Pts1(nHN&>zJVtk>OkVZdogF2PIzM zgEzF&5H~RjPpoWaE14Y;SIo(8)Zo=KKC)PXqgGPSKbsVP=0cZphNEFU91jQ#Biwq9 z@UCDJwkA6|7j{nRKVf6@3(|BEQCYVUieHXzWn<{gFntSRko$v#munxo`vVZ;K5`>&GUjN;!Z9t$eC+evTLWR1t;pI8w-hedqJ>V}!6(*pg3V!1EzFqyB> zzb?~#_q0%Yz(w@FB&>Amyi2ubfN;(e-L3ST;qp`gVBpO=pPPqdpZ~#M>fye^SVE6E zF@G@}*k`rVO~AE+3(d}OE&XyxvSZBgQ8yYx6NSp$g$7l|$#8zRxbT2NGNoyn-28_C z_d*CKYzZ;F2g2c3)R-RVH21aD`+Ogff7ZyJaxc7aJO$IktRb2TpjCzr8ADuD#Lh;2 zByj>qxs7Y&A%0>MHWs!r)y$5NE9zhyxU3!L)2+7na3&GSKA(_&<)9N2+U==m2V6r>84Z9lWQ>tX5)8dEB1ZF?P4wt$qC;_utnV;^by zz|u^jal>n>LnWAV4o~e38n^XotyyQOc+?gz)^moJ|dJs?3M(wM%esYy9aeiSJRfeJv zSm7gQ=rPI8x-gTV``F@d+0oExPBkk+XgML$mDb`*d~Uo&0pH<(2${Yf_O4)0Dnqmf zrtfp7ges-(3tRIH9$qhVZfFC;a3LhnBwA}}dGoJUy+ESRSPE@GTk@6FU?rB8xVpN8 z0L7K$uMhddL;1dfQ~Hv?TY!2Nk8hI^?e%q+ye9iCYkW%%rEmI7BWZ;1)@~ z;#9M4qwE2FBV8Nua(%RFLsCVVQrYxmR0W|}fgAt)n4q;br4Ts3;cugOeT#^>JLglu z&hW9|#;V|2+Yv&c_+_UW5>lWL#22^efl)BwQfJNzX(0s4L6Aj2KPSy5!{OCE1n98g z@CNs=IxVV=tUN^YT2cf3MrrJ{3a1Y0U>?z9{{s2*9%A|st~HHt3DWdbV@yz?&mqE% z)HWVOQHRA!jomGos73u@E1=RhKM$th70b-VSKlS*Q1?K4!=PF^H!1mB`sBj9K+y+P zh%9D}%PwGDAaf#>@2cZjpRIcf5p)K)q7G`=Ynn0!+j>|RaDe0kVQe!-DMfRKH~&SLd*m6eP{#e2QH7=(H*hrj9AjV{ z0LHY0XLc|By4L(~`o6gHu-xif21J6VYloC66vyZpwkLwjXP20YO{wYYZf9E;{Ei9x zG$IL&R+j_CQzgWq{wQS0WA5EK5AlWK6-QS?#Km}SfKi1vu|my!U}!1<%|806^CaVr zK|TimsiP1C4lyC=OK3|SRg6c03XN|U{uBnLgb&=oL)Fn)b|hti{gET2YKcth*Dsle zIQ#(vz}<-e4H9aTsj2zDklYp&D2A}cM-;%!GxEQZJP|bRs_Pg&^|0I> ze-&jDc9(?)3(~dT;G~;Z#WYWzoJ+eG0agN8QUf|q-ZdJk^6e%(RsUj6Y+v1vghHX7 zkJlc>8`i|^RRB!{gUIG3;?q#g%<;!PNnloWJ6lT(XF})RXCJ}gdsjn)c(SGw#%@rN zT(mhY!jc$Z9kBA!FvrOb*Q+mz7)aH8rPJ=04>J$?>o2v)r=b+`@U4At&OB{JRL{2o z6%s?H-r&&~2i&O;57);)nGRnKN?Iv1)3ZO9+!EyNtL>P6`H0fyiHK!-pjHMcI)BjP zP884272S?hWMWGpFnT$d{H>2Uz7gY|4zf&E;=aa-WhxF?q7k~0 z>Js!m{$yelV^ln->4)6@cvNlNvYk$sB)>QVbXkBUk8kmqlW|~HcRPnv7=7Yfg-qPo zH#B4+lB{#*&tPaCs0axOAF}(|>;g}Fkwp!x`_3MFOrm^WDe+rD#ouO&v5H|YdENwC zna8BD2#~7VP#q#D6Xg3pEiju>90nkZIM=cz>BXPNr%9W#H`Sva31pL*AWjtAY>Wq4 z-fX{|U(UD}d;)o^T)6QaySyH6LTJDvfeU$#b=@dTsX>Ef&7WL$wFg6#g)X~Hvx{{+ zY1%=HWaxxsIQ_;{h$6Bs_~~yMdBl^I$%bk3HX6z|0d=dF>IDw99+(=J(u1`jDccM` z)038_9NAAKR}tMb{7P!B0kO;N`i_P>TqaJ>mF?)23oSz_sYhfRn3dU0*2sGNYAMVP z@fE!^uf%?r=GFaVB!gX2e}kcMlSTF)b0mA1|7zwE3LN6S#cAKkRSmhltktwHVjC0W zvNG2Y_(K*$KYhq1LyF_R6)IQu?{9n3Ti0}0gRxgN7nF428H^Gi>=m%k5>`zV_T z5+AoptTI$;KddTv+U}T~&b42fR;fPR=#$0}(C`lD18xIeQy^Wn$m3@m(Gd<<&orUH zBi2it_KRH7ux}V+3zSUnd44)|%N8U?;zwN3|I<3j8^d0~@EjRafD7;&DT2_ql8$vK z2L6yZLiwpN#uwFkezn*07|v1Jf^y#$Ai(^ZQAm$@?cX378#itN3i9hCfOon(2xR>c zP(hlB2=9)F3)4-3Qd}2V9xf-(p09^HBl@wZN7F<&Tc-MLGi%yXqOS}=&z2B{D1?x; z3uJMg{9@YzqM|PRUh&Q786vz{;NLc9k@F0(>rb54>_N}VBdfq5!#NY<3PtaCr{!jf z5h21qq)xU>7Y7%*7rXnmIM{mLP*$$OMOL&|_k{ca(OutE&H_Z-Q>JG}bV)0}0P_Py zNnVB&ks?>?VfKQ6$N;shH*YsF**Ij2aB$aFQepezcRw6h#Dl(OtKHN035v8&e20QA zMQ1zvOX~FTU^#jP{+K&Fv^u?yNOV`Z4B9c}?2l{11B!*iZ+ipG+1~l*kRS4Ob zeMmj%Km;Pb^8#4+IeGwaAhGmP`ZRgrL*;)%R-J_HgB@5JG}}jAEk?wMIU6+7O4lM9 zn(rxD>sD&~K;{C+P*-d~8!L$ndx8OlRwtC;(ZdG$=bk(5s?$itx<2{m7l-?zYN^O$ zRS)a^zl3idI_#pFnG;B?8tB>+_)Xew$WFCql?u9X9Ee+s<(kCNZ;c|!DAME~& zYB(2dha+!RuuXFcsbh$ZJbplRO#5Ez-*^6BvRp7RBIV(wX(Psry52b+z<~(Qkvqo9 zU>x6LsU2dMD+2}-m5~aA1R5fo#!WWJpql`Fdpi-lsv_D+UtA>yD#G5E1KtH>y|Z(l zSFx}tMTCmdgOiqv@uMe^De$5CrxB0TqYMW)K-1<-M9X!Qq3sq0_2gi3ZWBU!0xy}x zhv=pbLASIKyEq2;Q_&k5%o>8hLnIJ({UJp^0R_*+N8GvhhGi_3r+BBI7v!rXA3RWK zd)R=+sxwOH#BqZj-Fw!aI7;d=PQ5&KGOFPdj@G<9AzMHQajKz5FP}5g19PD|?Rz@e z2|gwcbY7!W9m^KVf~ReN4NT545Z?G85>;Y;sQc4I=K7B4VUG8C0GvcM8AN3IPT& zn82m6Wtn88TA&DXlp9VSgek^z)JKM85?0Q>&jajEqp2_3fI;@&0jS<+Km0i*_N3Rg zy-SXiVz{TsQoHpDLRoIQpb2{Xh(~LVkRNFMfV$)MN7th3@|OavX^J2hSm8d+GaGnG zF$*9uPnj6N{5NFdESEx6Y;w)^Fzy;USiL$81syzRg}lDKlRL_Ao3u0 z3U0jtr(5%&y5oCZ9n&??0fB56+|v6LN~{)`yNzEo`JKNu!H`#ksCk3ns+~v1A>Rig z`h!Cp*6I^-O|DTnDh5b%XI7r!U-piGuwpJus&VVu7%#Yvm4{Dx1`QT8I}CWY)|>Oz zblT8Rv&uzql@;%cdZ+-vCr3n`0f@-QhOxe2qiBkgJcpu7dOWBKv;+*N55yF+lO*{A zH9wBL_YERgf#&{I0}Ps%n@X1U>e^M>kwy;mrcw^thaN2{f;SBqhOm2Wp8tn4l{g-E zQEvB=dDyPhC}gjnY&>%?NcLd(y*I-UqM}XPdX;()@T}xp@%0+uhvZ5p?ZhEP&Ul!3 zv;E6QyriC?O%ARZ?3}=(ZDhHBPbWV=Ds-%s*vUkr5E%@+vS$jqk{ij%w-X50^O$!+ zd9CwdLk%S^+^>(x47drXdyic*1f6D);m9Y81zws4srC@*hq{Wx*{)uFn^m{HHhh;} zewKfs4-D`KYB{kB+o(So*u93?=tgcfD~+rLnGSg{VS_jFjNRdH9P%!k!b{r=7R&`~ z86;9R`SDZKQMpPynw&_%r1JU1Z2G1_#LBHQk3iM#r^KNu;chTM-`RIytEtt@carz+ zh(~V*fr)aTPeMbj3ojcWRxA1MWbR5xKz+kOLb1;wRkJ4W0hnCiI?q`XGK*&NI%I=>mK-9kiA!`Bu{OAC1 z!$CbIdOBZSp;ir&ay?6Z@wazOR~($o5EF9tr>n(c9Tl5U>tgOqDra>+>0Jjq#mzw+ z)O-Q|4J-?0q-8ldnyDl}dxl*kYmxBqs9W<>>y!HS{7gv5vd^kXC3UR&}z&h;tE-zVGB4%OtbtBmOU@@=4e0MWR05(wQE_!!qw&DNM`^6Kt^`~3%GD)H|- zlC9#5*FpmhQV84=-F>kBUmz!)egpKtaqidw&TB29|*1RzV z1V}C>g`H*Fwu_NM9DOF?IOCE}Snj?W52=oPi9`KAwyLIplV6e}clK^y!?cT3vx0rH zXO?_Hwr~il1hWh_Q*`)sB$+hdreWCz*AkkqS-HN1CkYbR$>n?P*%AWR;gh&CH%L9O z+@vMbiAZbu68I37vELi?WrQX?QnQj}C$IfQRm$ypJbvc+tr(F+Yw8M#tPQTRqP<}c z6?jci0F+qAOibfkNXyb~k|HV!xz;BGlOO`e{D0c-T7-32G;xB8{hi2Xp_;IG6q9?s zf=-enU#xwdbg_=)A6GwmX+47Q0QPKd#o$aB)Q?|XX}ndxH< z357lnV)e8FF6BCg0T8tQ8Nj~PwNzx01M43?r~UrqUtiHD2HM%Y33s$>v*2*V5gqK4jW=9c_HJ179uHISlKrt*-3^e3$Hlm^}U&j3qJh zRa0EY)=iJuWqo1aFSG;YaoIkRwXts0w`dmPee9FKY5uX2nLcjWI1hTZSaUE9ABM&t zS;h`*_|ZX6R-$}g7IRx6CD7rrv3$(zdY=a$$})HQoc?%gy3-pMYj*ZllX-#_tkCqg zgudUoG0$A(ZNt?pCuO=Q&sX>9h~NwRgjt_4WdhtCF+c|Ffjtx%aVBpl)YWGMqJo2Y zpa6SiV+Cu6X4}EUw=i#PUm5n?JapL+a#Y49*_aVH7{z+Yq*caE2_=x24#+Ic-eqJi zbpBhQ&aZ*W6id-!I+sIuTu7_9!o{1>Z(6y34UW6UMwWxi97b$Q`W z6)|e8E?>g5jGr3jP_Oqo<8*`@&HZ5#T0y#b3zO+FFp?Y+7aG4X<*$bzyT)*2uNnIH zB=F34}@3x7i&1;iqH?mBU%(-DPat%frCPLhgixtBl534-Em#woRyUP?h;D>T16r8f*t>OhBFqQsyVfX-sKjjQ`NR= zxivQd0aYSU+)P^ni$v+2_wJd7l!gJ#0%%qNu={sH54U+kKNV}mw=bFd zT~#!aDDA(7xtV*}gpHYP&{p$Zn48)ENtrAJoWe)U+4Y;b1_kdx>w1P<&buCFIl-a7 zQSlX-SZyF>Phb|YiTb6&w<<5cD2`3s>Od z?;$Dp#ktp?X&C<3iq@0XZV8hTv(x-gJF_-=S*_u222ko7Ihn%o&Lrz1@fF7EA~A`x z%m!6_V9&+kQABN;oN)Ka4AUkpixzYW(J`g!(oSo!^K_bnd2w}}(CfhY`sLuhH-JSg z5yrlxUk%M^GthfngpLdrxxLf0GVSM)Fq15vgq$HzGEgM?ksh3{M^Pw||7i6C1QJkb z5ttEcrz}$r;ncV#S@t6#5-*;egmY?=?$M9%7Nzvr*IGPEhd`|oT zA@pH^z8Z<|LCv~vFORGbGpy*aUXkx^FJq37)qjK^HWE2_twi+)=c4pir|J4>k6;wo zlQB{h9sI3|C>?41@l^OzI4QDJFSx0|x6Z$x0Bxp32tB$}GyG6%H(RM3{$Wm535AR;jb*Zs ze%)@5X(VHRIK)Q)bbulsLbKoa`rfmEhgrjL=>P8!yMTO!n6b0-E79#;>pii;G-}~{ zrTca#p*Ldzpu{`3;m+dBleMf8U49!G!G6zo@^f`luM~X~iM;co+RV@CDkJmxAMX7N z&HY;_wR|!#Pg@hm>3z|XQPm6D!(TFw`BUi89Q|ycH+or`WfAoILEV2Hn-xgpXu?=q*5$G5G9B)v0MsPHDC~B7&&V`6+HSNB-FsH-P7LBhA@O?!gulx)r>~a!!8Nox7 zrMI?yv!*=}$`ud$MwvIK&=Z&RueY9ft+T}x$J2@3^aam|a@*Arh#cIuZT2cGFW&Kz zR`@{iQc@mi>h1WfLP2c@V}Dh9*mp!L*mdbC`Fzs(5k`&xGy@2=zIhsOW9#wO#HF&b^dhBWR!HTR>~Om0Xh35>3Fc)zEeEnxst4_MhY0g&8Xw{=e`0;K6I(@ z(;g2Rg;$6#}avcIrZyhqPdd za4NtLwJ^`-ih4&y%PWt4)ixPSqepYxlfmve8}*H#s1WdhE7&YU)A)fJdjNo2V1PLL zWW1qJq88nw$R`Uv)=R8w=+u`VW7oa)0Rv;D0rAkN3^=5TGIV}UECHDx9i74GdGVBnqQ-DdK=ISEA zGQ+E5F@KEPTgH+!RXkAF$d)J_S))_H5c10Vs~gM31K`Gz-sy6OT?Y|vi(gh%gEpZ7 zCg&-SgKwPITCD3iqe`j;(TDhL&R_cNk%*h_1FW3_Z^C$sH11x#*Q#vdYA3-qHBdv` zmC|o>JYma2w$Mf?&Ub$cbAjX5)fB_I@DpEhk3~}}F&0P)<5)yJap=v0L2qKgM0sVj zyZO(X00imyZ)>*_Ejo%@q{$db$c*!X1mpfK@OOFbb zMqDfE7dn@?qR%aB!S%)d$qS2I>JDxQJ*)fRvJL0IQ`X(S1FtCj#b`)`qtiwoNGQIz zuJ`AonKp@H#oPO6X^=5yHYsV@x<;ZTlwn!*3DWI7V4NJDpO_2Sd~fwvVohYiL|9Yl z3U<8#FT)~Uk*Ys2_arV1o?*S$CvENHE%*EvK2bHLdrv~}R7btzhZHE$dilqPW}{|6 zC#5+gdS_T3TS_uKYS>cIit58(vrhT5n50Sizb8@%Fl~7Sao*Xx;N{*~TDRedgrPC< z0YI*S1LVRZ>fWHB>!qUiN{M2Oxc^4)l`Y<*cLQqThW)sp0BmfQ%jFi`P%y;TG$%dz zx^@wP0{RnR4TA_)SKI^fA(EAjg;9+WQx{mF$j=S4%xPBhmQ1Uc(kmV8lQ7Z^IzuaP zNM?|XG_zx91jDh8o(uTYzowJP5b>l6qejP;jSlYk37yO!P(WGiu$8pwu}Y# z4c5jc6vTRYmK6{LMF5HhsFdpECDFF#w^z-h08jt+Nk)E))LFx6F+q&0=&g%|yw+Dj zc%70ct2+#n*yxi~k9fo6m{6c#+&_!PGxuT13$$}x?VMy`StaW7BTH~P2FoA|n*i=E zGK!`=AIJ{@H6H5;MeL6iZ@*aq$&bxJEL)-o?oJsaLVMXan?_qi5aGmhZsVH4R+f8x zVu4WH>vc}6?39|Wo($uRK%H#e$(CskIsVHInz2a4C}(C*G6uvf!?NgLT{)VI?6}W$ zIh@e>JNPf6nXzKM9K-Smw1ZteZ!?;6a!hP_RQ%t!9w3fCO$v_iM&}j7j2I>26}00@ zxG3{Ou`_QGoKF}T4rVyY-jMdte3P<6dq>;da8|THQ)l)hy|9K2SnIj*!W7XF!1ZigN?>=EXdKf7&-cFreO0vc)=T?+F@IigmNvWtLCI zDW^a`qq=x~Bjks`s(kTZ3!xd(fhk)p-Vk8}q6>9>TP>??|Eg;;l@>!v-q6q}Gk zN_!2W7pbAD)?hx+52BnCJIJi^WXvTl@%0iJih2V#{49zEi&>DwEInPpGw}rXn%g%V zq+zr_z0pGW85M6ctcX4zFEK>1n%=xv$ZLF%IkU^WXSgQGzRIZX1k~w}Y}+5iDSKxn z)kt;_EG%+^I46a1%l;rbx}#a%>+BjTVqV*-#jX(ViP1yWmCg%g7BP~vb3o6${c4~~ zqxJ9a$*&H!uwqjNg_2zNI$erlEx5pRo$2!IoHX7$!fUg)q>+rMKXNVPduKOL{bjwR zIv#??`(NI_4Cdj@n5sQB!l?_DpFyLetmV|5U-e8xQyVz6JpXHwto<+d&BP`dj%0^v zlLG&_86aTC&y`vVZc%iv6cz$R^9Qllva6~P;9Af5QscG@S3pUpP8<|Do3B{DE)5X#ewk!|yU$)VS3U$y9hF=$HO5 znMDz&H_w4)L8ys%@IX~4>M{el^1oTZJf=CWIbAu$=zF9<0ab6#YqqlUtL}+v0i3`~ zxManKbfn<)3z281&|+b`a==p&styx^^xi^g%H zngKy8B*jO;H;+wA?A=ATDIq@cq0|O)vcRG7uKDZyTT^!70Q}(+r{&Hj1IN{~!c)?q zqGf|2?^b(p!ea_ZLXO<4BHAIvb7eAjtvWrNAG@rfoSP-Dj2}OE&&5#OYu3C(?cA!N zs2e5RnP7JT8Xpb$?tghtH)pIw>x3kedP`vj2614}_`!)A({@eSfkVK|e(0MS+~$`c z4WEI`2%y@PRmX=wEIo|7f$EmP#uOmYZCmLNyzh^)1SLv_PtPQ!EK$H-Me=_mdj6Bt96e%5-M zQWr4s3qS$a2jmJ!Z91LbC=B}JW}@SP>acFWW`hXIOu4dFT>HjxX+xhEft2kGaV2_2 z!6mifU1CeG=3&+KNmi*IWu81bf+MKQ>a()EpFH?imAa4N4a#<;GGUZw;Av_I3i}J3 z8Tk)rZRW6<}>}A0j+YOoIJ~tL!$i#xxlj~FYFp< zZZt%qw67ck+)d0}rAY2_lrwCE*(iNZ$+;;{F-j9)iK%UXrvXpv&e1dB0TqB<8$X>- z`aGa|-+f|LQ&DE2JwCG{ef9NGyfo#&E>Mf)NpVUM2CwO@cZ&Mox*#DaEG?MLApBf{ z!#Y4*n+NgK{acwe-&oq;ht*OWSS`;13N^`LJ*Jgj##r^E2V#vZ#~YMyPiG?NoRKR; zqJ(Hk!G4l(GY3_6Afhf|xE5^GsI7ve`m;IGdyxhDgw!>xpYxz|l1ucw*N$lGju|@##|1 zX8_Y3R|o9Ng8#i_2*<={mX5;HWGMu4Y)Nu*rG9MUjJ~-9i$cp^Q9^h-=f-!r^8glwS zp8j8j1r>0%FSw@0=^s)&0>OhS0{#n6fCoI_&5i@W@4d|eMmLPAUH`n2z`ii{$;`4u zcdMUE?pS_b_tga~-L+cJjc*LB%C+8N`kg7%0QfKl#oXuQ9f#}zvrVl7OWxq)8r(6S zIE>Ez8BI zN^)(4VI<|)U*6pG>`4QV>TE~GocH_lX=QyKobqDR%S%gaFCVgs*=zxgy~1715AtYt z@p<+3h9T_!&};)Y8a)9NDIu^|L$sXpEW^t?L*z;N}g-tww(wCs=gt@{BmQg()5`R)` zg?%^aVEfR4#&bGLh$R!RHvh{AGhW%``IaO)t~t4lPkZRve&>H|6_hD{WDrt`P#An> z?rXfpi{VrUGSU+Rt#Sdn5Ut z0iIFBUANfE$-q|tDRJ(RSS_2kZ@A`#x}CH5?e=xM%!E5dYlus1$z~!DkRHvOh{(UjJy5~5CX)z8@k#-8mt6rhko(005dKe{rIUj-j$ln$` zBV=c0EI5@!0=(GZwgKB)qPFU+tirD#YjMqc>)J7|bXe(*4+4Vox0Evtx>YUAu!-*D zt+;z82@u+`px5|&TShR?(5GT^vJeGqlCskA2X(L96KH#SzkAUzGojHql*ZUnARhr9 z1o6gRnMkc2Q(wBt{nH&xn_LD>F$^X#))`Fb&!0v&Eg|H;eVHj#9#X7|E+-L&m|DX8 z6>0*4PvEgnU!I*Va4n2_;+^j#BZyBmt1%mq`uDJqq({DGS!cOdnR{`Ldh5Ly>NEqd zS3WQ=5ow%k6TS25I#I9Oh8X>rnYcse8VpDiFoLLpL(38ORN|MgP9dIQVY~#v?)NwU zrvfXcgE)_chO}MTQ6!9m(OKDr-$;4|YLBA(BKkg1^Pk!ds@}OtFeu)aZm8>hx{KgH z3MEds;irFJmbe?pU}yE}KC>jLW)N z*LaOQX)BAu-;fA%TP1oya2jQVPhnHFLo%Kyv*U8;BzGGgLtqNWQp?6h2 zJ(J$qR7HDh`(Z+R#|_2;bC388UCJH)EW6qRQnqYYZaTfKs=W`dw_eFCfS?05_Wj!5 z-U2d43|lL2_PHm3R|2PUxt%gk7BQw31&Vh+qM*`$Qb^NTVEcwI!7tFqx6l0R4Y)ry z9*L4p{G-INqs=vx;I=^C*#tW$7Oe6gy|B%T*Xh1NM>sl- zswvIzM0sTri$uT7Y79P)Pnc(dNFjtGDV#8dputP@Qm1MQe=B(@Xv09s^(lu4h(#nX zc7+y3_9Rbr zM^~4h`D*O>@Tx)X>v0|ibWGP;Vgv(6^ROvpv(KseX6?TP==^}!X{c%C#L;*#>_a;T zjX0g)zU3}#==IK1$b3|H7r_hqiQIoXChN`y_@O37i}h52+--oi-xa&gFnO{7RIdLg)7WKS+{P% zjKAg>=1fqO6eNfBl6)SYDmq8b!|qWG$sj{6HtsS-2ECW)iB3x|{I%q{pfSI``|JBhT3sk{R(fATn|lF!;ejSHJ%21`+|)h67bTlZOA z#O*j=@c3v7X0e`!OYLEkZ}WV#3-^nczgx9d^REwh*0MnFVXYEWxF6xZz z!mlNLg06YBo!FFoNSi1H z6a9c>miD#`0===$dXa{GW9mp!-L6I!PIANpxe06q;#hw90Qz;VB~B#Zn0#C*?Y!F< zDT9raWpE$gdzacVe@^_wi0Gs<<`Hjv0cMY_gca4sx?LT2^`Ec ziEV53XszNK2~ObeDznJuNyUT-G}a$mpBnd7(IXV-ib)qjD#(-*P%6@&yrI+54!VqS zZ++L8k`94Pn~au|90-K5S=OECKGsUR&8fp%^w}VxrH;g&QV@*ZFu>SM+Os4sH2{+; z;>`Ygc03D*F5NPz_m!GbGFjW?_ zEDizEX+1yqi~kJ`kY!I;_vshY3yT6Vi-^e+b{*dFw7}bTEKKIbqFTqe0Ytr4!Yl_^ zL~Q#|5a0e5t{gsq=ZW`^k5;V@?x4q+#Cxuxm8XNq`_uMd*BLq=D&!M|^-*JNzn;BHtky zUxDCct*p@~zrAWg0GGCU(9%E_$WYh$rv!xYKB}z2PyplU_KDd>U>f;cP-<>}N9J=Y z4~)SA#EB>*&IIieQH}`kzDc#q;()LC_iMG3}S^XRMP4GgyvxW5rcS9rQL6aGr7fwsj?}>ftq|s^8=1CIC=cE zIZ5N=i9@b}?3Yv^o3B=RgVUE?>1)ZfuYh}8leHDG%ZlFiF|kApqshQESyo36RTjPm z6~Ii}MbJJG?lkQWckG>)z(Dk4Tv&s$}iyq5N3R!VrDuR=b$0n*VhmDJT2-eUrx`3lryF z$qSyIpPQ8baY24Tk91#XXBOSb8}923UX(>{>jAL`sx2_3`|OL7H*hwChLYTRbwOSN z2o-O$O(%V>oHK>3VD;E z9!+j+4*R~xKmDAm2uZvsgVW~#=VZ0Q@6^fMwtuq8ISB398wA6d6-F{+F#J-=BN_cj zJbPZ5V7;#g+V^USpzGv_h?yROOx%vC!s)vzUGThqN#eukS^_~jm<4&U*>V1cFYr1} z8hFQAiqq!;`{avPgFBQoG#v5i>u1^vm5Zj2%NV-vy^@4)5v0NQC`yck1T_1fUYwJb zK6HAiUq5-i!dbLBEH$HGV(YT-yFlbXl?IdbKPojlV+|NYGV7EDaVbusL2`-y+o+o5 z{esk7NA#V)BAjfH0EDHH6qKE>CAuU{ggwpV$vlAJ_9sM@t%c|^9n4=Gcj%5kQ@^d9 z6nJ4ac!S(Jtcc5FN(ql1=dLQ<^jW$_ZXP0# z8H+C^vU`c#-G3DJ4|Z#ipF%a;Umg^>mXzXH%E}0@hm$~y!1j`yMlG(G>DdT2)=i|% zMs*&9I_2ixh&Y%CF*m`%PTGHt#rqrZVYC9k4ZWGzkKn!lIT>{Qg8_SZ+?;Y#HubB? z&c=w`hCrcflDX^k(bHoHhS!9^HQHM!*evs{>3y5%|AfEi)0?;yZ*cY zOF*>0yLZyUBg*g^aZAeleVMs zOvPCwr4gE($@GNKoeg%#405T7^jgzZJWP{3tr<;i1?XiLv85r(QiR~}JOeLe+ygRk zq`SIQya0BhT2Q=Twb*c(t6I}4H!1=vAwDAr^ddz&%8uK|-997J#Gx)UB`1-TCIFuq zS0ym@(#gJ`a*9l4^YCUioct2wak_x>NVdtr*pXr&!w_5L(Q~Z^OEC#SSCM-BaX>e; zmEw77>u>hJjLFSMsGE(i2ZAp2>x5ATyO!NcR?QeGg#_X5$9K-Wt8(TLLxxn$p#moe z4}Pu#eWe2%48)E4H-e}6+hH15Mzk(q7(rS;;QI7J3-KDX4;i0%>C^jQM(6w`2u;4p zib486xG~@_qOBHRF9v3WZx;2o*U^Yhu=Ehc=w&a$?_dh2-%_!W_WagYm9P|{gh61W z%pg@Qq|}gf*TpH_F(gmrgbzw$$4?F`9 zlYl3FEeNF52fPubAFiOo*@~A<9Omp>W68vG4u?aXlDNYqz9^hZp@h(&*bOO4xP0~@ zw}MC}<(l1}v-w>nBgUiQ~KTO~>@Zkf9l_bjgIT2Ibffnj+z1fR)fS-o+(L(jCUx3=|>M4ic6-g12{%HS4A3#Bf&aYE+WF8@e6GZCHJwoAtd8Ku^+S)bH5lcBa941MStkeqapwTOqsN-t7 zUX{x1C&oQw_@HL(KMNK#qvp4<3J)&e@?(PBZd_P6nu4xWZISMM1IqtLy$n-ZgU%7x z5Y%lFZ)?(c;wWZBk*b_`1{nlDzM+K6PcvyH7gr_DpJ7DD)>PcjlUl&!31Jbb-ClnT zM756lr0OT%%b77KZ9+H*TY4cl_5M!`ys>OTY=LxBI`h9UwvYUcaox)7158n@z$Lld!V6j$ zY_6IO+sUcN)R&XN-vewNpo<{K0o607Y&M`6ndA-p0(()Kq)w~e_!vDfdctUv*BGPC zt#)&Z64{wIM;U9Iv!;+2(@Omv7W?`?{@{0_ndz5Ko!E~tF@Ry;)ihNv0#V5BZ|e*j z`jq_eW0dStms4Hd`S2C!+=d?xcLF-jO-5fO%`6sayJcD>Z?hg zMgIM4M0yZ)bXpCb+AyzlbfB$d!=}&hL>V%_SFXRW7%sg(FTGtXWFm*)n z=tE~}n#JmBBhDlz-u04%Qu8*Ko-WKM0bF87vBNbSrioLYnkEc&p{*uF4*!F@4DGAt#)NNgh`U z`@7nh9evLJ5K?`?Ggz&T_hrI33L- z{&``64Zv}!Rd{@TTW+dAM>??&o^$z-Hr zc<#I9CyL5;d10&K0`LEcmV~>_R!XbVspA_AM1T`vsCGZ9mUy|pRqt~#m<4W0GtqeD z#b7dSBQp_rR#FK?RR^OcI9;+Ngj>Qz_0ns0*B>;^3+iEKzZE9I0WU)RzWBAZ5F zzVE{)(;3^CJ*sHq#(E@&0Xk1IrY=<1k&?G?!dv?5^uWkHp1{g%dcWWGpF2bc+WGlA zob1T|zWcAqjIqQfgp8e|G<=qr%SLmEq&!?;9zSNf!^B1-&#@u`_nQCeEK!3D&7K_+ zr#0jNy<4tnm*y!7&`+Z5uf&m$sUa;}S+B5V2Ksq_PC4?PVd-yf zbF^wp%EY@~)&&3~@eLC;Wp)kQM#|uW+#DMM$CL^mAfz~n44^+CRiTu!WK=u>ep)#z zBAW4e!^Gv9>9c_hIjazJavnEh9@WVUwxDP1Vve_fNW9#vn~4Q^@1@)2i~81zCncH{ z9pJ4Aq^+(;!DcLV+qkb55jl9Qd9}taT(3l25KY5?v60KCyYF|}uqh)m75mdhEoCeXEOj1K_KL86N$cOKG2DLLxHRHjIR&Rj zAA>(4+ZT-oSdjrmKp{B?FWs6p3$9o77!ahnl{%6!Qzjqe=U8&q3I835cLo`&0BUND z^`&$xDxZV^t(FxLHRFpz_OBhA5CGQDdEbU2=f#nQe$_uOS|jeU^A2y`d&{4h_R{#m zi>gA~D`^vQZhLjDFeqD5un|k&>@j!(Vgnx8xwvSTw@NeUsX!)J$Q~gOE1&F9Vpm3J z*9nH=9ZEpSP#Z=&E0rDXwmoC(-bDX**bR@UR4re&5x*(wYmHF4;j!jMrjiFvlgwd7 z<}7b8!}XIn$9R%<)aDQ8mJqYWySQ|}zs1vyx~tE@Oq&D+YcRva!5@;tP*~WUR%v5K z)}Cv1msPSZ_{#-SCWuUQR((c+sn2rUuX&}Ry168{$^9sm$KUBV+9R%{C*@PcIw~*vf#%T zo_A>>YA^1zU0<44H3~VP*iO8)A;uHJOdFv^^$xqlbWe&fIINb$nLywB#B5Sv=ggdW zr*im(tPp5^cQ0qM;OLP*e@~?zk8q`;8m+_fF59b2b_03_leX8p5;?1TK4T%ifkrv%u&`bAKz11}H0t6>f&UHAat?_(h4jd_h!(Z1v+kx~zW`xMz_ zbpOdja%FINO!Ji(mQuyGDt2<@>~P?_iZ=x6%Da2^KMFym-fU~;g4J{vafF2La(X=p zbU)%=vVw89o^SIV$aC(tH1c{b4^%oNa#bKiMCLh8Bw=YM7Ax}ZzQa!z@K_z;_6S`b zFE!(#5YHREQ1N~Vb};oJ+_CF%Sc-Ty6^d`*Hv;|yQF~hX@G0;Dxt;SiUtmiq&}V>O zg7gX)c8UY3t(3UAVE;F$S|0zCD{O(xf*t1*x}8;X8|r5CA+^|{ik-{Ejss`%*T9Q2 zDK7?2A_P;0O$F~~f-rf@XZlO_<{~7>bb{!ZlOK)n`+j!Q!$mj+BG7PHs z{rfiJa*3JIMQQHvT()3RaJKtS=doNc>!*;uj&zOeTFyB5^zTc#TrB(3rI3$9%AKnf zh^cMZI~(w&XCK6a#?XcXxDY$Y{TgLqP4fd|o5`ds_T07kC@b$Q^>S@MZx*_U^+Y1> z>l#kZASd_!L?0$XH z&7c1S(l^uU7%MguhxsyFl7Y`TuuxP%mKuTIozEo76l?tZ&X=o=w+|J zFs+_$GNKeKYFAM^%jtuGn`N=%@_W8Ng@%v7FBVH;m~gAUGBz5Rs@7+GWHw*>*WVFo zI%l|bxr^zox#n6DXjj)jTMguZ)lYF**f2^I1&mlEI-veK4&}0{s@^u^20-7#HZa-& zeH^A#R=60%!jFlvpage(delUp-=vJqC1+6azzcX$%J(0hHD+W6g%#Qe*f!J^Lo z@~tuc&}~CXyD=GQ6}NZ2gjPpCS}62%^xF$dC9S-um?pX z1DWp0rt~-$cb{Sm(`4(0A1?76@5E#pz)+<0-p0Ee-c?_2ZXxD zTsoaiT!GZ|*HrDVhC>{nf^(NX^$6AxYT<~pKuF}Rf`$qWGDB^ZF7iibZKk&T)IZKf zyhVbGo}0T4q_j27RLug~w4~5+?Q6%0!iK03HiTJjjtNbj_mroq5(mrctVAje*M~QUT}js?TVpNF|2wMVWeMe}w%psLsfju9T=Y2tVK1(LUK&-x;<`it-(k zP~ppxvfGrUb&)qzG~{=9a-HTEE_1U4Jf$jYNX89wqX2QwNTWnJEI7gs@D2er$=d8r zDjb>&JL{1{;aMf3gjGN*3*N`(lSNDbN9L4C94+5bNYU>%cWv0*T@nz%26IN+lmWJ# zWxNh;(*{hg?T_8>liKQ)kJzW}7nWo=-z1*3YygT*|H?dG??eI#*jH!7Bc?th zk~BMUx-6H~&Fw#F8Rxxo((&-3j5mwLE&v$i|ER>RPg)C^%Aq zV7o!t(zWBWZ_O5VMz)+Z@)c!PhJT%&uscOOWEN8y`*WN4{S8%>7s4TS^H@2$jJ^`{ zb0bN7UA{qNNbbWto24l|^$&B9)bgDx`h_Q>Y9F?R=v-2F3Q#EII@%s|Vp`L=cvOYV$fuO#C30vo$KsM6GJRU~r#8oLHCJB~Mo zb+Tdgsx|gFw20}iO&*PeQ|6Nzgq;N+&J{Bf9swb9%4C+7|GI$E)zOh9zrK!b*aA{8 z<;oYZDjt*h&qb5zC#+MkLt4q_-y$;n$~4?{0eqx$)$U_Ea#yAUl`5Cw)*pGq;4mNeJQ5*!cSGkEwJxYb zk0pDPL&J-_O`Hz=?N5-iWD1xD|7ytgND!jOw?Sk=t+g-B_bkbKKmIN1effsT89GI# z0IKuB_q>#Q(=Z(9vzuCe9}brPV6!e65WOzsM#CbNb&wFTTuEABd$YE(48GYDC>8}X z=SQorHpq2H#olB#opl`NxkQ)$AH`eO*WSWNpWFR|!tct#PZ-yH+|F|7f*D<@0eq}c zY9=97MK-+YN-ObN7|cwSPU@45H~rWzz#mp95_rt*$X55)z-pK%5sF4F0eR7=&7^2= z6q0}p2mmm2d+RrK} zuo;w4k6GDvql0)}C`x%Ibmuv6d5j*3Cv`HO@x)%w8>62X!=H?PlF!QVvws)f^kcdl ziBbc5szqvC@Z>dDrVb@(AyyFyrOm0HCumldP?d2+g4Fl>gV25ui=FrQT0}gN0XKb* z`xxlQUq4M@eKFpJ+!j1`vz1xHg-&4pFCmeWu~V>R{0ou`#cdBOQ$7h`;(1#ErbMJk!ZvY7e><@Iu+433Wigz40 zJz%c4Qqg%6J?yx!o}=}Pka&$nR%Wy14eY1EO%wf>=$HL~&-iw_1Fxa^4$4Qt&_4Uw zg#WlT)Dp{k!4fXtaA&K@X%BrK?5ytb-`MV79kXy#WEvbBNLWOg{?w;66kK|V$OJj` z?9|{VUqo(mr|n$(c@w@XvIO(wNde1OrA4?jdeGp_bCp3iJyFtHWD#Cg%C7i3&IXhx z6bC+l-P1qtVc1JfFB9uI`%r!J`R0C>x_|SPM(wgBjVc@<)I@1>k8xdB>N9dqKFNhK_QDt z*cQRs7ff{qDj1_CcsqIcpQqR7g+?MxP)1pwk(834VDfXq4L%tHM)m zcxl1rKZG&fV2YS_c18^p!-(x_Ea*Hp91gm{?PsQyyAQ9o+dm0`-1Q-v{OkmT4!S>2 zge_O!u@NMyXcrg;uMBts?z^5!g;qQ2Zml!Tl1&7Zt_rI0T{^KkA$Jx2xuC4pPJ3j5 zk-v$QV4oQ|R}EC<2IEDu&fM9urb*c*&HC7>Hyn0a9`J}Jkz?8v_@tG_up|f${WaP6 zz%giPt#N3l_vdw! zC-`eeTy;b%_X_zVQzHvw>b~1CCB*X?KpQ_2$pJr5vFY1wBb%m2Iwr&25DJ4kIp@by z&q^1i9k0-S;)zHKFy*^?(<-VPfnGse?Ir`>R=+T%LE}z26tvE1pFwj}Y$L`4TV`Ko z=qyPDQ<*dDx{pKXe=3K&m6h)OdxV0=+e4}feU4ayeD9jEA1j_1OBL0vl9z9NObXqp zab#H1J%d5%DEN4lWr>2lz#%9s6s==9fGk`sYP`?d=5F{uVp#wJ1gF$hCy1J!*>JO+ zzB>-tJMy>6EA`%sYf&X%mfz5>Kr0!sw%x8$q-0DcLx0>C&84Q1U;XfHW~7Z)0l)TV zY{)z)H1{@MF|As8tT&`7P=Dl7l=$W;fKh%bUk6qbX!g%~$+5A!Bs@9JV~3P^{J7~M zbK=))QO-sWyxv)^a#0LX3pMsp3t29%Wp#6ux0~dx7BTrWpf@i-9D2Q!@J~gcIq{Ln zo4N*?B|*@Ly*`?zhK^wJwFdq$*9xC)VQbIf1RRD98;@*@cswErzp>VT^KaPeCDYL5 zY9T#RW*Q&(;7Sl&AkYG>&-ns4g`jCeZzQ4$uEN;z7OxGyblwX4o@4YrCT6cmT*5D8 z$Sa{D=$hBOFfI2BaBLtS75dGXO0!p|E(S7kHb9bmQ$p|}nH88!$ZoI@refLq1Q{}R zJve(QT~a0fnPfPFtY7wK0F_B-VAOucp(O?1o#thn)anU%tf-MM=YZp+aIa?22|Y59i?gs_noq| z(XFXgAL|Y3a`ZKJ0g8R&WCCBRPH$Hd2=vOy0KkxQm?k&CI3-@0LA*#In9W*WECsS-df z5kQ^t+V^1|%egx4_IpB;$}lI=KhKT(XCk?Cy9f`7B)lpo7t=b{0AN*4XFWy!woXd& zzzg8YUJ23%gJyOg5-|l|*7sm2HlNvTE3Z4~^Jht62#i;Znqd4xVvSPS-Wt)A=u6a6 z6#3eT04;&Jr+oh{fUF2uAcyCVKjhepDcaN1Y1;*MHi!iU-8mB!Y{>_Ss5=^w$S|LI z`3qqK19YU0P5^so$x&XR(6&NQ2$Q;h5V!Jjn>xKQE75%eyKUKaJHKvec-49GXPUPU zjmZz^SVy~Y-ClQrt?VDM+lYK23^h{UVHS5`V{mMmA>%< z(2;*oG-`Q!b4XR9FOkJzbWMgxyy{{GBHNeDXD6N>2}RUE3F z4UYC_D5%Z}PZY%Vt=nnx!B6X??K01v`yi}SkdhOtl%pIYX#4cIWo1vJ60nYtik_p~ z9@bS9EbLI@*d23~u(~#}o514Kl#u>z#J9JC-7Yb$3l-$evKG>=xZFYg8Y0MBA_?JauMBPxdsd^+`K14h{+FcimK(lq>H z36`JqA(7hQwLTm>T+-`-V)A=T3w3*S!;}(~v0%g&+86dOwGCyp_V?w0OnMFz8rZI< z1U7x{VXyT!c|t0ms9O~mdbRE%qP^u&)B%A>laZ74jF%hAAjXIPv8&bo&a~2tSJpME zi$}owH^LzQ?^FYB9?!+0xwlZ>*&5T-=u7kx6nOV|K+75yWAV_n3Kyx70=wh*K|;Y> zsc4*mu2cBNBh7?9isnK zpg*|_YK`lL*`^fsC&_<;>G|mu=31OHYL|uS8PDjfm9_tgQQNj4A86lkWW(MkTFbb- zn*we34YKZa@4KT8wY@khsL|UQZ;|Tr-v=yw2+DIQkX*bOBLA?Tjs_flfmx5S8FWcA zCa1+m@3u?$f6(8XoO@N5suZ)C=Uc?C zpqHYS1S8G25g3=Hf}>1#th==1Au?N#UDO1Z2D)^B;L`ZOH;udE6Dr=uBWeSvVHiz} znAOt{dpUJcVluopzX~D;Hf}#`@+UORiCfe-m?Zy>G9UErbM42mpZd7Oapk9 z5|d+mm*T`-a?{(7o4T3qsUjT`MO}}Kkr_evQ#SDJNB=R~pgxAMR{E2p}6%%#o{S4Pij;}jx1 z+1Sf=iohlF-b|1$Kp}$10V<&R~RJ4r0(^aWAN=>BXXJaAmcCBHE_yr`93K<9} zLDhRW`0*LLjJ&fXC-NSG(~nxANyWHxJf@w#ny7|q%x`5E_6G?uH9Yc0Co3@#(*OGEa(X;eba0NWG%#h!mfc^IRZrV;V-%w z`D98?$Q>l*2Eq?bmUCshk?f*e25*^oaI|H~jB!Yhq(Db3*#Brdl2ko>e)02B$1j+y z)pya2yEoy~^k*LcITxx_xM_DpuxKe?;(H`)-^rvc<{Vap@qyTEFtB8z%qMvC1lM0q z*A}!$b49SMN`G||qz({CA88}DL|R7jRY5Gv_jH$rCYQL->-^Wb>kD*X?@p^NOG){4nbh_8O!KBiICe9i z*WV`=)1V20@UtrUgu`k3cG`g`mxuLNF`>bVLSfragx8%CU#iP-yR9rxD7iOUI>Apl+k_$}3VSR*V1?*caZq2*epqI_PX+W^ZTe-4iR}gS0EipJOn|jBLRa@3G&ueB#-X?D zv~;_^h>$5_)cP)J8)AG!b4_vC)+amn?>B`fCj*IXW|Zhg(gCl^>qSw=vO+@tZ!e*` zgRTc+^PB-2@J2^z*m_j0)ODcCbrCp`KWV9MPBk$~YI{TI^2;uLdP*sdEtAHw$Oj*w zUoAHjL#!T)$ww|mK|TI={VztfbcY2ddjGDVy?Z}rCQDf{#$L~(l_B5AZ0U7NUCXr) zm;W~m#7r@@*JFqOf*E+`(HT0h8e}E-XD8g-c0N6QmWUKo>cT#00_4V0wG(thS%!=& z*|1>IOV>AI*c)>00Q#Xo=&g6JC#eNHwwglny>_?WZY`ev?9E@HxpKc|$<0ibPJz!v zdgN4MEQd5B&w3|JC8sWs=};PMpiIlzCRv;XKAj{HL7u&tFqW8weWM5C#tK;YqSC_3 zVD|~FYxnb@5&?>y$8W0QuS|~&IbX*lXE5-X6a!Y6=Lh_N8 z@4l6)nQ=7Iol9(g43t=xs@9adIOTo@`X~&U0$5DFoBzm7b)yZXrkHnlxpTOq{Nn?+ zUF)@VI|%gSQOzik4S$PbTcl&iHE1pE*qtuWBV0K=Dg=$~mBGy;Z#vZAf9Wo_{~7WO zOaJb}%pDeDxJ%!)4SM7G?IlhxSzl;7oI>GN>Az_v?Q%-MfIoYZN(bH?!b@iN_r~Q$ z=XJU>|EsWf0=hZab#G%k=9iDiBa}&;#9|hfJvA!81cKwUC_6UwPqE)YNtMSBk&L}qYAw?BO}R&9s?C9}r~1HQ*2 zQ}S@sC0n|k`3TTiu;@AQ%~GmWIFR|i`$IA^Qfv5tef@?euUW+>Z9G8g_c+4=BLHYK z06EX=cf6bbkAXSafRbH(u9a^jOCb8Dv(9IVh0dl0c7g8ZJlM^mIkF6z%-nxQpUa5U zBfy(g;;j`sa4P!{h|w544-)?MmX}8_Of_S*h5%5qOBu-Wq1u1l^~>m4gO7igKtl`^ z68gl|u?0|Asa{RWX~I_{BP(DNFKIkiSYHUlVI70}MB z1Odo#I4v3@<)qaJ%S3SM#Ck2O%J%Prncv+usEO4VQh=0gvoP0Km&TaWfU^mgYB%#+ z-?H5vU!BK%y|i8TNmt5sn*z)Ue+@w4l>2rc#77qGS7wV=^;>N6pGojhL`-HTR@4y+ zr`}N9H2I#ZUoUxKd49nq1P_J`%PADDyTN*RcD^-Kg!Qkg)<<`JK*?!2SmXHuD%9P@ z*82Q<9AGGjFu?v2h8{$cxhi3Oa2Xn)+hUWAOyDIKPZ#G3QvUsw*;cg#2XW*sJ`A5t z!u!vOxgm8+5R~eKaFt$_t!iD-M z{TU7X*V12xPP-WRCV~FsxI_=Q)miDoHgusraKj#b+(G);32vGV9@}eJL}fM3EwqQQ zo>oyDRXp7_of@ad!4f9YF@=hCPm#4eAB{IkqpI)*8X%_2PQsC|p94ohaYn-*4!M!C z3uBpl2Uq@G)14)!ULh$QsgYW4$8l5Vh`oNEXJvHjp3l!_2P9}3%tzr{1`O%8GM9uY zjK6!hlgT15=-;MccRJRvu8hBvjM}*xxt?e335O>OCn`^1RS4^uIH3Bg5*6$APfp5b z!c@F!pLpJmX9_E`Yp5gDjFaR3x-wm`P!ZoT*?*>i>2XL1jVBTXy@&?4-9GWGz)m%r zcnO-SQ+74+(n=j2tVWA9c)jNCkE^$KY(Gi}k;L_1(kn*?ZD9uZlwLZYUYalT-64HdEUEgRg3$L2qRN%{}Ce8xf?wYMxpO>-@7>$|qOPugbhe@No3IdCL&=;`AKJ6yw(lU9GOnLjMp|_4PqYgA`M9urm#G@I_y@_PaP0<+F^RVJZsWHH$XYvDX;4`Y*V>at`xo{ z>XrEcNMwXF07RVkv(CgWHz#Z$f}zbf=;QPfLmf(?oZaUfUT!EtgM0c%^z&iR8G$~c zUOsu`<++9NWv2ajbKm)`Q``oDjR)Cy2C`aDZ#m2u9S|B3jF)Z! ze0>_0e41F5Ff|u0Z475XZ*iQm&l>*mGoj2%iW!L2!-`YQE5XQ%KQhO3vCe-=ceECY zMvCG7<_dYV!yt6CZv?=LocVDSD*@SK=0jw2d?(NAc|F6D;+<)foN8}KWEt0)JrNi{ z9@UE7i%}<1eUHx0NB|G}cLIT(b&Z(k)AWv~xK_%xQE#IL(skaT-#0O5_qZPwo3K7Y z;HX|+o7IZupAY0A-lxxlx0H8F-7OY7=2JO_0|1-f;16BZ0Ka-lv-u{uc<4 zF&uqK!3|RNd~0o=!VWir=msH97(VjUe4pCq2jg%Y+zeeH=mWvv8HW?1zEiuyGR~O_ zrai!NNJkt>a+IpiS+78hnU3?*8C8c%icQx0aMN6^mv(PO3Z=0ot687|(|S zH;yyZ#JhBk;|(_)p&JX>7NaV_O}p?h0ZOO=ot0>NT^aL?Snqy#i;rd)3L~QdA>?Pr z*K78HZ%vcbB*RYVb42`nuiEbi^O=MPi5uwFki7YeMFwI~io?|Z{0AE696JRUtO5^! zn&dhtu`xMSId|e0_3QiMO~&ZsHj_nNQSZR>>yg5&HFhG8c`yQr0b z;H)Fuj0P2Q%2&I6Py@07z`SLD%84*>ci1+^6J!#s(XRW#y&rqHH?}-7oeb%5cP!|m z4)nQTI%N6m0l+Egyb(W7IC?H51}O0*ycaRsq?pEOi)An4{l%B6xFhBDXIy{%R2q@+ z-i}$p(+)R8GxESV*nKZ0k4@ao0`@!@FMc!6A!x#MF;j7Wg!kde#9{YK@X{>UaT`Jd zceoM5rx4UY%xh!EN{Noy0$fzrM6I7!wr)1n&dQgxs|_;lA5`3YS_8j9be46;7xu+= z1|T=oCecafMkU1z#%2QWV`FxwX*#^bQ1{ouZH|eYnCKse{QBew_#o_N$t7zVlNK_l zzwbQjQQKh}e%iix$>(IAD!V&mFZ4>7e@xT;sRIj7V(*7=qXoO3*XrX(Wq&GG$kboE zU%g^4W|}0HksQ-`;GG8iyANP-2p{+j_;_)mXcF4zHXuRaCSA%deqd4Dbx3~ZwWz6l5u4+V@zyjw`% z79g4koIznb#B)N3WmSJ6w7Ez0VljTi9U5G1?aFMh`7xbBImHrt>9)K9D@U9<7{Sz7 zbavCSF)?m^%7i?|-5sG~K7BgUSNIf`2EB(r>8Igi>k@wx4GHNAsdO5+(ok8 zPLk_Fxlx3VqIL)*HK<^zG~~~OH~U}?`@oDHvO3bD1kIYlC;<+N3i}Xq8_kCT*m2n0 zeeDr?y~k@)QmwfhcD&j}gkLy$vsnN*+Jw8H6D#fDar{`88$={wEFhPdVCt6)i3fH} zYE+Ug*Y_?eqXtdTfE%dr_0Is5*dIA0m2)=v)j~SKagbfVsPft}zym&SrA!LB^a=c5 zjJjy+y)XBx(F^!Zp-vJh;b%lm;f}eZAX?Yn0-~)5?-sldvmZ1~ldc-|%W0xwf)oR&j*v^i5yL7niek1sokGoEsfKez5zZ?jKE!UkEC&sFlL7h74kW zMHI00yH?%HbS*=9Qui<1pOfID;Y}EnTQ90U<{BG$`N;6IG4b)+WU_$Wxlj@*=f^}s zVf#OZ=vDs5kJp7Dy*{~nVBNb$;GME%8K!0~l(C&mjc$NoVLjhgK6Qb%UcpXX_4)lV zxlJfo8@MBNrn&W5lcCa&iN3z~Of0Rh#Hk#bp=g>EDVVgD4KQ9H`u&<0P_V45<8yD) z;bg5nx_atIPdPK_7c9P?zJFY|iHCJOTr@F0l8u>({GrI+@O`|u!fCz!NJclehP7kx zvYl%7Hhnr_V94pNoD;t8KS9do*dmV_c%4l#ll>h-8pz?fB2%WS zSJp%CDIU)Yx75(j6HZ_9x&40HjyGP=yMgpo4!pSfWwFkJke3m~6zA^_nez@%{rCP{ z73k}%jffzKz7=1ZnueYXh8RtLa6PiMfzCzlHI34GVBx;pQNSbj2?PB20t6L~K=;AM zE2S&~Au`HdCMZ{RtNruM5BGHzrkl@#yX3Fi#tYJs;D8yRoH8fwtp*(eIkY^Xfc3u4 ziVDYP?~^_og9b%k=j7Msy5GzM3qK`hh_JdM2#TeRc8bcC!xF8W0pi@NeGY}o0LI+% zCLK-HI{##HGJNXkfxlq+L4`Ly{wo~chds;-S1e>mE!S~D+=Ym-RYcoy~pbK`F zp&L~BjFqO&I0z~PefQtS=u=T)Dr0)BR?PCxsJ2{zW$9UC%HVAN4eaQ8~$bvv4v-r(9Fp??-4=5cqqRZXmQTF2kVf~!-a-b{SwPhOJQP}!I z`VZQl`jA+oHXi8QpOuIJw)%|zzJC$;CVP%8R_hE3swM2Zxu_b@ipj#M1pLQ&ZY10= zM=qqfw{U2$6kIq27#07|wS@(J;P9Jp6Ly5~i`jkH z=u#h^7u&k0Jej!k142U-ewq&o0LGom4J^&dZy-3IMtWHH3W^Z;MoC?%YEyLK24@ao zmr&wR^8Jth3Ku98BHoa_EgLL~*pA2cu;WoO7>sI6hbAo@)t^m7KO@7_2TnIZKCfuo zQjKsbE51A=eVr8B-e2}HzK_33b#1Oci5+BW>}?aNq|T4kN@IJrC?ej)?wY)(=y1Wy z*K#MK^{TjyYxtv2EO8|C;7@VQwd!0H=%FQaj*AM4K!uJVs2yohnKOby4{ z5|x+^hRD(HEukFU=3dQ;!jbSx9`T#y?E#ecKp)s8`sn~hYIHfH{S*yiONDcj=BUvD zmygvZOux38C@Oq{!x4jWq>EdH6v>TT1>cofgrXJ^yg`B#D9>(Ps;tce4F4gBeRF0Z zo#L-mok7ZGFk^yV9v3-3{@5HCGfu{2kQtD$(vH#H-y;x0I32<3Akk=ZLb|Xd)9{2I zI_~}8A-0rf(Hb72XO}HuoRIt{Sl;U~)aV4UjSC zc`OGCIdD0NLO+2qcz^k_#mbF+-Em#l*n2lTM5FI|5}fsT%9#GDm+}AXt5np)c8i1L|_!Ryzm%Ti0eXTT7sd9F!VhoPmLz(|v@e4*BkaqR+ z{Z4&nC*|aYh3MVrAX(35cBQfVil#_}qKqis{eqmDcc+3j7PiuVIq5~;NamS|89^IE z<;Ph>6CchnC(WhWnhY>xWzWMdRT}_hF-(_NuVVIA$O=>OIFxV_BAx(gD9D}QwZ)*) zt`3soNG|HR-}P9zK38iKp~`zmSWmRp=u6VQc<|(Q7v-!50cg|Zoa!5&2Po`MdiZE# z+`kBk2!eW86p=MB%R#xoD8gVNmOS&^1V20Rjt8oTRq#{rs^f9r`#lyvGGPh|dp^CB z*NaialUidul4BgVo@Sr(KO%Z7+YY*tvC_|p9+FhPpWAdUI3?i9*x z(pkcRbfedjkcOuj^uK7XrEX7AL7NZY{L_s7>892)eVRE9j8sYUf$xlLdI>(oD9n%v z<-VY2!ccs*3gVhoYeUS~mI!*h03wngh%)Y$^i9WtkCiX?+ye@O-6>9&s|+j_F%ks_ zXdD`NInh`UWU*SIzpX*E|3}XL1l6}maT%-r@{ z;^D&2h!LWwQ1OJ~Ml(U>Dp8R<^~&*YX|JGqIiQ%^UVdnOgF033$Pv&+6(tH>`PJVH z_`|HagL7|wwjYicid^2qg!WAsdf{cmX56l(Y@ASv;PTZun#64&@N0H909p1;rNQp9 zbl)sAf+Oq%@ybu&Py8$S2;WrCwdG3YTHHqT;sdBYc>5twDlYvjz|ZhAg1uh$3)?(W2{G!9PV`v?R4(S**EeXaX5%1h zA;uxACMPl^WvQWRy-y`}bphz&kk$AtUyxaj+>gV$1nE0-TZSK7>_h^@Zyy_>+Z&WW zc!F#Mw=6(u+`@=DNNnjnAfcT3_TKpIZW_%R`-NdeIe%ySkaq!$Tg3HyT7SKE+fjCj zqo*geT-h5yFP$e%y{rE&S$vfx!#-ixnd!nfMIyi=Vg@%-aO%xGT-s?2MyieGyfIvNdufDNOyVBoLlV;6IAC|@a?Wnmx}d!N?FrZ_+*x?1wq83QQU(Q5v0UMk~FVs*cMC2|GB z_x;>0DVq)ci+TJ*cUwGfYPI-3^+W%OR<#cQB{3^wEl55;P~Yeo8IQRciOzKXZ1u<+hRdqDzF{23U>eCI$+0s_5JuOVO^WX2=q z8JN|0H5i+`)W^ooofFzPp`5b9m>8b~q`Na0U*|;vy>V?ThGHm3LqF4jK%vVOnOz4h zMYt;Y_%=%u5kdG)_1^@^eeD!c-i${X7cqZ#HYt4kL#G~#-rwvtga`jtx>Ji*GL5iy{DAqJIfWC%<`+5St*PS$(p6NM2O*&>Dv>`AI1@5wFkX)NhT`}gD!A6(}!tP*unW>CS(lviv$^F{b(i|&8sKdKnA(nr<$ zKL9bz7tvcw^Z=5%@I}9b?tvS)_T)>-aACV4gwv%INGYJyN`(m6CY4NP9y7HBNM=lyZ z5ev6+A%^s9pYluw)doC&Prj1f#~o?yy=O4QHGQqby_^D-Ba;AWKfOGAMEyCQ=Y8S$ zStZsPER^BktJ_>ocUB6`x7Ce#55uKs$`cTB+#kTX=jvq{oLfc+r779%nNc$MlLIJ< zebxJ*$M=%@V0XmcwpFBcGY0sPX^4-PW#g&*+5ZTThlQ~vdgL4=Ig95E(-xp{=``Yq zJG_Lvn=2g<;s1Ubk}u!z^rKc)iJ0B*eT?z1M+VPuX~qUzT)T>f8Ov)&ja!`%_HqOD zSz>`_3D}zdGfW?HqiVISHv7T|vJ}tZuYPkP3s%Xoi(9{0|;p8Fxwh z)c|E^_m96DMfPv?N+lIVco8@hF5ZYAP3)(pQS#d}!;}Jj@C1w^@B9dK|M#z_!#B;Z z8Mh~#DcVEwQEJ&|1GaYbvO2&s{YZD^+N#QwS6!g&9&#^Q`JaKZ@EVG)#4IfTK_4)0 zqcKq=;)p%GjO^h`Cq(4GA4g=Xdrwuhtcb_Vo}XZ>e?Bp2icK;p5G;I71oI_}FXZ+= zow8hRddit%#Gepx<+Ple5i_fGzrb;}bUtz@?QZq!=(`FaKF*T%``I)CZ}@j-Ryr8} z^QV7>>&HGT(~OYAB-W`imn7m{%OGdj%Bp z_{kqx>1=}%L*<;(2&)42_J8w&e>+6t0SN@VS z2AviKM@d98u2~2Fsa|ZqGL~ey#KZ;@6o&6TMy~rE-7M^O&xK$Dxlu**iLTBy$W-Y3 zw;D#SM?10a1tkXcOg*>nQ1W5|k=_2(z78ivxuHs@2DekOV*YP@|i55$Z7K>KNX1QT;uuVR)hVty}^t zrUO^xZv>d459rw41BRf?`z~Wj-V_cbWOxX2E+@7br>pS#?)X$x=n&Jqs1maF-TWdf zoR%BSVJ7DYjQa1j7he#F$R5l`@^!ZNQw5pT8>ppv0Cy0)0uUl#XF(z#Mh zagdn3Fc(edE5?sKsC@w?XMOd_M^g3fKbiCf*a(1BpZyDNe9S&t)x(Ej^1WxyZR)S@ z#4!o18}GFeVI=JbdK!p+CvEe;DdhI9d5pgI*9KtEAJ!hDq?i2He@~2VBmBcME4iJG zVHW7vjkF$L<1-UR0dU|FVdGFlTt$@2B<ySaZ?*WsbnQM+R!BpdE z5g~U6zNgh&_v6?rvUeQuxbz>Jbkv)TD?cW@QWlz<5v--!r6fxVOQd!l2zXfc8j9D} zxx68{D_QT{h16GZR8e*O&#z2b3dDVM1<(Y9HXidd3AN?kQOHdioSj!UrXL6$J4D=) zvTLCNP9y&p?0RwtaOtt z4)^hhgnAzd{`Sz*P#5j8#qJbxnab`==y4>w?(U{#$@1dLT&z|4EMo@jR`JS{g^z;!Qcu>k6S znsaW9_96N*M@3-L(BW}r+z?VlrI$~cJl=QZPz}CLnaf8TT~pA0+wh^oS9ST6B4q(P z_1M+*8JrI?2?!;ApU-vX?g0CgH-IdQ^+*MiR+*gb#A<8DKWb}SeoUpWG)} zIUP}Tm9078j7Lj9K7V6oL;&6EX*dd*slR*_UBg_z=g-XC?#yt}ZPUJ9qYNad4OCR` zJXM$cp>5J>0epYHtMJ~DAdPoGk>si8el z7P0NXj#aynMRBGP!K76@!7+D`hXqO0GOE_p@}e+6vHhh+Ly~Ab9RtY-A~>?Rctuvq z|Al;kX1`4I-1$IJmPyR;WhTwJMj=mxCZZ1Ey^*S?a4b_U+7;mIo>{z}TH8Yt=6UW= z0b3&|JjRHx+9jX?xhA=gxiY6{sKVd+e}DX|wq=A>+%g=K1duQS88z`WAW&6gthIRO zkH0T-T7HzIGBeB!kT>0fJJv?*(lZ>s#o$v$Cw@CF3`zKdXfIAq@{f-MyTK|)l_&Tr zPl_T$Qi$78eaZf6A#F?86K0T$nR4w%xtCH=Rh2MFY19P43ddPHP0I+_(L*fHmqO1< z>85t2Y}F0#J(HB&qRhmpQHI zAlXPrLpaBmW(r6dN|iptMgZwEYIr>Wv95QxEH^;YV7*6c^a&}qlg9_vSn__;>Mqya z<+{-+)K9S^iRKZR@UAoAuSztBpHS47b8YW9K;H`O_A7?4jg;AjcT0lKh$QIkC__(@ ze{3w!wWwQ)GRcjDS7ONQQTog5VWsDJ{BQ-u@uB2=2A3R3UCUsWBr_85JVCgt?{2N* zfEK3;U)YZagiImFzFKQ8O_#@E$A_5~)yH#CdjuKIkyc_yby8Y&H$U3A_IIKzZ|AUM zzQ$`%d$F!)2%Ln`*{1!xfX3!fT^$Mn1?Ux!uLIKyd-`j8AEr~I;3?Vam!t`}bt~u4 zG+wQXv3!&AGc?m@5lOp#^_y) z?iApVThduCbDGhGf^Ft4n168;_t7he(e*kP7t%ql_EGLACQ7pnF`Vx)iu~T+%Q3~Y zYj4Iwa*W|b{NaiQwMX)M5d(kg#9TbFs<^^WyD2lPtRH7=u6R=km-D1sWmn zfu03%9+;l9Wm8(z=>Y5^dAuDJ1#938^cNJ;>k_gbS40=sH?aT-VJZHSjaRqf0AjSC zUWdTBXYPe!^L)<5G0KmLdL_jRiq>NNg1{8R^6iDiy=t{LP_YWld*0*&t*%gp>uq(b zeKy3 zv6a0%Tv`nRVZcz?ht-Cz{SqxU91FV}H?XFdj#Ed;OtsyO0Wpskc0F;;M?S#hOZaQC zE>K8AOW%nkh}$jstmx=_DlbvOoy-ZvhbH5Lz^N~i!EA8qW3rHEf$tLa2&$<-V8;M^ z{ov$|sBkCqS2^HAx>cvyha#TOpTFGw1H4u7rer7V$mk(am&-fg9Kxmts*)ua^1B+v zawoS8M96H6Zrku4ipTR; z?b!>K_t12eg>6qRZGz2X#OA*umFve$Z&D6Ea?!*oM)BUncy-dkUtz|u0fkXv|GxY6 zA@*EhdGG>$Vi?h)oG$)$#7h~w7Gf$~+vDsWF$Equ-(aJ630P|^+>jfiGX^@wD-BC~ zQWDtKhX}8(#*6*}(Y4#SbPhyY&3qm_~c#b zs;N_?k&QDv3p>0lc)_O$?U2ZzR@3iu-R1{i+AJ!gP*d4zE!PvmB%*QR5YaDW^Eve0 zL?a}<1~gnzN;vKtyFY$GmfwohhIh^dX|0VU5X*zZpKFNi1o9pz zL_qY^;k{BR#m_))>(c2J{vl&9C`S(_fP_#VybTY&G$ddXlstuq^9GT)j=*MDT)?+C zq6MtQ=G+6<`*x#1R5Or45Gadv-?&RCX(^8%f|zTfn-oN!xusb>XmG#3tHPO}WxAa+6 z=6RbAQzLaryzHO#jO=dZ+|hz6ZN$S*0LYGP9${?zX)xCvc=|c<IYD~;Fawh*vy1h^;w;k?bgFfg`?K(VITZ|P9pfA>aJc22FfM^!Cs8frO zT76y^K^luo#atQq>VVm(#1{7Gp)Qq=h>bGE2*7{4qkwSuA(hnxH#CF!L(rqSiOc5a zZ9GyMX}k-V8r###yCVe^3GYt562&+UxFmIb)y4N`@tV%w|8uo(>m4`1J8%443N1~( z21XIFPK3bF>HP9b2_{mIiTyXTU$l6y#G%z$chZAqgT=t;z|BCA0YB479cTyu3qhdi zefX0-*W~v0f$rwCLewLG+~`tz48><1-iB`iL@<#rEI3=0jPF^B4HY1_gQbQWf`(0E zEtlmkHUll`W`LdHQa8stMC|=DjM0yR;Kvz6Sw=y}_#m#my%8`zfHAKZ{Z#z8St9~w z_H^y)+TOJqD`*D+2dMB-A5<4K*sVoI|JgH921gaV!}kGK9CHl)Sc!1<_W9Rph~dVO zhT}P>Y*)pnI795uY|doF6o%a5bG*=D=Cv`mxTTY8-?W0gdmt6^h2tOL3wM7Ol5Ql{ zf8S~NwdYK{i6pHDu)#c;=kIr9=?&4+n6_#s-M%=(Crskr42sqX&X6{{n<9yhQfE^} zYGtn;XLx0?woq&jeKD(fb*`u;HlgBYl$e<~dC*HyWR(w6B`O0BI#94d5CDqaH>N0o zY@z2$Em5Itf??}*{p{3E(c^hXB>n4C!9J);*6sVbhv^ zSfib2j92ZlxJwa{jNP?uY4#?hDCL8(~JYOshyv@-Xd8< zj@l$jV0Y{{0j{a6;x#&oZar~Cn4*9PNz{$cMv5#~wQE7WFz+e0Lk7qtYUT=JhifZK znMJ_dLUQCw8S=IGopQ|Ya$aAaM;l$WyH+7~HX)?_a9ScLzc`P1Gp!HtYrC%GRSuWs zzDq9w_I6XNx$kEl*qMwTPJW9dA3;#Ft+#Ax_asx)v+|$PzFSnt%~p0zn9I}D^i{)L zXEDKHOhi4s7z1F<``O(!e}yIEO^m|CFLIrq>v;(#m)%PwzVE-31N|x&x65# z-+mc%r=GTG+O~&pDKkR8)U>HfVaqFr9w2zn4qns}<2zT0kGbxX3Voo|Hmt#q zcok20@htPvn^#SPT~L8zC1QEQtxre=SG@=Z-zOi?S5Wk$luN}A<^tCA3pe}O8MY#? zz=z%r+5Fz7hkvsH$+sNNP+&HSZ7-NXO~E#{+4)ebLj@|P2_TP5jfUW=#NqA`Q2Lh7;(W}P}9O}la$LbdHsgar*spc}T zVg(wnzJ&@42O=N`&Haxl6#!fJf|rA42E+Y}x7%?R>^Q2iMHy^sZc>lOq%+trU}AZSdpt zll#dV9*K7hDJ-CTs3f|;4$0qnFkOblucN>9rvF#*hip4K5)W~;vT;IL$C&JRQ^yzciZz%RU7oNefXDx73kk$xkhRpwBB|C{EOAA2G0=0`JRm|3lc zl_7Z!_*$Fs;qhC{O4+p z2GgsNbyb(O`&(;q5LNrI3}_l6o%#EFb78pLX#DWxjGQ0_MSJ!*5!iHOz z93Ph!vLR;o=VL-Hiw)Ge;5o3*eZ}~gKDOT@H-2tagiR4lH>0ft_V^Z5Uz`^bTF`ZA zSI6!hZFXcPd@b8DU^p9k+Ta8#g3|p`xCf0=M@-AC3q6?y0Q_mhOUN>TiB7HqQ5h&0 za5{DHcW%t!5PnbnB)gD~i|6GV!ieKLmxuGIB(FO^S@zv$cEnv7+Q}}+94|4H)E71? znKX_GB-l%JEb)px^2N>2gPJ1aoxb3R|&TecI=q(HXJk{A6`1G2+e zjZI_VL!MDIBeSN$G^!vqVLIsXjn7rwo>VNJ>K#Nz0Kzfn$J3qImFC@S?Tuvbt;&g@4sMd#w>4HXG|%Py*k^hWe8kEbgz zQyC(YbpU!eRhi^^LctfMY9vz2?LBPzV2P~~G%AX&zqBVAV!s64_6PV#5t+tb%q%_# zo{T{7Qx=chq_+2chK^O&=9bcn4Zkt1&`{gBocU~)PN`4JX#tcO4UBQ`JBQT_sIwF` zV*mIsa`20C0C+$cF$DDG>x=$vMtt0Z`W+30YCsAg;FZDlcGgJ+oMn68r&QyG~kaz{<@SZ$m4XQeox@tFNIx zyq+D#@eKn66 zl;eQAax=ya1Zotn`Yl7k=a5@0f6)T;W%XTOogMUik~^jJDG#j*yu|$Wb&I``g-h@J z8~Xdf38|@fzj3w5eWa&LRVH-(^pb&>DIM^Bo@W%oK!k|abGFGlq6_6tbHrJMT=+cR z(vV@o&C&9t0y={#5^NY!9*hCAMdVH)bmxfw4~wA6>UG~1P zYe}T3)Gz@0xB&Lx4}Uj(#E*R_zE0uDQONDf>Nq>MT2S}WEVxqLicW7qU#X z1(K){JN_P0MU2+1!r1T}57NFq2ry(#u#{nDBapNhsCkYPB-?*>v}2OX-aJ zbAkKu_dP&%i4Ll#g9{b9a;NT2E%{jxNk5d*%Uo6tHJ3-iFmEVyh$Ev>=Y}fGtLT31 zHwVBGprC-HXILBi0_;^*%@lW;^*OxdnAPg2AYU2skkKA218}QeWGUHk&!WL#5k#?0 zl3B`)bGZ&BgeT#mS<;bu9h9t+EP$C*RR<~rJZR}r@LLB%C>SUgsKA!aBO{a%F#~dxysa}2xpw>6*Pqgna-9LHU+LLIv zWBE6i`!=0hzrFEYxmBe&AxJ{}T>Bs4&K(6X1hmFdq$DKB0PcaX?&}<i-z{`SZ`|8zCXKsPYQZI{16| zD9@9cFxn#->P0gd!Rj?*A|E&%HXe$`D95*@yM;L$+ygl5GWB5ktiKef#>8XyWnn8$Ls;5!N+Bt05r1*>YP2wzHyh3{+EcXluDFrh5*wLVi}7 z&&}6Nbj|Md1cU(pX%2RTYdwqee2-D%3wZ@4nw@eh)e?>x_P)MK5C^SR@@n_X9V>Tz zWv{n@^ee&s?~i*>Yl%fgnjpk6U(6a11-nd@6)-lrHVg@&GQ6Ru9*Xk?d>t?&E33hx zuxkuWg1=uAG*vxq1)_abHAh@L(SN_Gc?h+m-%?WBaPlaj#8^NHuGf<6fqA8e$JXoQ ztwK6?)*eOQm$ipHqa(^|4OdpKW>TC7Jn5C^)LhjaB`8kNrno6^HkxuDr2D75c;RWZ z=iRlxT<&}F;`;u^_vBk@xUjwcbuh2}Z2Cpgez5~xn(=0oKk=)d)tVo?+Vf=Fso`Qw z`4Q;6lOk@wvOBNN+ic*&G?nxN?S+;!>xe5a@tVwUN3>99B4s9{;rjFnSct{?MvQ5{ z2ztfWL6lP=^7o~3;RE_oHWS|}MRDj~_VzA8gNq9iGkNTV2efO@7dS3N;qn`}HH!aew zjdFmQX-SQu_pPn$WdIhB=F-@52Wy7u2S>SdI6L%Karx?++nXF52GURSuywB5_rJ8? zvC>3S60c0pPI*qw)!b2nBAx2xw(Q9*ZNY=&rztP3w!Qn_;$OP@9zWOGUO!6!?cDlq z1bp50S4J3>OZ)bcy3_$u6KoSgvs+~B!E4=bw#fQ>n05yc48G9Z^8-UDr0@UveEe+v z&A1PnC43jQzMhR0!uuoLyd95SH;M5d$*}?C#V+KGV3<-~;QX+7si6y+MOO4nGeC&~ zL;v_Tf7BBLNi1XCxl~R+N(id1&32+2R>X3)`V>a%moB|;^Pc3~-w8x>@>&GP?D#y>TqR*u+1IE9xIj?)TCplgdLM2pJzZo1 ztzRE8m+&3uWG&GtFx1qsD^H_|*Uzr}_Hwan1%Mr=p*-Iz-xJsOtKLUG z1It+A{@!kp3smR2HapU@AaCPQYP_+#c5 zUy|wiH-*C3-3jdO7?S$h${%vZ$^p$RXz&xnH60m9302#H(kZk9et7GiPgWfOhI+^KqHIT3Dox=o0X}^5B?P#{1*G?J;GGP=%XuTvstbPevFfKx< z(edn-y1wF0;vw9NLjQE;xLg6q&?4s(yW>#entqG1hmD1_mX8J=I4l{Br*WPxTK~h& z_>WO+4PNfKw`1Q<{rjILKY0?^pSY{qcWyTN4~5j-JFoEB`wskS$}tf_q<4Mjvi-8} z6tp$T+cc%z+5ft+{3%%X+eLu$+_qa`#7i3%DKcF<_vYY%nEJzX|CE>4p5j-4-_EZ7 z@p7?q<@Wmb;G8)`azw^F!7=LrP_O#%>dEj+Z>P|=Xt26yXYQ1@(XHD1Zo<(8v&Wm% z@I~2lC{WCnzbp_TN?)gtJU^z`RpAK?1@Y4yMA}iqwE?RZ<@p|^CKe<+HgQ;2n)8-#^u@R{GNQju zTip-X{~{n6#rELkt_K^e8^3?8^u7HQu-}BH|JJNDno6O<7d<_&z1eIGY#d2DCnWh4 ztcX^QF^k5{@i-=3-~>FayN!<-3NA7a+`GZzUT6JKiNzeF1>dZvt?+M7Aa2@GR z`&oe@>JljpgZ@u$oC3x1suq=-ANfnqQ_4s+$AP!Jtf9or8DDD+x{1>^?bPKpI5LK` zqmVdIn~KHb=5^Wa_|*c4w;PWBf$34-FjuOoa1dXivY~`ges1OaS}TTEk$V$>^N1bs z1_|}VSZiE^td?yKGGc#n?#;@)D*C8{8~S>39Oqf|@r~!XJfBCSKSn(ZtC@(yiszPO z?q<=OE}5!@36gK^OZOe6KTLUXMXl$9rN3P5%L`xkOmHsmuX|5yRY;!K9+ONV2YA-2 zUVPtsgnJ`tnk0in(M$-)Kh4FCSz6D+yiG@o6DMEVy(YU!%rbLk8Y!M^^(_)v1^ajO zsr@ff*n^k-Z#F{5MuxoksB+HcpCnBBpTG97SEk%4Xfnyj7qWad9+L7@FH(cM_YF$eGm30$+rk41!`+10<8aZC0usqj$dv9u>CyX?K$DjH)P*XM)z&vZWVe{ zv?SpamxUQk`?Y_b`ts6m`C6%Zz9PA>L43qj#}1Q64|o#0s>%g>3tVlL8wBqE>HEMg z0%MT8R-t$HjHu@MZQSVMRQ6m)8}mGg)Y*LQXiejH*;G1{ZWBmW0NTDze40ceb;ar- z1yvzFWV!RR)=|VG^U<_o$u@$!;OT!l$3t)ZuVn<1iFgV~%u#uLFCm|tz1EO!5rz!c z?*QTM3QJ5qE)>L)Ie2|mxc5u+#-pX>hXSU3c5CqBXBO%^A{#Th{EwuOQ8(E$A9nYE z?dT%UsIv#}^nBW>gJ#zB{@>r&V%m54xBvDG(F?-cP|dwRS1JZcnE0Q?k^|)yNo6m4 z!k(6J`zZexRemc1?Cg-ebbhrJ2S4HZh;!+;zXPC#L_<2nJ`IPVd=1SgeIj`#sLicw zMEvqmMl9L5b(O?I&CmHgH7a`!GRS26V>U9Qc$Y z>rDweM}Q^EuxmkN`0KR)v2sOh%rkj(t`aMO$ypCiN;XNmj?iDHj9YmOz5VX|FFX34 zIK8yWGK+MQ6L0+>>_=8q7(j4FU*zYBFI{tJud)fVEIlu=HbQBs<#D;Srzh342tfBL zsPwJfz@BHQ5lj}q+%3yZ*2^R}gQv?7RBu~i9;4d9(QZ%Zz%d#9a?ee3B3yjXIQq0K zDKqXM-s(LXMSxJ)T4+uhl8#JCaN>>OhvKf?XN3ytO#fRT>U~uvV*zT{N zDNqgIzp06sBxa(+)*o&|d@|m~VcQ`-``x@$q(+_8cHu zz(rq;&;BW8^sE5hho8eE{=-rM!8$#TThNnmYn_;}hud}7mjpoWuu=M<#ymI8&-%{i zn;@`kJS!FVmy!F(n{i48D=q~zCstW4Tf#XdgjEn^Zm|ZjetiL8Pyn<7NbhRAQtij= zmkPDqEhz=5L$4+SL!3|l0NiQcZrhKZ{>tjTN8eR#hhPZkt-e(Y@YMrvLA{)KL-ulk zpY}UJP6DL7^v&YkbGDAbfJWCsq-LJk8c7e*#%*UjBuuBhh0q09xAO)g3UWwcQSt*L z)7}inqd$TM01Qo*lJP_`ZXx+nC-F`OTe7G1kU9oC2j`L_DX|ne@iO+gRDE2nwJ=wN z{X4h;Ml2nKOW5sM80Vjax+K|P)T7OC2kBHI-*e;@QP^~imq9_g%&NYzEf_Lx(nJ`e zX0-Y`r7%NeDB>}KXdhrumCYQaxUj7E;1Rc{TA6u{-T7+#H~2L_caNLy9qr$kdBIZR zhdf$9bcbH^65!K&s==YmK90Fd=GcAT7vqLtCb@t{$>o`gOcpAACdXY{dzQbCR}SP4 z1a~)~#cm9SrX{#e9z0_A+G;2aN&6Se82|f@w04D|WJi}nvrPA0qYMEF)@Wv=pA5vo ze$i6ohuoT=7rYMq@b^%lzAXVs#1}}-T57SK$>TKdzL9OmrHc*{vDGET{{p$dJ+c%ms!qusNMQIG9o?-&c#mW{~%A zohj($aC&j_72sm`W3#?PTO|y+;(8tOs4o}Lx)qYcJ!k*f4D)m2ZaVOubQ8=}KWcZx zilt(`A3kjlkdNC9axC8jVP}53nQ%H|eXb{EX!J1}_I(b5$gdO#if{ebv*=+A5aY-# zW}#@%CPSxL(ceF!Q~9furQXr93*Dr@@r+^>OL^{(SJJZkpONo5M61iAV$`9m4&9o* z-D~ruzTK~HUT9?!H3KB~&t8&!9ccODgZId3J{nR%4sZ`vqkp6yt&oL}Vttuk_vyg= z(t=T#ViP=YIHgzPP{+)Io8pr z?<0OQSw&5+lg{VzD-Kl{J=t|0yV06kfrjTuixFP?)^7L|HM+W${?-@GFEO#AtYYXs zB6ZgrvJ8{T(v``P$emdxoASSADE!+*v&xfbb+&ozXgI4;+(i-A?8-JNg=$Pr1L!{_ zw#{>I~@Ay09QhS&ElCnO>}%?9aN|6!OayFhsqG_90axvkP* zn&!@7s|)GJAh&usBv+l|taW}fssB*b8v&qPxgTf9XTlTiG8GmaTYW_#jA0t}7kW-9 zXdqU%5w>#}vGqM)xTo&eu#bKN)8hF9%F_J0232c{2N_9z)dA!a;hgb$qo)OP(j3Nzd5E(cUdg_{WUGM2X+BI?@;NCxOJyRoF1Dov91=ZT`d>LGsm-i;YYc z$shJJb8uud@$Tl>7;;*DxC;AYZK1%K@g-(iW^vNz2YqRo1+)pBL@XbJmqX6>**)vP z;asg*k^Znh3HG0N5XQnhcfNg9Y~LOFe!9$KU4lc1iKovwk?lMMrrqS(()R_f-Esq;AS*EvJNk?P za0rJ}M6R+vD;;%DCrY%45f(YH@u90X&_-cl^Jz{-i!p;xxrmuu$i25Hn~eLp7DxLYv1A~ zYVyeVSW>G_h-He*SU?x?ICwLeio#bI|E@*03?$Wgxoj$}wou3^O?OaX3N1J{Z6?>w zvr2d4s15%YKWs~;V7*9WhyZ-(8bkcop0B77o*DXhi{an=WISwK#>Usi%?zw|y8ctk z-EB{&x|86YZ{gYlBmY1Ca|G7tKr{si!A;45PWHavRRpHV5^@S`DYdr8BUH@>v;jVRPgyngQj<} zXWXkHOwfG?E;=;k*6Q%ezNLg%1nFs9kafpqixaKXT7y$S^2ucN`t?;>ZVOh+Z7+Q0i|Hf&brLVcgvd+wgRqC-we>8B;PC5z7}aA+KWWwU3F-2OAN zmJ>Wm9q>hbiI_CTHxlB~wVU159RoMFRKc_j?$q{y+i9aTfo3hI%D27UM#^Djn8xp& zTB-Bzpa3d!exvu%Z+_e`y`hA769REk-+#V=-_K(Mj@+T83is#op(kYR@`~xq_KL-| zvJO~6n{*bBZh2AlUPA%11TqB4Ygi6(=e>z#yMCvrP3>*UE!&OK^WLD4g(xh{%OLkV z!W}aaZ5XG&h-&;9y_I;RU;#*n@;I!{0i>@ z8`mdqi7u?DX?7?9GX^!mDF3_f^-sotv>wVd-#C@U>dbeXj}zwE*>PfI8 zH7|5))DpBzCWHs(~{7A-DfLZ<& zO9Rmjs{Im{mA|z!Cxy2PY^t5QRB~d^=`)SYed*PC1JscIPFN1`%^1*0YzcABK>S7+ zd!=s%m1C{H&Jaz-gzu}B>Bju>x)X%kpL31i5I?)ED|Q+QeQTZb9e9lIbXus=(Feb@ zG4>fa(TBKVk%u7@@po=_;oEu&z?$Iw~eoEFZXoV_?Y4oyQmu;igb_cBQg%Q8&V~mDuLl zhNAZ?u70!N|As_!|JuD|8E7ou1hh!P4k;uth|wW?Z`#8$7QyqeKJ6^y&9`4bUVPe{ z6)RvayKGl_2b$;erdfXFbBl;~5D1m*RWsw$E@0;NjvkD?jSAh&U!*ylr%M)q=E0Qc zArvGp+rF!Vz{OW;`srUBU->y$dgi4wp_)%_*k{=^ozG#I zFyZX&&cqLqT+co_<$t=f_-sB_N^Pnz6{?&a?jp7s9yA9HW?NYs5i zwiLuXpUPLM#D-mLP6MbtPA?%0nh@trl&(wi*QR zq<-rR|gUe-W(pnwu(!6_?LR>zYYvcxFz0=eT7`_&p?ef2xM@eD-^sF z8^W&t+c>AiPUTPZr*@h-^c=sxW>)jFK?#mHR2bH^h*%OcjhN{qm>l4wGZ+WNvWh=F zw&j_c_-y^fMNX$<6bSrr`akm70L*xuN$f-q}Xwuow`lmAsbc*p2Rqx+EKwG92o zB;;X%OI>@WIUnZT>~{X&^B{#jV#3=@`xK5v>1fL!Rc;@ zbQ35oFzgUhSA?C~_{$)G>u-o{8burGcWG_&uCHLdWPGY-+NHp>$>i*v;Lf!70byH< zt0XC`qRaA4M#jQCM>z?B(*T9q9>89e0(#NuGH@b!v&jkE1K?Ow91D6oM9i{jghN5o z_%qgF)wHDO39wzj2laK6$n47`xnb5br_h}l13;jd*!EgGF0@2L{x4$`M`=-yGNFeR z+sNoXRWY9-_Nr*dEwn2?E2OvN>V@F0IkoS4OpJqNSg(A2^Ev*Hab^toa}s%3Pm$yh zJjRNLb243)Z{{`k1oFpg@QSC57_@~9F5L8{wzh$;=9EC}$CjVQ@OqAgr)(qZtmGK} z4wlDh`=Q?al=H)|D4Hy8%1v$hmV3#$^S{NN{DACv3-F!5hxIud0UQmYz7`M&U7qeT z2sMA-mhPp4woub!<$|9T?HTzUrLoa{0hhnKa-eLM?Z5@#O(4%Ymzqy@u1oW4oL~sH zA0mFG{7SfwjJN$m-L}bLTNNLGq%SnJdBpG5^Q#wGLk#)_bwl?%c6)%lhVGxm*exdd zP{8q|h|L{Z;2ltCy&@?gB~4bR)&$FX;2UbS_&?^7dg>p(SE0-DXQ8Z59n*7|l7_=1M6;<@CBfqmn0%8AwS{KL@e926+pg?K!rC z6YJ=X&-JvLqE^0T`6?sI$&JkyKr9*r=wlAt$YLlIYXS2A=>12*&rg;asIR)zxp%fLZv2_52hMLlHq__bzh;r0Y^^m3}tTG z2N)K%Kr>J`y7qq8dKWH6kE8eL?Ar*XjZWYA`RHrR?WzuiV)TlD8|rhWkDD-uuPSj7 z<)_h<%6~n%wZoI)(9mc)TjcV}%I5Gm2)x^0*-e=!<|)%CiT$>owxgbfwXjjYX()mQ z;I}q_Wu0V2&z3z#5VgGw4xz=cRI+CTWivXUEfOYAwoTCWgi8-ax(I8x7Sg$#_kPdF zfobjHa(!iQ10<`xGr|n4wIK2}@x^i7NFC^u zH<-^6g^hY$ei6KUuX;Jl>x|f?c?k|(nR3ziC%Has9fDPLHpNqxHm*fp$gMFULFMwh zvM+JT=IQ`SK()VsbUJULW0{o1VA6$E=3tJ_=wYtJwq{ABYtw%2q@Ow=N{u9P^&@MV6jY2 zP+oLvLWsZxO+%&++;P9%74Ix!5ik|gguhqDO17Vi)h&**p$q#teN1;kjG9QTgg;B_ zce)n@Dppac`%mX!Grpo|!2z@5{jc!L!Y}-u+I$#d^>sM%MC|ZFFN#Lt-}tI=C5ZuG zD;@L^f_V*Umr9ZxWw6yQbWReW0b%D8hL@%mV!9*Q1a(L3@3{T4+*2@{p#%-gM|Z%!t&9m8|u>~LKyy+?4Ruj0Q( zz1e{E`_^gr)S#r$a-=i~+{3s~P4};)Tu?Eu<<$^-9%x7^v>j^}(B8ZG{c)+y@oe;O zv^wVKkZO{EA(Wd9fQ=gBpXY^uFYM-K+-KRQ^%Kld$GVPvTN+9l6`b>>H=ER9ZL`bv z#8RZag=+PjSU#ARN1H^Zz-^9e0s zH@`nVr8%CB`Hjwa97P{yo1>~_`nhKwrkWT6XWi$hLhQ%cr-pBT{}wtZV)R3N)OZpw zL|E?K{{$^-Q;tr=sXpuGA)@rB)Js~vmN*{lyf}E)e25vQ8x|IRe6-5phL{qvg!KK~ z@0gbYxj&{G+@JhFJ2VurEV#7CIKq@(R}FotT@B-RNw?QOXSj88@3bqC_?K(~O`6bu0#m%mv`k$B-!?{9 z_^Bt{#}2WAQq@tY)JJA@y3F+Wr0Mh}T;gBq^Ch3`0Xf;hKJr(ccrKc)jWrvCHO;&1 zXir;R2Ce&4r7}>kVn)hJ^|97eu{bf2oNP3trj8pIIpULHq!g31Q|&h=x?k0MG@TJ& z520_z#QMZvrpt-3!Do*!5a*EEgZXk!kSDFa{^+T>^6Q}98vA77yVvy!WrW(&4@!|L zpGLg?pAoF6+3#|2JSzGz=@IqLGDK}hqJcsu6xi$&G~2dzIKG{bbO02)psv821BwoW zbU>r@(y>mJ2KyvlP6+8j;x5${bd#EvZ5kbNwiD5AZv+IT2?gCLXrMs*VWm+SkN*lp zn~IMAw^S>;p)6?#W((BF>>p*)cptj9xfRO#WaeK*>u+fnQl02g?o8&1pr_8qpgw0* z{B@<@q4noiypMhKr>sp5P3yO3YSO|;VP_Y$&);3?`n}I8FM2PlOb%f6*C_o7#C?y# zN~xs;ov)4%)^8;J^27DsKE5M<3|aG|65ff_{MPu? zML%DEi)XdTA2TMuxxqJdBL6Uj=$il9q<(r)|EzkS`o<=a^`l00XObfa#$%%8M>%Z{ z29Fh#HvfCMoU@TS3Y>nUZlxQO7&$Z^5!LNDC^{_^PO>u`GatH6iqFWWE86(g?x-zsc+4YinQ z2xur*-Yu8=cIJcSGbe0X4orBPPt&pfgIKF=moO(Bvx}(ojEi{ql8Zgyj~C%~M|l*Y z1C8JuHR;Xa?T47te8HI&ev?bFp`~KTq>~#vc;^@Bd*sbsF>yK5Lg4J@{cj z!S>nh@-YlkU&Frn&*<`+LM;Px8^#YdH9?oqNfU;s%N^-bd3-7{(U6s#GGPFDjCRTe zKVY$MJJBy~rTaS|f)hRzeh|E{MLk^nRtF>lrm=`@*yV)~gt^R(P{qr)&<=gLs_&}n)qq22is4WDy72tZ9CSAY%%j8Y#X zW+0GNwIk1fzJMT2fHJ+t+|2+x^&&8Z`q^r{T|Gp&?^BJv&T5v(j=9dBB_oD$wy&Pe zImyek`|FWg@M~WCPehaP?n~Gymz(p*>ZHc(mSIQ^e5mn>Jli(KE!Rm!=2B-Ci%cjp zRB&#GzZ@~6A7XgP{-Vd)*c}!%-iDMSWk5^#mB(mf&!s1aB$dzrYbJfY8r>5+uRa0o z0Z2Ij+WpD`6S$76>{ZJ0jWO5% z@}Uxj{S>lWCCr=JO9d!z0vQqefq>oHs!UfLm)R~|US*d5ZtQnyhdhK1QO8$2k>(>0 zWYDL+7Nn<9A2P4=Md*pDsLKI-X9B?>3LanMxz1(Dm^V#_hn2UK60&=AWZ}UJriYFc zblCh2lG^<54WV}v6-gI8uKYgpkp9o-U%KbvT$a3k>iF8jon>9ieEW`O3%Um9;?W5& z(>Kr@8W|>G5a{|%dTvOzhqF$BgMakVm+DPINF~)FbJ~kqkF~i`4~8zPhpfn-E&s5D zZK^Jxq9O)={|6sKgPUThBBJd`6spk)DVYFMKs#+Ob+scM_>v0LrC7IX%QpFm3@)5) zl;7~8Btp`K&mem^Cv_dRY%^^ybxdowGZ$+xA;k%53flgc2enF&*F<#2aoDw&sO@z@ zrD}TQ`iq(Q-bI#H4PRxY|3#%Qn ze&Fz+rCDE?UZ6>eNJglGO$#V#<8bdoxmdEb+hWcyOiOI`Z}5`#p;Dn;0kXKo^gfS( zDsy>RUa9r8dCERpaKFG~0nxKlMD)CmC8QuN-yR7qUXT6Ckl})sNDH(mJ>(bziyqlzt$lKTSetS2$P*4#N961FcQL6j6&)zt@)F>#; zgZy1OT}FBwSKU5^MeI{u^t5-&Pdc0I-TWWjL=jN$%0gJM&(wKt%!Cqk&4d96He$2R z!D^{WIz@7`Zp3XCfyGz44)VVV-B`Oiok;rclWy(0d;35KD_eWJvaLzSL6cBR(McZ7 zDa6(eLT`mAf_g^_F1wrfQi{g&jtI75h1!F7YXi*vsfp+(Fhw~bsn-At;|x!r<Q^cV-&@oE7?-)qvU zV7uc#ITG`}&>vi})=e0;*iN8J{MW`G@rjszavQkH!b?t`|ln@1B4 z$aU|((q`BSwr9g^Ns^5Os1BgY)m_j+{)M+vFZ_&U>j4V4IywV=FC=ux?1j@!90e6x zZ29}#Si#ZiO)K90=vAU-;fepy9-Lb~V49D&eovPbX!&-iCM^It3^vgd$PYWn-a{qN zF@AIEew?I&d%juahGr}Ko^G1qR1b~mOo^qDQ<18D@DGrUPw0@v3*cl>BdnMKqi2w2 zF8<#m@%`Wqm#e2xbo=dDYm;$^#7IG`KUm8{t5OerT;2jQ#pt>c^Zs@r$fc`qK5$&o|@Or|z?9w-Y7IqVi zR~Ejh^TY2UI6Wfev|kuuxsTpCp?VfoMjsUS^En&q8zJ>rv5w~Pec}6DJl8~Q>JfA7 z*CI7MarJ4#k6L^92abRNGhy{?@Tn3Cw=IS&grY6Qyz@!bB-JRpBXRpkExLVQQMuyh zaYv2{bg8qQN#X#v3>M8PDlnn_Ue%P$W|#+8rTLJ;9BY zSz)tFjeOytSs2pk($lrvQQGRiNEyECloBjh{>1?!VkS2BHy4`TkMhomIGJA-(EkW6 zYb_idDR=p9@Ig>1&!`hxz7&nz-+5tBt&lqwk~q-8QcevWo)3`ydvM4gD>WXi=|Aj8 ziqx3#(q&YznW7c>q2tEVHU7})vmcV2gB_hxXtN2;7!cyr>2p%cz{P#6R%sCo=X~by z%JAfw@~5S;A?mW$NNj@m(e%gYtU1b7la`C zo;tp`*VOpz`_6!QvL?Nfw*~QwzW8mUx8;UJ^0EFoW~~^Wn|fL=DX~t2`02?nWb%CQ ztaCfv2Yz6{4+vUjxYgFfWK6%hpE*JMTnzidt>)FRH1;_o4H6KjM3Y*e*MWLMYqeE( z>r4cw3d4^*n!NCA&5~x~@3TAZudPUlS|G$QEJOzCupD_%DPIdT`fLHN|7YsJZ-)74 zxS#1>Gl?(Rmfe@cM65#f(GXsyq~Lk0k`gTtNn(Vx%*uQsXFiU{Ed<;RAlX{mZJukD zl&y1UKJ^t#n)}^R=5kc3Emk$jN4#`Jwv-t#1oQL<=`_Ppx?cFX%6wCWOM)Ewk_7?I z$Y-9jl7~zOa~K{<+NN$0GKlL9WEb%4^HxKean;YtEpyOQtKvquU?F7ZV4XLh{0svS z9Tdwe1K>6&MS6yHrt8vt9uIWzgRyAs-sck!ti$+mY~smzOg`{r5`8s4f;nji$8b_e zli8Lb{P|GmeE)Bd@Cn#D8^E&H&i|V#hu89w#xth~-eWsc41O zWiQrQS)Lo9J0+B+8??ozYOIhzlgMmLqJ+@o3M~^KrGSPO377VX2FAKJ=P(I*kYe#MMbCl@9>PK#RRCCmVtM`Z zGuuwD6s$b#<`r`c%ur(#Myml*9qG#_!zuYfK?Xu1c+1`(^xiv5#%Rl>ZAp;7^sXAx z5mpB_WV|t};(oYbRHIvwq6l(=VtHvGsdDF_*rsgehMBG_^Lc-n#>gmubQ(jT+<-Qc zy+-65LOTCX3imTRXE`5-F@=gaPiLt$1TgjRxxzpLf(2Z5lm_GcG>f)y#TI=+MaN;p z8y+YgKv^Y4o}Vxr-d5pT6}PVDtxsG2;xs8-Wp+(#&B3?2HZ;KIs8HQ_8P2JQPvD&p9l@u}O`bFOe@4;e5r)cCCa#Ktivbu0 z90J&V^kCoY#>y&M3*2zN)h6&}MokG*P|2O;Zdi zIN)RSQd){IAMslqn|$*0vgG%gv>@g47PH6-XiKl;UsT-rHwX(bw5i@UpyZ)7K%Du2ICNE4H0_Rz!TQ ziLK{QKl#ir*)H^|;;pw^esH4ioQ9x)4E@^ioV}lX(YC9^MJ@|@s69EGeX?C$!kbdX z=y`QmTke5NqFy4BOs&}rEi{Ep#~hMlhOUW|vndoAQ350-#Ov4oF5=gl0w&C-xM8C! z)Ng55tzoI`QMYkcl>`1SA4mjG=L4;0iCQT-Sxz{?{UDvs?Mgo~(OJdq7Mu6;bNgG0 z^p0hz4|{Zo>j7%f7M(y~gz1urkbtz|JQ{QYs$q*kRJ(wfCtUJ)>pCf0kt^k)ij|A% z)8onap6bj)VY2I&2Gmx?N|dp zs4xvPbW7J7tyX_c&CqG^?ICLY5?8U@f?ZIF%1xky8J3Nx(@L$pSzOfYTXle(T;Jki zGD07R78{_XGs=O&viz1LD;VLTRuXyXdmS1|%XM_{CZ-NSn4wE?4 zmoEmBLx1_NLQzN`K|x#SgOio>uogwWl?hsg!TE& zd+AkRmH3`J&9TTHfirb*x3)xgXG25w)k9z{7G`E7tzjJTM<(`GvA|z~pr`tm|5AUE zTlGl?dw4nO2t!}DFJAZ+t7>%l8U%;dsuyPk1ogdZ(IajAUuc>*kjkT^UvwKo(+;ZP zs+ZW` za}|=GSlifrixdd{G@2~K0GfC8o6ol-t!;Z-W6-bjjOuqYSVw`1DRz#Ead1JL8}*M+ z1uBez$*q&K1WG4F6JyNo-dZ27C2?M-I@ zK&gCuoHn5;aZ>IIishGdWQThQt*CQ*_u?p0I2paB4AlJ3;u_?;eY-j%Src%UA=U{O zjF6270Eh1G2E4-?^bAF)g|Hy+k4Ejbt4$>u+oa-STl&5dW54*_&nbya>3=M|XERyn z*Og)<7VhN|mYBi=2ak88Jp^=^_9!%*N1+Z@G5p$vwl$E0rGzSo(ay`(l+EorS7C=k z(SUsi1r(zBXYKu=l2}K3m^y|Dhf88qX5<$@`xErTSOPu)ziR>(KQKa5Xr&0+r7WO! zrz>Hu3P_2V8{BNUwS?L!Mxnv!j%B62s1lfmN<5x$i8C7)2uuy)k_L@os6-`=ch_Rb zd0@9fHv|DxF!BFT+No}$2IC;4@uvyv^M938x0CXJbrGX-np?eG8N8DJgkfr(S{eL@ zH|m5-GIB5%7W>oqaC!6SakkCc*0;QxIvu7{JN=jC{D1m}QS6Uj5iECQQC>lRVJvnb zQFk?_)C%0CSwu?pE-9hb%aOM9|3?^QNHHd&1sELFPXnnmSN850ZI^3H)n__-jwAwYVh2gsaipq*MYFat;asNj&J*aZ z{^v%1u|gf3-?uWsO6y_|cJR!Tgv}jEM;gCs%YMTxk&2`@FPX1J2X1jeIe)#fYWMXb z+C$fIY+u?kIr@SL6%5(3Ccae5kmIYJc;r_se6_}ZvxZc{xrlFA(;UfGB#m7`=1i!u z6((;UWYX0V3gw_2cRq?FMUM0q+`2eBNW&Sc@(;Hu0s%IiXR>0!rE7S2q)`Z=an>g6SBqJQ-K zV5*5NBhv%J3w)T6E|~-i-2WH>;K%A6OORy$-FZ^}@ccB(ui`R(@+|o`=aErBvX!r} zMrj-v3Lw@`PFQJ~O&+(L%qSSK87``VN)=FWqh}P~o9|5U~~#kNNRkiTcgUnV+e7d^K4R8k2jFby#`_H1BG(*`!w3_^^)L zt7dy|R$p~Fmn3TnL}%mRG%@3@(DL~StazlcFKX=+R+PeG;gH>xy zHf)W{?II5q;12^}5IJ|m=9XB}4%vt>L`H?({q3^orpGOgSkq;*pFhWdKiYJZ;DN`= zrtD@JGu~XQF&hu~#Gpn+_a6MFzv4u5Fd|VnJp?wC3f(u|*xf#KI)9XtpW*MpL!jkc zKT4nB3pRvy?`cKcZ&~LW+7xxuSc885&@@Y0tT?|iYmUDV(_>m(vqt>aFF!&i8sBHD zQ``Kk=$Y2I?~nVM!CMEWLT)Y?k%LbUUEnU7k3Iyg?2Rgpfm+pY!8B+*8)T3vNjxm4 z=x21dn9r2n)&IULdO2rg!iE73xL|7l!|~1}T+t#tD;D0smj#?egD|05na6FTi};ew zxUS!fbD^!hm0EsbVb~55xVB*;;GQ;pT4%am8JQdBTG<9~)`E)ZBv)iq=Pz(=6W4F4(zN9eR>n z-SpWRBlAl%Sn4>&wc~d`++gb`Ok|zI&cmNh(lIw%-jC54+D=;Bjy$cAf{t3F;6hFq zRLNV#me2I!jq?zqTZuI}MbAp?gNM*V2J9<757)55C5uFkr<$WWAc@{wYKYXGH=nwywT$D60mt}xe7?!Fg@E5O!6DC`+Q}?fadMhCZs5m(2^3L? zRw)2i+Sv*^8?8}Wpv&X@0@tr2Z$a>ovFO(7s^u;Tb|3%hYtk5=M6QKc{|*}FV( z*9Pl+sq-lw;Dl61u(FKb@=GgvgQDB-(&LZ3yOmcLNy(f34fj&r17EN6elkV{9ST>< znaeBe!*&%DVX6oUYT)BC*rOq&M2+3-3peY&mUm}cu|VMwdNN4%M6l~FzX)k^?!HWv6e4RqNO8ef#adWKv8J2We= zuSpk;mg!O(9B5juZ|zwaCVk7(I26}g;Uh&ZlEiDXT@W(leBIpgjqlA7k@?UW{-ts( zKIQIj8(x`YRShMD)TSDGBN?K&k$<1^g^vaa+**(mYPsckSoai(DG8j^V5AW~0{3Q5 zHg8D^kUHk^h~h%1N^r>Ya-CcR0^`Ao>iQBj!w){$yI-hAq(bvmC*PwZq3@Ees;BrG zci6I?ph{3c4P+besNieA)-Wc4*ZP0*?a=DK*Z41@2tP$nqxg$dw7sX@Nfg$2bL^ih15gw(xgF+OHnqzL`YT3?WSq*e*Hc2=d@-Yr70bKL;eNh`9LS! z$%#C?#fcJb8(>U0gRUP;+&9ck-C?$5*os1A)MYCY-`YvrkKw&2|J z>&Vo9biWEk4*VmRpm9#ZG#g~D!yoh{BR~+A#`yn*h1B%eN+>~ zxanIMZ@XyUYS19!UIHPUtJnT7++VNIoc#MUSc#2rN8Hi* zU3P}4K5J642&{h!^-{FD%vKxnc#ohcu~lZLy-LMHL&Nw{3~;8MMQ{%k`X8jjtgxrk zz4Moah%X2i9{N^d<~jOmKgri9M}ty=}H8wF`0WoR+x=km6J8B`h7>UaB*S6 z)LqKWuQWVMk2@3#R@&dBJHAU$Z`&#Pf>n)Ml3P&PyZ2m9b-H%(4iK!cJ+KIY<=`Q% z*WWkR6c_q{fEg6HNh3A|DobS`Op``s=u6f^zr^&&4~m9n#}t>iATkz|86zrZ_aIJ zq^3O-m(y!wtqJ`1-I%-zU1B-l>Lc^)@F~q{SNgR{yI4ScPfQ|?c;ZZ-{c=M*$rP{p zFFsUA-TaCb*MA)Unj=6q`cwiv1t|m?{DYb`_Bu^A*(ywx`%LWP3-_g)l89su5*8rK zTH>{g1Q90XOgx<`X7}Wv*983pTe77yI@L5G*~f?h3FS3rTSiXb8TBW^JBKdXKss!w z4q@8%sOoG*|GwLY^2M>MPGLxk{$Q-6hz2wKOj(w=Z!!ubPwuyfxQ^_&@vrjCuhN44 zePEfMFeBVxA4vxK6Y7Zrhsi)j8}|eknF#AG;JKncOx75Rkfm5VUwStN$ zmjKRyZ~mikshjWI8G8Cuv{4oSQWkZNT62-Zh*|C?V~w<*zgUwN;D=5oz^%-k>vV3{yg{( zqts!GKfiSXZsH3+Yy?MD?+54zA*d$d**~25$EVECLIk_gnOhdEVq2Ky_&@6Gm))M$kAIZpMM@9kVN%oXX}fsgpxRLX_a!g-c6JX6Z3`; zy`jUaTxF7}D|cR|^&v1b;Asb&#_ECOJvk}0n+v>}qDT0*Dpno@*FgeO3{MI};F{h; zqzuPMD@Cs-GZb}Fx+<-nPL15tKAd0?s6)WX_2hY3z3U3CuK`7Pw+$k9B)tqUoZkYN z0g^G4!-(O0`i-<)BwL`9QVal@?fN(-Bqx?%%!jsT?n<_jZwYEjTxa^s|XyH&c67 zs?01k!De2g@Dx(Iz)zGc$&~#^!u|f>EsZ!5fYGB9DG+Dvla&OUHeeNq77vI|PQ3c& zkf)&803Lw5e>;vZRoFS4$}GwO3y4iNLEjgi01VvO>9ws!#PJl|c(B4b6KUFtoGa2^ zziovn3`&G2-W_pD7ZqokaRjbG$t>*qh%T*AqbHlHzDVx*#`4Ovelq*?#_r%cCR}|J zzfd3u29e&?&__c&2Q0(*zHD0dRx6%0@`yVm+G(cIlnQ;$p$u~NM%@vel8@xy_)-KTXYz#~m*ZKlh!6>*{NnHdw7m^t^2DmQsO-Il7r zABcsv8U@Et(ea`dUB&H6y#?ID?t$i}2q(~TM~fp+GKKBBe<>d_QyT3obJE^n>YO0? z&1f>cfXJS&nugI!AJ;GM3!~FrO!nS04M&gjUI|hg1iQ^^Gw|b%?H3oVOx{#kP6CzC zOLS6n{30kliySIE!lLJ@-+W|GL^PiH!1q)x)7dI2ZY(V9+zD{*sXV`nCyU1C-4oQ3 zeOfIXGuL^=b-?D*s~(0j&1G1DM|Pm|DW$RFgy4_yGSwcje;pG_HLo^*yNJtJjG}79J@{8g1A<=BFMT z!j3OHQz+KU^J6uA7i)p6buWy%8^VEyh-2t$`zET&b6DmAVQ~CVLm)ngu*3gFf<eZBk|Znv}aE4fd`Z z&$23;8u|YVr=dXmIC*F-RiGcNlrWS{)*HGMH}z zd*Av)&^tmkEODtQSm$OC3=-O7OnU?vluK~g1uuIZq>Y%D^^rH8i@9C$eR>Ql(>KO~VGaVpIR5lOE{KOJ%@&PtH1R3BGZRLwUJcWNw`@pTDX`blQ z9!3?oSWl{5=xm^jZKQ~ciJk-mxz!NDo3%?;Af+r%IkSNWtb>7L8;7d!OXmtZSTmpW zM>47YbHo!KvX&QA@wzN^qEYIlR}Y&o&`egfj4`7{%n1d+2Zi)sK}wg{99y8T?mGT4 ztj&!UwKxAD0~u9KXVk0{BCnOrGcCB%yUS5PWm&rdY=X&Zp<;XE-)`Eof&d429jKm1 zar#6&Pf_0aQ8-}lL!QzAAql@whEDlQ$<8_nB0^#}6ryY#aU?ZAD}J$J?l@K2?Dbb# zc&elI%81p1%}`LKSTo4Z2frEr!12&a>ZG(5}3qgRkgE^lq%2;g-(Ht|9E@|*t0 z9eu^u`Vz`0`U0SsoeM#4R@7I*Ov$-cy88*Gx&64{iE}D--gYS?C!x%SXjRMW-;AkK z#%~`UKN_`NF7*Dr(X{~3`CsCeyKgL+_jH~o`JzQCa8mlaHHjBaxedP*>WWn=v+Si& zerX~*m40usS6D|VSLppx<5mUtrP`F`nA3oh-IJfZvIX`Um8XzmZ|z@UuKZtffKE$Hmn9?uIbSO_qW!z>(e*OKUq2#xt4sqlY& z-jmbqciE zMNo6itkX|~dfQFdp$6x~ZZU}*!z8o~g)QbOi5g*ABY$NDRwWm+=+%~KY)asn5m7*X z;gx_Lq^rPh1J|$a*fi)ELGaL(k}KPrW3mDPY;Qq@Z=VFFli&?Q7I)Q@vJQQWTm`wl z;$;AdEHiJ6ld2d-mD#;3q7>Qu!niqksx3E<(|GBFbEddRKX*HI^==qF0dtl_h_ZJ> zS@xgkR>p`4afMOEWjzB5j?~&q<)^uvwKC1{KnY%9^4E5~R-0A`4Ci8J$Y!21dgh65 zAwU8>mKf|3r2y*_EKc5TeTx@?^Tl@8h_|1Zq0slv{p$^Q@}sqTbL;>tD5=H2OD(0fZ z+9c{`U0;dC#Mpe*3ZF~(n~_;`HTe8*M+Gyro9VR~24hW3l(<>+3mA(1*ujBMU(MGi zv>X_~ytm+e49y}2t;9aRg%e2^tA;hPh2t__J+*;XHix=mo)VdqN5vYGB4ZZ+&64WN48*UO zwHAx>o6=e=X>DFZ><2*l>?0)zP6K(?dw|iNCqN(bxBP;4WoD zGLmn98kKS3Ka!t(&ee&8Wt0B~>MM?H8C8=yv(AH@rf^#p@@z|HSr+8H__QG{_nEfU zvt0I| zhSj_9WD#5%C&r?hyb8qMm7LHI|3~F;#N8?W*TpeF&y^0?U?95#43(J(&8?eVO+c!09 z-~6)pMzY!b^y;i~<4BTH5&k5|Lc!*Q0sxD#V8HUbLW>H^j=nzMzZ!sF>BP(u*1w%Z zESj($zEWHkvB~J*u*TRqCDJ>{)l&`7Yr||kw>pGcaFr#v5hRDV`*LdI)}CcTlSt83 zXC-;yTlgq)md~2~HlVtjT%0nACSZt^4DD`?3_|$ZpM_)#*FT-Uza|;e1~kD?|1z^> zgb6bdz$tZr@F*Q}PGbn!TT3sHEAUJzyo*%x!frS%ZJyN!89SRw3H+61;DzLEDHL#6 zDPb2s?OW7)q)@7;N5@@{Z2zq5{ph~73@0mpdyY0Xf(h+z8J0e zIL8}Z%_qm*VgXaMQ?sM)K>O;<4q}(P?*GR_HS}Q)C4uI$GZxWyc^rhJh~W4l)3U;3 zOhnv=k^Xx7)p5~=woF#2V~#%o;=Jq!BKS(ckzamX3mMy-`^4Px@(l^$!)Ge}{(z;h zNi6l;p?3Ry1jNYW+L+oVrPC@3ut>ZIRQ5mj0-_g=WBOi);&&3o2wm1o$k+I`Y>I443< z=RPqtg4q)S`!pm;vF2!9ud~T=P;ySpU-P@I`0l@pKlR(3vLg5N)W|cyqAYeS!Kt+% zny-^jdUqX>U{!Y@?%F3MeRrcPf>e`ktwX|w<0X(HEj6LTDj!wNkTg;mlRoLzxX~b} zc0=F#K9|!?gMi81t`ltaoFyUkg&IgCcoTUD;nDjj5e!wF&j2mel@&B4sGSM<&QW$p z^!WmQe5*YyEj!rcp}M<5)}FP@uf$r@o$7^%$OEWF8CWSFv#AK3u8!=J$kBcBZ9DKC zM4$%YeM?@w2oJi~I+e!3@PZ~bJta;z>#ku&-0Ht*emHer4P-`qf!dTbyiO*vvhBN; z5!@c8qs|;mD0e%AF&+cHn%l>3iXc##29a(zs8y@zk{kk zL}rfjX1Wjq;pre;5yA0w3ZakWH@pz1XRTkCXllUxJf36^SyWDUl*8xaOL7 z`vCFuEQZXyKEWT+giZ?5ht~^trgs>z(5{v@c#$i3?;@CF(m;U~KpUbleqN?`&iIoL zZ!C2W!e7wz4!$sz7V8z@W6XMRA3Lqud+1oJb^4B9_|(^a_*9&I3{doPyKh^?2O@Gf4&OE7mmiatfdLz!|knM4^SD$ucdE@#0 z_i@tOHynD=I5ZmSo$l?+{f-j`&|7MON;ZW}i{m5o@fIg+&J3vfVk~M;a(?UiF|iPP zo;uR6d@=NXU=H>!a#$*A#FAy6vKzkbjB+Z-&>zh_7U_`nk)~c>^L_qEIwSQmpMP|G z{sZTvT5MEcTB~mPvDrz?H>PLmHoRpZ-m}t8V-GDhC}+cu0cS1!TlxP1MsuRj&-^gWn?MC}n%fnVOI8%SWsZN)kDG@_myeZvp%Ihwta2Rm@ipg-dZ4vV0*< ziPd8`NbgH$b|Wgver4SGVM57R%zRtZEdE=pi6WA0GQJAb`M7_bHL+QprcLc2@g#ls zVTzmDn{pL8BiRu`D{rxj9TAdL>ZrD+k@4=vc)L+Pthu?u=OaN?D*!;Y7w0Hp<){@cMq}G=cxPd zV7=vVyg4K4Ad>aKa52u=jA+$rIRV00Fn{(qd=5-6_;~F&F8aA~M08xRSEmj@IQmX* zgwd9CD$qH}po5~OWF^-;^t#}70kxU%J{5F2H<|I|b2c+Xlm;O|i4LbsXqmng?&Ln`qKLl12vQr|V>5g3bXUaA^OYc%G1v>mbGG&IANse`BTiD+6h zL>q2x-b=dUn)xUqsi?wU{ZO)ry}xhY)A0`uN3H6VG!Kx}%HY7zfE8&-b^F5Z z7l4BbKIZ@Wffb%;bZ2G69Wfu}ZH`_CWe!JUcFHy81JKZeWi-Tqv=d1imWM{b5o7Ak zbSC1#MhakAPJ`dgh&hokLOry!74`?{pgjK$dcH_dn%D*fi4$RJb1%z_$u?)sRlzS# zJc&~kf6(Xs2$5Lk@wOpedGD^en>kEkb79B$QjlUa#OP>BcjyI($KQDudG{~Pw+}oN z$^|AeW*&#w`b4@8NgYNAUI#PrztlL3Yjg)8s**y#;Qi6xK`v!E(RzCV8bAf?7Rv%L zU7l!YuRX|o6TY?9#gbcHKo`Hh@t7NE=2O@dM92QCK-upfKz?U)L{s;@4)pmCepIU9 zd>)cJ4uAhoam}70=@s9woh~a3^TC=%hJA9F2)ZCve;d6aD((ivk-ou&i9t~;9bf;v zCFVTV73C|AS{Jc_-ifP^Xe7n;Gg{;dmm?rqlOOTiW(bWm{V`-A^|BAW*WzaJ zD~MKQd;UZ2;zOOW3>AW|7p))>BJ&j9OKhyUB5R|V3qXJ~f4~(~1z=LQKXO0D1*M<` z)InTe0j%t%O>&b-8VEEz8-wG@0@Z*d#?ySEyhhN*)O z&!Y^`f3|t|>cxh8LSn+}3P+0E0{ueJdqNPpigu<<50m#=i|}?p!#qc-WC>Zloa<@Y zodB5!!E)GThtxM(A|=Z^bP!rdzzg1zD9ogKvJWze)V~eawWl9M(Ch>Yk#yLzZJSI} zNi-&tP|RK!p4LbhDs;MxVpFGhA!TWI=2ojtJq>Bot~}dz!E;LwP`;c6vLQZZFu5mA zynWqwHA*(Bxu3V2ISX$N|K^YK$z`a$>GVT8s>TQ2&rO=?PeC8TvlAcw;-}Lc)$IO8n`OwLPrw=#8ELxu_ZKU zwvLn;Eyl$c=(Ucy217EI26!>CU;tkIq}qII>(K-GzdUxiv%aF{#upSaaPy5}H0lLH zbd!T9*Up(i2Kjvh-hc54L%GUUFU6+qgvMV0COAJH+}{u1f*fTI2)1wtupBSa6DE+4 zo$&svcj%~m%`)FecpPx!@kET<;t^!RC*doP1NTIbmIb zCl*J{>~?JqBp6_SHZ?f7Zr!J?ulmkD5sjU&B^+R3vm-P2+1`4GM|Fwig+8t%TbdR;V!x}(k<8?WjvH%;Wy;`r{7J7SZ(rEB_c^H3q~|4tbP&xb-4mVKxdjuf;_Jl~ zY*_lU0(dP<*7BuLj-b>zM^x#PC4aEiJO6<{|PERG;s24c~G!XoEJxyaPV?)u|z^nmkh zdS^JA`s48^B`pPSN#25`J##)p1CLz2a_o2a6^N@aB%@XU5io`5IDzWtgO3*`^Q}-y zyaHTNL{h+yJIHSE7~dZo&rhyeslX39Lj0D1#qIcf=;@y zo&n}%)THlt3^wTQ8Cf%Fy)7<_%QDKRVZt#jGYR7$AE1D=8+J;wP3F@gj51!Vnpc-4 zM?F~PlxDU{@?jtWd#D+F3^>uD{0axEvw{4c;h{{W^E4d=S2GZ6zUTE zTjz&gOJs`C5M>V7w9ZSu^_R=CdXhE&EX+uNv(sf&rAr<#5dyJi^UHP$CpCf=(HNCt z$&G3+lCo@^^XhD5_$ z+j}e8;kEr?<(}babE~#cX*s;A-}Dd-hEGD?7bh2I*vE8Npp!RReWJMHtb|9k4gyge zR!<`hr;*<43ck~N@}Y`NOCW4hFM0KXn$VK$e5%z(kH<#WWPg?ZmtH||TGREkrcKep zJJeAb-2-si;6lUZW0v;L`l>yxxCU8+j}?Zs@|QW(+hCp)kkoySgx^~g2WxB5jh5N_ zR^)Qkx*eHW_54(u{ctgExf{#44ckmcF(tIHEXW#=>+ZQFH$PsC&Mz3)=W5ll8;V!K z2|GrmyDNJ4onr$E5-8rJq87ejpe#u!Jyyj0;s&n=_#fFtJi7>C5>b62m0i(ll3=*- zKLPvLkhbLZ3WGetG(SFwT$L(Ad3sD=0lNru7aSYAt&kGSiTC>Sl4K_EwHU=toH+7k zlg=@|#?6Htv7HFxmUZzTyP(N`)~&hczQl!+x;^URW(vX{xdW91gc*dsOK{yH3-;t7 z-#G&6m!onueLfHKkN>WVM=qilH%q2S8J~b}4fCn)oo?Dk(EXU-@Rsd@LtY$EE$Dd;d zcDH|s8lPkthFflFn@w(Yh2c6~_iE4qb!F|Nkbu})@Iqqe8Pyx7{qw}jO1DBqVRw6q zm6aOA#~4A1(hDJhCJ-pY&`83u)q+kgn5w?29l2VY56d}l=rif2k!$L$nHo1sl%?fW_@Iq>HvEMC3%go)0QD~%d`CPm-^!37 z;|9kEo(YcDxSj?!#9(`jb5e#Lp+s<>ICczbaL;GV@M0-YbNKu_#YYAl@$yr#82+vN zUa0}|4;%++LJfjYW1KUh8J3e3H0?E>u3-jP=zGc4_S~efu)U?(nOy72_25UDm({axlk$V12Y1Er;U>Zh@_ddnwhSCE<+Y{8Ev zA5@(`RN9n&#D5?NX_WCvt}vUSktUP5m_&lvOv$UK4QWZ>>Z^-{1|vzGVHDdo#Vew9 zyZiEN`UCoS$nfN-^C?93{JbW@Khfax@beW@TYym4tj4jj>~*HqyB320eh}=_eSoxUfQ?1xm}Jo!oDHpi($y>e@6L}f z`G;>#FP(TxChMdDZ+W2^48Y^X5~s$6ua?t2803MHHYkl zryAy^g%Cy)#909py8r%10k(``PnG?;Osn=EzTulsLAv?I;Y+phI>Fdc1(Xhmp__J0 zVpHw5MK$?mnZxy3cjFxU!EsGt<0bR59ql@oS zLk4&M!YfEhmG4X`}-O;GPKCP#ZJSdJFB6zUBI>=06?rg2_6Cr#^gCA zXcas;?I7>KE1`!wGi8h`9UIQq8&+@E-eiVa`cbCAji#TFuxAX48hR41aT>EA7YbNn zWWUEx2;wj5*-~E`ONLEU6SQ09n+>NC3<|kK%SOo9(p+3evKFdqH0t3-*L8uLZbq z?8Z9zN(seR{5CJH+B%AaG9xfTJuRR;%9hmbab1%yFSePy^+wCBIkbYJ2WU<`ceHSJ zR<@3|Z;ea2u!mETQigP;q{yo4)PO9O*wb~93dtJPc^WHy zSaQ4yPal}w(5#@d!C{g1P6{Rutv>!rQK>o%T#s*qawIKlJx|lBCC)?0X}j9#Z-|(ix#)j> zJuqHYB(=1t&O-xiF`nEggJT)WgHcY(esAu%vvJP){LpO9K$jvU9vq#q3r6DTLh%!> zMTWf7pCU|coS(h;B<;5uE`#nP)}kk&DKsB7*4W0o=r1`EfwFTSKAsklKg7d41VQ)P zF4dWvhtNO-os`U+Zns-yxeT=xFrdQqD2Q>(&aN5fw;A=*LH=)KJf@7y)R_uH*s#Ud z!RvhuH=DF74ucuV!}pM{thO*D9-M!0JvnK&4uPL`9-khmu-~wD{LaE8czc@qPKTwr zUi!T4M(utd)OMkGsp@y;rDYZ>UOPJ`asQlRP-Qk0ehiC<^yvg|k^VcOID6#b~C=SNvyC7t$@yXi@{*R(=2z5mt0gB1Ep=+JZ$co7%Ly3OSHe}Lc!ZH$7;MK&80 z=itb9c8BT!WQ@+WkoWiDpNv!o!|-Ap>7F%*>ysP&4@<*dJPI-$Y>YXbE5q$CF13wZ zpZvwI+3uFFh_f#(&^4Sb}( zGt+DgO~ogsW$CnY`U`ycJ0C$~kdsqPf`KN$dLESILJ~zA==T|?^Ar2CC%gXABt~|0 zEy}i6o^N6;{L~InLJNli9~tP#G#evRx+G^GTc#1i-@&t6LEUx(vVG0e<1(Hn(e#SB zx<2`z6%G~)ulMR8X&qU9hFmdNdMqq3snl4(q185Ae`1X(n~t?SoKY&5Ctx_U@}+K( zn;vvq1=&-PHX~_fOUmZxWCBD{#w3}ORZPkyNh11^uyJZ#AtnSDt*!Xf`qJ1mfi+Um z6_czP?zJ?8VeYV~_Had_bHD~PC0G>SdJm3EB?$EUM?l&K3`yPFS9Bf*G3-~)ZCqv0PX?sv%@uZV({MpE zHV3J21l{^BKK5{#HY*`jzZU{deRwe492jo-u9#}3u}2=UEP=y171>huIH4iBe!Cab-?1%qpHcH|!T?6z74;IsFrp#f1M(_eG^W%R{WJT7K{rKc9Mf zD1|}1B2v3DQiIk^kPvE88wg4f^0Cj6o;;NWw@vIRszsig>%5EG(|>|tjFzXJ)zq>9 zxnNq#qKa>fe|&{2hXP;Z{5Hu=D{j2tNT7ab^8HGrV9MXRlSv+N%Z5ze;| zzULJ1EG@=>{(K~=Lg66GK9f>-d~TVA`KNR~s9_7I4-6kwOu}e`q52FYfj;aV`iNc1 zzF0{gbz5^dLi~+L#ajqWjKVE9TP|m;BJk!Og(plKsvmZkqhLY{Kv4{IG6%p@$@3JN z##C0Qgd3FJ92CJnw-AySj@M_r6g~=n=w31mos_8FB6Az24wXxs8Nb$Sy6(`r<@NF3fY6*qdrGU^<^cCs@sirF|33$yn&F!I=C@s{`sNns~lWH z)lAJ_fT%alX|J^WUt)>Ir0T*%1nva*omQsYtHx2kve2D{$-9DEx! zXaUx)gs(n;8wa6I%~V9f0UspEw! z!T~#Cs(&(9+ftfih|N-n#)u=LeehM&+xygSRt@1ERFs<@nT`F_fvft$mcfsH zSiPWZ`S+j0Tv+kv&sg!P%H#U_zqgoc!q!Bke0cb@cFL>9bbCSPfggsg>+6A|@O0I) zzp$~|CPG|vw{%Qw25V#!H+B(*`hkLXe#h z2zuL7V-RAYM-NkBxV%M_QwQIwL~?r3^;H?i>Pv#Aeib=2P7U1Xh|^7|L-H_b#xb0v zQ8c-mP~+4L4@kK=$@-MRDub!UK>yNU#V^_Tg4A|Z4M7LO_bnCgoHL^DoCk!vTJT*) zoj6#dmp^4{Wq(a)@mEY@yQ6Cm!Uedn*3{|cIa9MWotGI}h;{A4Z?H($8@!Q0KFsxo z-Z&qt$$+QMq+Po-nERzOy4r&vs(nPwXmnZ4O7LH(xCU{h>UtUWsXJ$#N=W!5XHxqN zFdGzlwF`T_Y7x0g3bo!R?KkxfUyIIl(sMB%$1OMQS zVMF@buU>=<5TAwM)#H|`ZLfg`D|^kjWqfJ>f~qxETfGO@BgQBMMvX&3iBz(q=@45Y-q1`jnNKgKCc3sPimu||en@~v{cp1Yq#p9=DVI>G*& zJAQY^gh$h@#H?UAJy^kx^P930bXjTP^S$+k$eKt7CBsejbx7%K-^+2r3eupMCEmp` zfXC*Qdd8i&yPe|T&K|Ce`ds8+ftfF*dJxzjqd7p)#ENMQiip%`X@BzxF)psXu)ny!xUZa-x^2xl z&|+#@F>#!$;kyTjJs;?6SGR1)M07{?gz;V7j)vuq+*WIAUPJlxGFwXWR%uSNZ*m~3 z^ik}K$Mf z4-cZ(xXQ8X-=7RLX4}s#U23wSdWWqv`-!ywABU~#u%Y@aZePR4MG-AU|EMlTue^FS zH}C*`(e)c3ZB}pFMm&A3-uuN-&4K6lxSr7tdIgAGQ$7{aE%t}X$@x=^=MnTutSc!Y zDI3Jw%gx6;uS1H)?W%0Khk1{AlJ8{`kQ}h90NDU=AHck}mcCI+JnNCy25SV*Qo^gL zy$D-6S?1(MmFeC=#pP>ETePB~^+~j^PoI4Yv?*pPU+I zjoea%TS|DrA4))qfj20yh`6 zi$ND?8QvPCT2NugXrb~{9-v&A5Rw5o$19%lYNh$nS-aN-bR#SAOTBqoOMlXR*P^e! z9OYm71b3RdHbelM_deRDtq^22SJ#{;sJ6k5osZzmbxrj@oK!I5gBgqC9XoaQYp!Ks z#-~Kc9==8fSMZ(ssLPO@?>yZrSGwKW?ngb*xbJQy_c3G-CMHS+uH?SE{fM9HmAd6! z(;JU1h|=CJ-S**CT3OqlvIl=_L`*5vqXuoW#=exF+{KDIrJG076l>Vfh4|YZAL35| z0#J(6F56L`vt`IKWZ7py$lIVkBweAJhag?yX&!tosB{e2Fa2xUvhY3!-NLR6Wt;|O zBmWJ-L(mWy3?Qt3JPB9CvO&G8u}te0S@2vOj;QPYc8zYKphD)hUn|HoAE zXN7>dNi&0n(x^Hn9qTg87sI5dkJXODs>gLiF-%U`D^JY|DdQp4H5xuSmnVnj1#oDL zIGc&*)_RI3gh+hV!SFX6H?G_dP+_4MidtRTv6Cm3^;lX8+QcN$5$@gyxND)aO zUc`aqkRFmpVn=cKT=YY?BR}%USH1BIzxe9LTJo-pKvx%T_UE%L+aj zW9Vd_$_Wb-&6h3c@Ev^4%{R@gQdkzmkB-Z(HuwKOf7d_nfW}xS*v(qw*F0FA{;=;u z-OOJ5Bj&6d9B(C-0!|9VV&c4aMi?orL53JU0pA3HNTCTWVs-sC@e`)XB@bgy?O@1= zG5jh%!RO%*>k)Q+r(o*V{D{ivj-Ua$U9we%6fkmZ+wkfF{wW%iC(~w^cCWer6(uf%vbklNz)<7<&6JJrK$RrS7qSM$1q%RE|6y3$QgFp z!oul8vaI21{;IIBhk;#m)dJDnoCXrwY+KZr-%{Rz%1dSFuiv>#pQ78jAj5?0Xrpfee%r)%+m~kH`#W zqqByL#l+9M`6^knk-6R*h?mvPeY9X-(5Sj^VO9Zzn8@A z|C@#_Nx@&I?^~I+b~mkPA_9Y+0gd3`UE=`9oGbJ6&S0n zzXY96`YTaJce2B(&T4SpsD(FD|osOhbWjU_5_HV#yLYA*A71* z4@SKlC}(H{8tqrAG~?72zpM`c8?huI^rI!hT^P(fpgejeVIYx^5(gL(f(qs2aH*)$ z<>pHKH=vF?LhPvHfe;6h zcp}ORG2STVgE(K5@Ix|xBm|&UAj$+GPY9}okzf!$F+voYXrNXM>ct{e92&&OMhOzr z#3adVQh+q6sE~#<>1dOI7MVzwb$W(uIhb-$BM({f(X1e_sxyG6T!32u3RI#{9~9^- zLcN6hs1P^R#{FJmcaN>0uB0GvtVO#Hy%c9SSFsdZSV{>~9^nWRazz+|B9SaAfFv0J zj|qYV-LV@7E-|u?Bm)8k6)m~|=omP-c-Ps5X4#GBB)In`p}jAO-1~FeJkU*+2iAL- zmnH;|zn^Ev;rbj(egISJz!%x_;Qi-OQ5@qc){o5vN|MVO#lu0ID?}U`!J(e-A2(I^ z4}U&NS&f@8E#YISShWDYl)0u5h89$#|WQrT&}HeVU$$`b{k|M99DU2a~f+JGXL#Tv8x(DA9_S?iAVyx&+6r?wOXOYX1>y zjdYosgjJ@!72440ssKIiaF4FaIA`~2^3>P|@tq|B4%Yh?v+7NY=Puo`ksQ z>XBUo*(lj)$o!N~2$wE&qZh!h@ldJrI;Y3qr0wsY@c~G`luoTG=31@0k6srv2>9DA zBxzODAP33n;fPJj3I&cGA<_wYc?u^E1KJ#POLM*GUX&9w-fl9KsrJXGc_JQN%$KdB zmE~4jB-YLp9aCV#0@OyEUGsBGfS`bw1R0o9)Pi$?CM`H9svqXBhCNghbM=t*d(rC$ z2EGqOY5yJFAxbIqt&^XN#I zUwqaBm|Sk|>gb~yEoa6K0o4Tk$GSufz-{zITG` zYQ-yeR;7#3(u?r-{$@EJ8Oo^1AJLk7O*r@y1py^aSV)*^nBu={ac0c;Cx2W?g#VLv zTNh`ybt2{T@^((fU|0wclD;7G`*2rvp9 z4Tz3{0mLi@P!t4z#SG(yjE#ejgO7uYgNKiUkHbnp$c2cRm>v}!j38m4U?F87BVP>^ zw5x)Vl8Ty+h6xo6L4m@cuqfbH0yv>$(3&n31Hk|YE;UhDqmTf!DX3^_%N=8n)v>gO zL32--oC_CD*m4O<8$}z;Ev&}^W3_j`)0QkU7O3sCD2ZbK_GIi!AX=ZcRAbVp+~1u# z(s*NGPM_G5>k>ZluW8)Y7dHZ-TXZjd_1AJ7jDNhYW9YJ16!U@sCs{;*+)#nLjY z7hGE4Y{VNZG#Fz1_e@&0jLmGt%vtR&O3MLiD zV7Hq-X$_m!{fa_$yL;#22Gxbjb7}CIM~AxpZBTdW*b~L>f)S6@a>E#L*bP!Ea)hjn zv4&p4X~=a#KQhl$Ch`Jg9`6u=hme3^M8HJSo>Qb8#u+2{s-DB^7=GsV1Z*0fB)?P$Vdj{E9$mwhBCwQby58gyn|P z8<0DQH<&L(AWTS6b1t%$B!rZ=sI$zzsz~Azt*C@Aul#n`^VV5xstQs1+(uxScFg^2 z=(+ReD^Q3uxtSEWO6lV&^i`CZuDCnA)7BfpN{!;0TxHnGDU42^cc^oD6+YkWbR_pG zG)od5>J@LemVNw}9@5q?g5;{oI+!WGQbVf!dF))(#l?-&i8SqsvMSvL`IdTy6*1$a zBWWXuBIAMQGYwNE6fnG))sk9YPZ}x1k@WlsgRR47^I#B;!ukF4zwm|# zrg-8&$+4DVLQjl~c}%?X*wL`v9}Bx3@?iOfCQkRKAJhI6%@uLH&yI6_7)aevNoOYM zUXnc5aM-@jCN><7-`~?`9>3-6G&?`1$oXqVShcGrsRos$0z^HRG=d=5AjIgl3B(!G zUOw`1z|WWg*csCSb!cX8Y6RKeuCY&>nL41iXRx}3=VxlNh=*r~GKbsee&wrwrqeio zp~-4E>C_>$OKno!wa!bAmKHv9a_gAx)OaTsZ(AGRU|0r#2EMWUXVX>5c-r%!!d2zb;hpYCPQBx9R1@2|9&;%*vIP**m^oAM_d7& zk#-Gs{EWXdJn?`*eF{TkBl;EJ#qsA*s$272KML24`={rDaL&J%o2S=v7R_&@Sqn~- z1!YP1Rj9o71Wssa1}9f2{gGe0&MbbA6&5|k;_w6_iA=Gf(roDrCX3DC^7sOwNGy>? z`u_Y*B#|jp8lAypu{ow(9{+G3t26=741pqzKK z+&K6OB}9TW16EHcvY$t^WaV1*utW-5A`1jB1P1{`kc9&Dp@AM2xWNOS2u2u-Ln*|l zMm?I)i5~Q0Fot0?mS6?eV7m!~Z>Wb%Z@41AG3DgY-T71wa#m?!J7uKaSDwm)UtTAvjp_AM3#gR7=xXd zk40F9Rkx#o`(H7__JS3(CJEgXn~*cEO!wp~ga8rdG-b%K=j+vDz=$bxHtaa^uICd}2}xX^2d$A?<%K zvJ|M%q(cvkF*t-+M6QtctI=2EFF>ep(PG6*kR(Hv9Qlek+OAQjUQ{9sDJ&v~&=snL zt$7$~@L5OI>jGl-=4|d4gU08hisk+RPiR=lY9JOekD<<8j zH`~3En!~wx!Zr2$Le$qarQPAzl+OiJ*y~+|)L;8E5K$M(v{j~Ej?-R^YTpEXR?&%D z+?O-xN_tQkRjZrt&2fitOSnV)9BBq3njw}pikSH_; zi^E&M_OHG~rch~g29w3+aCv-zP$ZT}Wpag5rPgS5dV|qqX=TmG#LU9V#?HaX#m&RZ z2jdqI6cQE@6%&_`l#-Ug{EDmoc%Azzc(qsR>Ncl&K?P{F(p7C>^V=GHTA$J6Z*uEL zXSrA@^oT;%jGn`%w^>WLV)cR7ZP>JB+m2m(Iy%~)=WacE0gjCw;yF0=9T>-W4EBT| z2nj(E48ajHLLd}`iqH@`!a$hz01A!4;y?(-6Nn@-h5ER|Mg~(qSDVA-@dZMWSR$2m zse9c&rRK{OG1)If7htldOl8*HN`Bl>*RuYBU)yTTwR9SGBB+EJ6Kdj3(ZX}&;ly0w z#U1^BgJsd>+cFw%H9o$ae;ub{z<%_(jDzv6f`C-!`-AJ(p%ybR2KjJ=4r0*3x&*(m zoQGn?mN^jDi#CB$$leI(AJLgG9%S*|lu?9oAx)k4=p&T+*9wL%A`iCa1CR4kNvNN`y=4 zbG`fe%X+WUU*fePvVnxZ3KLtB>h}1!^gHlgGMgt{$FKnC;SU2`!O{Bk|TE@&XGI;(8SGO~M#o*uAxK zGWZnb*-Kz=^&fr=>LNAYqi2NrV5j3VyjPDYF?D{!Hcd%bhhCv5Gu4HfP^lIIVW+mu ze`??B%$vD0XJ*eVGyfAeG^*^qo2hAf$!(< zW567gsCiGOx{Il7vIPIWjQ&mK3lLqGH#DEi3>^$E)_Fe|t)u?MtXYvLt+(8}YnCmT zHD!48HUv&U+fEuYZ1-F2%@vF0Oq(!v zyDeNal@;csCB#Go)$O2Wb!mQPa$H1kCw7)fHvL1wHaxYfBS74HY>F*WUTIm5H8)l2G7^WS}F)#Xy3E0;0))Zrj6?NPn!npz$UE0GAzI> zOu;yez##OX4GpM5De{qtWW*vIf$)X{HW;9W6nrp2fOV<bDz=54-ut5@FQr8j%wO`dzBC*I((*L&o3?s{#% zBSxs0AQguqt_ry*XwLG%NghYJ9OST<%}y3unQUaRmd;8VOQ|fRFqh0s5>tsxBrq1w zNE}1448+hEO-~eEk#t1R7EVhTO`$Y|P!~*15LJOx1W@Kri62G26v&4>d6OeAvgApI z9HhyE6xoT$osirJ$Q7S#7+HZVcx1+rX(V9FwEt5E|LFat^M}@NE`HJYN$m%f@07k# z_)6ZtkhL>OgTzN-ABenXct`h^<_+LA)hkMSNk)G`;zH_9U8ys4c&xoY(#DI_np#4$ zdz#u^jpUAoep@|XQeCJ$4Fhs>qFnW#eDcu;@7XLSgHEGT$Ry%d$h=*AoZ?Kd#uy{C zAqt6r!=Ml_2naCH*VFaOzTmury`8O%wUwpGXwd7l8nsHPkjtbJu}CQ3f8z1n1LNXg zV_{;TqoJZ8BOxNNfQN&Hfrf&FU=9uj3IYrS$c!^iIpLTie&WaTLeTaHj^;%TK6U9*cI~49K&E24eKFtEO6{PUF0JpTlk{{ZuivonaV4$KY|u4o-%0k5HrG9glsZo{PsWRKIG;8ijKm7%M z^M}9u+x|C3aN(htfno9y0Vv?9-_u#NF_!5B zy6COxV*xYZ&1Qy}!i+GV8H39-TT||4pfU5&0tmC@O=VVEpV-W8k;v?L|85SDIiNZM zW=^~|<{XUQ>F3+Reto95ysjX-S#^Z_kXx6l`X@z1^N2)TG+iQZxJ=D&TSykNg<8>E z{1@5Ex%#}Wsmm=xAoxNhv;xC;SPWaj_K?G#a6H@zXmCOw)}bGufCn`=Aq{;P@rf<$ z;3gs}4lrVa9bUzcxWZ>BqDyz8GiqozP4NqPC-37!e3H-dZAO^qH7`UGl9UvrDQ)S> zkc`Wwd=ytd(wL6vnxYQ$q@L4W*ecn@2eMJO0jC9{(Ckv`24@#d>VUUL1(W@p8Nouheg-_tZD*Sq;}*E!SFI z*IoTz!=}>on!_fw|5~>VQ%<#XozA4EiArp0(*HT+%>KNe2l-k)%e#EkRXbl-?drY1 z&-YtC$74R@+kL02kA1J7_Xo~+<(J%ar&No*ILl@EPX!l!DjJE#qKW8}g|oPruMsop z$wHo3F?KbUkJV#u(kdO-&+EEc7vGA1%XLHuGnTS}!-;SrmS`q~#Cz>+)3-qKlcz@J z-s_1>EYr%AGf!N@@>6KBWnYzjuJf~_>=Y}pPqJSr=?bMa!o7UgYAtk(D_;eH( zFMAc>D1!nj1WN8wtn@u|6`SJowqqnS4(HA|EB(&5Cuq7&_1q`FQ~9%HUWb&Xa=Lof zK+uLw{mRGiHEI>@Rl1tKzqVy*N80XG#7r0xBqJ^|KFA*DV>MmA+#rhxQrcP-KlW3y2zzTu0uc|2C41 zT;<&Pm(n@Lf2VR&84AzltGN3d%ii|&f^;Em7sze^^T54n&5CKmh77u{l$Df1D^6w6 z>%7tnJ>Rnj^Lrrg$$N8@xBG^2WXq5)MUr^!YpY-`3~Q|xshs}(Ub+2$Cx7{WBYK?D z95_jwJ^m**@tLT>*__7le*4F8crql3<1a3*CuKYycl+aNT!`hk6D4e**heeV$ka25 z4oJ>8XC(odMeM|U_>mrd^S$#Od0z9&JD0R1P08uA^=#N5?I(D|eZ3ordZL`jCqk@* zP0)$?p4BtDwZ0XfsRcEMZ}p@aTcfLF7p*^+x_WCTCd9napUfN1%}kTXA4yx%`P`D5 zb82?xjrg|2GFp*?h&!?uxiV&juD3t4#aQLIaz`^wjT(>Ckn$BH^3_kp#$x|swXs~x zhxKD3PDn5Q(^V}=+w`-Ge!ZpEKRI{KIm@nP zeCvSMY`8Y88&eyj8<#iEyRTdJ*?q?R8=JW@*AH8edCmQ%wDFDKrRu13;&Jpxu)3gp zOlc@aWmI~dBuS#gOPpkrb|s6nDJ@GGiID=5PjX8qyvk_PnA%iUh~HurlNf_-DOdb( z;iFMlNEc!+86&R17MOzZB^Ztcp^z!0gx3kK{5?;L9_l!5g-dYf`z#w{ee4kHXWgue z?eC_8?8_6W$Y!&#DFt<-`l@cKOg2f6jZfoq8bH=nwar{pwg|ntfAim~;>Gz>w>+`( zH@UlFcdsX)?gmErqj~ndenoCZL3?pdjA6k$QefmC1 z>x@0`{=DONIsca2;Qn)Kcwub&`NDW;kCWWZ7C*C?zcmAxoa3I(%Vv)&)niSj+<(Ri z{x1->s>wy1 zKR&Aex$K2MXwmCPGt>3m&ZrbC!mgH5=BO%y{!U-B8mACMUDIBBamtoBcIx@&upN16 z$}0I$&#rnxi zDqT@K%kF1*$(~bD5$15v%ef!&7}3SO?%4gJ$^|S~l`O_YJ9A)f9NTqo;&2-Y=DxvU zU%7*>&SvQbZ`9ce9NI92DVE~HdxzWL{V{Lel(xkR_yjovG`VW)QC8j*HKNI~l?H98 zrP@^b$74yS!_cjf;y#xx6!2$s-5<+gho90-6PEH-?fa1x&%@qwTT6aQPm3!h68+BG zs+cy`9Ey%~^gf7t^H!T$IyrTt!(!vNCilJ8p2J4qgnH^z04>5oTM}c!?*OC+u|BNK z26U%0ABdz;TiRh=U!%YQfzAXYLFBe{x26LV71C8tXV69ghBCS-tAvZ>4Lz#f^q=ZW?vW(kA0bkGvgsFS?gg$ z6D^VVg0HI~8lxEsm))CG6Tq6tQy-F+x>+^c0 zw2qAflz|k*p*)rQbg8AL9NQU=WTMevNxa;bY+(!&0T~g9gr(_7RLEE=iE!iWsW0mJ3L&^_s$Cor!m%I5(OToLKIqt7_U->dN?nvqNqmmZ&NGVI)Nxg1UNkg ztI@I!#caC_al(<@>s zpyFD7kY)Fx(jI~rYfThg2w-MBs`C4~GVY`SkTD!3%^4`IsgAg&?+e?q)hd$gekHUP z>8YWr>$W3YtQX0lt*uAwYQ>||>HIBSZ_!Wlm9AZi0(FF_krM53Jc)7xI}QJ1VFkE_ ziZZL>_u3^%&b!7ah>R$oxSE=D!h`(n6^r7jfv$+-&iY1OM(nlw)064*7n10?J||H} zKd4U2I#gb>;o7%~=KD=ryn5GbQD!16sTyD2SJG^d$%i{B3j;rn>vf$cDkfBza)q zBt-zeg&`dc(uMM92=4FEumszVM!0D^nk0vbQCS&)d+H4`P`OGmO4UhU`GKnSiNjfi zwe5Z?WR3+yACdP?XOg=$}0B>Zf37hyqXi;t@7$s zUZTAEl!=}a`fW__q-6dh_zj$_rO5n_=r3zIi`$PN6YHzkztLjXP!;NxwZ#Tink?VI zkE`w=-S`!Bfu4&mAb7Qk-1md$sEly7*y;3u6e9A)8;$u#5nADE~maZ zx?H-Cn!E8IogCr|+{}4g4gp96xBJ4%<@;sWI{3%2%skD9*WrI?@BNS1G!#_1KbRgg zwDwbQ<9Q%Es=={$iA~&_l>B&2%EKNc)42GM8eP0EoVLP$g#4WR#zP|R^_adb)`Pw` zRgYxjmd~!^{*Pqb^^ET+IY(=ohBww^Pmb|_uY{WAJuyoiV`@y|b8L=!FHYJ*(e-a@ zXp(W+8kvz#L*A)*>f7A4srOCOe~pl1ZB4G6rBr!`Lk@=@3*+Uyae0S3Qnn`I%;M{5 zqh=mt@pxH`@!avV6vsZl!}CW|*tfii3d53rJ~(+Bh7*uXPas$X=u{_mLL*E{2dtvO zb2NQ!BA>QkzGt0c)=02+wtNl&&@Ul2(o+guTi(H#FrohaX@G!oXzs$Zh=2iLf-pHJ z-t@qtp9^v4N+hTo%T)HZMMzW(%HVdt3;6g@BZ)~cGa3^k;$efRf(zMplO`oGPMK6G z5@}$>wiynj5*Tj!X_BuGhE7XqVtJHF(uiLA@UhFlHcrsNqg-0luDhZgmKxct6|r}B z%neFV5k4z|0_F5MY!|47F-r%$#?6i5#7~_mN3qdcS1Ke^WVL?I9peOKny4&r*^+nZ z;w*lObi5RvgYjUjRk{5bjaU2zUwr+iw=fbv7Qw(|Q_ZTMfryQ-IVz0F0I5UjhR&Dg;-!RP z0Gi_65ItERWz9V08_Q>^+2pK0s%w!=*YY!9bAOr!>tjDrEqG}q$f4|i;kty}lQb=1e6 zoNGiIT*9HWe_IFB9T^-aYaZ>)O|kw|z@=5aJb}0LkF1t>;BF7HUtg;P2H}jTg}6|* zFlm!}U0ye`z{(9@hEw;zd`p16@o6>NCElEUGgchThCC>+V{_)Fi2Q9WGS`+(gzbLKXlaKu+}>*(eCw5QDB+DzTFw>O7}!+v=_-+cRLH$8Wz8If76&cY{( zhqCvx>*&1n&P6`R*MV=dI#ORbMV4L8o{KxyEX0U**VWR7jeq2A4kF}y!l6@bct6tD zm3oumNaC02m-`SRo|xok+vy{`af`d_7Wd@-r29(`HN%_T zDSoPeX0BydPMOLn{IteRP10#0KA4R0Zf-jpaLT*DjoGCv(B5>WyIUlh^E`cC{ zAfb4tV+q-I7U~s@jbk!zYZ@%wtn51nL zY64r1KE!e25rH7M(lWC?0_(3CsNx^RTS$AV*gAy^Cr*` zENq2)@PF^rXLi*6ubDdSm|5&}sa~1Isbrhev+G-g{AGK_swtL1>c>G(DZ&<}^Z8`l z?9XeOn^|1+sJk$0FQf*vm1$1#eATBB!|CQKviWf7-WW??^Tao4Y?M+;gt)6bSgb^+ zdIcJfrmJms4DRKd${Ix5s0l|b6llw6@&AR=%L7`xq;I9{oSm~!J==hSg^~twU@bjw z{raM+lCg)J)uh2aiROZil*{s7Ibi`p%sSg?%&Bcl{hP%%)%LQ%0B?0CiM z`l%Q{z%~C~@2a8tzvku$UH~tUTT9p+v;dE-#%iWtuGPQU^rbsEl+7HXqz^=r%9AE} z<-d@In+V$Pb@pCT0Q@NesUQ|e*Qp3q*C5VBQUJ+>BMQ!cwR zNQ}oQBo>IL{n{L2nhT9;kwi(BiDspWX!>fmZhqF<>~9u->1*^?~j+bWlw!wW461oVj&j-6G#RaCNkIo9a{f+Ubp^(kDO%A z^EoB(-kJI0$7$96u*cHCf>;_)(CIoePO-cJ%a!rHXCDjAhOrWA0vLiI5KEs?#z9bO z=%Lg=)(txe{{Mr&`TzLx(7f~V_bu}{h7a!r?McUq8a1e(9a{n6pi-oCDSAvS?a*wE zD0W&=O1DyMXe2>nsR>4MC5AZn$vXZFtc@&XA*7XL&KYo`26xVhzv>p!+U{NB^CXc5 zl)$w|$>(HeCdqD=vZ38009OJ>##GhatE_8PDK>ZTilLQ-ng<(jWYq#RL^xIHUi#RX zn{{kD5iBhMJeI9Bp;yITDc}M+2^FUQ>i_?5uKu3|_Uhk;wWtbDT)OYLwaHv@fdq?q zX)1eH$|8;>5KKl~dQOF+d6RSh{vo=#O-)Xs=kw&I^xTx3kVK`V#Ca)EN-2H(zg+8o z#ZZTOtFK9SLw&WgH}P?48XfSYDs@W}v~3i;8+hivtU&&}`TtgGZ=ZMCbB{hp(mD4| z%PMnVce6lQ_ENH#*dend+hQ7^rU7*qVMA3@RU;2;L}pGLJ7Gh-xh-Ew?+<=WpD!~* z_Wu38VQ1jJ@OW+&&ofO$JPlMVY11Ta5+DWAV78(xE9!S$@C6T?-CWxD|9?~cf3)kp z+|R~q`Aj1fC@F^6aZC_fh$Fxe4roSb*=?McaK7|BME770ymkR%Fhfd<4tNMb^A z6Qk*jf+1qasOUK8%s39FyUuap_2SyMH6M&nwrbhKmX zNT`+$>d=JUWeZgVl_E%8s)cH;Skj((2^xD^IkWGQ@AdrD`p?wXkz69lw_GQ+tM6QO$`trwe7-+@F)mkh}LYW z#^Rux|4m=CZG?zJ2+#mEc@_OSov2K=-t?!tZSZ+?dt2LaJ>`}36BC6H#Ugx8L}puW zoNT<1pkgV5M4Y`ZY{W*eu?P}UDJdZp78nrSJcmLQM*A|h&)W>pTTvTk+Vi|R|NrWX zwRgVsDmqL5Klv>kAhnUwtCLQMY1Q$y=;=;tkkSAnVRu?EHnqplQ|O_)0kaS5=%#XX zvWaPlLNc}%B$?HFUue4Cf{1`Z+#H!8f4Ejm#-jxiA} z>cYT<2U&0k7DLD`&J_vu&Y)2*G@&Exy4|%|)*d7efQkTwWK9-NOZ@`--pp6!_U^3A zot2COhz_tpCK8}!M%k88){2%bEs9J6BZtAvLHC>OSp~lD_tW5wI03RNWTeT&*cb&= zBKe=jZG{PjZvTjMI$po3(;i8zkm8E)cxTJlYABQN0yt z7Zn1e6qu5xiUvZEcKnVx^IpF=-}~p8oG_aW&aij^r)4ElQ%WKi;YRH}fWvru*mC zGur94xkPUXN+EE}B-^rCrr4HbTb5)eO`JGw7pRylb-R4KEpG$G1?Dc?H?hk6>0nbz$nqvS?}Pi(|P0dp&H8~7dW51t@GG&zE|c9LaLR+NMZ;^4%Or&$yw z#R}r!2o9HUmZe2YxFpdK5D3Gu>re!RiVoTAs5)v!M^9HolOuS3OK!`;LMCiL*k-DN zK`@x)Xi4?rEl>)D z7!f1E5)vnlgb<|kQ57mi`yQ2jF8f@b|2)5U_GL)+xwA)q$>~pK-pLdx+Bzm4R9Y$q z6pB>o6e91%@p~a8K@uRCgd*O8x40$i-t7C{SpC2MuK#ZWQDa4Z0;OoUYw&1X8;3Ez zjX$)<+BOy^tlKhfTS;h6oCHXKkdUEU7|{qLoIGC0;N*6Wv2)Dz4%S(&rp59AM*IJ- zQtjK`7XYb9Nb-*)Wji6O|4-Pi>I7>_%756>RrRNFvFx6Az07=(AQLYVR3Z|Tfk;vU zBPkaUDY<}`pbWeuWyv*3s!4x#)t_9|)Bm%pdYUp{fE4f&bP+E=nTQ14=1b5vBPshh zld1t!^-=Xax_Wf=I4q~L@5Qor+oJwx_b@G%z3kJA#eVeve`zJH*LQkb)tmG-_N=3v zdz=BAl$aBs3!v(K)l~m_`qFf3Lzil`Ay>;u6H*UQt)}->N9TZ@(ZG>YOe`jBgbd)G zMT1S3F(YWexRHYDlcJAHc99tEP&4^!SGY?90!BJ z!v}o$|8MV4JA0_(C{6Ml$md<79ZFNo!qG3KszI^PiYKWhiOM%VM#;ec*YcZv2k2rR zWclS5!hmp_gu%)Gb8q*hYG8*Dbx=X!cJpJFTs|um62j!X?4Z~d1#KxsVV&bEP3*v| zqW>i-ME$Z?s;;|{Y|1hvO5@a!|8;D?btV+KTW}W)3b*A4^wec~pEDjzu>4J}IfeV2^{1 zGAI>0QT^&a`_0!?eZ3BKQMj~#dtmF!;ybH{nbUM@!?<5CHh$ zJFT=!@V$FTAvw^R(i#KlM2b|ZR+n3Na%tA(8LaGy5G+N z#$V%hakd@}BT-~X8}VS#4;mmXuG^7p@%>XyO-#pg!4d%m0Q8_^(wawpjhyb+qrKUm ze_wG03$u3z`ucZ^i0es_)N`MAs;U2K+ug4At4G&kWcbtBCK)qnob6mNoC(DV;`9#H zC)!oC`QI-(d1|>n<7h@m=KNfM0@_96E+bWfkX>VfL+s-hjzXj{QG2hw}+g$n*DJiXc}*gD(m?v(9U`sDn= z{V9ud``m55^kxF5a+~X?xImFPDoQNuubL_|45%8D@IONn(BUFNjs_!6*zhKhFrrBy zl`IM_*pbds#1|)C>5AcN`2!m)ygiOeVA}EJSsDl=`4sFm4126##um<8V|BeDb_f5oIEzRH-qxv~vL?aTFF` zqS6@M{0)YoNp!AArZL#?WF}uIM^HJZsDt{6Um+wXh(_ja96=}og~^xN>s+j0C<;$u z@!i!1D~?3xKw<@ARx;^CS4lZtZceZ6o`bPWvECjo9*?KsYpT@fO_#e%w$$v8=E-qh zxg8BG9J$~Ouhf{iakPV>iFB@5sWF;?&IlZt!FN;XEjSXLBUB(JB@+qKN7DKF4O+D6 z*i%SUQf7W>`?{{(L&9T|GxNJu)wjeZrso!v)ijnTYjn=FZay))uzHiNcHC~*n2FQp zELy(f#!Ulu88va{{H3ebZyh^v=FpNg>o={KThH+9qaRR8rqY^PI{?6N41vZGNE8lQ zqni^Lio_D>9Fa`rVX_lQ3@$8DX;Gb=1PLh&(Nt+gb)yz-I|YVCC#Gi?lvH$VZ0Zye z9-WYyl~-I|)7TmtNXf`8D6OtdcQ6!%r!e_$3J)`e z$`#7BCKVl3jDym=zM;8|6A+FivxEvqCo>3&CNcR^mEMM@afAx3$&l&UcO+F-zftp! zff2E(IVDwf-8yxSh)*l%Ufs|hpOPIek2E#tgk>-}ij=FOc)(F}p( z$V|ReX><^2JdqMD(Pod7nt?exZhS+DLajZ%-#(p#ujyiUwmm)y<=$v@&}rCZ6FabjHxrBtaW_3voFFM_>Df8J6h=6MTX+Sh=LZVjkT43Gqa(^tM02!9 z&m^p zBi+(34j%q_`|f|=Dm-Jy%8!Tz1dEyj35V#)*~Pb0oR_?{eRYWpS> z(g0MSf;_+*7_Wom^W{Q?F;$%C076D+^A(&EAKKpfX1#)M=*^Ne>R=Jk>{hE8fWZHWR{M>sQ6wvU2G_ORz@hfpa(fEOYadgmDgZ?B{1+Y9+@I;*bmZgh} z`aFv06>FIl5nx0TQKpeGZR^7c-l4Q(h64(QLc>^awrSwmtbA&ln$~C79QD6#`=>!& zMws4H>EMF%QT|r2Qo}58xEwMM43s|OQ(6o(IXv%^h^Hpim2j(NoM{@2H?c?osC2X< zq+ZexOJSQd_ibD}iv=&c%Ro z_-e`*5Y1#rSee>!7^GGt+!S%;?xb?_Dx?OhzE|@e$_zY*NrE>=-PFX?(O`9trm;zq z*6kwX#0GQ5LlRCoK}zz^55(u=p$sjT@L3{cG@j;oxo042-^#Cv(*MxG-gs$vXW+$HwdCoc=sAU8Y9&Iq!4 zzjU?&oW>}or6ieYuEsYy{!SWLJ)yDSFiDc{vcmim>a@((Y}GW)MnYz|5eL=uE1&pGn@>8=fc=hBIRVJ2~;MTzo0@Mp2sTHaufQUARmyis7@I}bi-7y*79yCk5jS)~D}=#Ntwph@#UYv&tYrolB;1BKJU zTNPzRSDR&~u5$h2cTJzA1r8ydNTnP&bMpYW=>F zC^}Fr@C#z67a*P((NQa+vEq^=Q_aPAHAwM3+@O-mK<7Io-v~hi5aSFaR<8OR1}iQ| z4!tz7Rl%eVtQRc!?4d1AR~oUAfl9Lk+h4XPcy3YH>=!m7xhLY3cXsqikQ98PhhC^Z z)G7`%6#y#&g(~YGdBU*a4E)FSl*>VfKT7dsI(soat@9(D-`2jA4Z6`>UxT^h(iBSx zK0>K>ECH|>ICYF*@s%by*`VU`ZD~MJYF{|1JKkuUTO1b3$E@*=>GfU)ha)RU{H7m= z6CZgB&|_|bXl>Vt?x`c#ENTvHI@$5#SkEs7e*ErT$ddRs;L&W*O96o8sj-?w)X^5w) zb{44uDkKBFZ@`AoXsYMlP%dcgEQ82;dc~s{e=njTfL_=63C%15f%$={CXNgYy0+L~ zH$$0@((gm#09A5m{gSL#*v|TA7?cD%2O%8Q_H@MUVBe|qp+QgE{>f~$>*`W~(uSjE z>aZ*sa>q9sW1Hok5d6&JHikHLWnAqryl}PcYAR|$jttCbTtUc4KeM(dIve|>glIod zAULHHFd#)I$YkxZcJ4;be%^I_9}Tp&kLP-X!eS6SX3*3^n98IDzElIkTH|($OSPDg6(S`rzbvE|3JLC-z#J z85g8+2Q8n3vgt8<+Rmn}3$;-Pojy@G;&ddNcAgKgL3cVs=k@IMBo|T1{6%yp_O3{fnL|qCgb^d-8926%cTEJzSePQ9Dx%eLHxf{3>}xc?Oql~T#vatR8HKhSe-aj$3(TIFk`Wf5lgHTim@jNb-?J;(w=Ej+Mf>qhK||kt}H^jVOPesaWVzR zuy$a@<;6Kgb@r!5~bkg3G~o0D~*BbTuHtzH}s1E4^_=+;I9&t5FPVGk$+%A zqxeo;?K(6#-|&-U&;Du3X0>ed0);JVkNn07f|(yi+rw3;&nAi9)buIZ=-J4c5G=e9jusNU-!7S5TrR9MqN{n zE!R5)u(n$UU`b}T97LcI@FjtKI!k{8l|eyYB9W-8x+6?CQ#6$rj2S+NMLZ3Lf9)fL z?auTqk0zq)EUk1*2VY|OSFW9C|PFd+6j;7U~<#G;QrjLmq^sTiULY#sO zF>^b&X*__ov7wmT(w0#JkvF)hE8zVKi(orm8UzgUxhxwP z=rI0hak6a44hZFU(CV1fq5aME;U+;)@7V|%N^yl}8qdjS`D}&~8cei*Dk3_8!s zPGiSxpmAm<2SE8K8&+~+7#>HI%h3o52%bdQCpq9*g;Mtw5Oqw*5TjF5>I!rQWmL)N z_q?06XSB_EY5)*+?c)eVpI53>wB8NBEwRzS+xfrS=aI_42Z4J%HW5%B1dO0!B~ml+ z2>RYOpIJVl4tA|6RF1lWHq1ML%uL;oUSwuuE#(kstO?g10oCbGR95VKh>o~ostEBW z6K;^$h>XG;b7Ivcx->Z{gPqjrN1HKMp*z_SOmkIFs7hfTyeuD*{VMjg#Mu7zrCTGK zNozgc2&=i>_!ZtRSWbn<(Wsm((Lpv&IbUa5xsEmsZFvDL?dxC*gj*YLQba}4btaK3 z-?qd}*PgQkWkZT{g(;x{0IDsWCDo{{9FjE~-0<(5muh}|XE}*WLSnc!HGcScYb@Nf zM4{=tg8A<%Q<(5f;~_j;3>$)O&8Tc}yKTS#-=)024W#yZ|IA!|P?P4cY7MjY2mp$6 z!bWEniU^A>cm|7_|DT|d)><%wdXJb!-T-|Ktcld9mz-&+jbe`{L%=gh{_O0S(x!+z zdF40mMAu9q0y{qAa^Xsu?ga)6ze@}|=pUUe7r&urq$v+D<6ObgOw)eMZd)K95OU5y z;nHRo#Xq@xmkRxy2kk`^LjZC7csjBN*!;E6_kYe>0u8G!;z%4&#SC{MTx^@}e2PDP z<|n%@uKrrqBdDlAGpfOd^ILL(Riw_g9u(7(%yPg_yPhh(*)vtX6#^!{4JSRz+Y`ipxp6x8F* zc`>D(Em(`{1pBdJr%DkvB%V5qK=RBIkfLIuRS~>AY&I8%*ovt+tD&vb2!P3@+|w`NQWukF!$Jg+1RkRzW zJ*UFMAZ|6P>! z+!oIN@+y7Of!v-GvM9tuxI@Lyc;pSK^Cq1$p55z9dj>rT2UcHpUOqCsI8JsIqb+i# ztraJvwYdo%w#0w>0HHDNP43%dLu`I;6Gt^v*sffGoV%!Ozgnup=MTFmX`I7Hq#zbh z7aaBoE_ARigcfNXtx_j1;W4~_<&q42` zZYnWRQ4s^vx#akY;z2bIbyE`7yGAwkWQ3kY0uRrtKAC}SC20O&Vq?cY$T~vLxO_Q1Oh~AQriy*3R1d(PCEEeZOm=eyia}dW+~h=- zE9c*R7=@k?fg<0RQh4c(q;jJTN1Nk{0Dv_5`n2@dUf;6Dzr3SIPg{J<(D3HP_B%G< zw$U7yXw(w1=FW#{wd7eLFWqmf?Ubt62N4}R+-%+gKTB;W3`?Fw^$YSw{5U=~9xyCt z08Tev&d_9|SxX#Y2L?3vj*91;lxG+^0?nN9-FM^5&@8TXX3_Md<6^!e%U_)xliPNE zm{8AL?8oc}6^Gcv2UNosx>i;+)F{yO>}FuGuc8g&wN%6w+w+kx4QlWw!>3@Q z4qrEW!3YdgirHOiQrPgx>H-?CF}+>7P@;9BmZ+ucr-#FCvZEYr-x4kNQ0wA`?j#Bi z%;O?dj-UaC<>@FAYb{1JeUSsGb;%8e9WvH(RC~}Z)M(>N8K}dHg69*Zg=vu+?C!qp>s1uZ!$hhd@d>*XzTVgs-i>WT8>Jb;z>zS2@P1#>vP+ z?xZ5wYF23$%!{CwP@uLy7*TCl%{UDQxxYDuVg$7{!2QYK z78&p781A0iD=%;etnGdW7``JbvJI4m< zobcC3`jSWZ&re6avn-_X_NsdlaFlC8E*F{c;w7_;!;g>OgK0P1f~zdjZOCvS#h`|7 zyW{iQ+3oh45|^;0it(9)cnA43Qh*1pnK6i>1n7om>D}8=24_fA2%+-9k9!t$nzP;| zQnvF##K8v!N%sUge6ofn2x>fOgC6!2d;r*)K>(|uI5QOIE#EHXCg@>(9EyLzx-uA? zy@xeQSsb*XP)=x5Zf1m0u7PR<_-^!SYA#A4m)Mjp~9Q$o2_tFSdvi}bB$ z8)eQ~7`7#ctPk7aKAjpL{Ral+A|;ke4TF4_^I^X+ybMQ~V*ClmubFp;b5`N%#WW~f zF|)r~`7K<3+21E>z8&ri%wr1of;#R`tG~B@d)d}IuHKjD@5_9CcpjdyEOYRtGR5LF zF01i=?zP2och8?brmcB}Z$u=gkBr z7oj0VxHh-Z*tYgZ__BTXb^JT-TZx{G==%f6`+I}x!5>BrN5m+`y`$7@Ov zUr;2f6u*Dt9}W0dBaMqps~&7me)@U;E3#z;G)N{!c167w#SB97bit_6qr0DH|3_%H zgyxwF&;2T;goK3?!lEc@!@g=q2}NW6MiPQqZ)D(L5Q3Zwa<#$|0TL#G=_>^ zt5eRn>h6jYQ&?5@o<(zNH2+*#OY=luuwE@%J;jdnWeyds6Z`pSrx16ch9}}LMfWed zJE>=*mrP>GjHvYH^abmEiE)y$YHoTSNS=56wB8^#2B#~7zmpP1NXbE$DV2I)EL-oA z+A^18>Wn^#aVzOPWBy06C?vaRvisv_cW+)6%OxyVuqvF~(Xmci^3s^h^4itGA!RT5 zwf2efSH~us$KT?RQ|V~s%_`^BTq3D$Rel<`=pn~p0c$Y=@ zI-qzD*KgT;F5Xw;^IHE8>NBFE{`If;rA=dEsk5R4L?*uhMZQ{?z?LPbXqujv;OYrp zD)?$4A1RRy4DXDd1{u4iC32>Jyj)cJjHq3r2Wnj*Hfb3(u8N;x^wLqnS_vnOT^Pxq zN6Prfbwbx)+}w@)&szQutsoI$#*`>2WKL0)QeH*%HPT!w-3&9%RCD~Eb;@e1UmHeQ z6Z5+I&L8$34@dcM^T$}QH!8AOG}$%3ReaNH)41Za^ZBT_WO3HExa@dwV|D2XeY0q( zs%}&bu)IhtFK+c6YpQJ>4coueG&Y*1R4>&*=Um;d>j{M)BV27;^HUf^*TTJ$`>F>h9tqIy+p$bk$@9-L;y%R|Y+3Q{2kpn&pZ3z9yXL||JKF2Fb^SL;O zL-Bbygo{3(kEDf{WCK$dE8CYY`Hr$h6E)s?tPPbMt6tWRln?#>we+$#evO!#fPs!n z3-na6*6i#Po@n(Q+_gsNF;75rqDUr>g`PJQ86ux(cg`0*axCCX_|QTl-mlRDMuMUR$2K@OQ#n@!|Np4$ zZD_UeDo8a{R80I&zv{CU?@aM;{s8}i=MSU)um3^N;D|ecL=neG#*t1Lqg>}c&w0&f z;8%X}0v7Or5U_<1$b&1;3G=WCyYQu_l_ds;qEzMPYVe9EUH$PIbOBAz?dbU2Ps zJX5GtJ9~CPkys*y-VRbpFrD(he)g;9CfVWp-~FmwYkoOW!bLu?@t(-1VjpZxwCl6h zoSv5NoLk#)>%BF3_4<82Vb;<$Tc$7Dv8pyIb1#{WKALntOqEH9;6fKEE4FIi z)2PIZqVg`SU7`}Qi^^)6`V=au)11c4%sqOlX=gc~Ofo->IlYTfSbLoCwn%$AcQN9AdW7tG5jS0z-ZjJI>)aR5>i9umZ&CM#}jWan03e?tX6n7@lySn==%bOr(1 zwxHBn%TQ78;Sn`1dWV4L0g}%pAQK~4Soy8BFR(wz&O-SdHb{HZQT<%+fk_j-9ACsB z?GH>9WRdn{44g6^N}rl|YeET48UgMpP*rTPIcqJxvRK3y>W?@8v`v3r`YXIcl`wuG zQy9p7p8z5+N8bPf>CK)Y%(bvL5?GN12@4&<_aY(|TqHgHKxsZpWJ|(U`ZrF~NT3*L zAqM?(VtgALn`~*3W<-O_Rx&V%c(R5cCQu{Bxw245m}9L+(cwbw4wG-UwGur0G@ zxTHuonmIuxWb&)Ucqg*{(Ruv4WUe^PoV_=X4n?^WRWqAahYpdD5_+WcLu~d_7w}E@ z|28?@UA(fm#DcW&8-67c!Y=~mZLpd1@K|{c;7Gr7Z)+!a?!O8Qu*iWHDiK+K+5_ z)Teq9*vKIyNXvA5isk>w5R`%O{S&aj@s6RPVZKq7olXmuGTYJVYNyVNJL}F+nW|oN zH_5DzW4RwuaDf%3zbnp$$&6OQj~p-42No$Yv-RY#sE$4tT1JryVA?fX^$8T#680Gf zsWKhe8PztPQhbLCNZ9UO%+V^j*pH83vgva;pug`z9#EMRV&5aN1duy{?+vn(th|06 z%jDzuD8*JGGS#ORC?$Mg%P~CDhM-1_Zt$Ld5+su4xRWJL`jlK^GUJHwXsH*HuBV3y zr-KB468*)9DZbB=dr8DVBS>F<<%1>+z4y_7uk;Ix{IKtSYKUl_CR@d0X~-TvVAzA% zExUx(JyVZj#SW~EH@ruz73grGZcK+u;J=Zxu)+arzTz1pp7jC^nD%fNv#u>F5*##S zbI2UK6~GNR0zVyiDF?QtOxAPo{hsFA{Pf%d%SiR+ye>5k37q- z_UR?leFwn9>P@pS z({|7@lii+)z)NXt_>O1xml5YlA-P%3J)_IW%t?<=|hW0R?q90C2Og3yO z>S;1ll}ELg+o1esRFBEjm$%H34U8T?cy^2a<-Mh?~jcBdY@rW zUPqS!*B2=M+zpNbrBsD4*IPe6x*|vbvE~T|eDxmY@%q1j5Fv0lJNw) zcLwE9k?`61bh#>|Rd#*;3X0IA|1i;+L&K4tVo1pEZ8cJr<+_(zMS zNw83s>rR%s>8`z{{bn2)9xL%d()EgA!s;MF!T~=r7?f=VHDQZ&AT=q6W<7^Ci7$!} zJ7BF$tw<`rRaB#Cim={=thckzJbPu}m@h3PnqGM$t?8(D!CXwTY$xg+ME$aQ?(w_m zZfDFyA-14kU*=+d+4|koqjZN0)w7l&X2(8c53~*N=f%VQ(_7f+H6Mlx1UY5w-HU;b zC#^)B+SobycBnrbd1@W=)xqbV*FV$4o_uSno>lh0-k=eKAMRk*oHWY_4sioy$UUFs zt5F1U14s|&gw=`H2qmr1ce~pc8OU-;B%{R5vZz(CU_2d-D`+=kM){P1Y?H3rL=c3G zuqH%0JF0N{2YB?(V3#Ml^uenm4-G#}v)hhZNnm#_G4~;x#0wV07Tfk6r9)0UbD@w7 z(GgA38}4cIl7#^JKXrl;2BtH}3xhaEyvr}e%j6f@OV3e*ng%UX17JyxG0kHTG+1PY zo%v|$%Fyw-;+>t3PZi>sEBvPw00?)NPliNIaV|-+IihQ%ld|O9N?e*F+h~O>p{%Gb zhvRQES^N!KGEqF5%f)rhEX<}~j(Z>&AD|V;@ZFOEx)A4 z(}JX4nI=7>o`C_)8SvZEf``jKM|J912qv@)wncaYAZ1t)hmd^$UzOE0yma3ToarN zCzN1u`+mYvO&mZ=GB9ShXWvMIh})|7XAXV0>{n0X5qnLjWeHKw|Sx zd#Ha8S=9#w5!D+feG>ToyI~_?JGQmM8mki)UWDm#rl%F}NF2BoprZCbi0t2wz{NV> zf3GEr=C01cI1P)d|NdA9{9@Y0O2@@z1f=f?YQ5aE3Bb zRqO7gR}%}HQif^puBuO1IYEKY*kqECodU!(N!Dx_=EUWNf-I0a{z)!mLO5F%uh!Be zsv0z(y0!_}va>SO9@Yn^E+Zz_X@TOjUMne;xtqJw`%f7T?VFki$b2*bLBI$)2LQ%} z=Hn(gnI%9a8ARap!at8{==jvUmhxt@wkZcohFfOE&_Z6$zV{FcJ>TN+OM2kKsiJ%3 ze+qnR%Q19hI|6ab|6OR6Hmx=C&gVTZkvyMY$)5D-Q||rNNr`tubLgW*AXT<9$}8Kw zkmi{jh204~jHbiYg_c;-0;vLAP0x(gZ%k$i2DKcxuL9m!Qj7mkgJD?*TTIX#4cklR@z)dp~A zcp&)gsLHig=Q$#ev)VpcdD##67#xseLZsN3{)gX+=zF?fQLOD%&{K+fabY;pnbh$; zo*AFiF?k1x5n?4wbxS%GI6B)t>SWc@g0K0-NC-W~OqJTQv@?9QURSw#tSWK-ny>Q- zq^g~;>R%H5lezg>vG!MKgxS5ZA%VFA8*m>@i)0(WQ|tnXJ;#EK5g4U?Qd zsId_npHEr{y!h_Lrwco;)}9h?gzCnGVYlD^EoEQWuig(FHmTN@0H^9zZZFBaf=+CG z`@(DVQ3nDnf9CyBp&o~sTbjAQcl^T*Ke%K0DG)(MSZ4i+;Fgejx~GYh3~xmA)wVAh zmJs2lu+p22)pX2g65g*Ii!sR1H0?zE5O$0YKlsUt((Q4vl|HxkjUg>w9TX{cLQ;3- zFi}DxXv1d+&wiGUVlXAgjBI0Le|x0ZARosSMfIt`;;oexzWNl3%t5()vb(Snl@%M6 z#tfsdK83`o&-RMed_|{InW>r6K0~Oi@e# ziQ1TiH9PzjWT3F><{bbMUINa3VOx8_vP4we9Fzxf&-wr0R7T7j^})`>3zu5Rwo&wA zYD(|NanUJfJuq7SLk*yQsBL`?GmMvf!&FZjYs%6A@<}9tRAOO8uSE5rf5@fICPZ$MxA9k@1VOTQ{UCp8S zh3rXXvc;@YFIpA>q?QAg56htwq@~&@$nOo<;#RjAy5^ zJNLsKVsT#zb;uxE5NXhcEK=0J0nrf~LOB^cb@q6{+0t3V)fV`SH77*K0!jKjsD9@I zApXo-$)MX3yjP3KTaujlRKy=jhU>F^VPlhd^E?D>Gn(I z&731w@Uc2B9Pt$%II`{|s1c`TWuZbVzDDA8n9+iTveXVd*McJcGOcjy+AZ}V1UR+< z+#9^m6eN3Rz(D@yi`B$aCV~_gA@Rn1ftT}oS93Q^2>_YZTQ35(1Riv6%v)*r9S1a? z-hm*>yfgGUbm%}jqazaqV1m|-;Cp}B6FV%xL5kT}QB{tkW5#otap?fMHX-uE<@0?B zAeCk0SwMf7clGbynUgX!de2_I{5-&tl~c|KF&#VHEuKP7^wEHO%5GmO<#zY>XrA^r zJ1w7+#ygfs4b31s$I8jzGyQEQf8T|Ce;ZVaQBLFm@_ue4!AT=6NrZ`9EfmA-fKs900+odgJ=WZA2n^6!8zA`<1TzIp3RZmLM=)O z+Uo-|;rxIm&0*6SW^ECGgWJA=>;`-CdGh$nD`40SYtiD{fvY;z-Hu#c9ACB}AX9hq z$Ly?Hbf6p2V|(PB?NxD*!@Kh}FKZ`giMJPk{Db--c;e_aK@Pwr|7!2dnN&t{pT(mB zRlnN(=x>Wo>ZeCTT2Mv)rdA#H(l6?Zd)-tYRu_qW;=xUU2_Fecv>0*513!X^AkIX8 zvo+My#BfHFLIyb$Qbr|pebqHu>4w@xu5(ZJhEG5;c?VuV4YV~>nHgNct1YC-7%agS zT)-OwJr)BAkPbOe0u@jLjWz3s5tzDdHGKvz;XOD&1?k(Eum$W8LjgU^aPhAMAQWoQ zff1}=4_Eji6p@IB5vPz`m^5KWPUj_8U0NH)js&%+XH!CTmc>c9U-OT^M%O?bqnVd8WT$g zPY@)Y&JoJhPF9c+ems^R*>^fo>n-%AH29I9`3=q~G$vN|t`HQ7$&;$h@9*@xGXh5w z%QOZXp3Jn9s&y7>lTLIw$-CwD11B*6zA>$cS-M zXD?i~X5+T;lMCuCT()-O@;QCgXI}}anf>M_R(8%n7@ElBi3P3oE*79G0!LzSrN#0C zlSpOp#R>!!%^!@GUr-3gMvj+8k;rY$u+nhJ+X~l# z>#MG@w;8o__5?xUX>5VlX5(T3!Y}|fK*_%(22Y~U*#HU$mLf(er3uzUZh}*4O|2cg zMiXfqpx<_;inxVOQ2NMuU(AqjK6``i=(gva<#$D8AW99Byyb@OJXn|%8{`$R5V2} z{9DE>*>dI`gm>wk(c;T{Bxxt~-gI@i2enQ-*rqb1s+i$x{k4Xd#^r3Wt6oI&1~G|)%6W6?40d&f+3lT z70z(PBRs=9d;x(%M8_qj^Tr=i_Jb0GACOii6;$NkR5pznV6AV-mzOi*XYEw zyyCLj=9pkwPEmRN*Xfa3TGBCH(H*^xEv)Yzo!>kSjm@oYAD;hso*Ay~oZh@$H~@x& zTzK$guyX)I!K34ma-iqT0>}jt9+i-S2Mc9RVG-$}g0Klx$=k`ZH&-`b9)c3`YPzP@ zj!uH2(hBOj#^$z89@b>-sHlr|O}Sp3=+w2PtJ{ z-zltwvMQ*dTBxl$4NWiap1yzh`eSrzar^l4;r-(q^Gn0058duSf9a!{wz|**z0g~I z27*LD!y%%eW8wq`k48X7!^BgXv{8UqI0TIh^JlaPrZrP@V=kid>UySDww_%@#AQ{q z47^$RO3tThB8gqrJ}vvP)|Pf?mv(QThR3JpmQ>Yu3kZ!($||a;Z?6`cl$P1FFtgma z%W>yi=~_2+TlZ}ClGPiw3>rFi^6Vw6*6+z0lL#O2lWj4kcmt;yL@ z(~{ULgvg30ZLISaAj`?lx#G4*-XREdk;?2pNaKmsCtn)x9n#2-07|l*#D2B`u%Cu%Ikbv$W?JpUzC_$^YIC&Cp=2uikNz1^(qi64;Qc7CJ=8oTh-<}PcO zbezhKpZ=i^O$aEE(4KBa%viDO#Cx~C`0lew3)by9b>+dk1uM4P>^MZUvK*9qZcEHdf5+GHBGe zDYF-EzhU#>5fi2_T)BS7;H-r!H}2PQd;hJyI<2d^tyF70A3S;S=EIloe*51?PF}ix z@9C=#-w&?d{_fq^CIY9m)-H`~Y71M|+IDRZD2Bq5XiW|$7$S|yrlUR{ANb0no1gsU zgbS{E=$RjV@Ffzs{~-eGa+`Q)FCB*La*~c%83s%^knUZ}KO6f+x7f>%7B7Zu5|L{P4y&AK%Wm=N-CZck0gH zRl8v~A*>eW-OOulREB*=MO(!-JiS)R&0g^?123- z4%4t0tFg(2!glwtl6Y#v*oZ=kAr83bgMZf9=bCqZ5GPBM2@CdoL6I^IdNQJ@`dVqP zt3HaVq@MoOY7-+_uI+7RUu)XN{*1A}8hdGN14e9dvl+IK0S{_0fF;o2;5^)e7cdSf z$btbK0H8w&Eldz`fjKN=2j{5K;e=Q5A-=%~rcuQrHn5EX>KI~+3uf{pkVXm8$)ghW zXphd&bLtSHm`>DL_0_RDub!%yDyxp-Rjf+Ar;oaz$J*+%`mz3nPHWOFy{eHOj5A^5 zo1sz0o5@@=_slyJH>xR^rdc+M@l9xo@>BU<^;P|^l2xg?-`=%NdueakKWxd)+BfS9 zwOQZSKh%r$*vuQhDL3cMt0vz(-`;A|?P`0r{iVIXyV&)*Nq41t)djox?!7McAAPmI z>u>kJ_PhP;?p)bjx+l(Zt4?vp!(_0A!f-rX8y*ZV2Vs~WUh}to!W%yDHGk$`c*EcC z55hG}0)#QV3!xAXQlMam#Zbm8QHW}E;~*ZyoAKLNjgQ8o#!2%F>d#$CGIKPVb(8OHpANqoiW^{9(iin46sS@)dSwA^6P!ER#-%u6bXNs1 zzY9@YaV|r{@hNtfx=6M9!>8?#J2J99&PW9@=e1`?t0kP|LWg9s5W%6}+o5b6#J0(W zFw>NNn|Ar*0BI!=rpQ6%c_{fv>cHKxgp~|yA=?NJBBK|(O2BM5O8b@Q-LhD1S1W$B zyRgd@VRD*59eX{cW&s?deTx9SJq$2dnJ_||BDhS`cU^o(hh$cXLe>54C_6A!QY*3h z5;W^$-c*q+`*0}G=jY4v;Ws+C0nkj@8Sr2;^dEe)9bs-Fkl0Q&lfQNyVUx_k6k_U0 zCMYviS_G{kHVI2k{qrm^(iMvI#d~cixFQ++M>P6-5I&S%pti93gO({Nz{hZEO4BvA z?$ZL{J0JsnLZB7FJUK!86mo_0c_FU>sYVmK4AvxVeSXitXen>#>||oaP>n+fiiLo z#F?U?Fyl#whhN@krx(hE3{p+!FCuM2h)cq!gGOI=9UYMoU)2*xX#E zPZ^EGu~z&~Au<6MG>sw@;)_KoKDP8VK1fj*fTbQQF$Q_zaQOC?dPDaR?hc(a~#BDzZ4nv7YZBW{p2DxjgpNX?s-I3w z!^C_i9Vuq4KOG)VZa9HeW23pn>s-mJo;HW_P1{6x)2Zw3j3SjNn zn_X*kk#k8s0_M0ZHcw4q&e3D{CHtsKc;NXtR8a<`KWv4ob) z5Q~XPeCPh-#EerkC)9bM<@^$twsyH*gnsN|Fi76gW?Q4BlP4?DG=rXaP-di(H!aXp znmoP((K;ao^vZhJu6a`I*!-Jw9QEbNN!t7FuyKcuDyA+a07mhS@j9t>-U?d`HH8O6 z#AHC4^0^f3zMBYzv%34+=M!~lYn-lmK{*fyX`ed~`>)fDrF9w9kZngRK(HgMgx|TB zbd)%h9M&0I)q6z?)3XC#l4Wj<2T#SFv@H1w%v=7Ggy;Dbo7V1I``E*N5*CB2`* z8nn6nI69V*O_i!5pqcETBhq$9pH*pQD+n(kw02d&;Q=lm*d6>r)j58r4r=ZK zh%m%49a%!*oC?hPC@ui5&|F5z1bJpL$6Nb8VkeV)>r^MnMCogTVn98sz(O>ksg2~dc(}`#H4(uwvZY>Y3CUH^KNu3`25BouHeReK zXH~|uo82`WsGUnQu`R+H3sJVUbrSVjZB68Qg{}{Q! z(p;aEybVh@v?MlDAz55+U+uhmL;&DazpP+d*d_d{sZMaV>d zKp`y1*8^4>y&vc$-POM%Sx{ooIsr?qd;7w~mN^Pm&m?6D{FCHL^_fF@w8!sq*Tx~h zSlr>E*cvb8(bg{dVyHP3aOGH~eB!_|C|S+ywmpgiez4~vnrANhLcMJ`C~lgOW1P=( zE|)WoTc?4J^hMgs#Y01t=@S9%->Ad;0{SS2^=SBoPSlJ5y`%?yit{eVRjP1aI0r5Q zv=o)D4~Iu1&^;~o9TeAttef<-GP1o$YwTxJQQQK&P zOc{6SwZBtckSns)=^gBRrzR4lgJ>H-;t01RooaMRb&S)-r8^9!H(va}DBk`hi>EAe z*kI~8Yh-=M9OuMKwbtr5s0r{r)a8EK9M`T=6A;R->h_6ku{IH)U2@FISXfDRLb(i_ zk%)l`x67KHX_--W@FuFsOee1xgDQ1D9asmnw?Ib_28dyc_5nJe2B?yjC(#(Gn^qx0 z^7-GIegHcpg3qT}1JwhI9Y6(n(NyQrK_0Gj()pVV$QMyU*V^N>vmwz)dSwo-ujHtJ zQOk=6exYQn5JAETRqA&WdM{}d;0W~q9asYxU8Rvs?(elI$<0(>=7f`^6nYWh(EbJ7 z;9Xj-Fzca6`5-+G0?(35><}QLlb{rn?+8rOQrSc#PkZ@87O>bT(A<24vK}T|V{D=&6cPV5iU>F0&0&28)1?-~)D+E-j7?B-RM8-PLR-AD4k_iV#DX zTkTB7Dz9Ufg=Casv;*OHCi2_%bihcL)dRw>a5d-=1S=dm>=^c6?TZ(X=|D#H#w-Tc`{H- zeCZbrLRDY@uin&A)eJ1?WgH1kL1o#T|a?1f)3?&^+xA*F2r0 zYo1gEh3LN)O@=%9Y31Dyc0iC&05%JKqd^Az%VLioxy?Wyn~zOqbcu`+(QyL+>Y8V; zLJMfpx>{ji2HmZm$^1a8=ffr(;`}`XSVp!UnFZoEDcU;7|sf!O9e=llo=Ss z+tP_7pWcfR2am;6JD+nY%^Xo1(Pb(%H?$*kBU@Y7n2mpP%H+Byh{#}; zmVFR*1)3$`AQ|b-6-eCR6{patmtfc6Pp7P2kPpXB&<9mnk_Kk##%+!hwr}7 z|N3 z)i=RRTyoRK%#c17UrLCj%%sNrFjN*I)4H}cZ@RV#;T!kB+iEiYp*AYyIF_lnB%ZQ# zS-&){R>}c@G1u7m)s;5{Li}s~8&GY#R|6{Q_4y5jKalFUBN*obtHvHLx z5xsUyaLaTE^IWjo&5lW3YU_$+h5vidRS^u;Fe;vQdr8#RYgHJ*jr)Yp2FO3AQ4w>dBWb&um0}2iQS%Pzl=39-qk4+n4p+BC4vW!s%J|BvSjYe zIlVpIk5=PsXoB@c++e3NU^@s?MJ2ZGrr*5JSPx-te!?hj$4_i3SMRMMTkCaAV9kY; z`gx3MtjPqq7vfUWsV*0aa&?H8L0LQ z|8KF)kH)m7WTpibJMP{HeWNDbEFbENR@9OVq)!dKsGLvST#RRri*Grp-2$EZF`DZE zwVHerpheUnz6S*T^GQBoC-Pc(PJr<}u(rUla4cXiLk6!}enng-_-5_~hIw5fBqIbC zi8c94zpvv&JP*1oj*gY`=!%tf{)iluuNboK=3z7ze-oEKDc;uDx}S3upz$(zZvwEi zJhR?Z2rLqm4_Qi#-WE)Gtf2~;Wt)YIzgw{d4wR+aS-`&|0=D@ z%2e-xlg_?607NJYu3j0I>L=?go>CgFm!^8{DZ{WNB@r>=ZR=0)Anwhzq}OFKw250A zi(f(TZOd03{$v!0dL&=3){^bVDuO&WaqX?YI#BPSH(vNaOIQFJN4Ar-mAHqJF_?09L;Yu0G{;f=BpPi`Uj!1|%U948rE!J)0jjYAp1>PHScJGrRqs5oV2TI=s-8?S0n zCT`+{%RskhVo3(6u9sq!d_bt0^7lKsH{_oI^;h#iIZ!egQVIxr+-D& zzTcTe>&C%kXY5_A1ggJM|Lm8Q%7Yq8s?)&o~gv;CRksX zyDEYdJ{B9MYKg!sXA0N-uRxD)VNwu^e;S3?-PLIj5W>a}m~q7{W=8M$E>bCiMA#|_ zR{=3bkZXdBbWp|Zvz+hoo!{YdJb{?RxSSo$AW=i&;ZzJc^`5y$N6E};J#sOVBg}5| zGB*Yf>mu~6sFaCk8m_?Hw`H#b&9_X5rntlaW0>6arRfa>AhZMYG`;OA*#XuMn*ND9 z8*(;%z?w$-@IU@Nooy&pWWRQa8b4qat_^oSo^Y+B-YfCPk6|e8@jW){LaGX?f!c0z zVj;}8b*aV#fWdO27X~|}04jTkXr!}^U6Ohp_P8(@kBEVrPeZkYR?@y@d}9DjF|KUS zkq;^}8MKNb5~|Fx;$#`5iN*~9Ehpbgo&6j^r;@1^w@Jr-Xbsf*#u37E7=NKkL;}VO z*BO-=3R0`Oc zhQ%rlk#Fd%r|4;=A31wieT&mfn+nIn&FtY2Z(j(lcm-y-dpZ`h8f&Hk!^nd1_FODF z$2QxXB9BFwSRVxr+eH^z_nQ$vBLjmFK>g=>L3XB8S%auGf|g8KzvECuqJ2kSNP;~f zWNXRXpj&3jN;v*|CNWnEs*{&LWRg;-=AuWs<5q*_suxWy{9#m*;}O8^Ezq;2arILq>^w)TPgVu?Rk-JxMO?tlD_u<1#7szd?ey!XLfy3+!Cz;e)E7S@z){br^Qs zP<+7goD*%C2+$RSMJWTS?#d_j3*cZqQ&jKL2NGrNE(^RbiS`vdscXg5$71Sh1*TVZ z4;kCqb{#q`>|7aI*yOVb8+1|LW0@vsSd!>}Z`IR31IThalqfAQX1w42{r%_0KW5{e zR8udeW)fFS&t5pcu3kC?XdQfHp=6s=NN5KT*-e{ z0n4I)gA{{z*aSm8j-|HH#BM_oGq?uF`E4j&s9hl?-x_6gDH@*`iu;*c4;}9-oI(`m za@~`{;L~M6v}7tk&G2ETU+n!1ct+hOD&*@E)YX!2Hw#x#C2y;reDCQD`N_9 zunsV`U>o*%&9J?jb^&#b7Jvjb$&dSlO6FmGFxvNc{^t)PC+HXpGOK!|jxhPSz!Iu| z;FyL?dzar;HP)lJ!B)7RjovrwA7{|5PNrqq0 z8}?n~$agF-gN~zUb2W>4+NGQ*cxmNI!EufIBM`(&J{E^6u6oc}yFxC?7j9ql=3;!_ zsQ~6Esmk-MW znDCz%xtLMUISqCRK*bfTX|Rm>1Qfye|H#se#uG5xYK`1GGyF#mB=WJ{PJp2SAjMU! zORn_=@m66}c4DPSB(Q8a9>bl3E8b}Bb?d{U$;a9c1qNOMw1#r2^W_l(V4B#dpuM4& z602f$FAQsQjq`3Muv4C=%4D4VMlTMrO-B`$e|r}ChwR-exfrPINu_D?T$JtK$t!#w ziS;m{CxLWXt+Q#7ej5rV^&&gm3-IJiwP#vRR+hNRPg}yUg7&$-Jcr;a?!o=i``_$# zL2Q^68N4(jvRaKod_S&3*Mz#DT@~N9n&G4jNv!W=xTjWQ856Ee`8Uj*K26mV{b!7t zy2IiEnrv=bTA5jED1=(l@I)p~3*mR|{w^`){*!WbSc zL#>4ve_-nhn%btp>EsFk+b|%g-lh+#=&M#DBxvPzcwsNtG~N<_+nAVH>(MQV9;lHD z9And+(YZ&$W}KSFtqN0Eq)MRl?+n&?MKPxjk``YI*c#ff()+n;doq=)f-Y4_i}(}_ zrXRWC?mWZ7zt_2;krFF1pYB)<|;0_X*W#|j6rn7rU))sZ*rcD zm)CFZx-Noh_W#Klj{;lS38AO23LGBbHrLc=9Nh}vU#NLyq+B{k8S!q(gO!FWO`?z? z$6n0{BiYjGHO0y=Aa`Z`O?{|PqSJ#hMB1JKZkCiH=T?1OFs36#?6n7kYj$K3CpNh5 zI%>)4CtWUL_}X$ol_iE@6oKF~@00go0^AWsJ-S&i9;j zq!?Srj5Rb$Pu1RZZ;A`~{?e-{2nE~JKajm11)$_2U%Tk;wRklL8(Fic>WwUX3%r^v zzjPlxQ=F5d-6v*+D|gRn+#Vgf88|SdxA2Mmmu14ZD9z2=RHJ zU|cyxrl81h*9lc41?X2Z=p6jctQ4m+#ub-hvfJ+CINGZimzdR(L1Rpa1=2_|Z&b5t zhWjla0M}R0M6Vlwkv^_HRX2(YEA|>C^1|*F{U!soEjs@fZaD)hA6+nMJB)ceSy(il z;e&3;q;ES%ylItvL)=#2R1808|bQ`{?VJ{{Tx@-{x|^*QKXW!+L@M;1Xxcr8V%)9{%j0g%sYe-YFs@b^DVuRZyJ z@G&KHu2Ujjf{LzGp+(rbK&-GUGkOiEWF0jDs*@2V(28;56_QFys#TaR#M%rEX99Sv z$P2qyVI>m0Mw?+(Pjx`pV3Sp0UTn|D?ThAfyu+_TM$!?{8^14kp}_JQ`KoC*oOM8J zJPZ9lqgErw7MF@vx17J>@44a2eHn+6#l)SaixwL4qBr2$4J9{EytY!&)+jMY9a#ei5>Q=U z`O9dX$4>m9`Ep|23LB{5a&(FvD&;1}o>lH0@B4AwRNQ*h;4zqvpKT|sVu};az+^u> zQ80DlBZxc#pZCcoOzrJJoVA}3N4-pm%Vn0sGb!Q6iYESMGr~-|=MHxT2__qwZBTFHsDq8pBJAe#`binw8gpFFHfm-T#yfqmK1bgf*^ftV+syacqy2O-B|H|e5 zzY(C*F3Ht4I^&wdwm8VVrdgguT}O6Wv}eOKHKe&d%d2%|2~hDweSSSl0AJt8`&d4U zJlG+?V^{@7q?K@5nA7kQIx16h!B={C#`j=e>$%=t%`8=1WU6M}n0cHK9Xf2`d9K|C z`>tB_RscD3m7RMjR81XiL#3h#?y_#}OKR?^{uHyBsfphw5FvDkiKld2>@b-z+Sp6v zvA^tNsZ`kGMxTa0J;^^;lqnadBbC)~Hq}-9;0?`n+LP3F)ft`K+kN6YJtnI%U{{_d z&c`V@kH~}pc#8C2zhSx|_bidu|8vdYl-eik>M$7X-87m7 z5YeM;S3JeTly_ze_t-rDQpNv2P!#XRqlESF4K(E$z!Ww~Lo`~z--}FzU8N4;enW#* zr%vRkuQBDH^c3aSL2nVKmkI7F}0qk&ceA(KmFkYO84Ilou%N$h$bC~2t(5^mlnKIamXVf9h3so0WK*Tq2jV}NeCw(mmle6%r?I$|@-e^HooIltt6~){ zdUKCUm(%Ayp{TTlb)}9h-BB#mYdUwFoP(a~SZsC$=#}O{Ta3ADie`MH2{&Y7APQFl zuA74aZRxj8jV;K|?y=9FK^@dqGUzKi%2VL{-ytoAaAaxGjGC~``Q!x)P5FE zXY3?5?chRnriI-$r!C8DJH>?|pIBO6sNFZSkvr@u@Ng+OX{%8%qzmkjI1R>c5#Qc0Rx+kTSlHj=8&Ee=KLssL*3?@tRiPX1TicB zP|vKU`GUfrWHbKZW3(QL)I@8B4V zG{p{&XjDDae^}Z&h!cxNmY8BRI7_6CvweP%E1#K-iUK{U!uTX&+N$rKgtCo*!*~6a zEw$ClHS&@957U=vhT5=F#^V^Bi9R}0U%>Z^&$nv6vYd(?$d0w=B*3I zvK4N+4ig*}pLDOM7+i#dS74;7F?h^PZ!mJ0HS?#={Zw9`@LZuVY+;J2! zKI1;UAhWkrUIU$%*ycJLX=axV6sKFbOqT}6V@S0_l~ULiD81V?aTxoD{%)_V#{72F z3}k4IvnV3}OIiEX)i(r#e1bckLA~`pA^2fpM_XUcEqD%a+;>7SWi6rkLUxCF&c8g4rL`HgIb6v|sv+7S-p97(YLv zs(DZQ(1s5}J-T-ewFP@16lv9`7`tICHx}2N9-t$lX-E>IqmaE{PU_+Repr8ym`YKi z{CIfNd5)}M4SY{z{GM()HmtH(=L;UtC_6PKT`-@aUaO!@9l^S?U|3*D7Eiwa$!Tl^ zmNRxSB0ce%=el2BRi*|PJ>Mx3gvdT`Hb6X3^zTSdo0LW;q%`%pPmht{KFi__GwQif z>o?4EX{^V28g-?(dyobkWwQx^2lz0CW#LNHD0`D2w{nFe8jG@dU^EKF>sX>5h4#$S3w0i0XV0XWp^E=4SMP;~3ati95%m zg2V~{ewG%)l}igJ#jk#$J%Z>`ItTQqkd?#a9O;xMs@#PCrELSgp11&|#jlk?OSnG- zz*X!Vw=#Vy@Wf*4lFNoMmCAj^Kn@nyamA?MC`Q2?8C6jv&YjUqd9oCFS`><|w1&;4 z#lr+nBWpc;)>Rm4Ul@BUN0w-2(H}7bVB;h(IZ21gK4RNlD@VoIoi`}Esz^y;?Ug#F zLQrxsJ6epcacq(V9(VfUu~I=sfW&fGM?W>xzbR9EieJRAOo=kLeO0SX{@-Dnk#F6@ z5DHs}73Zu!##^JDH`il|kHEgidWTj~Qm^lY)5yildd{h5b|QJ}D_2*R){woX{m)9- zAA?+RYYH ztu-{pf%8aS&t9m(a!{Nj6kV!^T^b&EYsU@mzLq@>#kM-y<(ND)-O&fMxlc}V;Hg9( zOz`O&H86e^BWYi`y&gx967rLT!w(%y=1TH|{zBTvqQ8%FNAZe(q%u*1>cf#_+lJf&9j?j*R2(^FqJItyv&;WpZ}PT@_@_}j9>q9&@`U|bZ#%jS6hD_$BEm;- z!y6mAHlN%gV)spp1v7}?x7HZ&YY5zbCBHm-18HA82mCs4Ss=3kzX;+QFmiwx%5Gpy zl&T9cGv2=TI1eJvAlwhPyXm7f; zBXEf9IzIE$7gnkAls2@a%Tj5S_nP@~tI#7d&FsPTwIq^W}Hm z>2F^%J&ow~Cosc4Y!N^x2ay8%^DZ;`D0U=C7@Th0mIbagrl~?aO_bs6Ke$dr}km) zKBUeJr1_5=+Ga>i4UAGX9}N)DMkTqWFl!XjP>vJd&{GUeMKw8ib01mc?U|597!_&zhYiI!nsWKqoHIZL z#$^I2&CC);+KijD#+WtYTJ%p>OhGPs#ukKA@L@p}(DP(Pc~FMn%8aqsLaU5;b?3V; zgi>X6c3E$$rk5~heB9T&omCuwOCRS!IX*R$(ol?zz?}(uMa7R}@KOT?6ptI&73>TC zm2U;9Len=hMG?OK;1ne71T*~7Z?_&zp&?D5&G)9>TItyS_LFSsDt9OOMDu{y=BK$= zK2sZwR>;_*Z>Of*3kmRH%eqv`JXF^v$ug&}2<^aemu|dzWrr5tw6Lq8vsVAlm=(yi zCE4)XeFgz!$J(0_6aF`M-VkmF3_rclH<$nORTlqq<7nAxHVe>i$|2^nI81Q#im&$f z#Z0J-{7-aU0T_c%%oo{y21X(02LC)aUT1U-?OhB~x-H&_wmX&PzcvP}#wXyCHQa6e zu3J1Rt?as7GhzAy@cMUAV%@zaUKbqf#r8@o3VkO7OviGJY;0FEm1$z(K6{pStm$I2 z|4-b~xHQs=4C@iQMRGFOd$_b}S+NiowZ4)6mn-O#$ayhZpk z(a|{I#nV>M(VgJ$3*wfmGj){|Ms~az`&ITEkhaUUvNg$ zDLxQZHXzO~Sx3+*;OVxJe6c2cTmW!}oJH+;W52-qbzx+r>$rAnE-rI&Ga|v?e7#nj zY3Qe3i*2ekPdj*a<12O?rXwY@3-vIt^4~~4J50a0yYJ~lm<^W9)!tIF{$U-p zb8QW`-6ypID`wy8gw$Q&R#>Byf$Y*(ey}i1@h@1zvG!TRR9o%OoS#5vBaGkM;GIL; z`os3z&P5&XTnbr1vd#V;Mt`g_vtHfz)w+?3KS?_|YMFoUrvlX-x!!nUSM}?09yqug=s7v3^D`%5?y;6YqSJJqI6C{ zQDqRXoS#$Y4Rn?FgRzziQ!pJB#ElUAN)FwJZX+)0>^a>>3h-(k8NA+O!e#tN!-?(& zvlVbVHuJ0qS!0eln<<;SENp~GGjWJHRr8ao$gH;RaZiUUFV}hGv};ti4V$yfk`?BV z_`iMZijZCaULuH+Ei953&~IOoOAi2dbh@Yg46xiIM#IXch3{{+?Z?Q7wX|OWu=3s& zjW+m~=PV%E<|z$wedfF1J6Z(k-?Dv=yORNcv0(1+EgmVZ6@^U_Q@_67 zObpw;vM|h^I8!k&*vUIWaiBu7jOq4oV_3h2Yv{sfE(pEKa7r1@qf%674o>@oB&rcd zCKIF*7(B|h5Xg+54zHo^W;h*pmwXHbQPM+yh>ckBYAz}#0S5nxS9ay9^!Yn(opg`e z;)x%NBvT9)++=wlOKv7fWbi({EGkM>;GhLyJ}d?=L1OrtAEw-cug_PNW#G_>pG$n^ zdens<`9c1HbP(EC8tp_1VM=j5(=Z3n;hhlMJ|?nuX-tlW?+>d2HfFJfDjJOdB^GyI zRqi*tZQEi1fxL{uq%Y5q47H{$A)5myW5h|#4SbCSB2y5X^Twn)qw&Y?ey{)b4x1|< z8>;7a5~s(k1^}CnFkyB2m@jU_k)0x#rblGmIKv!&6q;Qot^;GJ^eWTOdCe_)gjWB* zzYEcOLUtWfgz)f`b=|7|&~yJ?R%xSuHDn2Cw&+)c?pqE1wTSg7u?<5IUV6=Rx*H|K z-^75vRV$2EpzF}DV!c7V`mP1KjRfu}V!D1`G6d7x{FtU7et^Hn0}aZ|lb8Ruu8a*n zL6>}m3fnRSHkk9*EMoJ}uN~eo8{NiKv*+{}aTwXUPOmnTWx`X4jd>mK=*#ZlrXzjW ze_%)ZsjGpjfA9XSE+cFI{3QDRt}3F^73^Vv?XoxNXENm+(_Ez+hfNY_-TPjlw4f#* zO#$a!OM*o5mY1EGuP-5cUjNp0#jZaVQkx?ubOQUgbbzwA(h3 zm#gaZf)iBTfSpaPwfKKWFGs#D>xb~?Br$W^Q9!ZJDCx_#{YNzv;NHVu91|-(&`WdSj zBki~aUmd-fLL|pv(4k=CBR53Stv-Qw*P&Q5!||~b5BQK5JhSjmh-OI2*IE6_as=chm!#M7%jy#7P;qAYw zW6R}2FpG7lTcHUK=*%6i-kncAOP$jCNw4L`VyN;pmbdlVxCr8nwFe&8x`3@yzdr>@ zTS0`M`@y9JJKJ=$!tQR`g5JCFwo7K1k_Y8r17epjWg&hLBQo=pi`$p=WSx;~D|6}Z z-57eQ$v*LxV4T%yX~v~!uzT%{?5st&@3_#t1Ot`j)z$k{RXv=Il=}2(VL&TjsDuIp zGnKNr|FuQrlqL#Wp_sg~dU1BXT)S%E0l)+a_nddA-CdpZp2^F^WT0I{zgzgzCUuVQaMnu2Oj@a$gaJzVZ$&?x5VMm z{xMXtag5F9j!cVB8$yHBnx07_1IYSvSrWCsr35;-U#3L5YR@eZbdyimT~%nX?QbHq z=ZZVB?L_}SWlhH%O03E+n^;D6&(84sVkb_{UAQ5N=d40E;>Fjfrd5p+sUV+C;qFfm z-gBUY=gu+*lySPRbyS4Cj%(!1V3N`J)fJo&|F3}csI+ZsG^kL%xZ{F0GW%ykml0(X z^4}JX&64NN!hvgl`Gq|TW@+=U%5|jUT z>@wup%0bBRm^KGD^__#cd&Fa(n*cvRz`urRzQ^2jvy@YcTfFyU zvv=JP0Xor{Auo*Z{`ZEkcw^t#@%$*h()Js&SbKe%x;UHnYoj2(o%^|YYPmtazRH8j zzD;C^9dnQwu*3V%1MZgkvz5kFBm0B77LR?gXe*0L8xguUq{GY?4Ym95yk-=9Ncybt zR5DG>X_PD}J~L@YXTrbqckCIddK691?r+wvH)fLL`k}gGwUJ8ZAN$|Gao>mEIFD$R z&$k_E?n@P)@xK}6gxUN(IO^Z!o|Xu9APqyaGK9XL%H1INGPmJd`Plc*?ZRnr^#pMu?3kF#Wo8=3H$sW{p<9}F-67+^5gC?r?=LjobWBX z2oeQiD`tz#+8l7(du^O9Fg6cewV4-Vux(2@B5tj$uL8P*>A-ZM<@-XXW5ca)oN z&X}?W%#i%(bWF&hNe1Hat_1<^!~O{4j2^aOgRihv!+1y!mkFT>;xzL7s9+#KgG=6(rIDfwHsTTt6DZG z!=>>8v>AGsTl663$xma;do+r3I{JrC<;VLg)Bhk#Vm8F3(j@H%V>q>g`>bhdX@Ts$ zFarrao2DU_7(jmFjL`iyz~Cv30GdVA9X+Y-DIe_G7TU*QiY(@~c#E}|DP4Oam&<$g3|0-_onW)B;W z)VC(%o=Mcr@63&O#&$KEQ%#>ea%W^@p5F(`k_tT z`d^1WyYaTGW=u~(Jp965Mh<4y8|L!B)-4m{9E+(x$4noKh^=jxVEyrx<;5nlS2q36 zZM)L3%hn^W{%AGO7eUrlEH5oKkiC3R>&9|T21GqfRan5(pQrFO`KKb3vTi?0r!fW- zZ^Dh*oMLJs=lTEM3l6gUN;V|N514S8axFeN;?uCJ|AA_ZcJK6a3z))q3=(TQX3|oC7dc0LwR$=&%CbDK40YmN<1*V!v?P2fhfnR|g(Bhr`msZ=qfj@Em{Cd}qxig;-#V6R*U4V(B zZwTkQ*XvI>>_8F-<(6-|dZyp(v~7!kwVI<$nxloPrG-3i&f5RBJb45(2f0LiYnDmQ zaWi{Ii$@8blhVXHKS*JcW=lE{h#>%vYR(0njL%N#E-ckXwZ{&R4r8h&Z%ToYdw)Y^ zqV#+KgDyl?EP89}78(~eD!ZnAj69n=Q=c~f&16?2%Yc);q6Z@B1B{)thZcQr#k0NA zf0aXt)SmIgZ9V^_Y&di8gKFD_)oRMkXiC+XHrOGjwXwh%22bu8j!Gm;N>63$5%;-u z-o}!~`K38z8~SrQ3w0Qd)-S8TYCRJaW@f+Iv3t@w=Jh}SY5@!jo-Nb*z8@^vRy?n| zHfvs6;518AsZ}NtNf)@?Yzgv ze5qr0dG+S|Bvov@%wEb4g*&$6z#UShXM&xed76e138TEV$9dK2Ea3nMiys>&J^a|b zRL^D9f!4OJj%?w-JbA>hQqN8CYt3LWhhDtyMtrFZm)Z-_YS2;DqIbSMwrx!!ES>uN zRfw5`i0}nJkU63G*6_otTO*O7*R@UUvHIMjOgq0y^oU>mb0?P9-1*7e)ZocElXp{W zKzWaCn6+NhEQuwOiL$ z8^}fnlMS_VmRK)fEaOZM4&sOy;JK&txriK1Ul#Jz4DF} z#iKTGnf!G*97z@9geL#jyes$&J3cTB_^aSV&Qmu2dU>ZE@QG-+h!#7wLD2k^7-^90 z`d^QGk|DT9?mT_{f>`?AZSFlSq&uP?n`%umWVOdnfOvny6L&iy)w;E9!`_nXzrVr?WQy?nsKB3r8IM;xLO}df$(id~< zx8E>f9XBiehRbQG9V&Rp`CTl!m_)tx-mf%_g{LR**|t{(u5u``+S8t>KfVWy#m&{b zA5^Mp`W*d4BDx2!5%Bo`8votwfh`U^k)Q)6|4#i%iB!5)~Sp!$@m4K^J$0a-AaEh32(TSy^rSY|jLp&{2{G z5%J^PjVE|(i~})i_$5i3{ z9h8h!J|)?YbMSBuHn--?tq;gP=LU;!`XhEEZ~Y00Zy0%*JTg81P{u0G{ykNW|GHNWg_DrZf@rGz!CfxqGyUI?r*_?F+q~oStSNudjoBGMywA;#C9(E zL(#L@ba{S^l-`4yi#L2aZ*Pn4+Qv;_Lj%d)Q~%TM=Q!{qQr?A(1APVu{F``nR|K@X z>Js*2TdQ>y%y$@N89q@)O6}$7e8~N7op-7uv}ukbEYw+#whH;#qj77ZA9|2`19R`@ zi0FLg=C{!!>oypjapf%j9s~V}Q=ne5t5W-MG91#NdRJLSp5aNE-`J8=oo5o!wv8uw z5WRxO_WLyVIm%$73Yje(Pi7CJ9^%n?=Q~qdt~kQHnXhYn@-*1Oi+)H0SUybRH6n)n zw3F34Q=DdbhJ_KS;)3SmJa%<4dZw5OmM78P-)F)kcl{CG@~Q0sAeA*c^$`j9-{Mn+ zJH?|93Xri~Uro)$c^+p3B~Ej%dX}G$9`V*t=gGrL!wqSWrAc`Ji>~;u(`P`o(){F1 zO4pqUDv{FS{-YTMrsD$WbbNW*IJZ(CF&>*A941fI>3h6skaV;@-~|s@J&p6dPEo8( znXiRv#Q^~hoUO+ssdR=5q4X3-sPNPz=x!W86grbDnl6;AP8a)VIjPU7{ZG1Bz%boB7<-sya<0H zgoq{5i9(`*=prVFwT?yW;tWj8o#14S(%A|p^OY8mE!J4G_y702ee+hbs|0P_Sy@|- zw=gezr%9%^zrVQSM6f+GWVSkIIYngX8$CO7Bji)y(-KgW`B* zd10~bs4skUd2#8N^4j&Y--NjZ?!rw!U@%fYAzD;J8}BC6t%(wcktpScrLmfi39UE3 z^DpBc?J>>pJ4A*sqn2KdAVZS*D116f`Mt9(`&}lT{iTS=K*4+Oyy(|IHe!`^Asc~1 zVQigGP{%G=^$!T(Xf z%Va+D39*J4h9vXwE}=K3DYPz(0ckFQkxRcte+10_=9?-Jnur3m!lmUG3Eo~9q zJu0DEoR(z)Yl5YOR)sUPAdY`N4a33%ecy>*7)Y?hLwwby@|%%3GE(6ejVm0T6&L-! zz3GI2l}1|rA0plJB$=NJcv``wvbx@US}rd#G*@0Dv`mKD3LY(&zaY}Dqts2`5G{X9 zXl@xpGaU>qucL8R%|!R01^LKZiB1qfw1PQlp61_678UuhqtRnhE|!h-yApYEZ~<$ zx`g3-gUvV4^(`YTBd8ypM=b};_JVCWgQiP~&dvECCY`qiZ1_o>r??fzdf1!CNP}Uc z`1zh?tcRHS-AfDJ`9T(MxnTY7B8nUfOzRYXF{I&;(a4Y)GvoDxqmFBdMx;5 zGM^b_3l8>OCHA-ZTLTP3l6l%51*a@d-tgy#w(wtB$TvpXiQJP;-TDgsEo=jeO|!=a z+d^vTyg=LW*s}SIF`z$;FynNAc4j=u1OW(N2R`BR0>UR3?h2Y4MzC?I@O$S`$4>_J zeKJD-Dr54tOth8}`gKhxBZ^+M`#lDUFeNp}<{$U6qjnGtWe%9slE>Gvhn5bA67Qy> zv;NR$^zbDzPeY?R6Ds&21t@`~5Ym-rCi7AF#8OKg|I-{6=vatC&;ER#hSsq}tF|@5 z-D;ey@j?|eI1II?{1_Qz^OF?b5o8Mr@@0q3Z=J0z~DEj=GWh9&b+c)vn? zKZnow#rFHR|Lco~4I^y<86k%EQvQ44uw3405RtUKF2Y3?Z(2_=V9X%MOB_z9=Q3B;$``YD zza+Jc%`ayBR4tSuKh+@H_%Azs&qlizvv8K&Av!g!hjr1ZPZIYOa+#= z0l|0Vl||;7^%0Fxp1VZnEdxemK1g8yniNqd(^l^fhw}r=R&5dYymftFwUSh2ON&t) zPpDJUE1zmXX3PSM_bwp9K7uWnq1}wPDumHFEHN;l4+Ka=Z}+vh^9%G-A9%%+NWzY- zjTn|)4dh4g1JsE_pAoRlV6+8Djz96ONadQWh5~2|KNk*r+;3k$X9O)GC`CU=8 zsViETm3|!4t82#52JA2UopDTZ>>c}gp4&K&?fxvIcf4wy`piA%{^s|ti{-TWXrl%0 zx|Sm?kz`U>ZYook>C5D)-&-;kXsVgw7}}i8SF;>YxZ;OCXdeb z<|ZF6(&N}`=+;W{qg)HP&~1^nES^0jUh!i_SHexrZkZ2%duj%CQ{M;YoLU>Zezdr! zuxx_<(im}|*V-smL!S6hIg!L-Lo@66lNbgT;B4X?ZF+i=U0@@YZ=yO*QNAKl&Id(y>`%QD`&xk~aVeS_^T`<3w<_8mMU&MTMReq(z2npAfTB+VcOi?^l zs{Vbh{<{uiAz=|9L(t@_=aEM81zAm25wJDJ_-ehB-Lt<{@uqUdIMIW`g~cqK*kz-b z0!KR0d(|d0XF4w&M>)cMrq`S|l3Jqoi-^=r_7P*9_j?2kEgZ*=)JmsvgJ5G7ttL%YzK7|j;eKcS15a(U~QwyP*j0ZP<$I|C~W z>vSF3(4x`E>jUbldfFYNjj7XF!H&w*IPJ*w_xxBt4N|$zj&Isz_r5$)wwzQjI=)6Y zigbK-tNv!IZ`URpJS2{A>Dv9Ad2%nHSL7jjMbW=h+CiX}$lJGTe?Wf~xJ5E0l$>%= zPD8@PUhOX^MFk{rHWzFoiz0X>B6AOvjLxbZs5wfoRkr`B@+|yWee8&j_c7jpLYVSMi6#^KQ>FaFp&xP|k2>fFE zIrC@3FUsr+;vOv@cXP8-1+G;Yci(^2YbJ3Ay#gULaZj5#k&l3_#Gyc<$DBU3+AS4b zKsb}jYD^!htmaFmJ)rES8go~XoCgyD zSJAvIe}figNTx#Zx?3Ljb6IR2ne!gMTlIk`^3lvuiSTQ!sfjWbGZ2TSS?wYqihq>5foCkf+;|B)(u)66yATPMX>jsgt5h?C)(v(LMtNrM{HjpH4-`t2{ zldnu@!5N;n+TOWhVlG2kUbRQw2I#eG8Abu^-C^!MMyt~7O%sL!h>7Pj>)Tx02q-fh zdUegF=xxMsq$%T$PY)i>30G5*X4X#IQ#RT2Gi99~Sz+(*>Y)~9ynHcE)x zUWoHHACMjO%>mRp8fYmt>!ESsQc5Gep?Qto*8o#;7^9ZDT4?R_Y~eqZQ)w;r_bUHl z^)slRz>dXGUfW#8EvjQ);Z;#X?VP}`lTD5$mRw)|CXP@wvMu|GN}1|w7d_5<;z%Vm zGvBXyMA9c0NORYVWbx#oaw@K=dA`mDXChS7+CYPRlGBv2&g3;!h;)joWt^Yu-_$8+ z%GQ^(kLX4X@$_#P=i$sjrZ8pBTHJYzt=CxwajHKYWL=5B5SPT%^IX>uDv}=v*B}1n zK7>b6ovdhQ` zqkhKfuKY^#TZJ>&|HLVi@}wAC|5dSpYX#%8M^*RwMDUfZW4t11DN0F%ql2Zy5U;S38@fOt1ebCJfUNmT#ojm~Wc2Mdmn@8<~<8)AQ8S zm^|0jBKJ%iH3Y!)&lI#bGdK0JS<@Bgtvi);H8*>Xm{;j}p37&uFvrFDDjHav*^*M$ z-&IwzEYVXRH6yI3Xk|wK)h?_4)G)@Hmb&Ze$*m_|v38!zU9BHw!#3A`aea@?Ke)L= zD}=RG?O3HVsohKUWV3Ip+l%!r(f^f!3e*(_8|aOyTh9!S=19fM=N$d^%vcYO_u|AT zP9Epf2u_z{e!!WJ&&+n>Tz<|cXwgQs43*0}qpD7mxbp5swGu15fi@#_{YT&v%@8vG&Z)1YV`%by?ojMVVxsw$3%s{#N88*7`IODoZbhXIjWdD8+dl-T=01W&yO+%GZ(R3W1VHY z!~UG3k28xakK2SNo_B+9p1)CGOz?_Oo^YB-zUWo4>*A#nDU$J0S<(x#2S7Q_AhFspWEve9upXOSEf{8(Ypgj`y#@~FOC%eb<+zPe$j@tZ#Ovhe!RYsS~_ z-3Ynqf6J*gp>4cFy<@f0sq1PF74&M|_U}7;V6i`IKyjdJFl@+fSZ$M6{U?w9SS23w zKM{Qz@+{$b^o!6P@^13p#g{v;>R&g$34U|$?X7p@_w66eKQ(^-;*hjwewY7w?C1K= zuwRP5YySKdtpA<_0Fy!Y4#Yw*NP)To%;!PYgH0W@3E0AhtupkpJf7W?qh%)>w5w@P z?7mBKuY)d!)tE$>(~eahU++I>4e0a@6B#=DlxGuk{*d*s^DdVoE+LnH3-(?qxyA}z z|1M^E)8dwZWcHoLyBYV62XF+$J@_uaJLuoEEfi1ohEc*VM(l~Csw-%G(UjK8cy~DA zQsR5Pu8)ES`;+^=oJ^yd1pjzzzOu;VkEr!q(qEhFg+AOvyssVV`9z#r1ch8zS5rOm z#1Hf{m0Sza_BWMnl;2FD@I2&I=-lRK;ert*8V6c4w7y!qkU zJL}$Gy}k*Es*c&QH7i!Ujg&;jzv(!>iwQ}Wc2_5-qy(nsr%j}fWNtr19ZJu=c9b4@ zz4`qG?S-Aia?{kA+h@}%4qoW0zIQpLmR2XX&Vojcn=kKj+@{>FXzge-X}9eN@BF)U z>(SfCZ=QU6%KuFIx#o++p`77_ks zcc}e{`7tUyK7Hb=AK_mI@HEqzhI0q-d^OWk7Hu{PWUFCM<8a{g;=0b`%)7$Z&%Y(8 zEA&>lL&R5PQ&dd!nOKNez1X@q9g0heM~V+i5WYSyAt0e35iZdtd0sM4vR1N7azpa# zNLrL)k}{G?ma3B)lKS+CqI9c_hs@{E)M#XHv}LSd z+-Fi_dJs*$OrM#_nz@-DHIFc#v~aTcxj5ePW4Ni+ZR-PQokXHSQV3~)^nmo*2GM5S zw#V+aLz?4x$0R2{rhmC~&+^G@n9)2_Y`!1)5rO4Bfe37z|ZjnBbLylDCpS?gLCYmSUGuo$@BtC$%bVAEvpdWu?=n2c~DHUrwJ* zf0c0%Gmeg*dn z=?fhT9~8+Ik&D`jW{at@n7de}*rB+ngudi#iGRs_scPwJ8BtYEB2u9&|hacQAasWP+jT@@u(nN*oqZ2if4fqK>YtVU{V{91XeNvFws3_@o% z>=as~`f=am2JP!ZYI38l>>oi%Z{r~Z|<2A!6O>#`C43ajn0eSJMflJ=$joWj~>&Tza;;~pg& zM&7d{{?WKM#iw=?!I*Eq>g6EdiX}iV6w$e243h2Ee_O<`S)Ta2@nx1;T@a3rO?#`P zy&wGG3bJ>{mB0~x=+6lL7*F?8@hfSx`_Lo@iRiBGo9CCMQ#LDtm%#%b6`i4=H-mbp zM=xJ1*p@ym#A~L^3C8s`kIl)CBSm)Um3eB#QUMd{1o=P=erCV(fZkshtGbS~&8Qku zOp}zFgEEvtx$-XioCBc$d00fw;K%{YHkSCqm^r4in}iE__g92aQ~#w5`e>083B|8I zFlAopvV|q=p$!NTWIwX<>~4qN_dliK$R*9OIT5S-Rw0P}S2|la4D!Xj$fm=@?{JF8 zFS^{`wtR^ncrf3kD3;Tx0FA!o;C1>k88u+y#ithPkxTOuVU^bTOs<|?ov3U{Ulean zG+j_yr-dhHN1i>0k%qI(r7R$wR;kAVo^5 zagr4uRIxotd4-5ntikDHafm+9?*dm;rdZLPuKJuzuc{S1^`C(Avz44L%O-M`9zwr6H-LS3KlN7`e0%^HpZne(Cu|t5;7Tp3aqJ7V%VzN-_yL zbxYV%BStZ{6u&T3u*9^fq*_3Ehf>vKBpwdhBXJBmT_ln6793Ul;;$yU5{e6`BsFYK zXFSd^f%4@2;j^B!CECC1qA#sODkq0ZqpjE>wJ7Mh?=$P9X5!Hft6bq#qlVq{zh%$j z6<1?BIv%4P+Wr)@Yu9|}vPy3?9(N=6z$4m<@%+d7)eiwnIWx!G?d*|Q@wG_o73|Oj zIwOK{q;!3~#O5h*Z&GsV0U|d>OJOo|<7&FmD7`J^bdwo!Q*6UEN8xw$dyL{n%7Z71 zX(m-88XMHiN=+#UFbRCmng5jvDFhujR%3;3sVY>l(sX!*uEv)E5c@ecQ{3Kw9;{yU zS-|JKOIB(3gKtiglvKZCEp>-1sIkS9aRSCbn)vk6dz$(Vfz-;!OM-q+ET<)>ub_Ny zUjq-q56wl`^&ncwllu*^C0Gk46AmHcpG1uuc=_Y+3eAT++VGwpa_sj-ruN{{yvrWP zP?&zdzAFKF%MhBBq2L3EjuB%D%NlKlGd0?Eg>>vGI{dn;-^iz+MftRpOd2wP>_)_mxS*@t z52uhD9I@)!EmW!8Nd%(FCbnv1V}nAU1L?;>=K!tu80MD>=?h{fIKpsdE4n{ptWV5< zLr_KhempEN(fFmj6zy;FjZNZLr~ZYL%DvC=KT#Vl<<*mfN2EEe)?mU>(dl4D>bHOB z5bz7a7jc{5L~&CYD9{Fx*Q(6B^JqNy!tO(S%LsDs_K52Ba1w%nK!l8$>DC06j#9I6v^D z8)M~NwaLn@JVs_@{QN1QJrBtFfMVbY3mD#W#vW*ct))Ud2e17@z&_xKA$_rgRsiPf zulyWso0mqd3eFlU)QclO|1&3zHUu(Vg?kL6Lhnl@rfq2Bc z%Rq-@-YH+m@C!}t-4xmvP8Qi_;Dy2Ef);nG6VCs7!cpMW`3ZQb2RssW;O{8BEDYK@ z%t&7^Y})lNWpkuP84<04kF3kJ>*w%RFb270_lDd$R<2V?y#&pT5Ywb7P}X>L%2_mX z_1K!H_<9Y7bIsVAC;0)OtLy3mj?1<(OdEWDHADx6I6u)RT83d;D#_%$vjR5T1-814 zgP8Z>Tr5Ug1*qc!V7zPY(V!|wst&xWQ09PVjkfwA_#U_4dJx*{<4ai7MevBJZcVnt zAO(mrG^r6f?Weo7PKW4DosB>hqxtY1dixz>t|BWJos944DS2vz5W_GBDX7Cdq(QAb z&DEIG`i}D4G&-!6F2n7S!(S~V`SInw0ayeoR1fv{QOhVe-z(m4;|@-Vc*GWrbr;<; zR6ETFi#^u`(tgS(WbP{Pw}Ir(^3wJyjihdVY~Z~BI)}+LF(>jE!ez~Q*KkxaSno{4 z=ILjl_dY-|t*K+vlBV}|2;pA}&RIo%MtwH2=G!|J9Q=rgNA_MHph5;uDH_5XvvDM#EMuBCXCbqzEh zIMw^e=M1@Lt0Zx>v)$e)1r~E)qJ0@mevY?x@=7~&u>bH7T8;WBUJS?T0s`=-XN+$l zxv^jW0UjzrxW|M>k(4>oc^_bReq(rPLkJd~0w6{MT7iHHM<4fEYP(xFsT4!$qQW_u zw`5=6zuz=k)lJRXrsLqECJgsc_2@RG_ft~M-`{q5@FIIXpWtBwUb2RXz1cGDIzyS7 zeTG4%sxz=)L~TGoOHarW&3$S%6B$ENaaS3ooGuc@+n>hHp(E-^Zb<#L5WF(7!crso zPwm5A{M`Y~KJ;XB42C;-r! zP3!M4iAQ-BZaJTphqDTiK5h=e#4MsFj38+t&#-N8Qce6pIMk{`?$m2*c=J^v<--IV zV#@coZf4%r$F_tpZ~KaW0l%qXoSI&$ZUWtOBG(*NTS8=A75XMT+z^Tf z%{~31%cpBOupvfM>Z0((jw);bT}80;6>%T&53amO=K^&nNgo)5vsG{nq@&v)@yt5& z;N#g1Pwh|Sh#33qTWT@=q%z=j+T523&D4?H3%jZw8_KIkWImF^e=+I@L9aauHX!=- z`!xRC|49iY_552Hn3gw&V|og2QG)Y5e&oE!fgt_|l$5e(Q(G1PF{-XZO{mv20SjZm zk8XgdNUkwOPdW}z3{3(Xb8?QQRlEtf|mTA)+-B1yv7!R%26-vcW zYD?(>V8R>G=Xdn|mybhBkA>w*V3w~++|XD}bt0LvbnW#?vnndr(+un@cw%Hs?q zk3>-JeSjAA9IbR3#Kl!{ZU;B&#`g#QiCZ=DPW36fyREK}C_z6L;?4?o)UrFof7Nrw z(P1%ufMg|nv@J$6?+b#oT7Fy((SPj+;5wp!K#RqFg~!chiLLTIH{gmzq|h8;l!hFg zM81!Mr!F!3rU=ruaKi8~PgNiu>2VU=;k&j!$E$6t;3U=in4r}21hc#Y{JllyYXBcFLG1X`~cN*jX>H1~x@LXmN4(F0<*Ja#21`Nfwz(~-012}e1 z{P}l{pQh__tgs4=JU!^)ku`Durc2`f180BNA_%deZqxNWWg^Qu(-MqvilmMuw|IE0 z4NBxZLox%;^vuPgyYZ)9Q))dnLOYOVI--x64A{FeWIlmK?z`@xPNNc!mt7$Q`9ND< zJbuuHrZjR)RBz_T^fp*!<9Z80j6*dFohei;=FOGXfjNxp?-Dofl>6tN;;V`5 z;svc&Nz%Wt#An7I~_befbS3p`nqhu#pmZek3?XQF^OWFPXA3LIA&I!+% zB4D8)?Gr=##B54r2Qd={YqI?5xg@b)a(@+NoGm{PHu`Z@UCFCXBDD~^X1_{wXWf6d zt9+&VWfvGJAn|tS${=jIurk!7p9!0mroPdBCCFP{3HGV6>Y-weRO7q^r|u6)ctH@f zH123XvwbSIf7uv8M~>+ZEt1Ov6N6w&@svFb7J@cGfrUY%crL(_Yeo1GBE=r`=7f&q zjuf$Hd|q62R~Yt-ikWL9c=m48jfsY;yl1AC4B zB3Ll@=2`-I7;Mb)CyuqshwJEtBVg7&#H=ixn2T|E3l7L51tb$^TBVzTzgSE53kV1; z^pkbXC6+Ui%U4nD{)>R}Etq@5CV~KAZtlSlqIJ;$C@M^y8^HMDN}oJ2+0EH=s+j&R z?#byn*v-YBUkW&q_Ird<;?C7=Up3&rAAdDjfG-TXZ)6y4OS@*RAzWQmxcdTJC{2Ey z=*GI?ueZ1|%b&KAeKc#lPtTV3PMaoiO;y>Ce^l9mxpy`=e09`~(V0n>3dpla^;@Lq zf#aV}aS5K7EF#VF2ZZ8k0iJ$dAl6nKiWt4PrYa7&#al49fjp}&_{N~(au`3Wa3&5> z%3UFj*n7{8?VRYRbD3r3)IIMU_Vsf=r)(B(E_sH|JGiKPlF|lNSL^QP3}V0Wy4R|5dI;&<;YN9E@TTH$H4~g<);h$y7qFHq$JXo zz?|p$B$twEOq?UmY`*aC>%^8<0*o}stmQwKZ-H!j#^+z-dS*FUM?!FAS*^!VR?5u` zlB&(Q<34zXQ_0p~3A<83Ns!Ey`qWiY|9#k%pSSJ|*cqQjQo>%3DxFitRzFn*FcLwD zazrVYhCeUt-+sX~B}baOmyESWJKIGy?VcN4d3UQ#%tDBo=}w?hiF<0-LM)2wC(IgE zx3XgHxESC3<9ce?1w7a2ITC2TT2#(P0F&m?EhwPS{{D|+1|?fdHi}&0j>76vn9j!y>eY^(a8n#=;lr<5E*vTWlFs>Lm8T1 z9+nvd3Nh2c?(^aZQz-Gq4hx^uS5;ckT-QyEc$763KxE)76zuK-{*Bsfr8se*{@Xg! zAgK@{X%U6mNFBD?vDej6)>x#4GnINaW+JHDK}f7Nax&~kN(VKv_O+x&OSq$GyS`5M zxEuB|n*aHfz3yzD=kt=9ZO~dUGF?R>b_vZ`iCa*0{!|Lb$t?VD}inlEPSt}}ewUqeq^Ic|_!~E?& zduuntGu&f5o^j9|I(*}Dq^!y2zkaX9P=0}o+)Q*Uy{7QcY5UnijK_{V_b0>CeO8A` z0g<+|STy$oJR`z&u1;K;Ndj7VvNrbpMV>fE&JpXpBh{1tP$!pqoyG3HG*Bm5v_eS=|wwTh^3whqUZKL+zsBhod?`Ka@Ok$H zw03Vn&PP{~;?xHi>%Ahyr1jqFukMBB@A^oK`YQU+hTmNO=GDstfBQuTk&D zZPSdv-U_i!ca60(+9O%n_Pq!WChaUtKRVR`rs$5`HYT9R^Z2RuQdD9<^m%U zT1cipX!}pu!0j*XD-?kabe6{}4}N ziTEsv$m99BT;)NwL*NLvkxvNYY(&B!3%^_J7G9502C{f2dj2k>UDKkZ*FaN^$)|1V zg7Rs1K#q-2$X_RF+$rxcrlblUa;S7Q{KKGqsRRGvp3HIlG}hg9r{gat1u^Gg{moq) z8*1a8K%r|)Vp=Z^moOf(E0<>4*GNjA`t5sR3~h+5ZCH={xdMnun9vN!31#9DSNL6D zr-78DI(&g9K`7;|OzLsO5~u=Y=rSJw^R5upebZR5flPT}Qw;Z4dH zrL%F)P_b@(b#SmS4BcDTE;~Cf?4%!JCN38URQasB2#r@#r?F0K_!iS@ZS_@mW%Rd+ z)7@BBfJJ@MFvc8^E`1}e6b9*R!nP`pz*oC!*}3T9m2&l~${EtHegBea8E;7d1}E2B zT8`PziOYHkC)n*R2VlE516u&g*jL zMj@0m1p|kA_1b;ELiyr9P4wP%CgRmg)05PX(f^R6?(pXqa{e||>e+MGrGL-KIel}x z{A$~FnWtY6;}J=UNW9eszv9)G_C+*c%h@Il2U+?JOgkKN&c^uQ7g6hF^YHplh&@vGE_n_^@LX_j((iVOh6+l}U!^-1Grk*L)wV&DJiB76 z{jhP#FYFbOZ%!hE%+BQI>ydcsDpi4cD4Gi*h#OroXfUaLLg4z4>zH`Jf@%y#9O5uI zUBk<4Ez%O5sY4N<$zW_~IkqB?GbiXJIW|GKHeIV6$cKa1pyflj-&-O=eV^^l6ZM~O{ z%HWTDAk%rKA-}$@ z4ZIOs@3rw9M#a*qSyz3AO(3XyT zwhHn#9ctERo$bfmTC30p@7EvT_z){RbZhw>Jq{^UPE#f&P3+~c0D{n&;^>|oL5Jmz z`x86y?Pd@dI6mdLA`xf0gC4^aI!Cucf0AnkjaK;CpK}3?^5hr1DmocV7K% zPi3OyDIfu8f&WCy6vyyP5(d6gcpr3=*&XzcQk>jsK4TKTDJcJHK}>bwar$4i=!vgP!uBI05F$cC#(cU3U z{t?`vKw<$Mz`9OY%Os+P={J#ZAevqvi?m$(>Acc`guw)&YeQe=5|pDB3w(UPYm2sD z$I6^jyVB)DB9X(0i#lj(fhbh46*%`vf*LGg<|c?#2&o0QgQYmezuB$%{N!HWtwh2| zgOM;DFBdU(wf{qBm8Q>tM6k{*1dkkOYk`&pbFH=!xX^&RR-MAp88KepssDJH-fphW zE``?aiq&Hno1$m_Ywz>(nd#|?ObT_8Go}+f?EkflXX|e96n=s#{n;;I(Dx%I8-B*}t}^cMooh z-?nAjNIP!)1E%iAa1P((1p>s^6?VJ6h!RTtb7whuhwCK1+TH#)qm+?F@;urCX}UGi}#4eg%zGUUhaIflxMSq*m6i` z5F5nbhc5!$AWb%KYSe^EG}!q@w_&6E*6RF;Q`i!wz^EA!{- zSS+(~U0#-(xliPJ;KYCJ-Yf5H?c_K9^sopcXlHbx#c7R3kLYlYR-t9x5~Zvg?=xa$ zz6-S#FyJ`(6GU(a1s{>_{iLHkH6wg{O8Cc&6jOp0?<}o9jwiYTM#* z9(srzrJs7PFHQ3gd`4#ahW!RJ=>68k1$@q$@{<{x>(hyz?=0H{OqmF^Mo7*V(o>2h z`_!Odc`nJLbgOLkGIuO2SLP5jjFM%}T%oEw@Shp?ozRQqKO=j*-m-ochgCA5$)!ZI z2SdojLQM9@vuS!RQ~_Q|=D~JKbSS1}qYR4b&(Af*X2^VRCIbu1DTfod#q}_92N+!JTPQ+;pP$8=3{{jyKZ@maC%K^D9TrIBHX0rb$04Cw!UgP-K+ZsoJu0M)UOwUe2|rn9QG39&Y0ASu#<`cTnbD%?z+oDNj?=0 zgMe&`g$G)l<-{uJ|DU;UE7G(&U7@>u*XFby^q~ zi=j*~27ZnnuRhPyFv?Be2Z!3R%ih@QB5a0qBe;5ho)_gP9zR@^xD)(VCE*bHlDaHa zaOSWI_~{icU_mHMjtfyfJOfb}4wPgQ^&#?mq_YYC?2{$5-ELvmP$&w0q}34H=bc=$0(qXYeA*Ru8t zj{pV42fKx}?AeQOCYbUo;oP$exs=3zN<3s5`&#JzIm~nCnh1ScDn1|qe9e5Ed_U%*2Xrd)5_H%%;nBXxV9L9|7ARVR>+h{IW>g6-lV>C@0FIFL;73w^OUX8l@%ABlpHUjDDK@+zQ1oIzE)oxR_Nfd#FO4SIJu z9kh~@zPYSJ>tRwB=d{IIlj(tPLNeDz0rC9dYx>v2n(+|A!QJrmkREP`r;!QJz`h`Z z&vEJmDsS!eBnq#sh9_zj6h=*Vejlxn{wE z$&%eOsi&h0AB@HWNCCSBzNv%tJUf3u&D;cEP7I=l$cUX3Qr_867t#LErrOSy*^~)u_o^#zZR&rU{1;z44>&Ew`et zuQl~vavN@EsMsf@`g=@yYO;@tyb&dd~ZfKR`5oF3x|FEd8($)(1JoG9WM%->lvh*B{8V}z>TFjtdbQoDrq z)0lCqY*nmN2}5;1UXS6V>O%Z|@AuL@IO^Q*@3V=nug**7Jx3Lz*KwQ<*+1uAYYE02 zn2y0hy@ z2ipXJfkvvjuc{(!d~k9GZ9NkuPbkp7{Z&YaC4}~stsL`raSl00DwD5~|CDU=-M`j; zzuITq407uz(Y-OS52r)M(31#4ctwRuhY+7cD*vq!j|ab3++=R?7LTOOnHShuhbjrK z61EFu-W_=teZyPkz9+N~Cv&~L+XM3rlp6qWVT6MH92i&3w7rP?eKqbIL}L1Og?gXy zm#dj897d~>x7K&n-N%+-@OFmsu>t>Pyyp0=xMYND?m1GQaE&0`RdH1>SNhh& zo1c7MjkpGl2x8KVCrXB}g&>0$qgox8DWfjNZK;3dsv(@6ik=C`4Z`R$n|2{q+1{{aCs@TL$ILSZ zT~&g=#a2vZ;_V_g?*IGo)5xESZe_vx5Y@LdbN2m_gNe-_d(<^rRq8ql=W)vk7vL?S z*ut6wyX1ddyu>_z2YqUC|1f@q;9rAJFI@Z5(ew&6?!Sb1M;%u1;KtSWMQ6KE`TED+`!l5gEWp;{dZ4r&X54JOdK0;q#rIKJt^g7YbkGFNctXii4!@!OntVr!ixqkeiBX*SNI?>3#oXdX-RAj12;S}QGpoNR_^5{*yHEw;qvQQ8AaPzYUJ=uft@}OgVtk)XGUcLH+ zGGn@Pkglec9ip5rq)3O2ezZCYhY#jlTnNEEInSW1xprlc^j_8INrZCqIN2ORUk^#; zCiIn)=XKyamr#)l<;s6kIYJhZslj;d@)*OfC%^m`Wcj@=a`rgYO(uJ)gc4`gAoAk2 z?yPN6Z`N&`b{cJQk?vI1t4o@fDos1f<=A7Oh({?^j+3n9O#~?7?EJ6LM~RXr7Uq0g zlUGV51{*EaoKqn|b{FtUZf-u7t$e#l>fz<9IRsTPZwLxsc}V6EDme1|hj&6GMa#)L zm8Fa^V(J9v49S(}<5(i)*L&yw-f%8%VP{IgzST^}$@1}hmMI5h>yG+H^_KCC)2{J} zm6*$o@=s&lc&t*`) z{YUBhsOpgX2DkhzzCJFM(-Y-WC~D(y?#lia!^opJ4 z9>Gga!mH78E-t=++3AVe;bGX)U%A&t`je+X_5InZ%0%}VZDapiA% z(BH~_8y9VN5-@JqlU>-Z#gsD@bGZlfo*|O=Q*I_YQkL?xaVtW`6f@hPr`}goW@SHi z<`$j0_iXbg(=rPl{tEK=r}))R3DUnpTA|7I>!T9{PRB~k+8=2Z{(D%JY!CV^&?uV> z6aEE16Z>qDb<_0D&$h*@-g-A*v|%UBgiw>VK$6wL?%353nPx_%chTV$u@&p$U2Prk zG-N5`+nEYJ&5=Y8c|fOr{_I8l&iH=5!TJsV#}38_ z;(jo_4jf~9c9-Si82LIEMJc`AotTo~EZ^8)+320onag)?7Nc`@tulOSw{bzqEd=u) z({~M`yv)j7$yp;p9?7|rx8|^ zcwRERi89r;n?=1NV-w%8_8$w0!2;9-TUDmTq) zn^B;b>u`Eu!&xFR)+6B+iwhf>!Q*h&zZhbJaz0HgtduyZ1>Zcv5bK`_VMXly)Akyk z2orWTf>xY{00cfgfT)1_Y*rY|d-+>b5brH7B!f>E_;aZ9M-$jtHYX&vb+_R7O_neK zd)g<1WPcG-iQmqP&NUmw(fsBh0l>8hm7g7Nb{jAuhuDj=H;(1-UL#x^XA7Z=J@8YK z#Vs8y62!K|dIXW?$h74$C&A$It`GN`d)`@Z!745VaY#I<}Z+i?pX#Hg`=%M=C z6D{VmE5%S;7mcV9q=6Ugs7K@U_*h*mG`SCa6K|aUZ#z{tFh^GL{H-)F$fFSq&_dUI z?o(~x;N?wC3PJwd4%>%P7cIQ67wK(*KVL}Ou{DX1h;WY$AMDGV{0Gba69;A%&XsJE zM_ony8dID5?6iTBKK<-U(C!t0g4uiuJl_*Bct>=?yfKnTzE&k(TIzH+UhtGUqd45| zI~~FKMhWAzt8lhF`Q@f<^*3AKRQ$2sn@`&6ORoR+H$Uq)M7;+S1??|_QI-*2JnDcE z820>%^QqFBG%=x@P1VoJZ`%t$LPmLgNi=sZ4%s$a3#AU~MG+jKaSU|Vzo)s3R*&HM zaa*+uLtW<(wR~t>vdel=M%Lz{Xk$-TCtjDKGLvL@MgORt_14HN&)plv=)6Qee0q;* z5pFhk9P^%5it@86e=0CKaR3eeto_tj3R=LFrmk}+k( z@jAE;dB~c$7U{E{pjnzX_;?!82ZQ)+0yc&(Qg>kqve(>_KS_xhl|M8YxP6aM$8T>{`*eKV5!X9`if;PJJ*6B zB!|JWEPsrB7Sz%;9wG8c_H^|e7Sxq+PPs)nfy?XjXq-kB<)v2Cs+?k?%>AySB6l=@ zgJVd01{mOgt|Z96gKgt#c?!^gjr0791S9kcTTqbDM)lOyO2&RDh5COR53b7cv66Kg=C6) zg8xZ`~|pvHv_Q+>rwkCpa9 z+BbsJ06cy9@WkCi**$l}-*QurAH4q`o|`3pQS7O0Q}ijp(I57=V=z`)W1xKdal zuerWL67#4V(j)_b1f@`7<@9)Oo%b=dh-)a-GS+nIGijP*cIFH1)y0F8C zQM*N?T3sakA$9v!J&Ewy6+dyw?FD*zDaFDoqt@8%99a9VtLY?pEJQa;JmLl-D1IM= zXc$$$JzBpyACi84Uto`_%b(hr1EQzQMnPFhZ8aW+>AN>-Ee-O~2Qut(+j%S9{^P)~ z^uBF}OgW^X(yzu3m^^FSM~*+P2_DE`HXEp+H_ca$`hJy|KtCuKLhScY@D)wU(%RpU z@>!p~c1|&UJQ1bIpE)Q5Hv_&*kx~jSZJjXZdwacKn3ivQFuE)-2_uDPQ5{sT z19of&B03qa=YU|{K^D`w@6r~$f6c$S8yUT*`|oAo#$b$r7~}YplKY{SuJYkXPuqMo z(|F*IGR`hFs?4~!rhq1DLf^v7>PD5bj$l5E?mw@)y{n41)Jo%nJaS=xs{;+r=ROo_ z5aGBb&6Jwp!*yj5T5v}XQnspsvN$A^Z%`}c64?HN7B57H9q{jB{^L=3i_MZbKMa=iBa40g-i=3(j{giDH=DoNj1mar>`IzqkWn^yl8t+j&w z%Ah0(c^Xn^&gT}2G;6bv4hN&n;D$Eq+%$}b12`AA zbm-s=kW8Pv)TVt;y^gf0tZhkL?~^(cqMAy(kfNbWQR-7G1QMZ7wTyM%=qC}m{gl-`p33h)_>nWlf zo^-ZPZef+VyfN_2aI53sgq&Z~pa+iDZ14$+K@2O1C)+?HbEOH^_zm``u);jN$VyR z-Q4a-0R-&Wc@a-*bkd`DR!iUe70>F;M|96^U>79O;t^JOU8(Le9S%S2pC=b&ryON z8I5ORzt1Nq?s`{b1eyVo{-BP0#ND7a0Mf)t!r+&CL56w7SUsi#m znQ;*!)`I)uV;v~9j$A-X(i9CwoVHgtIZ6;|UF(W-72$z>RPEFfALCnob~?b%Vp0d3 zOXhb)fI9Uwf2vD zB2;6QLdR_<0%RpM)-6MOX7in3(uq?vOcwDiL2|h%-(KYXZb*_BUjX?cGiso!!?6;4 zaxiB@G4CpK&7Ej$vg$varnj3*ORcdr7{(z90l7&Q?+k3scS7QLR-LW7%a z1rSa1S!eU-sGh{naGo1L*)G&lbJj_{=ckkK)}}y8v>KTo4j}0cf`$wD$#nCyJZJ&W z!EL|L8eHDea$zVeL5Yy8&4HmkU@I+mmb&464uEP5n<~irV;0o&pO!b>^C7qNN97$y zWe9QexFKz_R1&{*$HeYSVz{#=WLst}R5GN24aN$%<;cW$+n(UkYY}L}tN4B*Ihl>L zysr84{#56p)1W|)aB6=J%hyVNzvj@o(#0HQj z4Pv0l4Wld$)}wv0*-Rl*`}|;{hg44CP?E?Xy!R}dLiDl_N=e@mlZJv8r{P-2|>)4K6Pay>_xiZ7Z z!02ux5$55K1$+&2(-5n-gg7saGrN&Y!G43GNrM|o*$=)9r>&_Ky*@D0kDAGfiP~S~ zWc|>~@a**^SB>lyEOiPFb$s%r8cp+_mN%_zGc~RMr(`P8jdq_IZ*A_% zZ!vq2LZNIRdDF-$B^e%8!)azZzzNOvc?DVwRXEIu4kB{f$yw%|u5QdFN2~-1?W}-h zSpfw=_Pm;Rk-?b8;_EmZV8Bh<)3UsA88h=9EFz-Q*-2Hljjo}zmiH~PyRt^#N3+ew zT01_ySLK$I2PwX5-}kJOeQ``A*7|0CqJ&oV<03mbVXtH#>w)vmMH^FBCZ7n#R$ffb zTF-dYE!r}G4gI%$v)0JYou#T*(v+-wqZw zvdQl>E;oMfaflg4V~nX0TQAvS$+~o69NtFIubPvSXDQ3C{Mggr6O8?|V*O8Vl!-bP<4gcB_E>mTC1iP+&<}p*3cldn%U*c= zy1Nk9d-b0Kx=(u{-_7RcG-PNs(cT@ChV=R0_6j4iEwuP3gRYOGmL^`ruGCs~@MBm` z8`YwRwMxS60AuuK@57{?Q*_nm9AGXS5M1v%+}X8qa$k64e{8qA%X1-zHGxd>w^lH= zx;)5Bv@E+SY5jh}{}Fua964!x2XeN_>rc=%$;~)1RtdiJe);=$ggFAd;!(tWJnY&h z@#;!`G_Tntw0O-oSRsR`Fi^8FmZ{XoE5I zwEkHC$${m#k6Rlu(=hDhj7czSq1mSNOslXYHjlNJjy*SY;S-Em!|`?hryEJjSU&ru zuc+?E5+bJ0USIvwYyRMR>C){({=fQtD7=xZ+t&VH|B#EFRpjE7j&C9Vd|lE~FO}>u ze~a)oQKQZOlpQ|$s7XPwRQG&I@-g80>ie(xrgcB)c4DTQ_p!t;U)sFWM|0qeyc$_z zjlPn%YQdF%{=hH#GDaGUPq#M$PV|w}4Nzu&m%ZOL)9-TdyPVc%F`6pLY#Z5*X6kcm z{@I%GOdrkhzW-yiW$|`2ZHLj3Kh|5rsy0d^*W0w;*J53~{_Epz6T$s>itR=}GJ4MF zGNb%2giI6!86s(8ohnlY?Gd$2ap=}io}e_@e4h4^I|175q=^sbjCpK_4~rhu7%rvH zU)PflTi*OSdF4;>+oSW>Evjwwheg%p+zg8%2d%QdS4B>vf=b!#kkP3f z#p(;Vf9BGkjoPwuDVty^n<_;Y0>=t3h?bi3&eS&#jNA(vMN_rJblmzbKj^-M>%hc)k zvn=PIeYtt%e3p#rIvEH&!-!PH} zH*B$w4^RY7j$C8INp+|w^S6#>KPk+thMY>U)M#G9&QPoN;Qe&PRUD3|a(B zWxe(NMKTlA`{r5DpR24=ue?YDtPH_oO`-Wgq7c36{#y%{nfq!yZcdY<7{jOq8&Cm{S2Mxpw*k6zy{U zlQ8Jl|6SOkKi>8H>{9)gKDRU8FiJdl z@l3U;BX0>rb;RF;Rqu|;UiQ)^F(yyfV!)?%o8||}&f5rvhfNwb2F7>OsNhI6@{{pC zuPwHL4W25Mn=68N7zA6VgL=-$jLnb*-b`>(0HQ5VdIRhVj;uTb{yuly!Soh}KUf}P z+~M@b*7j~50gNz!tA>JPUlCHf&n+`#otG*vE7S|Ka!@l7Y&LJ3$_Gm9!ANptcI2f@ zyG3?StUKd32<7i5yWzce3`{6z2=1{K-V?<(7JCSr+gS!Z{q$voEg@nN#82fDiK%|* zH4LLp@{?LuZ_n30JuR(`K^?=3CvxNOKa{tXSe8ex!5#HVBJyv>`cwvz3?J#|5Y>n8 zr=EFvALl7;;^ho`mn->_6`{q&|_m22JIG zdi^^#wjyZYlW@r3L^Kf^@zB+TgVz+^Wajyf?QG{siN zv)RnryW4O=5<>$A#<%&h9aUPs;c3Vc$_Y)T)rO~N9_x%h9^TF%*J z?u;Mzg{%JW8#p6#+y>iS6Em<25e#E@9u=AqzH?1Nzia11>i91EYz&EQHoNUr-Tn>+ z&%592`4kHY1pea6cTKb%k0*5PG`_QZ|A_9LM+B94!P(<#ys&4400ZoP5b{5M;x>BS zcPfG-xZ@15o@Sx64{R`={B)sRzFm7`iTWRpH-7fZ$1nBcJ=>tafHGga{cTz%)5W%a zC?>G262WQ@bm~1;vn(yaFIU@a#i#a~mqrL^=fpcL?-@#PU|{hZancsTL~OnoW4|!E zOhGBDq-i+UR(z#rxEP1SNi2F{v~9^ApaYcs9X>DULDj6+hNXM%TEvRYCK!877xi5? z8t8hq=?76^R{2jPeJsB6Ao}Fnn$w4SZued8D7Q?TQjM-)O+OOPL{!FD;($p{OI8Ymw=cu$xe;Y7%rg?U)Pg~eb<`b%fu$K zf!2N~BW(JB<6M~C)2eo9^+PEM{@Yb;W_)n3W@d;0G?KU{S%RtxuZphysEGjiJBb_m z27#Th<4QTZ{7D>_8;2Gop4uZCfm^72a35laMDf}();6cuvMiO>?Lbj+eLX!Gglplp z^%j+$q`+@}SESi~@*0gDHda*t{NOs;C+=fo3*SzaA`3rkI()^ti zx*B=S$xhql;I%ez%C6D6RV+JXRi2^NjvdA2K;nCrI;$df5Aw-LF2Rhf_#E6Dk0%=J zlCmi@kcr`{;*iXPsxSksF%wy0USHnqFA3xAVl3IOxN=7~A7dndvZ?gKDRyErTcaOJPVnERXt!X1ACfp*q@EcjKeCOAY8)Te@NpyA zdIPy&YI|HM_q6~L&t;oX@(St6Jt7y}LS=({Q8a`$nkjaLNOOVGe&4JeoLOYKMAmOd zk*5B>UJMTC>bAk6)RGhhqHovBPoK$7eszlo$WG?svNY`)e6&b6Ge~ycL%C_yA4y5_ zSN1pr^&*8XMSdYUX}cY~dQ3r!M(t9t5h;$%(bwBBI6xXVNZHA|_}F7;Z`$zi2%(3ka$dwNxz&=7>T$1P;S0gCE1S{Ahb91a5F# zhmUh+sv}r%idd||DyVG8rLh|MYHmuISjl;Id1J224&~{{g0PN)`!QaB{a)Qsb+#aX z%xi*<>-$Bba?)Ji5c1hqnGc_Ux-A2w@+ga~%LvI_d-VFvKE`*8q{Y=}N>!bIR#a1K zUodI=y0vT$DyWv-G4T@X^R=heW=Kb{{}>$Z3Z3&RR$lY+0Y; z^r{A>vlb+23Oc}u&7i-29wOPhrpp`57kE`(5Lub1QdoX}Ojd9q@B8vLOgxFtNM1sm zcSD!2ZU~CD3ZS{zLjY0vLV7|m1;IhV;?BxAYxB*w-^{4mKd-J10>-E_E${?!-Zi}e z<9`z|Nr?H8wjg+`fcB7%ob0f&)y2H4wU?V=gL^5>(7Xin-Y1^Hw0#2{cnifau-)Ks zbRA)O0(t_IO)#y-+uHx1Nga+iDki>JoGI=5eHm~2@jCnbA8eAqB3fbW{@VI5egaWw zBs@~K_%msT@KXA0+qO&fwk0DZhng+sYi*7R)cIn%M=@*n4T`3J`iAvZcNruP{EJJ)^f2;BYUnKQU^OU5gdY{JO@)+UoM{ zPHwU1h~PUxwM?9M)Ym{j_?3|M8Pp&Vp5Ae$?`o$T;W*mOO%h{gUU5m3I~1@-ZI0pq1|3SV6;V*u$Py*{bt{ zG0$2p!zBN$)wX{Sp9i_n!s1ox;vpOEyqOYpHDll;gMu|;kL2(8 zgIA9tT5Rn4+WK?~f{F?JERvh}(E4#tX7mYpr~D?omF~55?TLCdO=Bmx>IOw`Hk2VZ zufcO0k=k^Q#j4$X?pw2}*TuP-2$ta3$V;xcQ?yI}qIReDZ?gxO z!l&^LOY~dp5qUUD9p&>WsjntKC2`{KpV{x{^~Mj9V|2LZU9OY0-q=SEY>x=ob5MD# zS6G>F|Bi#so`W-d;#qt<#is8F)}*0eYTV-6cfnMveLz;D9fKzJ@uZFV{%tx>vk#Gb z0TrwoqMDD)Ylb>gv?bqEQ zU*02h_CC|mr{CGm~RDR@AHaWbcU-8!yHeND>f_&%7T zMV_l@**NJAuhCIpOyuIN9Q)i=j&p}=r|5t5n&KE@S1HC>4o4ko?gsJ^b|J2(C~k4O zzTxK9GeGg*+tsCZHgYVWE}9BPF7si@Co<5f6P21m>=t;4V%=%3p=vV0E+nk3EJtLj zDh}1LX!~Eis6lzzABe_oaeq9dyYY{$mz9U@tge-qJmiD#%8oS@zV6`D5?NB*WclU#msQ3kR+%dc{RQCV7!?Sp*5-i_djOuWb5-c= z%{_8Saw%s8HaSS+ule%3!Xv+%)I04n$=0049~1GzZ32(aL-~7z#osRae1>FNtmUtz z=CcTDgB5*a8G<729sZ6_eP>B%p6moan$LPs6m8SD_qSvB<^Q&4Ve*_OH$E+p^vlUv zjHdH69s!iSC4Kxf7LEdl=vrNQl+wZX8RlC{#f8f%+@dWt>Sm#WRGIKH@;XYHCIh2i zHEZV366<|)Oba+LkOpI1!prz`y~I*`Yk!fZygXF-sON{ppis%J8HV~YOpRXZu63|*;9fGQJ4pL>^`pDXgMlJoo_ zOr0^}^r8JSZC0;?oVjoJpY57$lb-iOy5hVtU<4Y90%NSD2ZFG>Skr#W4iB&%cQ&~1Q7pG zN_Fd1k_B;^c%XBCT-6*rc6WTT@wat7xSB{lE`D!{aV))12v>tK&UIVRz%$v9<@~_? zHPl)gT1TVv_r&TXsTHnN2ZrEEjh15Y(F{KFA@L6CYLp>KW>xWK*ifR&#!^4L%xBoH zAzv`AZNpGs))w)u?HP@pEWiY8Hiw*Xr?e|pZFoLvUJ<`>uW9i<=2Nr;n1`n3pC7{q zlR4dN1PRAyIL5LZIw9N1c*f4G{3o|7R?u&I=KkQ*e3zYR?I2l`s_y{-pU!qB{L}~` z2Ic~HP2zRycj$hEvcQM;ws;rjbG_#-WEG^QOcuIe z$U+puowtzWHAATfMI-Pz2`^b((XdrQIBR5*NjaXE^@^OgMH0Y;ZSTx=seOB~xaC31 zFb&8>K(&`Tm@0|Ma?K0c>?OA3m40WvVY)4;^=j?7Xm8bra?omLk)_m(mu-o8)&&Ie zeX$Ah%E@CtrkBYXZPt1Jm#f!Rj@yGGdUz~^a}usx^H+=D?mNpl2;-W65K0{C9kg-? zfzL0^CXH-z?AJpf4knm)BIcR+cLJLVi{pJN{&N8#>IU5|oV?_{wkrH#EcR9*M*eGf zZm)l~pMj~pKI$Js$R7i*eRBqe_WJ!6ugx%db1mO3yqtb%b!`Mg^DiKQpl^?A99`REezg}=Nm98(gikT=^c0&o{++y?f7qB4bjiwsa(hVSg96Yp99~T zPhcv0vC--YVQ;Wb;Hc_jm@N35CJBFbS8wvY&4O?`*mV7b7~p{e8EBA$?fvG?>HRkSvUG(FS@_>6TkVbkO!X=vkzB1(o^2-)p9TUHum5aK zGA74cm?VJ$qK_r~RO|bvFVyTwW1BWU?>L1QtgSeZPBsp;3{fxPhD#GEZgs;}6jq^t z&knIz4~50cg{Z`4lsGgKIKQ;!FcELnu~*oAhgqgv=KI?N2`Y(_&8&86?BBvc&9m^7 zpK&X4HflZwIcgV(tnq%-#;j$G`xNGdEaPfPJl^rz%q8NtW{X>XZyBNyg9I1$rP^~6 zz$ATMx{m3ExgCi#TXJ?v%i*%p%6FamjCR(^r4Htsc<*#!MU^eUM`4Qu{lCgkf+B#L z0fPY8jHQe*>`J_wQ@q_|UHlcrp*Z9gEc^%3kaF)|kWk{@k0e=B7fvVB54Z6-x(fNo z`C)ao+jNrVX#TL1=|l@q4G4dfPl1e(a3xKNzXA#mv*?)|V==~<-j8`tj-4Xz51yQ0 z18>^7eVL@HX#bjgUy)ldjVv#w=k_GKg{fYaE+d$Mn;PS0G1i^!_()s`!5`ALJdYr} zo-XRczi0uAE>orEUblgSBFiS09gshl<^Y1%+a*MQJTR*GB!Y89c-h+^#DK zLhEU&Rf*R;;HMrlCDLva#divxCVmd!aXatreY7^%a>j7%VTOF|yc=3D^s)7MuN2gr zts?Zaon?r|T^48W(JBo%yR3w!YRaI3qWWf~qlu^_=!at#*w9(;y#;Dz1Nu)HuA#-b7j4=)E&)l4(7uyY1QvOp163V#f5Cc zWd96ydL4v z5&#Bn9KXma4cx@9o&{K8LaT(bGfClO8fHa_{gU&yQ0;mSDQ;;YGjUNLG`>3gpDf*Hukm1%hQF&D`1CG~T!T-SmeCANADUm@*ru?y z5X6Va@T)lNWR{J!^g{`oI-K)G6%A+0*{alPufh7-GgV~6spg^Q1>98=pgSJeZk_st?{V zU-;nmf@Sgf4MTeaC8mqAH~n&2V(q%~mu$9Hrleacrq+B0$}Ku`frK%AIsP)+2YIL6 z5BwOSTG|;RVJN5Z*Ok)iA7jtur&EhM4PKr_80Yi_Hk{Z$JTgJ@_{G**2p#*+e)AFe`tRiY)b;5@l$2XU+N`y*jW>O^{@W;qo} z_I2Jvbc5sa6neMCo8lLUx_v~}o=jP`088)9R0df7`-ic8U4r&e`=}H4;ovC`B5$_t zTbQ2_Qnq>E`mG}U%SDn$H5y-0>j{ghnq2GFy?veIY#wWNi4_^z6KRrroPO%Ed*w}N zIPf4~V%R_bwi6*fw>&*mK)28Tk zX&}@MF`5Q`L%pL2SB?p#ZKvY)|I%l@t@g=J=bINdi0Q)~S#x+fujX{6;ca*Ll@=g; zHB#r^Br0h(z1CU)y|N0)681*T_0+iiDQ0(da7WvXKhu?*wO6M!;QaDpnykqK3i9il zRQ5(9pWOhQD?{9ZJy5#{R3K^IatoP0heHK}M;gObl;p{JT4G7#(7^6im1lta@X z82MRz8izm@jReZV$WyK0i+I(IlV5Qyv%HcQVxfkhfL!r55mn^#U+zUKp|0fT+Pn$S zfA|bTg_(~QKHiIv#A5PZ+rfK-82<1(8&3Y!f|!};`>2&mjpyt6Ui_=vF?S~8?R&rq z0t5!gbE=5%@^^M%Ax*7^L`$#O>~~`f=`pfv%=XIsqzH;L#=t=}J*=<(AHVr0I)C3_Es{-4Z3^QB>F*L8F-MJ83?l09WF zIEC_oQAp^8Yft>x!E3kA#=&aGjFW{13P`mTEnox-!~1RH6Pi0}aYW3-^6$Bamz`2t z0RmGO9H^)I618M%$?n}thXTuc&!iddQ=bK!0KKiKXvd{;|9{=D?3@ z=&hU14Mptu(z!98@EH>3W6^ymd3Rj=JGx2yA|Ck+Idg4%9t|qWNXOtYRyJL0LZ1B4 zE$W$Xuz#{cRh(F~cH@mYv)O4zSMbEhm95HI1NbpbNf$T2vCs8T`Vaa|9doZVFpabl zpUoRLv3zxXhd!a9?2RWEFbyH_k@7tV##>djSa-0?dmrS-KCNz7yZJJT^v2#vM>?`N z0%b3TpJxEt?B<80Yxh1jmWp>}#wJIVi6FDkJ-z2Gu3Ky@X-(|2G~Htjzq%gi3|{`k zf+RgwVSb5QBD;fZqusc%HeSLNr#$70yHF45_zRTRfqx>*9RmY3PH`|q+2^pFQXC_0 zH}I;q;*zrjxV3TNWrhCg{`f{_hJuUA>iuw>z}@kz81k35WY9BB6xo_zxOT)M%s!8h zm$w@msfh9X5bv<>vc#_gdcPI88_)$2owbOH;pT#ZF}mq3r`;hHX|``uYTh-;_H9N! zPV>q6F!&^UELWlG>g>-K(_*pQGAKE;Kcy~PNk^KQ1$x<{HBJx-^h!8*L0jz{+@o#j zeajWg?N<+=lT}Q6tq2Y)3C8RgnL!XDu7ZdfLh6X#b-)|y&bZe} zQ=7=W|w8Uu$FWqoDAyvahNyVUd3EmTNuoVt1aThFIo#v|k6GOxIMC*@K@={jSCDz^V;Cb!+^9@Tf|%30ZQrEN%eh1_1U@uP zWUzWiz5x4XVg&0TP((EQvP*!A3{#-Ger^*(yaJ^_mIO%dP^k6`YVbD075Dm`tK`yCcOUp#wo$7n7_vBpg% z!tg1E1at@$wBO*xc8!DZD$Wu5OZE z5)3F;;6c^I7UEApISJNHFiEE_O@UfxEPgk4V~Pe5^b@!kqk#@8 z!5si&kPiP3vAS74_C$n#hVbk^6QU6z`3s)JCjg^C+pg!BXTp4vZt7>2eu z-(qRyl_ci;B*uuI*|Y9-x>V}}R8s6pnsUtCj|?`ukDohIEK^r+%z|$c?q4{378}BE zgq;i2X~*veYqV)F>ufku!K@mO>}s(Q(>Wu$-d+l$r=7wJDG4IH)0SNNXG`>7)0(W4NZiDuYENEB(K0P4ginS^A8(rI@2V9gL_86on#2R;?mQc1B`LUrgNW7oqO4xpiS(iV+p6%bFpn!AL^ zPzBk$!ByP85#Azm&@2mrieN+I=3xJIU=)--X4zFYz!4~3e}Ub_51QFBgiY;+j;^XE zj&n&pkI*HMLJSsMe*<-QoM!(ylNpWV%U>s}7~)m%E%fFUuD~;sQ7^4jiX%*~Xai3C z46bkl9RqeMj#GI~1<*a%AL3fsh43{~d$2S>if)k7Z<6TC;SL1pjQj zxWHL5v{+;(b@;51w?0%yP9duz$Qt5^8IU{!1gnc5jW}dCfDZD?&DdM42(-*x0J97G z>na?cKn?t493-7|UX5x@zU=6)=ZT`puWT@RNT`A&T=3#hMV~f$&kwmwl>fn}>+I~V zD0}lkW-1ei7!@=%KFHZXiLV14g&~Vz`Qf~uN1Zqtt=A=hYZ(K{fr`AN(~T&B&KpNN zXwq6%Oixe{ITam1RwnQVQ7bpd5#f!T%}g-wWY(SH6CJx_0Y2ns7rC2!sI%$B9BE4D zF8fzHw*V2+80?`y`;8mC?;WW?kfWWG(76k(sK8faGOe8gVxKR63aVEEwqNw8^yW<~ zG2{dnH)2H6i2sK=AzQya(h+aP9q+PI8oD5yxV>hwW_y)@A4DxZ;DhiYir=UunI&2- z61|7Q%m4;HIPSRVH#3C<3?LCfJP+@p*+Zn{Ij+M&{=Lp-uz5S<5J{AK5nzd@OydKU zM_!)w%b#d2tt}CO(HeHgwyhkb=4{`(}1}r@~0_B38cXU64#QO zF|!f>_s;n7L>i+Fx@m-w7z#0>%&Xy&Az(p}ZP?i~RbXNx~U*Z-N9Y#$Oo0+KS;+Da1mL)0O=L2 zy!e&_EUVs#mzZTH!wU=CI@=D1Svij6vV=>cG87z4tZ`EXQC*{8heT{$w{+&a?M>@y zh(T6O*ru1)>#_3X(}`Y{a}n`+zXucawhKW!i5C07EsfDY%}W#wU24)JzKC?QL{332 z_T*NO+caZKMD{0)OMRuwDI(U<n^jyL1N$r=n$0$SE&{+7IwT*UzBBh^q=M=DuHKT_{ z;wBmn7PG+KHcRDKA)OUN4VdN691vnHDP5^5<)-36!>u9_E^zA@4}=^~>QSdSc>Pd# z5(^`8Rm)_Gvq7WOU}hLZZcS2}e-#mSldZ9FWW^M``uR~YANvX3EjQ6aGA)XP_$X@a z0y7jcmvmuSb+b(%E9NB-_b7fcxUOaG$KK;sC*Nt|yz1}~k|wHY@k$hXJXVMn#CXsL zXiO=-_%upC-M>f~8GWXRUBE)FR=fewt9waPgLKT-)UfISj7Q?-UD+shx&lx7 z#wppu84Kq?zd}Dpp%&c(EFc3Nj%#%PTRgnc&2YRlKpsl`S>#y}y!doO%x@3fjtnyY zRqd3x0<$FF*~hg&?QCIV=jz712AX1v3NSFvzMLT^zC8Bm@FC~8eR(yX>ze^Ra*hgvd}w_=_T3^&#{rwIep&<2QO$I1*nr2H;Pt9OF8 z#3F_`nLyP7{;pobaA_=L)HN@$yl0WF!)c2U@WTF2WbE{Sd_ZRk{M(J6awHuoBt!Y+ zQ^W_q5`A-m#IYhU-W81l>)Fg%w?xCq%>(rzI5F0I^JaEl;RP4+O*|WDYL?I*9Z>Tw znOb~=njMt73$4?K~+XYnjAd{}fFI&iQ4R}(nE93Dis@H;D zQe$uug=gWn8c{p#o0sgQ2Qc~*0JLZ&jUfO(0JIX|9;+yX3}EH~dH@6^bqm|b!YmR1 zO6{ch<3`?Md+wdR&;JxRNs&^;Z6 zm!n`37)%;+UTEUY&PP2~DeZ0PbSwIm@HTR_bSzM2uN=r~0ya$ViK;(uq;T=1eWd1f zj-^%DaSdDEAFDhP4hJ&3FYE&USgrZ&jk?H$%YbBNE0vkH8$W%m)>) zxavmwZMxTkH~r8Dzp4fnxMHiQgcRVSrpbNNa7uGsuhm+zw++BISt2}?NxgILh~KsF zLl-SfPpCdN`KlNu7($d(AhX>q3J&VXj}h(5(sX_@u2aO$BiDB0C5Xaezd`Ph2@aQL z=`H!Cm1Lg|W!p$`ueBrgYKz9v8i{%eUjw})t6bq<+oxltOB3!7;M~IEha{Py@x`>1 zy_s=dFOP{jB^auCuZ)}|>bjF#qj*<$(V(bYABvJmlMSNstKdo^W-6 zp?jOyYSiut2$kA27m$Zszes@)3j;0khvDrC1de;^Q0k6N^2$8Z+sS=~ zJB+nydTU{6Sb}r)hM!=-b-lZv>tIzg%k3TKN=+#qVCLarfE_UPixE7PAx}))@|PGXz}N zVcWZy&d&dxdu@mHuQaIjj-7Tht^ZThrLHJ%scs*wRTlsIV!Qn5-HH6&hLO6z7SVTq zmtQ4m3YEMN3S!nL5S_QVdq&~Nb&B=64TqZNzglYLFy_GJZg~7Jey>-YwTS;xZ&`NL z@h;_Om{ICfJBooc`emlQQn!EfB)e}(5N7mvhGv~1@fHq2M2~|0Q>GLpqysaspZOnj z2F=K&UyLv5^A>xwvHQ1|2uS^?JJEjau`kd)s;reW`(R6F-0QG!F2C)B{vj!X$*L+v z5#7KB4cLR-uFdIPUlL=X^Akv!plQfZz>bO7MDu zcBezWIQ__#d{|3xg&BgzQ1aWdlcXI_1;-OVE=w+Fi=|u*xdoF3>QKGI+Q&^3y5M7y zV4cUvF07pklyth0C{qRBvOd5>N}({!5YG&Y6vOeqydi@m&7232pfa2LB3YrqOKB7o zKEF16lJE-*=QKqzC&P4@<*0e8CncfW)|+La%AtDiOW-o0FuuduTdhXYJ z+tDsi%4!HVwf6PFkacSmF^z!xkW!0m>3my1kvcai=H8Aj67hfX{bJrf%Mdlp~ORBv|t#PgYf{rPf0m`UmP;JfN9p zEyYVON@WoOd z5RUOXohGQ`WZgtDNE{}WWP4uP?<>we_OuznG*^h6h@h>zNaFF7b0Tr#^in>Z%{m3- z<_xWdy?tcoZ)Oor4zYRt`u+=cbe2lo2Bztx7Q5`CoLxYpC)x-6V*bcu{bdkqEFBtF zfQ=ZCj(e$2AkmLp1whCu7vv`QgRmVKeOqks@Xte^Jre<*_no;@Q?gesCOnkzdkPYR zuyeDJb(?v&&q{qFavbqS=B@qC}<@Mf>PcU`EIUu7!Q4i2ep86U2BUhLot?%XHw|ceitE; zNUmQXKyqYE(L!2H&L+f+hnN-x6h{r$5IW-{Gkf@txWk*TPVJ|nd1X>ski(+s%t5Xx zb0pc&7{-ub)xb4heqDj7EwyIXh`_JUJU8a&b$eS~|1b=&xtJ&LBhVNy&VUZY4rm zrw^>Np&0=&CXuOm6%EDh_)=b%m-cF$I}Ae52^5Hc90ar)@F}2lQQY{V zssOvEd5kgfxH&wdM{h?F8&R6{4)EyXWPF1JtrK_V$$v)0jCcb5+Gy?~B^D@oKc`~( zNc{LRG&_f#b5y( z!P9(6`mv{tJlZINu9@eS%_RRIlpYEpq_m2)dZlB}8!$RSj(UidW0-?gfJt`X|7yIV zDrRmQIw;sll3YK2P=0(Q0ylh2bg>|5|u3n}Sl3GsSL5~Og7PVhksHW;waRi`0*6UCSOn@lcubbDc% zf<1*W-inHJTIFHz8i$eRQh?P%xt6`W$Tn2ZynX6jE1#LS5WDa#w!pvBvTP<@O_8EM0616wTWI8lbDs;@ht7YrRR* z5XA}l*K-meoU?S5r&>0ZLE2u)TnV2?@&9l|7O+!pv($Rg^wEeO_LxG40IgUX(Hx*Gz z^MRj?r>BfGW=rP)76lhM#?sWwaoJMejr({Sb2*L07{AYsPE#{iW{y-ecjzQ^(R4Te zuSX#3Amkog^bFQaPhbm<8D@d+mH$lOwf&{ESw2ZL#9V4Y4WUVIx=;Zehe)Ak*qV;| z;RL+))wa8mDzunn%wFP?N9tIZd7Tk$cQ1fCA z0wB<~9!Jm=7#WKGm~iO3lJKDttl!YbjL-XpA+$FDI7Ov;&EZaT-XPJ3BV8B^Qbb64 zr48Ua;9FWHlP5PQ8$fD1ZH1yARFSi|Ku#{~kRcEvy@I(F);ONjgRJcPjF;YdTn{wz zv>hvzx}VEwH?DV>5Rvo5;jP@*b_FZTKwVu&6l*+6M`%7l2LQFng%_Sc4YVh80yQ&k zLNKY0xflg$$q`@pYRBuPHiq{gWnC5*qIjC_47DaTj0rl${Ly#CY3|0pV9@LI2xF#j zFgcl&nyOl*(jwi2JtuA!PyG8Vyz+`2(=$r1BGoqgcL)UYGV!zuD;!T7NnT8~R~@Eu zmT#1f1*7HEbP-ap6=?b642%UQ&fgp(zkFk+W%*~_iQo7E78LrQ>SyJR-a$@K2n<7u zk)x&6`H8~JXB{OhZcBK+Rc(Hv*^EMxRII>CmTb=3sHOE043>7NCryeBmqNZ5&h_s! z)}rQDM^Bo#xg|Eg+H?6A+PJ|010=SRLGq8p{M@|}eh^}h1nM-v&+aC(z73@CuebrEBZI+H9LWj0 z{r8fT%bBWRBap)8e2gaJ6^=tZ7g`VH|KU^WFpacRjmfUHP+7Fzd z0bZ`+au`S&kL*4^bKWKVOvJLQuCm8^*LF#iDJ5!M5(mn{6 z>c}Yq+}ni{;Q~NGb|948=A^;A?z@m!5bP#sH7EO4*gC?aLsf48wLR|?`gSZugcmJg z{j}QS6>IQf<@zFDZW4g~yG337pq-XiYt|x7Li`_tRe{qNBlJA7`T%F*j&uQ`_|J*%z+=tQtD+BTd-&u+hqisy{LVoHn$&_T}-UOR}n7{kA`4k8#dH$5) zl-=`&U@6t){CNIXj=AK1c=*gb5F=DDZ;}${k7}Ts`#S)mq5e2^wxH~2K^aQ2fVkOX zsv9nfk?|ss5}SpTpHqe?)(^E|Q4i>8mqq_u*OdkBZ3odQGWL|i-qbvCwKxbQlMwnW z-JOz2;pCui?)UA^Z}41PcQjw+{v7H7JElVT`owe*QnU-; ztA`bOkHj$&XxM|~uP88>H@Q0r8a%?HB6z5NV-Qtof|Mhe$^{LVELYYRLxzX>(YJ(8 zqQMzo%&0u0GoSZ4YPJi@^@}I09qMD+Vl4|NbRfTZhYSzx(QKzumP<*xn0nn8S%;wX zh&e@7)zxab4ctP=A@^j+vYgAF_djvG=0+i977hj=QLkE>fu}SQCRGQNyBWp6DxfeP zN})*F$yz#llRHMb`pE2ebJiMxmITh*i8`Vsrwa=E*OGUpa4UcbP<@d)TTt~hkjmi? zEiU|yxT&MhH(W?!<0&9HFdM1pldqBB#5jtrFo&_4`6D4LXk2(DXj;!qm6MV=P|#0q zL~$_`axsT#90HW|)wJ=n6XEIo4cnKe8kiN{@&%F4eg#6(ThUa|0CiC9P;8}RR3d8D z3sj)mOto74)!RFrH@wNHNW-hdh^s@V{{iJG3((7B?~@ec4odbkROiBH5#ufR(o9uD z6c46o8V6RMGi7j%gt4PKd&g7B_WX&(N?|vGK!7@_I!O5CmPn+GXl4JvH6x3sXjdml zd6a-Vw@jTjge}GPYQ1U*FAcg*e7yjSz$+d}7aha3jKhOUmF`|=AHAH%axn&w{D{{M zVFNM_N8aItlm;qiR`d_lszFb_3OS9x;D%>w(A%i1Tc`yA7SQ{k+y?2jNDDd5qviE$ zW6jF~x)a6kEQagNdW2ep_#7n@3jLu~RHWTVVJXhnY4mdcWFFZ`gcC9r(JK_5s=Ds! zWl7LH3}F%#ufy>HLLJzeW$J%1zx;S~M;we7Lp%+%yMLhFz~U(jV_C~Zi`fu-m6Q5`!~7fh@JM^!&}Z|&X^6RWTz65v=s z4M=#JiL&?9k8rK-8rR98_=!z!3;)ISNUILVW?S3rt%u*_pGboJmROCmO$92j;G`H@ z(Wf??3|CSU0$g(^G^s%p;ylwC#RZBA?r^@`7GCEQ9XPB0v4{9nQC1S*fOrq+qEzB( zOWpaM$10Vb6$P(B1oiAde{HD%Hx~yz&&V9DzPPeu=qIm)R=Zs+Zo5vUtNdki-ZwALDxvJD!Q}yY5IF~#CNQLj#tt9twbYxnVR4-Jjr6!tVweIia zsrs$ctSaC1RxCJfi#(p^#CE4()})56IDt$C7jTs;OADA4jI9|1(Wh7IHDt$9Pm&EM zH}PWmc*9+eaov?mGOmGY zKWJs=F3X`mHmhK;&oYj&Yw%8~5WpV5jz3wTUKVLV1i0rK!`E)~$l@wE*?C=vA3Dp? zg%o(}HDLDw8KK$a;i+Upt+gE65f7xp_sChE0cwxF3YQl@?is7lyXjPBhtd73rTqYj86LB9K~ za16bBZB~(FNeO^^o-km<&puW+#}iK8V}HG`7;nv#A?`{I_%-lsj=`WGhM2YpSX#q& zAzeKN`PDA#YjAcTvO9C{Ac=^EBb)3WlUN3XIu*vQ)o5y6_Se!6Y3im(?}W$C=dZwHD5V=Rz}&`AhCEF%WegeA{x z&4a|+!RCx_AO*<&))#d4TItj!ITZNc`6ev0E~Q~+AREUr+UTXwd0<@UIm+g&dP1Q* zODj_2O0utHs0$gJ1EMI)JKHWUtNWO?Ldz0iqym}^fkj}FpJumZ@vxA^8}_Tf)rQ#a z#2+G&n%rbVCy0S$N%{$xkYwAcd4J0MTwKVe~`1Ikv~ zuZgg(yxu4UlwtPS{IZ7T-~eHv6A@}RAN$6$+Z!mflG*I>Cjf~1pQjO3;q*HjD@~0j zGj&C|KI21oj{!3gCH0eB9Quc^LF$jF=oAt?xUV8pvSyJQ170ox91D`Sb>WYC!@2lW zG6w?h^`RhrF#Z#)J=Ap?i48@M~-PgGDPnnUqr;sAmdVkCAUP5vdyl zu_s~5G7F3-wAJIakAvp6=1kABpwc*6JRk3}@XNU< zz@tHi_RdItzB;Yk*nA}JvsZ(OpvxGk7ylic<)Um1aLCYFxX+l@7Pj+mCc?}b7u919 z4$Sc+wEp}TUjV$~<&}v5gG!Ck(f1N;O-$A0oX%CBjZ4%uK%x0)ZC#u-i$`x~npK_` z02;KnJqmjgqESR8MTIHTl4ZLJOYDiPRS@sk`BBklz7_TjgC?izVe5Zyui0a~Kh~71 zag(Pk{(53Sg40*DE5rRVN_2k4(BTk-vsL>}W>sFXZbx0!Y#hsLGnUmgx!+6>fAS_S zYXts9vDIOEQ?zCLOV$N6>_*l>mfJIlLr_4g)ZSgFz))iSVGUy|B-X)S&x$Y1Z<*6` zS^?Z*iG(cnTT`QuK+bfUNr-0#J<8+r0hmGHBdIQ{Um`D-w=tj(Viz_~oRg6n#17zz zS@&S#7ATB?ybcPjD3$3fgCO2J8|0r0qNpQ# z4uy*>w$rxlSA_?@NAF0n`O`&Y^qjWn}8XwZ~SQrIny3JT-rc&+tZG-tMR`Wyl@Xe zo5SDJ*^6o2plHUbnjSntT*6iOi);qmit+rfIp&`(FM9yO*b4*Y?d2~j{aQxK0P?2v zdmj2IjG0-q^HWdo6Kak`=jtf|Ab(1BnX8;ln5O%3litaqz}3`BN@!PZ?T02rE%8@T zQbiH`m|)5MbYlWSCO`GfsIj1Mo?(*u91Q3$dj4*o%kmmG*y}#E|M^|%YD?`zKEA%G zEA4joOe=ERlPj`aa811r-?9C(eMC+U-f6&>A+7r>U1e;Ne{8^JI{x0|`mA{BWtcai zSd-Ts8|EkHtnD(qnQ81+R$)*DsM8U+;g?Z~n{N_tYmU__0zhuNI*_u2;P%ySm<8N) z?mzyj{a1Q3yea+N{e#Z`u%A79uLkI@>q5WI3c{Z}72cgN*nP0n`fEn+PR>OKN%Bvr z@JA#@6^s>APtNQesBWgrrUvGT-VcCzPk%5svl9MBu{cymwl&@qS z7`qjTmBn6Yj7!wFXi63XJuhnmg5M!7iB0gF5wDCdwB7vk6mq(?&o?ChT`r6pXS|*I z&?Ya${nnR>IdPCt$5W0Q{n4d{2K(PXZ<<6=0-6C(W<-xYuM6{Rh@C$OET+v~9w@+w zr&ozlp=OiZVOoI1r&>R1RqJ|9os>3316=$9Sf$<>=6Oxr^V&C0ubxe543lSA1^fs{=mhXaeaw+^0$zWG`sv2Il*x;G}^N)`DEc%r@MC3{llL28UpIKbV!I-H497fUZdmCRrk z7UZmSB25~eXCCn161r_chY!hcN_EJR@s%5sewC+%{c?~OZu=y{4|wOo{?rFDD+_$` zPa9_uI`?8&!@k@rSO`aIC|=4}QdE0EG(HIDei+L3)u(1emXQ#`_1sCU_`o5cEG7cK zgBUoAmGm+R^h%^3O{K??ASlDi@Vq4(Klm5UI4Ps3m zxe{-WuQ%Ckx`L3IR5+BaLm>ApTS@vc zRH833N-E|G=*bA;B!N_q) z#7&ho#9QG-AjWq)+GKAwfRiC1#sHG1bK-C@2f)4M4(uhfv4P&lo`=YkP% z=h{dnP95zD0jCckPG-Pj;%y6jy&?1o!NvPwLkH_zu;b6GX!SHOL8nbX^oD zn_`d!bO}F1ujgW6vqN{hcp+Cz-Eik#O~NGrqghV2V#s=WMqpWqxNa5v$|r-_WA=y$ z3sOzlRDkmOP>fc6RKO4@5{?j*7uc~x91t2`fV`2o?@5!<#j{QML?xKRFigf=vDo*Q zWbL#K2nx^Mk&r5&2%)^w`c{tbzev7ph)spOw{9ir$EKKkoU)}{v7DInAJP77hh`LVPL-K8=>hBWzU8z30}^&b=5IIGyEm1 z=-o=hQR)AYO{#>f(Lvg`{3Y%0P}b9J%98w#REp~!cz+gpLU@4B(gLLoTD0R zd0!1D#-a!4B#S^CT+2Kl8AJqc2j63^k z!WLj}x$^`ajtQyVT5Xeb9Gnx0*D1;C&7H9_3%(m)hx$>PV^J58h8>_)-n)HF{cp0 zwTC9_AZ=N|AkcQ8f9p$HX5(~6KT|xx;9F4KwS4NqUZdv(EmWO#+Q<7jp*`A)EjIKX zAOstyd3o&elWHJngV?$;b~_!LGt|s+htoIDIT+LJ%GYCRG@W5aB!gS;nXm7T&c}l& zcUq8ttkSMmnn-E)&Yo7`@*1>Gvph&aAm9q_I70jd@|oxJ8$ERXmvwU5vp3QZL@MTX}?a0|VF6=OwBHT;)x^ z6~UGv`=sa~H}>+_%OHVxAF^6n5yqZB_L<@-2LFPhZrrCHRHWd$MSh1z?rX)|qlDmS zFOPrYl=rRS+&!2a?68WrH`7D&`a0Wo5sJcX&0=lI5SEs>cM9r)@-D)=?iENp4|eRUwygSpcKvSk)?Qw>dlPk_l%g~@p8pb{0;@`i~QJQ z`WL)`>(~v(nijd|i;}KH%TUhRoOiCM1qo@X_n+kXNZSn&yYMl^|_j9dW zeW)>97(xh|j*#mlVkxk<;K6jLml2>Ik%;GY;Rmr$c=+)bFk;4Jy*~6NX;Z9{AZUo? zPk{esP!AXGFg&6U^Qyl`PvOALdRt!X&zI}{4KndVZpf!{qKuGu-#a&5c7T`MYVLl3Ur@7IBk)T5&5Ntttz|lkK(I52Hhnfe@8Iq*m zeigGIU<=p<1=|dV;Kp(R9^zOr!ov!5JN-$+N}Q$Aci9Do>e=n}-cp2Cpu(PGCfI|C zL!qT0sQR6Eg_2imXsBg;mfu*cO9)-CG~Z59(H0vYEw;Zt2RQOzd%zf=oo@i&j3MLV z_CF*a3^t?wj~|kq@}lIW_y=RXg^RWm)KV>C=z55AYct@T0VnG)TTVrQITsyS zTj{IT!l8iZpOdMxxT{oyxfKG zWY!~9i}^DxbulzQL@Z7|*lte^Q-=C>*+0_p7ZCf^udHXv8H%Xc4wnRzi6QFoU^mOf z%k37^#+?Ti(Vgp|kivA`%JSYOgj$pPf~@Fr6T06?8EN15>DkOyiORStfcA;uJ*Z@r zD62(iDHVP8`ZiqmQpFd{LDX^A&J`3rMSrYy%p;QfqbX#yEZemi{&F=-0<2+Z1u_Ss zUeCAnJ{)uY+hm+W3g(bXcJA{ZmnhN+v6$8S@BAf3)M`XA+sdZrKvSk}o^J&6XQD;? zT!A#@z;L+6H-9}j9LW@Z!km=nM_%CLwmS-mC__*CbC-%|0hDT4}O zM(04c&+6p+NQnZNoqaS2zC%J1>GE;=dIp+0(kgWZcYZ}dEBlmgDk_IE1H3B@&InlB z8Is)ObVqc)bhk1L)n!th zXZaS}1Dse+Tf{tJct6P_(YU#rGj0}Q1tH1$0S&2zy|;Psh-oG}L-1-=?oHXpu!I{8n_d53ai{Ua+e=$@T1~k23h7^ieC72rJLB4+>q#+xJ?25S{w`p zeC!)hF9Od&ZY8US$B40J4l$}wa4m;^-c83%^1LVJ_#$E_XM2R0+#9p&0JA^3W3Vd{J)e8$a-N+A&l6L6`d^MX{DU;w z^4?8kk-~u9fkSJN^VUvNZCMRmhAsx%tABr6NA6LM-NBtcQ_Wm#=0dJ89Alc#?z7H7 zJZ>;WTMYd`<|}khnuG`8yz=d%M>{PPzYjo}JPl(-&)iw} zdR=+p!+v^4azA%Tc-73u{7h8!H&j*-@3=<+{CemU?SUxTM)HfPu#xjHkg=Ir-pzcE z8Q6Z`9&=P=K1JK+=TqB0-MhpWt#Tr@{=KYhzf#tQDUHW3)?j`4m5xYa4oW^QM9uOo z9QTPVo0(DVggI>iGYHJgWE|)mih{v`#(~lHeDGp#62CzR*6VU`KuWLO=&$oWJt$ z_x_OGisI|eQwXRJXdlC6nZ?2~cS7_4d?1?G2FD6F`L!l)>uz}BZW+3HQ2iBGS|Iut zH;~$n0Ru!&gh8S!ozn!zlVHxcq=-UDCPrHur&&Q$SAzG8tvu(WkFO$R7Lo?8vVTD) zIEcPZcrc|;?RlR)dQbuDQGeXl!8ch06Xn3_X@$tMi&?Jw+p-ju6-b8=^2NZBO&Zck zrBi18M}%0~RtxVAjV{Rr1IK~Z|lH<50uvbY|(SK#RLB%7=4 zA)j?DM0{PGZ19*75__=AWhWkOBK4iFInyZOFO1|7)w>*BQhMUK!f?bHI-Mu$8?-t@ zJr9nH=Gu((xpFHIWu8*HA8EZ1-eRJ8DED6^$&32-6F+D6a!07p=yX5gDC`CBqbiYXD?Go4<}+leLhZQM?~1eGuGYlzAxs z-z1vyl<=DwafcdHtPfH#yauT;8lxi&3k|{TD`QTPx^$I}<$7Q$m!r8bashtYd{GDF zHDZ;^atrU5PjO96#7imIReJJj@L@d(881QP7#Way*>`vzLV==&TpqsNkVL)g)@r+F zgj6VxLXtjOdVOFCSJu9ATYzZ>X#98EDJ#X0Yyu)RU7pFYknT}-1nC3dVKL64Df3F= zO?eXIJmG}tQ_4Gtg{ECV(U9|nZs#GVDosJh01sSaQPKW%$WMbb;_C&giAsR5gdhbI zjvz^=;_k*Ng!<5*!hPNt%+VgnleAFefxLjuN&Vm!9Vyxc&JoJIHD`t}S~op5>|W=( zx^)|sr0w$M(MTTcjN+(y0^H7>u2rbZ4=Ip2wiz~g+7Ki*^oDMGWWIH3_pAdL*iJMd zym;!+JGP6A=#lc4b8=UDejDkSc}Tz*hs!_3xni^R)A zOR}4epB!3RGc}6KsSI-B{YKZM`kW1B7`UF?^Uez^E zPEW|Ry8SrmKu6_B-~#A>y$UF#DA5IG;7s1d+dw0_oPQar;+3xxSn4g|Y7%sxjjg#j`nNa$w(=dTPCk^zcYxkxz~q+WT#`XTc-!s@j(=V_4umBrNva4#ac6o6 zmCZ4c6340+?tL@N4V$_55EF=O)AxKsQv)dQs;_JBmArU;Sowxh|Mg|7%NMEj26+0W z5;G&ohZUPdJT<@q_N$a%y(eVjVYyFYX$iP*YN4?@vXwjCnDg_rlN2A;yq!=do0B>V z+^G#8)8_65&6(YNl{Z9|aqzDaUSZH$6Lgk&q|M|ImiXWkX_Zor0-BNHm3>lQ52!(fy+D7@NBVI+6G%)AE1A~!}^eGH3W|T z!~4Rw6}GT_vKamQ30}uWR^c~GNhgsZey0ITpi4o~oe&gv!9^F5aka6r>CW)D-(*b7 z6B0+~LTT{h@zLT_yvW}gIiS$nrHGSA6rUrxsDN+*(ir%!lJoueSo-}k!(q$Et=;fg zX40llE)&b4d@uvPHob89=15L{WQqgb1Ly0bA|dVs9dha?F` zIQIPn?+biB9Q%H1HZo&?P0r@R4WX}auu$vmOSC+eWfcbB*EmbY@=7Va_{ZoUn=OMn zcrU%lwd}*(d`i3ETPe$5rJMZT-G759;HW;?9vZf1KLUZj|NV2b(?!bxmmIG^i968) zV!&0mq%QFMAHdSTRU6qSvl$1)2C%c49q_B1^%=vvFJ03n4Ahn;c)s+A?qNSj5x46 zCGhuy@6RM-h#bGbyLAiRZ=#JQ+(kpNOXRcIXRx22r+q)Y#f%2m&8{JLWVM(p4$^$0 zPdn8xB@#-?*(9*9@=P}}w{ulYAhaPKYXq#gTR}F?36V-|VoA(T#-~)N@s6|J ztE6CajTJU3rZM(RAJnS)rW30I^c%nmfB{use9Lu9{j&b&0D1APRX%C4mDeuVBDnCr zf4^Zo<_|_JP&ugs*t|0F*qn3L31lfd92G_JNzg(jFw=5HNRbK5(w|B!Z}CTnQ-y}8!pv|`m;xcT)IT?89Go_-?Ck1;nyt5s zPz|780TlxnaIFR?l>GbQ;48nS=96t9pI7;beSAm-=~5XV%7Frs#zS&*D?aQb@h0a#@kURlO+?f$EhTJt+AqO1#)P(Kxu30yN zHIRI?6iv2KFbgqelu25D1w5C+r$dU3p@^#wggu9`16Vh7hqqs89HEk83u0nYWs#hQ z>gyBr_2#dvKQjd-#zs`9`6k z@s2>jo1(8&({=X@=11qzX)uat^Zer&opBmciYJ%W-|gxt&IlT{xc{AQE8f#1Jq>Y;_b7-KY4M!3@?Ork3M*|VMWlJPxL1k&)Gbi+M!%2UUB zdzM%5KtAYL+@aBjUf^#ILbNrbnKm)GYLCr`f5j;H~mMxj#lWZoK1xR}Hx&D3B zYx}AnU4*53Z6fL>WCp=mL31xva%%=N z(VYIS2!{>YuY>?h3Sl`?F;l2!+NiDX6&a}#PH&@h;G>4*E4E4E(e9c+D?9%xh&u|^! zu!bGRqh$?N5whxAi&rX}S7t!#9}uU}e8CU7`K-f|#`u;OTs*MRpLv|~$Mgv!Pzd#$ zl!kKK@7#?>1+3WY0K$;_t7e_F`xdWmfmhZ6jjOpqsX!&g$ z!k0&$@_!sX@-}aM=n&By7MYi1bm^2cZP5P-M7vJ_1*DcBrLTk|m>>{0d5g?&3XvZZ zo4Uk6F-UQ@+BcdA}q8PL=KEB+L43z?d^X3o$(U-JXPE^V1E6OSkq&=#kH#epa+ z;qa<0=kFu4hYf@Q06`4+ zfKK~J8~8GI$itJ+#l%-mgv^~<4T=JA{~~GUCEnW!hfmF(b+3`8+P=H?dYb;MRY1E> z@Uh+8gPf_NG`(<(2B~A<=A^4C2MXZV!rlcMZb$k@qrsSKVdW^WmzMU0_H{ZF{u*=l z$0Z^F5GW@<#Q;P{+{8-qW6CB$_g;6_lZi!4q^EsKS~himf*Y=V+TqLOOc5VD!F6aH zW27Vg`p{)Er`SZ1SI{S8vEbADhR@OS%+G%z6y+LE=dX_9d27R3LHBiaqxP%7%Uk7x z1FIlAU6g1F>dg%I{reSM=M?A+vKZ@&PD#R9Ae*+(nhQvk%H&IXx9X8Xe1MLdF<=zz zCoQ4xU4y%i-;eA7S2OC~*mkwCpGwk}1$#ncP*yaZ+RdFZP3Ebey0Oe5QI(+%eLQlK z{--YxaR|lRVN>_3ng?Mfy|r85=Cg0h2qLEIo)icI@gxvNa+4>LSY5Ys;Cf`vuN!%8vXe#4RGe4;x zOomF@Yz#-ImDc2InKnSDrJiZAH1aB$I@kHq&eM8IO!M7khn|TDo zHXwqj^Y*Sv=e2!$TOwkEgqk$i(F>E@+-s4l>`!aDTMtI7!}l&9c#OEMw;&^sWk3Ap9t z3=xud2uMjQAlK(9RF?gd-h1|XGLz9yoGW5hQtj46P6obyq^a)b1BB~Fu1Hl4R=3$u z?hfbt92j6-yV9<=Gt(sAqcppmrN*k|dyr&tp2_#hW4O%|rL(>r!ISl=swAy%Y}I+6 zx2i4tU+ymE#vI939I4|&JD>jHUVke;#%8^FZ3BU)bsqe!1(_aqCrky_?t@XYH+5V1 zCHv(y%ewm;+KdTL3Rrh<64fqfYqw>$sjmrQ8a^f{_k+|uv{+iHhOZU@+atr=idb9N=NG^%`_^ zmP6W9L0k6Z>-ffFT_~bg5XgvuEWDFN*L3#Bg2s^)4MODF672_8s$VY$(`KUoT*}7=$qr< zvQTw|NZXVb@BB{ih-<_D15b{HFu+koWCp_psz~ZT#b4+G3Vc9^7g>XApObImHj#R` z*QpO70$P=!N;{tgJESmz^N?U(Zc&mR>r0ik)tf1Rj|h}}rU+DCN_nyueng(BV5%h* zUL!I{)j4e#lS;NZx+WkcaIcq!Zf1rS9QNZML?VvIgul|KesvTzR}0_@Qir7!DhobB zHLZ9ZMZJ^^ARR_N0yi{ql^sBM)(P5X4HHI+mxgBN8{$VeNARyg)b`ymJxSScJ z=D#-fcpmS*hy8@BrundF@6Ago@n_p?(|T-pcQ-1f=!9HQ873a`*+Lbn`wlNoPmNgI zt=kpFDORGxf`4tMDM*ZsD<`$o_$AW#gODqua`rx(HdsVbcL<^V+;`_E_UYP3YMKm- zb|t-07YVt%pGE|9SRklV8Y%0UAw6#KQQ8DV6~jMm3C3lmFFX)5LjMb7{dk5YqrlsN zlLN<<`<;FJWqllb2tfnLZMY2*?2*iBYW&IVPX8p2N|8yWps-BBE;k-6H@p27FHY=S z!kYMt!XPdQKhHdpWo^=qjIy*w;fn?Tz(0DHV(pC)VGn{=J1*yJGIT$1pS(@7D`k*)A zw7+NfZ3Jl zcc;HD3~lFh2>ez&F{W=I&|#AWQ9}$_42MHC(w+nzavm^_7AK$pH_p=1Z1#PLdsyu% zG$Df@%1nUM#9SCM?KCw}1S+PHM0@w9Pn<5ej7ui@*iw7uJY|Ug6%5dk*$8Fu(=J*j z7KSJfvZe}JuBO0?QNs8|Qa81ryh2q_y9-h#Bw@IN4eRj>MwNvxXd9(jCiy<4P6wsk zDAj!%LGhWgiv_f$po6hHQ&SF5=^0x({W~{9K+jC}L=HoD0o5V2J;?(86j){63z&Eb zf(rd!8ZY{8N|t-9eBt(R$Gx+<6W#v|#_G)rNafIY6FMI!UE=YYZ1N~uo3o>vV|-A~ zO;XF=h(SS;md1c&%w?i%ZNSt5thbacv*v&gyb_VK3!aEth{a0OR+$P|hZ(cgp;((= zKYTG=|6@dWOjIV@VPU9{Lt(@(dAy-Avrj+accH7hNfRWBNfv}NZ6TWsh5`A#zVJFd zaoq(9TG1OLU=EBsWHh4lx9mU>c4 zO;YpTh}=alyO=`1BuuXcXGl(Cisb3o1^ADB&r@#{j_ISj1uSaRbln+$dny!?Z(sX~ zW9%%?)$PZ=;mWZy#kp)cYX;S1Or9xENM0Q<_yb^0#p=Ep1F2~WTOb{0rT8U`6R+;S zm;&~*jPQ<#eJLrugl6qrxoSznNznx74HLpAiAcsO9F$a`n=jREWRWb5&JP_)y6w&2 zT~=xpE@ls%HP=??5r^A(Pk zRBFDKVg1?#bz_(qXTo6?Q8Vs5Qv&AgUcxZoi++<=!V=!_su)_`0F9Ihy2w7zw*`;7 z{B^LS#)UQb6-HPzrue#fYvWDbcOG(#D%%wo@K=kCwa_ET??G)_j zf6-XGvBMg_j$|RPB-{SAya6~(4t%&O)77^8RbGWf(i;^h`D4Bz!j*fHRHeH3$A6nMJ3h!?|1COKOUVwy61PscRlm) zD_6TZ9Q&lZCw!a2Dg@)X21v=3MgVVtzGZ{z<%5fo0MzG!;QH~K)IzX_!B~&sogg;? z+iewTUIF+Xz=H?=0b0u!k=9!5rxB7(a*y{z%zk>z9w>x58=P7IS==B~gf#2}aDMx; z_BU(abxK1fOTJKeqsNMI8eUx@Q z2W*pQ!HzJG9yR?{3vSe1-j9zHpr|LdFRvvABzvc14-}9$_6w;*YuZ zWXkdg(2|5POt6T1V}P6mtu;vRr9ri`ObUA>Ag0r_xSEdgNi#=z_+3G4%^B9-(>6a6 zJA9;6T2N>Oj;aY+4G)(9Zxf6wpj&pRu}8tFxo+5%hk7W9Aj!C}PB$d`qH2f63AUp= z{Lzy1J7b#T>mk9|;lrik;y>7M?9q_5i0}*G7Q#V5tBC-Dqf#B@i+GM@Q$RlH_7PpK z_<7Lz`;mapgxq333lmC`P)7+YtAsXQs52DebJsEJANeHQ(5|Pm5X~;rU05$tc7yw4`f_iGY?qYY+|wToZT8>1EU;nz zg~3Qi4*BJ!;YIgTGVj^OK6cxj8~Gp$^c*!)siEQlyALzD>b7bCq9yfYRj=ChDs&Me z^J3acfhzjYw$vGlfYV1l!*8BUgnX|t_HuGa zSDo4LVGVzsZRih{>j!pB>yIlO?J?4?KL!}nPLJ+RiWZ+@Q%PMfYwp12c_PqRE5diu z^pHV&VFhsQ&?q>gGwHlb9lf$w)EHH%`gKyeBC0Jnu2JRK01RWjD{u?qOeEn>hAcnH z>95;J{wmTu$g5jkV}Hk;I*&$zc|ohAozqLxXg8iy*hXPcBIrrM_s~qsdyg-# zY_69?yp9MjF^m#Wbv{30PBKs*sw7#8MdBqHao(f2=26f)y%AJGooNHF$xW;*jxPvH z#gngGw8X)J#39F#*WRFV>hI>NF0v7NH$s6;+fZPDi>`klq+Cf4+T0V8g0)>e+QuKg z*WSkplTx)XjikW^l?suTSGn%whp1J#-Qk)M@gIwHSX+3CJIFI0BzcK5C2=Js_)KDi z-JqWZbqG8V68jLnSa;Oo`$M9PLaVIRhCGLHx@m7|fjG_fT`Gpx8l@k#=%_c^f*5%7 z%19h+n?d@;GOCuCZG0cUvkw~qM-?Z}hMP(e*rT22s0_Kj4`wK+$gDs<+s9_rEi564 zUl9@R&nNB={7X^zrViag)C9?{gi4F7ho8nspV+!imt|Afo1t{JgmL2Z+^~DSIMsF^ zm84rqGsvk)?~Z1v`S`Od6mr2lZ;O5-f?$bRj@_b4P?Do!cFgu0Y zc;n^@{OU90#T=d*A_&hK=yhj29NqnJlSmpzllDuL;J_nmFgWhaCDQ=J>sb5ZR7SgT zqZ7g=R;UcS5`uGnfm|UL0!}Sb2Xl){I>_K;-AIv3+7lzsqHwH6!k@&~LMyQmB;PibzHs#AfMJJ8C@uH4YJbQGf13O66wsvIa73O8u=ZeK_5v+#0c7daC#ao2$q#NM-N%4AMPP(&dGVF$+ z&#FNJH77}ZICLB4;P(~lj8YlV`+h>Zku6ZIcyq{ZuKK(-6r^}L+M&;(Eh{d}G^A&8+)0muD#s zU5o>YrDVnY;=cHipZB?Zw#+BqB9kl$U$scryU^CETfIM*W51BJa*j{^U)Vcn^dgO& zh*h>v~#k z9NsI`*;=E#9`56EI-?5QZI=?dAyeckOYA5nQs7feMHR~HL>k$-mJk3F=~V{;>lxP0gAn90F`B-nxvw zog4b{ofY(yieOUgcx2Vgue9bo0ccQg1cv_c%q`X5=swS1)9%oG^l;Mc?%=mWJFX&KE z{0ON;Fnh)8^)5J6h#~VR;zxpqW!ug$k@Cwf*H9X>BFL%~uWmSlOY;|k>32f;1khxA zpih;fjn`!fh~&F2jk1H6eZT#f8PMBXM(U;GZkyjDc;$P-SoAuEO;8pMbAoMSN!cI&J>2(5~y+@&x2`rK3XL$tS52a9IK!H+?;EKx}E zV$b2|@3tzrbMnSjnB&m#>YBV{B5^2g2*e<%?`KCYc8x1?j0?hbAIB*(a=j{Vz7+)? zz;KA&1M}K-qI4r3YdCbhWmyK;ZZfP_yudJ}%%qe$I2Zs;kYCVlPnM=_I4L}= zFj~L5*?u!3hbDr*v+=U2yxK@vD{px$fj574|5JiV)k*u;p6w}mVUKFKNDy2gWDxsa z<)k|6)0Q?>g)|_5bIh=tq=i^O*t!fK%B{>zf=o_khZ0_D`%CEt=oOJq;_D!kIB7?G zm#{;=Y%waRz5|8jbUsscxr#e~3B)(SM%Gqx!>dGmq6|P^cL)Z6ws+ZIXZ%mZqlpNH zJuG*v-RQ-ZluVT#$@K?UMwW-@!FKb|Sd!w%s=ewCWq^Ux42x6<^&Eq_uZMpQNzT3UB?@NuI)fwp2kSJg|CeB3VHV&V5QN<0GEFameh*V#LOPRZD@ zRm$Yr@uCWw9kf)kPl22SIS*JB&{UA8KoAjov@=XIDDpyJ z{>QflRaqDYxsp}`VqbuV+U?)TCz6Y#!y<%OJ_gSENYpLp>gRJ6J!6i?Zz5Q;p;DXl zXbEok8ETIHJDLTd;HxzZ--hKqa;|S=Jd$pVOw^G_?u^tbWS((ggWdgPjSIQ}>&<@z z_T@{5P6Qu+{oC$nSi zSGJWPuRBy;E;`O*V$mtNmv6s5NCVGSu@Z;3?knSxSah!}#WFoX|&J$QU62i$&)<6E4=P zicm^;T{C1W+QV6{gaM9(Ad3`&`u&)mE?rX5T%Hl@}sXY&PAV4Mb2&pj$u zsuswW#F(`MFzI-a7>rXru;K}9Lf@wBcKcT^nq zNeqX3Opc9@Bs;mkChVZgnRb+KbtN$yvxEp2`0!){u0-PXs%m#>X)HLv_*FEE5~ z613q9l4a|n@~}TAxXzf|oz}A!v{UaA-OPl~CzESzPiquC3QS#aC=*$Q4+$1al5*?I zzUkA^oe_D*838AVZW-fv#S(QGlD=or+)|#8P{-xyxXx+}n>uk&vqfrK7|h{KhpH`W5ZvEDD7RTjH$d`7dQ z)Wo;vPdLHfc;OFWe61ws9am@;L?l{$jE9~HLLHkdd*=P_B-8YKz(0A8a|fAqP!VoU zBy&r_9sIuh>_7AU6oy%ySUmGYq_NE``mZb&UNdwG5wpuj&m~hK1u9W9H9+uii*Hr! zJmL$Mzyb-GNC#r-MGa_YS&CY~!C7c&mn8-%4k`E0r%WtthNsw`OG8{3leEaG`T9MSz!F1vkBx-&@+pBcP zGScyXnAMbFSO&eb)NI)hb!%4TS@jRk2`7_Oo*80}cB1$5|Lm**Za3EJgPW)THoPN| z@2i3=;3&9i3IN6dirLI{Y}REIf<7b@E$v~tBgKt05;@=$V`Vh*pMCTHG@@?;*S|Vk zS&llz5ayV`ZNqm&wN2=y#;Wtt4f+CmO`QTSyAp5Ix00%*mj}(IQ&vj=wgnJ#H?!q0 zQ!5Dn%d2*`dpel0WmCZ%T>Uvec>-3*w$22oAIo4fb7)4Rau1skF7f6tKX_tV=25Hq zHA^rQ9D=!O%YB02IEV?EXlf=+t5jI86v;$U=lL?yCY#n|uq|Z04^mp|w#TKiR8ZVQ z69;P0MZ492q7Rh0C}5Q)8NJ_2Kg|M?zpuyV&D}QQQ|-dl*wpCH1=weW`rJ}bBEUp{ zs92wfbnD_6`zh5snV5M2SAslfvv?l=P~oa&=BqI!X3c2>%21CACu{;s4>7h$MlZLP z`yC^AU6$|qw(3DwUqSKBPQIHa}W%!Pug-}g(SEb!=lU~Av7xZR;2*-rm!3kbu zHHrN=e(}?A6p;JE^xV!3w+HRf03{AO(9*^G>j2F_6&aCwyaMcmGdb6Rn5ceLcK)kl_hjL;@1Ue=*SAmRjGr*>$48WG-De1#Dr2&5GVb|$y z`^f0jhX@*5+g{L?^ zOrfc3O}Xy}f!z_~-NFzxx_O9xr3)l5-PdJ53O_e>u_Yl=#L(qR5Qc=H-NSc8D!||Y z@}_jy;Ve8jEBy5(*>l%sxe6Pu%H-K`-av(py*WPv2l&NayYwX;dL!rRxtrbP9Oz!Q zX||c+SIql<9#_+Y)#?fF$dDu2qp(`c^Md=&#NNR?qHW`vn{A!4B+feAv5@X0cloUM z!@WgiqbsZ?Ty4VAJ`UXl>Is)`Lpoz(|B^8W*9U)fmhJut2#g)Hzq0)<5&GVEngFd= zQU{Y}#*MN?bw-(g{QLc*XfT6~2e7y;EJ6aaEiIjl$AZ>7u!dA6@E$byb;T~_aTION z<&8se`a{o}2V$92R7fim{|ph4XSA;KRxhp0I+pXxHeZL!v+{Byf`u;gN=gVbpTI zh&07!iup~Lg3FiIhB<3Mw&)}VUn#X*ZHZLQIStN`oyxu z4Jj>*+1N*k3iT$X*_pGr>VN;}rbFqf#P89jOst9)l(2 zA0DX|Zc!LKU+~q?OGP&w-JBuTMJG7z|T@vb){Tsn7< zx1Xex24z}y*_SL1liF-LuN_~LHb9STX_T*O)tleES3ka}VDPkZQ8v?{SP!V&VIMYb zwUT$@dgkfHIu?P!ZTY{RmK9XdOIxh-*OP(gJV|U8Oz`M5EWXg-bEsf2HZwd!=GUPZ zs_ONx^vF*RH#=N<&U6%0ZIBZ+%-^{po>%s$$2SDdQS6?TW)s$OLf zLBO{jmuRi}V!HB`*qL!YdQqn>f7=HUMIuw z&$)DidMJ{ED$%70a8bN-lgKDaG`-y3q;rm>Iov*RELKJ*2;X825LkiLfTWw!QEE#T zkFL7KqQjeLi0CAvcILGMs9i0asiwE(W&HZHJv%SU7YPUcOB*l+&cwnj$V;kEqLr1vyMsSvi(|$zoVg8ylJ!7}iS7Z_Yzcdy+hfD|T*S z0D+x11!QB!Fy8z#S>sktrvmb`GLrJnDuz)SkJl(T5l zudp<@WurA0TD=}s?`~PgaJh%LbS!arkCc!EmMy(B_Jcu}cbwG1&sVd)uAYmVs+6k{cbODlYf4Q?idhsI zBR0xqF32SGR^u9VW4vQH-~4T4py_*yc18G6br?9uiHw{Zox=m9_s1GO*p= zg7A)Y7^A1;TM~%4L-AxVhIIZ40|i(ng{*@1+Ki*tQnK-u$2lG>tzqrG)`Z7&5)0%5 zxSUQkF2Z&&VW!!ZQi6EGx7kt}Ae5)dBJLqQB=niB76U+b`Qc=u>rN6N$qtBzL!L$E zY56`CFTE)H(g9#iXAd4#!3={hle{yQTf6;+E<`?_bmI%BPwCV|yt z>x+ba)iCK!bsu|8=3yu8GXmbDoK?iwmonhab(a(BkajDM_4Fd=rhfLH9V6Eaax5TD zGf;k=2!4kl7LuX}z>O=5j7Kw$lCSExJVEhrMEA8$wD#iouWAz~o+ud0Sw-=_o0?J% zWK;Eg@2NK`D;D5-g2=Hdk!=({4EM!-@umOp7jMOTuFYD1i1R-$+8N}qC*0*(Yn$Y zN1dyBv~dTl3TaB@dyo0%WwHEW7|&vA(;Rl|jv7NB)mG~nwFEC!ix;rs@eTSymMv`T z8Gj|)#P~ijR9YOcgJonK!}ElsL#&zd3^DZwSR^lgi0RrUqUgO?EG+4nw7}-S8AM_- zU4O*ma4$q{Nj z*e&$%>p4c0t&l_e3{0=oLwKv2Qf+d^$d7F|7%#J$M%1q!Q{ZU~Z?5^9@2e25eRVhQC`>f%tl!wE8 z77^UcH<5R&8}T`|d6#aV_b8lNQ|5s56kKQO)3wzaM*TWGmR4g24}!)$5cXA6>=q3b28=_F?DFWG)Cp1!Upd^MmuZ z?s9sMg-gw3AzZGoi8c*(dQ+)Hiw3#ig!uq%SdwbJ*(-E_{LBiVr6qV(TvXeCD zRGv|YdYhnKKRQ`+})T9eWnrGP(AB^ z#S_GKzl@40WfcLV<}}b*Bi#!_&fKp7y3{(yg`O{{f^%U^(Nk>fZpW9-c`@U2BH{UW zS1s=V8vKs;ynosFVHFBHJRNj(|IP!tbS+o~PA#W#z9qd=OpBmr{Hw*s^`9 zZ<>&JSX^4GSP7umcTqkm!#UqP{nCd>9JE~mGKd%@R?Muf*E>ZU&%oOkN8cxeA5kSm zX>+h7D`_OcK=lDS&pfu!>~d1z$bJ%4hJioX31nKo6f3d}cju!imVDGwls~JLCxXbd^Cs1n;|>(fpOeb9W2*}yflp0n-n~O2D>p$JL@DC@2T(1FUr7bcn#m^0Wa{R7!X(`i3FG5oEn?_*>ymN0HT(s z8SeFT*T2cb(+5}g@7ZJNgKl&oBn1WsoK-{pzt&;A$0*r71+8d7U*=Vjq^<{m1!S?m zJj4HRa;D)&xl%HluA4=ak?4{|;l(zhql0we7K}JuoMepbb0JYTq*l6j)7O_G;M1Ed z_Z^wsUu&FJ`MIJ?rg;0e{Eb#Jxovr5WajY4?r^6si^N$B{;|o`Law3SzqF6NBKUu& zjU%N!WAIz(Nkd}aM{YkJ!5VANH-%Zt$4Bf|AVjswLz)FuQQkoQ+ZFmdp%eczJg!y; z3ms$;tgn+P%+nZ50)w5HSr9D1yVI~{)nFN(pG^o#!$8NYw9%=|$z)kzhg?hmkK<*n zvh6JBZ&LMuG(at-A!>-9rV-A%5gqn?xC2ML80F&<;g?JBytf12l&5T%Ka1Dyqw zJ5s~mpkvD^2jCE@F{u5eiRDaAiY9VHh4>KgvXy2_c=#K*>eh7#Wk9Jr4gJ~0+T~t8 z-(L@z*NP8~T+l2GC5HI%mDZs-N@<`|IJUgy1 z5rh8Kt0lYgb^J=tO_b@sur64-0VV#UK4?>)8M<^_&@+R-vrx9Yk7+~LT0=zjH3F_j zE)4USHQOcf<*I%)sZ0QY4@m0i-QhlHqwoODT`rvSRsokG3j46R9(X5+qA{^etpovLPeD5l^$Hl4@vk5R`Su@$vu~eeai8Q&Td_~zLMo7#-15At za8WM;nkh_JlR=9WVEFC$+|)hdfA4ode87)r8_-tY%s5iv_`?1w=+x;9;XRjVV(N;Y zSAJ@ht8MKY0@EY2kR2`hAQTmZiYnRbQb7zAsVLht{0i0((W`K&G{z#s@L{>M9t*Wq zu5P*)NJ8x`x^A$HOqOATZ9(XXz=d_AOpm&( z%lp-fx@=hus!-TEqHQ72b-m%7(_KVbQ$`^OfY|AFVE);x;)tck?RkMS{VuPxX17xe zM-eOT9VVeTLa55or}OJw++-X3JDdjJ*lX1VX9F`?8Mv(avHL?TV;Y;-O$1FOXjeh# z4t8qV4^2km+b_{{fQfeSjV}W;P>2b5zd0K`JW|j|R_mo$n7~O>OVBcxa-XZX9^UiAZ4y^MG&a$%GT}(9K9Hm3<%!l_eQCt-jFn z0amC;D(O)qaEVmfRjA|<2j#q(cD;^Emj=g8^$Y78Guyw3dTmrnmZ63fEZojhY$BgJ zdB;gQDn9e&LdfZ07;b0?Rnu`6nfhmJPs7@6!_J8VIRy+Cru?M#qNy`Sc=#wKGGlM^ zo~RJ*5W$1VApvev2TPEWM}cn+WCvOw17Zq9pN^g(`Jw15 z^`$Vana-mD)$Qnhm$KddqAurY%%&hMvu*2q0eb|gc8B?BT>5~(ODc4e zVaLpz%f#{ZPdy({i7ME{MiQ`tX;)zY4><&flzev~1p)W_Bn=2T7AKf^iyP^My^xd> z(W80{q)$`7B-0&0McJt)Yc4yfMhKR}p}1oms2lWYdi_&|t74glJ$vI!xhO@csK@2B zD9AThtCZlT@vMDXQcwMGVr+8Iwa&peiMd*6M!cgD?8ONfL&7m|n3gO-3hM%wl@RQF zQ$W@C_OK1M2sjB|Bp1}bX%BXOM$0) z#gL46zEx2Z%Tciy$~xdRQl%>JQliVTP9wTBkx*313sK6scAyoYz9}61xnW&9>Eu3L z4Ai592qDc7SSFu1k}<}=G2p!h^5X6^a;6a77pKqaiX~&U1|ys3>;3XB6ilt=VoDMr zQNCSo?wcKIshPDTsRk+cj0m!+(4EhlGeq@~EM%8$8R`jGB51sF+uh3twTbojl7dn-c+MHte@Sost_l-ytm zTL+F^5hBv-)w=<;w4S-p1BMtr0CDWmFsme%kJjC3q9-sK5@9DGmre1W(0*t zJ|tQf+PfD9V`i6XjM1z25H8R9sbm*sk>`ra+k2&Jh4D{kdLJAYH|YrpH>`&K(ky8? z0=Zf*fAz%O{|EJB6g>#-70G{_$8)&UDg6b}rETapb)F3lHwrtMxhfV0n@Iq+Fr zz!UiXqsZRceknK{?$RwuVhp5@gaE>pkJ^W%fJ>Cap~4;4?D>m-V~OsMJUR@ciN&(& zorrJR&_<*?sErV2gVo>~@UEq0u(z&Q+q5Zjv^%T|v%yJkY;+`9!U9LhMbzX|9u9MV z7`xT#CHQ8JeN~eN22k>h#E{7ebl5l;_a}{)$ZtX}Q-p3>n5Uls4Z2OpZyjb!$n88O zaroEMZWaVrVlDlu3t#bAAjd*zSzd>d{mmTgXe>>@A8x7FCL+N!a90Xis3vnxI!}sE+`UpI;L2dc6Y^3$n|@>*2F>B3s)*1bH)s-@tPL@+VKrB5jbMG(kNJ&)!4MgkIG(NOfjrO3$ZJe~!2#^%~-RBAS6_WUDrq-vyJr~&i@?B|P zH~_Gdu-botjso9P%f%h-jLc^9)z|?sLJ{c;4~j{R`UlA!_~xC2MfIa~Nm8Zf^DYK5_m>xNObK zu8hEvzC4sIEF_EW5HYrse)rUmY96)pjDBx+hIsaRq(o0DDP3T==50b`r|1wIs6!`q zkFBw31hlY%tWmlMo6|DYz%-(hYT%nli*467quHfkwCT)jedq{@lK&b9<~|5sdB9wb zy-Cst0~CS`yMQ5jwcxX20i~~Gowyw(o^#0S8v?TL80*vSI$}Nbk;3LX`hbRk$*Qv> z^;9_hgrgt%wleRrVy>L3plJ!VFPk}tHA#pQ&mfkUjwfB_pO7R;^EmLLyMNqsjtEuk zZHmhVt=B&NNUE$pN#%<(ngzj{GzvP+2Q1d|(_tun+`4!~n9)Gx z35{L>KdXRipLQ_j@)Z9<(M7LHoX9)8+|0?0OpGgq*yY0q!*(jbJhLSMv4@b!gwF{5 zSoGp3^RTC$cF+!=(_V*0&fnj1rsm&BhoaH9hFrJ*iA%{T2C@&_bO@JN7wyKr>pgf# z#dF#0JIP>F2kbdra3>X;#CQR?9-*xn#BZ8YYewa@N$_tI4t{Xp8Uuf)nd`#iamVl) z4nKrL*UV!KjGj42?wVJ6nyjNt7Bq&VOuI<+_B-XfY!0}$d8O5~?fddo?G=wq!1lc% z9y1RyQiw9vFJvsHh7`;sH&nxd;+qe1z@H^LUs9Xyb-Y6`y69D#-@oH~iH?~#lQj0X z5yt2^JGpm#w8^#oz+Cm{*{22Ac4*nQJ;ghjjzptx$L-k5b150ufb0b?1j)5atw~wm zjI%6YM~3T)#69!mJc-6_$^9Ua30t@_i=$N;mI_x&&7Ug^IxU8VRIH_`^O`=eI} z#?I`6O{k%ugSH$b$=f$p4Ry+&N^3V=!xeK&Uk%sU&QI9Hw?u9OK@O^eSNRh|d;%bVx1OGXZc)hIy6 zi`a%Gl4>N(lO)Hqttm^7J~LE)IGeJmM;^A70U40OK@x3$yz4HqU$;VP_?NL3D8;4Z zzs<`?ZUAeEMP!6C$!8qP`#u>8t5frNmP9gy#`{MWOV|Pe<39=-BV|IG{fV}>d_9o9pj(0qp|3FaR314O44rv-2+h?6iX};!^wBP7p`h}q4RF1{1F|n zap)&7oP+qk;!ye|v^!$lDG^S$q|CCKxPZ*A{Db5mNQq!w=SieF41 zbpY~x7DIy1z!**7q->w&(lGN;;(rqsSN#0H7t&2FsoF1yM9+yZ2K$d zrGLWr5hFKI7I+mMOdk2C2%F|$r#HGsTH~HNVs9Mcc$$ZVoc(dl85g{6hoa&4VgLrt z{m8TU8FBs6Dl(klTl|#xa^{Nu?YTxf9#RE5j9^{CAVm!Bo1bsDKiMi2JV_TLj{E>8 z(+V+V3;c?7={v&&CKD_pO~kps?TZ^1UgOsoJRVYg+U{qioR9^3f}t)QmCijHd>&D+ zpsSY8)mF^}7M6{x=K)vWBl|YuG@X{_q!-;U|38`C#0`=5$1AG8vtlh>A#xWGa!3q& z!&@S5Y->wnc-jfhu-OH#5lL*@Y9B#(6xf;zj&{O($du z;WI-&7Fi!@vOjjfQ9IJ{GzSSde{<8G;Juy>MIvvmVyR{Yo#O+S(uYiZ38hEmb5{%$j-vZbA^JW~E~-y8m-WZK^2hl` z+IYgE51CEWF@9@7UGumDPpMvHjG3qCU#_pa8H0Tgd38ta2tqZnI6!n=I{HD|7@8fm zRw?YvTa!VUKujihp z)0L}0<_%;=j_FLQXPdM@Y1@t|dhi*7$I@37M|Kn=%R2s#k=C+MC4w7L_kClJgqN=xh|On$|A<{b`h;A9PGPmC1l`~*my(7~ z<0h&P+s(CAD7kq;5Af~H_k(gwhd9{d$3|8L?OZz^SHtSA=Y?XXKsH*7p>+Zq#$5?` zI@<0)qz$CZSjY?BDmxC-s4-YdI^9vAzl|81JT<>R0t{2l7{wDyl|?F}BPU2+YGBw) zyO|Rv9izD<8vxXW3On!e)ITu{f$_mRM4y+2tiIkS7ov4<5MI6HcT9O{rd|SHi8rzJZL@ggE{J@K@Ze1Q!6)-vZ(PBPjJJOlPKrS2LFRx<4> zY$$lvk=SNPbvM%6TSZ+1ps}O~%xa`{!0blYq$4Dp@+GHiV4edH4b_L*dbP_2sve26 zw;1V8(+c67=EJUa^o0l z;1l!wF|P?AZ9m82@iV1Fa@jcUY0Ga?;7-}5!vA<(%<+Qr5}9%h6t-)R>BlkzuzgjL zni~lv-y)UT=y8%oqH*1|s4zh4?f1&1iP>?N9O&g)&xPZJPpzKKRp+~G09~G>DtPeG zMY5_AL2U{+GmxHdlV|kJwn`tbLO=Z;qf9-|0#?wSmT_{O(N(lAIq)6s%O}J_widku z+w=)_@CXS{Hy(P^Y#GFI|DLT3%$H-I;W9l`DGhr1>LY+I{r1#!) zBN9#0g|od^nL(S`$r$>*Y_#HlnT?K{`ji!t>JMb_(-*=eMHVD=Fo|FQtoCk@nXcvp zmX)gbtdhB?{|vymGYVw6_YjQ21)|3f!EfUDF-$E59oxq}zZi+1y*WO$yKRgVtsoe{ zXJPzhNeU|CRi!DRUw*!P5X3B6C^(gKsyAd28K}Lp!aFrluB3Qs4v7OlYAKaO+Fb4W z{S*}iIxc~E?aR#%Pgy}(20l67dD6m%Edfc?Gt|Xr#ME|B^RJ`};-z?casDN+FD*7= z+*FO6*^J}qS#jn1dJsMoJNqsj8bxE|3vVD>NI-Icy;q|wsVETlCV^Q57&pg&JonM- z<(2RpIrcH5zEV@~c9EDG`4!8kLgNIgJE_-}?XX8B#8b;_X9|gJ!tkC?6~xQQ#M%$j z=PD;-!{mI;C)VHzwJwn6U|r9A7IntNpO(Y#^A9cEvpyLXps$x>6?gASH#PLni^9@) z@*$eNP;knhY6K%BaV{(HtiVmJD*Ox`}zrb_7LA9&h` zBL*wb;OegINNPZV&3qYYp{*t$2H1o-A1W-4+iL!Wp{Ab=`A+T+21C~sHGjNXgtYvA z?7tI0?Tgfv5o#w!LaF^}(9xx*EeW2Jmz z%V)UHFBZ%eG@w9TW|a=MB4#Yh!K8Yy8k&T0csRI#Qlm+~@^ao!BbbQ0udi8@0e^r7+XvmT!p@n(v!H=$ddAWDpk;I%dO(bUP+Dho-iQlKt0%u?L;=&S1NnQu!MhKW-q5gqJHy7d=-A|7_nmW2-zd2Pz*uFU*tNCH&uB3L(yx=lq=HF$` zSVF!p>M@I5WkBq%F?njAhD4_#am0mhkx@Vh9B_XEJp~jj8N2C`_UI!c)TNcQ8+Rwa zEDuaQtSz#DyCpAurtmW?mfR*oCF2FJkA?Jng$m4>NN+vp+ht?V9sOMTIpJSexS(qX zS|xxTt!0B3tL_@>=l!_mCu5Hw8T}TFK3K`_&JJ7%=>yta6O(?rujy^GmUz5*L~HOV zMM`aljKD&*l&q$*7k^R!`@uY0MjVyIdKI2L{Zd1gSJgi*)_`kGA};VW7@r9|55}F{ zsE}CXOHO+;0HV9BPUkRA$zqh`bnQ4;xY~zMu;^P6!0Xnmz=!U=73XQ5JDa=PVONz` zSW1L&(nOjA%#Ftr%Q5*|juwlEkzCrsX7EeJP(8?&Txp7mCf*xg=S&MfWogoO{n=dk zhDpx*ToW@UnIo0Xv1FYDsf-m^h0fDu8hU``$*n*7*4nspM*xo>^eZUtjVNu2ke(Iz zmFB3?(&3q?FUQ9|KRJ{0I+7b4yJbc5%5hvBQ1nO~IBr2NvNy(#{}+>=?0>7b|Je@| zl9#nvf6nDs^zxSa_C=4I!Xm<1eX%N~w?evqv6{2;@nmQ2S+I7>*goN@NB-^OS3zz@ z7pw+f>!^}1N#68qm8w!Hf%(w+OEj$1isL*EY+L`H3|?LTC;a|f3UXnF&^P@I-MTb> zyyRk4n7g)cW$})0eY4`EK@Ro4ictO})n!~rD)yzO(||VLtjQG*x%??N>*Z_c?$B2mTvdEeKD~HYm3j9=QG#7t@JK_n53dF z_*K^k7D(e=7@Wa8+FW%BLs-Iu!+5+OQnB8a{G)7zTADLSp|_#3pIC};%Un&_J{-J#AFkQP`FfLyoXe-XS&ir+GA@dmfO z1@{P9bXoqP0QvYbJjoE`PQIrnD%2Sq<>yP@Ppl$v7 z5iNA6#0r%nt6cCsuct>?MgLzz?in{eOgQeMkFVXkxH0vy!;!UXi0k;QtOm}b$6*QS z{eh6t4I?zLd22j*;SfcGRuTv8bleIF=C|C}EihLeWCSP9~ux0j| zY18RiI`4ot*lJq$x#tN_A$InZ`HLJaLqKQ8+?x8WY(87H*z|zJvLX@Q6d~<~LDO9D zvx!(rMrK>%!mG;;S&P|R5=r0qN6#5xtcE76>%)7Rrty%G8j{FFlrSrgk|n*{e3|2y zG>N@N-EsW*4F&P^BdJlHC7Kb3+mz?y<(Ytei5gvR`BL@+JNa8@@En|K{cN;tem8gg zTv4or>1g+bu6N*2uq03@?AvX)2+1u6o<~7G-T#=^J1*ktZ+V-p%I7DPGI}N5cqIg$ z%}9OdWNRITfABr=n(pc`g`JWi0ztls#AgFRdhL9XoEqIHGCb_$A7ArZ9-C_8@x;3# zRU-Ffx?*RufD8D`OgsOCxlppxs0Vw*@l^7;vw`Q5;8@niHie9XmXzm@_+lV}J+yqM zJ)$65BzWD>MKRL5pG*RxM%;Ta;GanX6XAf=x~WR+O`I1Wg=O5>(+sNwy$S^Vq1DCX ze}Ba5*{D~Wrdo}+=lebfI|k_K-4K0|AUgk(fgCHna(b!j;Sfa3VKp#D_E765w@T06 zE|2Be5i(s)TppDx<~Z(PZgGJ$X`#uc_*dF~O#8T zMsz6$qmtvndNU3(l?P227Ww{=WyLdtpLO+PvrRw!)9DZ5#yBUDxaQlwetbS!K#Wrz zC`swY17-f1?r-w`>qJ?ZZB(Rj1X(Usi!9 zogt~vZ+Q}~DRYv}f4)j`NxjA}93oDCYUoGL^xPpS{_M`N0Nc-ba99h|kAp0F5IrUj z;mOVMhT+vSQ1fHG+MxQM=5#iFtumjz_Km@{m(Y0xzZ<+%(Stej_Ma_n_qcp}u;OPG~Kd|B;>ap;JrmItKh;El6k@>_@=b`vf(jdF)L*O972Obuoz z#O|{CBP!CJ4jZyak!(y&9xE^XZ~Q9#BJ}co5@LY%t|KXBO5I(~s3=^`ma*LNm`R$I zAHz)<1!#2k7zxAvd|@|h!j+>mFUYMsr1sOhyf}v(S8W3FipzG?xM&~qn8VLpX=_*e zv4saz%^|EhK(B{H`KM;ZzqjZN#V1Axe+gtxt0d8K5S+dc_r zFKFlVi(rREO$%3qs^`BSW)3us7IEn~QbBpyHVnMq`EGtku_YMOgCZ}cQ>6#|CL zOF_e3u2Wy30Ix$8{U%psK-2)Jt=gt9BUy77 z0m=jchCpjg(MPSppcXx!)NZdY13#9ziXOVZC-Q$p9#c-1AVu5`Wj!EVSutr%DH3?Z z80DiiW`2;~lsE@{`jBYI*Sw7c_UH-i#szt^NlI1Uy}KSvHm~|CQOwCG9bvgte>r(5 zzxgIlJIN2Q7QSRQMBWnlOWP7$C#;}w>zZdtp{F-Ud|U+RY{B%KoP&}=8(Pj_18y6Z_+qUyTkAz;A%ZT3b$k}zr42as$EJJc(Uh)a6nl5Lf zC-i7A@qTCldI?-r6pNWr6R^UbBdh3y!kGuBYay+Ckp+MW2;M8qdZTN@H979EO0(S4 z(WH^syx=7XJWI;}%_AtiSoM4bi+_jhdVd)q)s8{_S0Si=&;*NA1dXwh7MzV@PDU8R zglhPi;8(=F3IMT$p=3|H7-hd^TU*iB__ zXtva^6%9;Dy}egL7#QDo7TX1t+Hn_{K_^|R2qP~a`9kp=L-6dqOP2Q$3$ngPP?$1T z%X=$&vX+UsZG-@MTQuHONk=r$-K(8^<72k@Z=KOo{1-R1Sm2_0X!b8irPe4YR$^B^ zTk050$IvtZ*0*eETmF;m`vv1Yy;@|4uLgpFuzJ zdq7?H#$GM8gKbjaom796&kfc!-d-IL)#yjSBNS+@R5(ROj*u0*?9h!sB#`*y7r40q zj~bh8pKqPsGy4B?!!Jv4)S_we|B-SnkzaBQ-AO`_;tr>oYbB$n8l-X!qE*fWI5+h~9M7tI zeL|DlV(BsGL+Zpy=kJWiSx7NRJN)d0Kpejv#tViiMHPl7?bm*M8!+s!PF`CF?W zk5qIQIauRbqqWUa%<0gJabhK^r1d>ni$`q^-{H4&g@0Rsx6Hn6O?7V=6xwNmqbpTP zWKx!5Dy2fSM6uij--`h|ly*5Xij;QKI>?2E6K0X&81OTTq0X~Nj*{gijuW!}i|*w4 zN6r2|axD~w@fn$SZKv6T?UP%vfOgCs$YWGkcxkMW7thZ6{L|+q-N95u+*Xwmng2-_ z6AM55?SUCW@+F_vV~5>Y&KocNN`wVcGDGmg(rp~#2Z8tv5Z zMcD`YHbMmedv(+RF(1IH(N*I%dDO~ui9WK`mfR}Njk#Fmqsr_r>LnZc9{T~(HLDvi zx?FLMF|o}Wn%AMH69|H@4EjLE3%26>?g)3*7~a870x4jIYEd4?o*-+DiJfU($bxpC zutp>7_x`!Rzpz~hP&rf-8G|^b!q%v!QAeU^&UKr`)1*sCo*cy^B?j_D_m_}B@*Zr< zkkQinFexMRrtK8_ZPP$A7Eq7%#v;d1k&D!c1_Pp%nK_?3N%722xI?J$xNRyWRx-7##cDne;D>^Q6M~&z&It5>SDl4Xr zTwffYjOa&>e|`1N6@Hdwc&YB))>OHS?O@(GD3?2zfn6&d_RXVy}a_Y&Uj7V1%t?a$!GU_2Y8cV}#CW#9lcs}MnNpMqy-8DEy z+MUxdRPfK7Lmrq6als0}rn?3gg=ApeK`dzt(k{XDC_OEu|MOY=C)E}%3YACM61=KU zMn-mVK_8GNMWFCcPQi``C)^IbZ^%o=`x3)K=fi}@d)Gn2e1<;jZv;IbvyQ{|2`vY( zP}Nt&7njBRR;=9lzGdUcg`Q(hwbY~u^X-ZD(G4@w4zIx0O zsf)vWSGeI0fHye~T&oTPUZ-+ujC4X|M+p%o*5SE>2{qJfN}*yq#E`U1wJLh9-E>1A zU!O1CE#azu{=#~V{g#8Jvix2nAT!H`@gs1$$8f#t-rh!$J_vM@xn)1fyt}Shd3vZ| zMMc`(GZR=Q1G+^&EZtU7Nk*wA2E;j_dCQ9_m;LsxIQ4{HuNbD}f4OY1jpEY;RuNR5 zQ_@m%vitR7pvdUAzb)gn6=rK{Wv2s`L6>;bWK4k=&nf&xqQBS2v>=Tp&iWk?&mB}u=Pj#2uPaU9oq{#_{fob6Liu*QnlJNZVEMXp zU3Z?|qz-u2l{9BlRC-EB-Ww#eLD9+(WADXNu~r68e07*wG$^7nBa@yHn7~&oVVf`L z4FUx*yUg>=q+bo94oix+$!3bB2E-z(In#_59qPWjtcK8Kcuv|My(26=9U*lCd7vL# zt%q{%1{w-)TSR4UhOePpc66t@&wft`Xhf(49tC;)C z1~9~nGGf}351-F|ELe=T6nI5@*q~0C(NY%oeU^Pz>y`vG|HJl!6kn#Ky?1jJ7hRsA zmw?L4BBATgwcSxr@-oM@x`djfI~X$`s6o*|1LJ2@#!{gYR3nY_3+bCa@iG0 z8?$ljAjQim?T~!EzSg~OfFGc74bdFztudL`YOhb>HIXKbKo?aE5^6sD7;GP2KZrSVA{Tb zIKh$-bNPvsRY2)a85pRU=gz66Ub@Ryp3^u$3e$3A!j)x)4LQ*2>|jp&4W3q%aS&lU za|bezQEYyShLrkF?DF2e-5*Zn%r5;J0j5=^^WIyifa8eV6vljk0CJ-m0AL+K(p}!_ zBkSa^IXCP0E!aKV7ns;`z!B!eV(n_GASZ>}QDzSW?5%u-Wf4Te-PfCdHVRmdAwgD2 z5M7Zmi>+-B3ly0^*p$uH{9BR@kX29zJVhWpsm;rDud@`mJMZ{zxe8o8&^l*gC{@w( zSBsAy_Id9wAEhF=z4-VCc11gZb+CUZedHU)vb9>APkk}G16_)^ebTx8gC0TQ(yTW* znZj^?*0)IQ_c-TJ>2nuzHJz43@hko%!JR7zZn>LMyBIwomz5%urN~Oot-jzbn5sgX zA@LGn)CzYmh*=y$#M4>F$(YKB&LSoHS;pa;xhE&};av-Etlq}9`eqwNc1%-aqm_1p zXWCX`IK^6pKYHMnTN!M_=H@!w_NJnlVI2<|9^<>=WWlJQ?gnH-yh4Z$_a;SR!>9a6{u6 zw*;uAREVhniHo0@!1rf(TTCxrOWB)7rUFn#h`NpwS7|gF(MmQSZA^hD?rz4k1`$@O zy;b1fR_GFuD+>u!Sh5^x_aPj{v|yeCJu4G$sIe)j)BafXEgmlu(~Sj@7)BB63Mx~< zcUh_99gF%Jce2MCE`BBz#y6o{lS^;yP|dkweu#r|R+}a8$d4e^TQN&+#Py5+rd}`o zo43&6pop8L?ET>ypC!AHZ^LT9N8pkS?E(dIg_fJg=o>jjh-v@BqeGRROTRECjP~;v zg`0#zc~ZgR8$7LIQV1HHn9cER5q6{&x*8>FC=5UaoWdc0E~&Rlo6$K?e=ECLa+-&e z(63F*4S~y=iNS=}_6eR~DD{+Q?|Y*n@uwt@-PhMvZz#FLc?n5`Kw|wqE9-I#u#?#3 zYk|ksha7J9Fi?QbYlhW06D(+d4B|A2$Dy zNvcvH31JoKLDq@b%gB8l8IAB27#g3;0-r#Km=N37p6tg~;JL`1QeYn^Ic^`M7&Rw7 z@RYf{v(7_Z2UC% zFrG!C&pDa{>^PujZ^Muf0jK-^X0jtX@0Qe=*;*ogaSnjf1#kx_Oe_Ah>_e{^5W|+Y zhx}mBUEj8fmFsGo}9yd+ntZr;MY?!dJgG;J`nrs)a+ z*g@DJ&jV_(TTFli2%LU%p7Et$Edhi0J)=|0i2pq+MnZ0sQujug!9Kp74f)(C;RQ@+KdwcssB1}(YtIC;0Jmk0Gnz{MREQK=zIx73b;t8^|z*q zrt!{NK2dEjgMi~`Rl^0ev!BMD9KB{H9Tpu+9mZ~Q5s$e}F7B)7BpYfD z${{nbo|y8(XJRKO-E+_>$NvUBSS4k zuKtz0dZp&`;u@y8U3@0q|NQ)=GdYhXPm^d6hzXinrq;z_Ny%p9ztgUlG*j0A>1r-Q0aK{h$ljkhAiCQ2!4FdM+sn*3Btv{<^^(qu#J~{}=atftg%!^MGt-XSIh9RE&y4uR<(4&ft_C zb(3vj%jLe5WZ>xFH8FT+8qTTTL+Xu~jrn#y&(YsO`rtsTII#%$5TcCyTKy{HdZFY( z>W?>qHlqdzl03$lv60>5sB7r4MSz4#b(Bq76aPZxCg(QZ;%Vu90}WKZz8z^hjLwm~ zt_CGIG3U$T(1iuXMZ>S`6KT2pri0d0PHwFqsDX zd7{1JKNW|aD#?rlK^;%@32Un8ElySL8-&=0eHnj^z4nN%o@*~vML;9J1;6uduCnHsC-$U<<$K-^z0nri`C}wPA`pS-zja-& z_QE7Usp(kfyzZHyR_qbyLiZQcZ8uAU;wB=s0O)Y$#`?_9?Vg@xH2-*Sa6yLxbW3bw zhBgPEnw)L56a3p@c%KZM54gSE%_GOAy75Lw0?1#bqRAmdKb}{_L;DC+hBk zEz6o3^sN>1La?5#_^Gz3qWr|RO0LTru_$`lG9%JO75Pu`fNWq{ZA@VzEm$3RiN$>u zEf3XAqciuk66a?|z2<&Y8inYTcvmkR=W62ONCWnS&pVFGYvN<{rW!s!K;c+R*qYXu zNVQ;5TNusfOlLqp+rPAoG`t7lLwKtD<%Khd%G+0}0PO93im#Z-;vV#6(`@wg{D;wx z0-M)pGqLrDcZLfPM4f24r-^blfYc(aa9;PkMOUQvz=!sk1yv5-rm1|qnuju~N{W43 z)%0Tvk-yn7IbvNa!&h0}IbCe{6hOFsNJc#I`KU~in;LhtSRl5OTdNGDEFd)dN;k^n z7`otr|DFF+b|bm7Ean#WS6-s`6|G@QznueM-zlNrU4Qy0GJe>$-udrcVYBfr&)`y=8-^&RycN7okqU?Yot z(3kBR4gU&xV4N(#y#G0V2%J?8#6FS+mqZBIsJVavEvUH-7K{1*hDp@-Skc*m@}RZR zL{UH6D=_k=Zd@F?3Tht;Fi-vGvkRxuGN-g_5W|H_muX7mifo*zo4Au~gqed|<>!HX z-JK207jzguEe9+@X5}Opj)3d4Q_Wr`ny} zz@EbyCb#8zymR#Rn)WkHXA~9;ldAW1)`Bd(rr{H&41>z!a09UoIMPUt0Oihjla*Hk z>w04$-p5xCw#-gJ+&N+Vni|BNyuw4Sn16-AIY4BltGoY}i=8onVkaBg!vE)!2-Uhm zzci>JoPi4S}suYVt^et&Cw} z^_|WA)E?pvNrTszYR3tu>mVB6frO#n@m;ma(_&*hRT)qI zcgi7uqIeW(4+1)rqN)tPAno`(mb~}hp5Jt!*`~Ok%MN3=46AY@9$%-3yg=}B2!*8i zu{WXYa3J_cr`e0`L)j=Um6YF$-gg~G3~{bmaurV#@_KZR9lxpu5htxwAQvpy0yr0_ z%t{f1sCE(u?PkeOIL{msieX&!g?%cw?`KTtRApZx5gMkKwdA<{hANeY6=WPG+Ek|^F%xBnB7B~U zpCyjzBF3xfB+@9|&-H2@?uWklo)3tG5T=)2ZKpH75>N%~KZjCZ+q}&>W#K>8TIEi& zAiPsEM(X-z!pL||g-eKWbbi%j!ONDc^6J!?f2g9yWZE*Qo945%y)+V}#M+}wL8%e0 zK2SKHb>=!G)G^-NwF_vT*IRE>v#G5!Gn$>wtB~LflW99mjoq+$uLI20} z?ni((n0nn5R1}+v*?p*}IT8Y;V$J>F#tgC10eTRP!yKXx6*Vwa_xj zF!{BFYe#$jH%zg{CJAy-#f(y0IAlW>g9mmT4IdDj8in?eQaSsGxOb4g$9&)*m9Q+dkqkdp;bvJTtXo0E&{y{ZmuD z4F30%iybc2Fn#u62dcYdWC4zSq*96Ixm=d7dz}2tMXx`#4-v2Z*O;$oHzDenxJ6KO z4I+2g4QjQrEkDTXlBSJhOwdCMWvRjLN%3%rqb(zC?ad16uVc zazo2Nn5TUKw1IaGs|-D?x3_bR5^%}=Xk%kW4pL%`p98S@TIAzcjl-!&O3j(;Twj*WED!tlE?3(lN9P zz)SuNwq=$|+nfmOnKHmZ|L5n|{Zk<)^JNpfvm!EeBhyGl_w3yzPZb7%)00CDJgL_= zDg-E%-DmYpL^!OnC@Sdloq|KjGu*Em$K0HEs|b}eewk;2``bBvwzT;T%i$#fP4i=S zS%IP;5e_IJP6E!u4e<(0lw2l;UBe8RH!{_B$ybg)T+9@bSyW^({5;JC;UgLduR@A< z^UXj>ZFZ3_02N5SJ3V*)z(~AK)tEc*iXlmi8F{*!eFrh3M|$)KxpMSoG#Om8i)(8O zGNAb(xTK?6ZTk@x3)=xHitn|^J7n0_?DHg4L|3)H@772n| zF5zueIvob4AH|prbiur5?pael1F~Vx{8(^cwsNr|BJQ0TT^O~uMYw@zuj{wRDRFqn z$GoWY1=ZM>KrIE)KmF_jAPsoKJw~%s$K?5v0bb7c{k&8Sy*K~BsB(w*Xq*I{$oIsWf(BpjP_XoMz;5|xdrk>T z^N>dFc+#l(bzX^7z8t+CNs{MR2&;=L7Qo?fx5RVzkTuHsKb$7U8UnnCY}RLAst5G6 zqyqA_R2|06Q8_g%OqJoA^n5kZM3!*_4M#Cv5Qom4Sye7*yOD_s3YAS&$)QAR>|tP8 zlRPJ3}6R ziBTYV@-@iVXm(r;z@lbE>ew*u@^Op;kDoK=t|il>?p4~hf;3Zb_+m9!Q5SjNY%(Q! z=dzba6B~_NHHusQpQ=%`EKO7M_oakHs3vY@&aG^nLB-vqI!VQrRGOOwe>J! zTo5-@_hA3i6^4Of;S&G56HxtNd=G)I4b6}sLDyQBBRj;0-~V3Bb{J?J^$;%u#6z+p z6vHZ;7%rwm2u^g-#kz&a%!;jC;8>rE<{Ow4ZdrE2(d_h`FiCM|X8ue2;0FPp>Pv|0 zeuP9}kDg(q4r(fZkB#R*=vbC~u+lk}$rNNXE$CSlp=Il~Zwg^fTy*eW;dA1B=zA4)^^VafjvzKhWADL;lrj zVcEOZ#ygi0Foj|QYV`?zxUWnhNT6DvUaE*Nt~VK2{4RlG7+j zYUs2U05?F$zY!FE9ktpH9EO}3yN{2_Ey0JOy`$2Tp5;EC!`zTxr=toR0FnIfH}P( zf9VdxU#$o>w>Md^>wXhMmg=}`+AIz2{#k8_p0YZ#Fnwe6t+4liXd*3F3Cm%7PPb;* zI#u}5nrgLB2h>vJ_JX?@Lo@${y;<1-G)5}z4hGZ(!sSVk51(Zu_|N{wpBWO3Y>^!y zl;DOJy1F;UHXopxF!plPF*PqDZaJa{?xt0E8aGAMShE;{f5t3Pnrmo<2`p*VItncb zK~>mtbzd}pR~P;;gry-7mM zv-Rr7j+{9wME_MoYan+zuXmNy*#-GyUo&rCo0F$TmB@yau1tKlSuhoV-^{}w$-4_N z)NHG+sZ{fIndX3F6;$`!#1`N53Jo^kZP2Xj!^BbrjuzXAD#zPW@Ihb7^8cl+BpZ>x4Uwelpp<9aiUPqGL=I`Q5qum5mif?m z9mRrgn&dU>U3CeMiqNl9?wx9nv@uS-_X$rdUR~{BUU?4ws;gMQ3MV0lYIm*E8CtNb;DodtQhf=Jz9p>&jfjrH_##NU4fw44gMJ zupHCzojp^aNZSyyMvK);KEXE!Daei4-SS@_Rd0!FC=_8vKGb&W=B>*g;eC~OHJ@7} z0n7^|U%Onnb6wWHc>$<0YaZ=?O&(qyM78PA2Di&Je7N5oI z2a2$o)BMXGCC`Ij#n<&sctBqXDPh(oW+3Fbj0n7|+8SKRaWvrFzPs4CcDs92WH>kv zO{J=bwnAUmrQoRzP0h65_d}te{ayA4b9-Lw!k!E4gB1FJAbK!10U#u|DuC#WchO%r z>H9G!FaBDU9Y0xqlXXUTQwDh{+hXRzq>@iu_wRnpnzf@F^{5BrCZ+_hDo1L?s}hdf z+;Y3Y6dU8F6{-#Yy$T*iK}}=jfnb^Yv2u(Yu!trixpX?6b=*(ycK;2$|G9irUJf5pL7>vjqjnl zQ$Odhe>Fw8|8RxS380_%k+LH!X4AN-5=14LjfsscN&UTz|a(@GDziXmYf3*xzYVPD9M&MM{jSN7_wW3lAD^zXmWekXAa zyRegxh!#ZGP=Lv0v!BHiJN|ksDQAbve~~YJk{LhToc=9CVt(#AC3eE}GePtyaMxZ{ z`cKBRvb>q=A72ZjaKS<6QK8NE0v`SSMJ{=}vs3O&IcnE>Owgm35f?jFj*Rf)x#PcA zjNeLF_)CbHwYz6})dPyuj-cg*DFo4SV0O%%6tl18cUuYm1^Q-9qVQB`^zej*588Z6 zT+63711hn|m!s>X{K;A1S^Nzf&3JL1!=xaXPtFa&utghO3?{M>F=YM=3_K05MKVb) z`45+cvuO*@J9aEF@}DVXS%+4(`TgE_n}?@$#&oBc*;9zt#=!~_uy90}3 zHI}j6MQ=r9v086^T#m(3iEQf7LgivUdf>>=?h;V}(U7qvKR+jw76Gm?y(1U2s9*Ke zLB5n&K9`x#0^2VZ#@nxR3NZu){+pSUxQ+I(9-xaI0h3CWJ6cjMN;nK=e&3IpLBeSm zo>Y-p=occKB=j;d|Lp7N1lJKPnfbrLbJbofo>LpV&~>a~7j_XEXovG*5#q-w_R28{=J7V(ii!EHwmNYdyR#@FhXKF0o=RJD&q~dMxbI z%LypGYcEBnH|=KK=z<@zgLvPNwK*7bsU2^?1q_TIXLJc~%VcYK3* zx)0uH<{&#Pt*GdB+kJj-e1n6h&zbB_DYK^(ttZ;CH>U~?E0Njw-p<`v6sxt2?JgW< zG{#HDv*{-n$`|zr$SN0<>2?5wsmu-23?D?;8}<|hd)c2C8`D5-M6tgB`a?1Dv@ceV zAE<7&1WGvu?xMN&$ZVSXIRU8ugeyq;0?>Yz`^@{=pV=q&n#RvReSBa0{M7Om=f9EZ zWaW!4J4kWqI-k^@{)FtL-EFr+!Mm33S#@80mR0s9hX9xv4vK?O|1dYR@S5!|!}s^f zkSr)Fg=gdwV%t_AO(WTe)m3k^1Y(S{bJOl5`Ruv0dmeSbR)}p=j~+SUF!#3?!GDq< zk~+Hfq@hsAmCBiI%80io&A5{nUcYx;=BG?o_qP_UOt%~CW|Z8Su>cn-BqA&RzvD7p z*<~w(7IY`52%{9fDO;NH*tH7lbHU3a5@nj1NTZ$7?+48fioR8nKkxd zEz}0^^2LO9};Q!p-;~Pd=A(( zU^Ml=CLnrMC6aj~38}wGPoF9GI0Ibt0Q(DMn1dz}vJDv%XC1({`fniN@R)9Z|y zI<0%P3_qR*+Nq!JXIzwMK_<|1A%?Zto7^egT$e(ul$@VXs0=h-dIRlxGVYhGT!a@t zu>3kYtQ|-7EBCBIey}DDh3Ic0{`wyek=&6+V`$i|P2fYN`Uo_BEU~eYtMLOgnp%eq zrN$2>8yC^R$1WyCQN)(pLwsEHCCzM%FZQunDy1+;E-rW312+pZHn%bkkd%F%~? zd;-9;a9!NFMsf-D+LKajmYwy5!@z?JbG-Ja zvDW@fD|+%irLeSwzbV5z&UG%W=TLZCY1NK8CW^qI$4=aluc}fgjO3ik;NX8G64lrN z4za{9J8k#>u-PWiTpls#sof#}{jZxu&g=Sul`7vTh*~N7{f9T_~KHJNd$EhlY zO!D)FtDj=!J1UjZLu-sKc>nEOgf;jhj?4WY&n-hE zNuS8@dT9mt1%yRxD7Sx}#$qPaCK6RHOD^ue+_m}u$gf6-NU8?kfV;fRRU)F@PR-6qgdnV~%D-y;F*?5tkb$sc2q_Y)&a-;6x0a zJir~Rkl=kJ64DZNVR98~Lr%3fVk#efJ zu&xSPezjZTIhkk=i_OvOeB2;@Zc#8j3S0|^#9Va24KgxtDfZ#WVqj??PDxN9mULm; z7?wq4j%Y?&MM_c1h}kJKq)4HErTh6oFsNlCDoop^Auf0>@+4YcRRDMoRK`KjRt`Gb z9{4@~1hHfknEfUMyXzIb8bs|mRC3{AjR$Wr!@)%Yxdg7v^*V6-q|pmq@hxm6e==(S z;qP`40yFJwf;lEB8nRgJq`&+$7LeZ(@ zZOgC`#Jz@`_(acgWt=4;Iazu_jRexWmv&+SAMboCU z_3Bf>D#Wr~*r*Ox`RdpHUm8Hm!H{{7U(A$CzDz1M)7X!g``61W4>WC>hu^|gcmB}s z{*AkkjOtG=1edn*&NhEtgBYH!Kw+OFklInA?29}#t}bQ4r@$KQOj(-UoF^M&@nfh- zOOG(ypQ$O`(Iko5cEd+!1`zbcAGR$gL?Ghr#}n(4Pne%JL-MfKh6gL`Vz=AaG4Z4@_@z$`60+`3VD)yU z3wr9@-|jX4osmZ{+kTGTUhqm{ZYmyBCBg<`4c&Lz$KVJ2uz=k`*?*@pS;RM9FS^)8 z{c^N3Y3H`z#r;RF8@8l#Yd-FO_=_#AmO~Pr8svwPi_g19!fZ$dqsu`Nw@G=&ku5$; zFOXoghRxImA-71?C5@E!h{xnR_$UaQK}muISSn&RXyUWDa@vucn~nt)3FxWg>?whI z``KWlGPF0gv|<=B6jIAe-k(XXBLc&*ou?CbJ5BW(S z?nU}4-HWZQ8`LC)79oqn2goH7jk~+Kx;x^NX9`EcA1{_(?j`d76$kb_`i(zf#O zS9@+paXvpZz}4KdO7uyN^eLwdR3aB1fd5Z?X%&DX($hm*M7)mv7V{jN=-3}X048jAIrKMCIgqzlE(YHwHdac#Mt zg&}iu#sVOmK{F@^Idu_D5ME~@K-pt_I`94y1*NejY)2(%%% zoC6bUb zf>QV6nO3f5q(LDgeD~?cMF#_#RGjuqqIHLz!Y z!Dmxt3%_lKs#z2YhIT>|B=qJ&$u|3hqarltJ#MT%M%3O#rxoKO%)}cXx#P))%#8ZsSd!u7oQ_b*_*M9}^NObq3Y*i&u*-Y+!!qOI|Re@@fxnh9y!Iyl~&a zVk{RvLS8)}7iueg1Zn$4tUFx^Koo+E16oQ-|1#PJmAI8Icr%ol$iY`EiDr)?Ye;RA zvAf3<9?>H+#S@)duqjrXNSulEbZ|O66%TNMEz`ocmqfg14EA1Z(K#!6Sm(G9US7Q{h<+S=AThaY*D1$mnQ#6@YSJ=_+aM1Vt-2) z_Z6h67jHg6N`DaUq&FjyEx}t!=Xo-;rD*I@95||kyuz@yZ#ZXb!~>XBpw;27lB`5Ih07??J*dLd#MBzPcz~ev z?tsnf`Vc{|sMjG;2vNfgG+I)uE~MvnkCl77R)eToL|Dj8)T?(KvX!QKoV;?cV*pi+ zhzP!cAv!%0nMQ9t=OBLZcC+?Pu}lOqwKY(i!yq;jN<&L$2JrtTp-z3Q)vj;61o&H* zE=ZqMV-UzdQwc`3*>N6)S;Jf8clk+;DDLUdZio{YE={^-WZnl%C68UslBsg)FJERK z!=@S;s;8x(`n#F0I`i&;AX|V*(NU-CWaMZ+|9j)7n%ab6-O0KWM&|Fj(<6ir@mmRg zp#ZfCthRQgYeZ1(gszR>9MAmUhXWN`b}3cA;0&g4(e9$T z&o)gIGJe~4l)Ea(wpsAPp_!?(w?aqC*>DmE`*OH0RW&(x%N!D3RsjV9h5`UsrM&JN zU;xg!JBQ?%pK%rX-^~5sqy&eqW=$L`f*DowU>42`hmF>!y|QduvUsy zxJ1bRHc0SY;F)kGU6U;(fYyZliXbta9jw;`6TK~sMa3&E7HWHOIh)cUd1@eyhc|M& zM^OIO=f9B&iXXL}qgsW+qOfjKL$JY6St@zf=9nlXi%$%XOdcOaX9d(kkG4O?I6|}fmF#$hk zwhp_t)mr+nwj88@l^VS=2qFX1Dp^?vlxEwr=*)6SfU$LVOW*m)7BKiUzzoX(QkhvX;K^^ndt)`mSt9NZkohA^3ap@UAN#{MM z*rTw)XWCSy`dGD3P|P4ccGCCFT7RvRu6s=13Bq4Mp*Q`l`*o3;#L?Q$qw8}J?sJp| zOtCZg#SF`LiqBY@>$7ezW&POuFdaqmbl@&alqFgvzUzfZI88*|1>|n&{w61euC%w) zt~FGxTYxny9dP@gGGbiQpWeML)jm4@6QoFp^-x_&=6dLKf&6We* zhWityx}%Xj2^tD4Exqr>^V-1F>j1SawPAe@&lRv}Jk#$QLBS-Xwj&}?3}a_U>QNs6 zgp2hfN*FKWM^-YqI&^K&J@#UEfMXYxAPH6iI{A1h@KkQ{>ddkEyr`psRBmYWw9KH? z*?HaN0+#LX?%kz(z7campcR*IrWLlgd)Vx;kGw;_GBGO4+)Lo0XQ9Xxgef4|CMNG~ zmSD3#b!x)GoF@jHcLm#&?Ux&KwgR3~wB$eiob1a!Q_yhX_DUC}-gVp3a6_ zS51{_HXuWpdvmD=o3U#nUT9Q=eTRsLO(<4;7J;+q;$A9f0{j@*6JV54xM?bVPs4!g zi+%1`-UF0j@u?BC{G1!@H9T-sSK;xLt(%4-jwr7XB~H`v?zXQSH%d)8J84eIB0;~1 zUSEKuQ^|S4sWQBCFfkDWs}yQ{UJn(W_-l<|zUwrNi#09ymhoMijbM;2GeHH)k7OAS z25W9A-cY~emZ10!svS%#^rSyvv=gZPub%-=2TsYhO%sl-+Vzq_(-i*>Et7ZWrE0iUKao}Lt-@A z)QnA^@yLciyjqIHRhlv1;x%fs$HUExl54~0mJxP<8xl&>gT)0J7K}_Q$6`_Ijh4LZ z6%I`n1&;q5u~d_b%hDw&j6ppo1y8KsHt6=RaL&QfyuHDWjFLi$Vd$1JQkMavnDO0u z_vPlJ#b~bc7^VDht4C9!A7LLNS8Er6%_ZU4j6H-ipM9)S>z9i?sVge~62xwNk%jHf z-*C>R&NUluK6>?54ffz?q=YTLtE))mPk~Ufy-4Lz%Ce$AY@?;6Uwwf&&DbPZ1I%=7 z!6EtNx)nd&>}dh~vj)j1I*x_KcqYkadcb9_S zunlgtf9DSP$8DgwI&XaV;W^dbeCky$dVgINls*&2C7!^D4Ps)^)4O`6N7*O0B|dFE zE*PvuYbEcGIae}q;_;SKibw0_PKT+xDpGfVEd0UXO-FlP8a*=kK!AOZK1UC0pq}FxG*h8ykVUj2+zb zTDF|JPLwql;y$Y#9k!QN`0i@gT4FXGk|ah0gDJ{MLh4U9SzFDG%n%FT_7P!o zq8wFW5i@0}_-$Qb-VMr5WzJccIOs_(r4Q5OOu*fd`2F4k1yDLVmHnpI?E_=|Vt(nd zM*GR6YR-thj3Ej#H0N317Jb&8l?)-4>r5MzQYOetj7-#ypous>ls?}b1v130*~!7Y z`} z!6>z^ikAm33)BU7T0b6bEkN)vST-wlCst+tq-9(DR)0hqg@;O3o4lM-Z|ICF2zWRG zzsOQ*ycF?7r=s9%*E-+ZtH*L7poF3)hZ>i9gIg}eqF|;n6~C-jnOE&gwJphWQ*E1Y z9caOXv7bW-l!aEe{cbpo`oo7^!e_%6$vm>JC+mrqA_DK(n zoOA{;bd2XVQszIKjjp?%(|U8{kAp!5p8QA7z7k$FwGN-~9c5D1$k?q*!^d`(XSJNuYJ6&9W%e25X}sI>A_r4{|}YtWH_ zqq*SAp1{lpI8J4$3x#x`B8S1d>iI~8Cha?pk64!;26(I$&kCK16`6gsWSiISk4sf} zuw<$2WN~qfQ)dKtWWj$^W}Y`X6&;_)`E$#_)8l?wMpXL;&G{?!A*FF880cVgm9>9{ zF?%@=7XZEfF~LeZug=S3IXYIE#A+-Wnm*Rd_P9$k?O$tyH#>oKAm8yq;$kb#de9tq?9D;{M`o z0-HPaC|%vhHCHibdR1M%m01AfQq+dROu>u7g|aEtJ~m)-@H#W-=0>Q>7DT(NnZ<=e zg3kthA@5XmSoyFMqH<#djtuSv{|hx0rF7bykzv0;E~9R3Mkc2SjeXSEVBZ6-jHmNP z7IlD6uq67Ls38YHPN@peJb)Jg-2ln}5Hf{tvJLH#1(?bD^R|rCo`*SIm6KdGH$WqJ z4H_vgrt_hxvfei$NlRdmwGI1}{*6|~sE~2JRJ#X)^kbyEfV~0XW55>1AfAIM>mIL%<l0rSgnUnIW35`i0Z?XEx^lMnQ zPZjH?xI4)~s-Yz@AWfQVX3Oc;OGcyhdH5Ni2ON2Ueb*1W7@8_-cGl9#ge6{Jnw$)< z8sdYGJ*g}VmZ7My4{1xA)w}aaN3uO+q+QLzbbmGq(mN|>kxFN7I7sp6w_#o9pHJeQ z8rg0CtSrX5y20xgFu2CE4{{6&n0=55k9?WPGfV=vy((CYIqJmLp7LUW6w*_7=KsKs)nT&44Nm4~ic=@AM{TFtiodj}TKyFB3A4 zg%w2aOeoWOMaM!SPyewRO(SX>7^v#BL?8+La#9|8`_sIMGlr-s`~A#2;CFj*P3FkN z;aF9_sX+imp1Ln$brR_9n-1_PO{mEE^%%f!^jFxY!Xoyj7MMt zeGH`0uNMzyQ(>K;Je!f8f8BP85z5c6Mt#Z&sV(uQ&%;LTswKSwh&TD>yuPt>ta~XH z65miL3SB70Z}ZrEF?keLpI+)@ve)@M&?Y>hpf9vMHxTi~z$L5ZWCb`rxOK3^s$$Gl zS#?G5VdZlPkN|+-^g6|AyX5NLGTLAKS>L0o#JU`cLwyJv7{;>nAI=sZ3YFXT$i4wZ z4%EP6kERk9oZu76vEEej%R(o$#s4XTz=@~KR-bmMR=#j&sMFpc^nA4wI8!Q;n4NYy zeNE1TZE*v&_1S>PZkS#RAo9;Ys`{k5NIM{jAt4o7IEhxTM?%gDWA4oC0(Ke6YC|h% z%W*Y6?QUl&x`pU?AEC0%ZIL{Cj+UH`6195rPNyMgcyH~~K+yYzz?3=E(uNMf9bmJ2 z+aOuJ4YA$N%qceigu9$=9wvg=tk!Z&xuCTsM~6>}&R&JOy+q&Y(=KPK@`Y4D(s>D? zoxo=v`R9g*t$nspjs}TsQ$IGoc-P@-SpRx?jabc|{_eSiZZbjdzYN_#uCYCdb2oY= zc6Q}-=UzR;PG%IS+|u%|+Rn0nZX8z$dxaBnTQrrdOwaoe%5nU@@pC2j3MwpqLLU&B z|4!c$vAY?MlkLAg5TwKtihV3JjV$z9T(NlL?yNzv^ao3{*?C}M?lc?H;68;^Ql$z4 zgI~9XijfmQ-o)rZylSJ5^AzCPtwgYzUlrpOt+7dB_0ZUIknmU2$LDl@T?i`M|H#Of zO9A-W@407!yM52=k+^MgtvZHES~3z6)DwLu`xn_xOpAZX5}FW+;#6E2s@{C>%FLXN zi{s#C;T{A1r6qZO(_;aY+i)g3=p|-gY6$o~IXg0xn0ef$ojO892Sb0cVNDsqvd1aAi0=nd%l|t@u<;C?O7V?pTi9OS>BQh|V3^DZ-p!oOKngD1UL}fZ3t5A?@!ebjOo&vJ0!Ci%g#W*3iSAFpWyGkdh|@Ys16M;Ik%= z6aB?lFSIi1gTto8l}r-;P*=+J$#-8{1m#-k{alAzSPhMYM3azWzLKnI55Ml>E!^H_ ze9>$Jclp0p&Bdb`#QYT-{bWm3Bamm;Yk!=^9Mm{lkFKA3t&_`y0n@Kg zCk`6!ID0*WiC+x3b?@=zY?iujtyg4c(b12`l_3LqUfUG;O3PB&YGsW(85oK~mf&%{ zzOyNgw1qA;92xdXP6lu6#oi_9c`^E(IYrLRnj)^?x?8aD7$0VSE# z{xm$~WMPuC$LWPhyKiN7C2TB3j#{KT ztkvCLJQc>pUQ4k~&A1X1Zt*X#fqf4)Oh;uZZmz-Pyy>3TIP9>-4|c*T1i{et%dSr& zl|IX?PO)ulTb8!_0UTNCaMBWVp_XZT_70jb89=QXjRe;!_KwUTuSajEuOdwCuK_;0 zTjT>&LoB!SEUuUp+GClx?DEn}La>{CEsu`UQIMZ0>LCiQOB43ahW%j#nyCCe-zUhl zj9|zy>_0u9n`1D&Yr1hw(OpV?V}^H{E$M{um?!A&d*2bHTlr?kJ9Dm2>Vt*I$5EgH zM-G0uZ@zOe?FXs?@>Y_UsNMZie$mD6Dwv&E8<0!t6{0=nLbj$bceTJE*3h`PoNeGq z5!$taIwGD63!&cdc@&?Yc4iiv&^%qdwvzHu5ZE%-G)=3p`Ff`>IrF!NERu?b(-5Wi z3ucs;eY@}Sv>`N?)stDX=EzHCm`uW>Ywdgi~d<+Ohv;p6);a)=P=A zmY-=`?Pca`u8xSOqGQ;T#aYZ&q!(U7$+DoHI2Q;(NIssDj|5|b1P_)KOZh5r>-hln zs#k>1heI#hQ70*zhvYp>{c6%3V1-NVfOaFon*i}=w`kR)goXGFjyJeEvm_Yg>bR_`miNB>|oms0mG z6k;$rZ~4%!0^DMULD_9;M#N5NYdD~HPG+m$g$-pvEAQBl5E~lmzG&rY)61-sLK^+ zV2DHx;5{Kao8utcA)j_~zn13`w9ny&a*UWNxE_9~Jpb-wu_CezDVubhR1R^^$8R4^ z*{D|o0_^@ww5kgd=#`u7IHz7+(9WcP{55^zn|tb7#Ke#uR~}4`|%;@lI9atSNz1P6(o+)+vHij(7_t zD4Y!sX3D#fqpGq5&-|yE2fn>aKq_xYs{@Y4S8hW)z0>^s70T<}73!wK7 zUS9L2X&l597W19glLVf8Cbd}&@?!e$26eBKlV!#;*io>zUn%X6Z1XwYiP{#zaa-gR zo2Lp@n+0EvaUkZ+hVc))<@wGLq5rI|4I<-CVQ1kkeN@h%%y@cX@jsE-W@otgR9RBW z##7f9L)sNW!j@_C6afY?jTHb+jbfsrL@^^We#{*Lk1mWjHF3!&%eT4t|i?0YTXq(W@H zV{zY1>83qBzC@=~u>$Wg6sTiQoN%Z$HgV|r5%)%Qsug)$sCub69xa0GXeNDxJ8K*X zJJiuq^TpWy(z|4JSG*^}BM!6J6P;1oFRi{pfQrK&0W%0Pkv_gW^dVv0PVPA@PzFD< zFXH~D?a2rjF3$^|2JC~^(w#`EZIla@u?F= zf3K8qy$`SwU}6_OX_0N(M|k}p?5DEGHpC-V%!(r{>K$ka=RLDq^;S7)U#cR*yktxj zeDO9)*B_()yDK~Y@Sj>O?Dt4(v-P}IS+vziX=&9##&am4s}AfrFvlw=v1c0({tG#} zKZfjWhkj$n+?#4rVv}F(kHdQpI};kK zYECw;Qzm-ek7TuZa^dd%=02pVPPZC5whZJ)sBt9rEFIu&8g<3`gm*Y@a55bwXk@AaFD3Cv)qZn6E`z4 zcCi~C_eZ^URYszjWH1Q+oHM@JGKiDa|AR3V=er*CWrKLgMy|5S5~;oTJEa>v+Yu3T z6|X%X&v;(p*uKq3`bj4#=*SG7@**b%n#MlS*XC3zPOQ$$vh>kwXHjKmY>et@_ziw) z9s^+L=XgOF<4KOhFUA1mcsk&*vZC9H8Y?r$QkhQoH;=cBo5jCm{6G5c?)2U!N!C9M zweETTgmDM!3p{yT1AAxOT){r{V4^MI5?m?;W%=bHvs$ij`IIR&fl4Q_zr)CD$X+szK$!#19eVC#kY$G7ee`C!Ui{P#5<%{rL4W?)KoruzYilE8ug`8eu|@ z($U@{RjpoV3cEQmWTb6j|K%2RjZLT_bY!CJZlgWU31)T^e1+0OKg)jf;_TGOnyfC4 z@S0Vc#-Tbt6oxXQT>a?QRKP7r)f66mx~{jBG7VgQ0sBh(t;C3eV&vJyg4p%njTB2s zwt?_lb%}7*w24s4ZRj%#OBd*c(1dy(p*j#>K3zab;|mIP^Jb1j#V49g`{?1 z5CL1(>*(IpNGJ7VhI=1I>yG}$*38gvueI6HGyU2@mDmu{UA5O4>&q}%7d5R#xu*zw z^pC(+)@6_Fokl8pRB*Ovo+Geip1!S4?aQ5%9rIdv!(Q?QaFH4Ie*k@YfOpGW0(%tug%R3cyZ6l?@N; zwj5-Z=KJpTyAy4No#uJL?dD*nf6$lzGNF{RxtVFCG#gMy9%4=xB&M3e*wp%a1jOZj z7pU^%&x!7)yUv|l9hfidAJ$(ZRfH2lJKN=a>hLd!BqhgC;Xx3^Wf?9t&0TeX%O!C4M-|h?^#{6a+N8$sUdHGbrJg#Az+w7Xm3NL}2(~)M?NCAb#y; z$oFl;p~%9v!8R+-1ZeDA*2jTZVUPtGCx@b*Joc7a&-1)3}zFnW!dj z!!ih(U1_D*|Ld8FxrKd?QqBP7DbJzbYI@vbK5byWmrMzT#d~4x=ANZ#+En^rjXFjfKCuI6*G!f0}MjCA;>mWAmSoGxcx!x z_Qt^1TEIr*WV)lCS50S!!nUJTEbTMI_&{B(rNG{X--IuH!s*8x@r z5M?A>Eqj(sb*7m4s*?kkQT$?7-S)R02x$XE{$!;Bnfo|c4uhy@zL|(HND|JUt%)!B z11qOlMdBht9|8sX0Gd4bSQKnD3S zm4-_bVi%8`4v*Yg06U~SN7=$_DR_ZhZ0f9%+?ta`XmPBa4_r#wdt-7CuJ`8FdjhrZ z>~#rQPQF9~<#4`q}Rb4CfBTC9W2T7p#0|eJni*kSbRq0yCiIzl9yhY7|FKx{-M5s_H>}@?JQY+AmPg3OLla+j7f`P`#N@6bcu7*u{DE=(^6I?sH}kMincim zeC=j&kWG^_7}=6;|E3M-OAwS9vhim=zhi~6gjZ#IqHk7+3v4^uxm4NfYhFGk~UR_;K7}adE;;yFalcyYA+oVob^QQ9h#;u5M99`>cU6B}ej7ErZSisK_+7~wG>U+)IaUoUR*jP+g%7VvP zFX;7-d}4VC42$bm_kZyWr*2~RyhwYWP!n10kGkkNgoL|#8d#o-)*7SRW6F6WdNAde z{SB%3NaoPuXzTYH9?o^qD)eI762jH`zKkc^bH-F(Y=e>VHtrV#XcuynRCftge8ggw zj+|Ev$Th%|P)HH=>t4J~MLw7F!VSlp-HRjN?)hHNE|7E!-wJ+jI z8GGs*v1;$Qdr}7r;5KZs!)1XD^l&-*j2$@bdQ;k2=8ekG47h^2>r02dqLsXOEF)ACO%7a zv4ElwN*MUB>UY2M`UbA1`nKYAt?qw#8T4!bo=eveUV%rRC*M#!D(@$INI;TR6IzJQ zuN;NN*a;#q*!NgGt^YZh07pQ$zpU{JHI0=vck5TQe-Z{kp|IUW>jn8Y}oD93&V5Z)T5YO4PMH4t7jK#{fgXTnVf-M&`d6Eq1(j(mC!1TTW$M zVG|4&3O}NO9;S3idL-H5y10^RR>oWZXeTj-`!GytKFf0Nm7DF!ZS7uFkw)}rL5q$~ zOJ<6#XWPD^JvU^Nt9sY^8!}Nt72YL4P8od1sF_gT;tY$D!oQPf(i2`GbHnJ>#-mhH zY*(m_vJzH|W|I*Dw}eiSx|++v@>EP?9sHZXa;$;gzBz`rXzPSy+zIK}rc-7rK%BeM zbZ$Z{#`t>Bx`H!~P_TdOrW&uBcR%OQZYmtdK}(tTYCz14F8X`=algZBg041V_MXMKSBnMb3f=o7|rQYK@#Sant2sE_Lx+FB}!jUg9Y9s?T7B3{ozP&>7wS&5- z)*9pEeY2BuSW3*%Rw83eMEis(_F;YJ5LWDsk2!6}w`;giQM@IV0zg0s5{F2m4glV9 z@8laU*BzzBVJ?k!;ZgsN3p&ILZWMUFvwegX#NES}ap-$iFPLzrE)@8ko+=UAYvJN7 zY;;9KmNfk|9nx(bGBXGwfG*6eF`$Z(bUt(C4!|#SmuiSdpwmWz}Dh00XqAC`L5GZ@4jC@ zpNhy?RLy$||D4A~di@}pc#_UrzZ7o|z5@^(K(&C8OoUPfpbCX5kGT3@9_7eWGV_Qk zx)xM%8O1174&FV=Reka|D3`+!M|m1*Ve_kJj}d3GzrCAn{65L>Nrp@)L%AKbT<-7m z5BqQzyzdL7V#R+z9&j*pNQWJT$_htXLY>agO%;|g%MN{si6af-kU&g!pE--W>;N45 zD>!xXxXMo3=Xz@ukSpLU03!&~+j9d1`Nr=;178bf;?vQiv71wec~hppMgW|bJ=-&% zOfbO)3|354;l{FoUZDF&3m|=XNwLpy^}T?QIk=WP*fE&l)9CB3U9wi&P5{0@rN&O? zwMn>xDRM3JNbm>1MKqNzlx<6PK6unv0=e#Me+eQN!}h~vKM&bBIa4i*TTwL-t8+d6 z4%+END{a_h2P`)8x=DAGBX?2jVt5Uu?VF?vGfJbJwmIqUO!&ME^MD{!%Tfsxq>DOD znHf*M*#zu1jLooNO7)UKy4n4Bv%MnVn*d?y*pZ)`S)J=v;i=KrTkpPwJs4JgsJVL= zSKbB_S~X)ymlDWz1R!>+mmCYJ>4hS|w;-kUHgy>nJSk)3UE5_wtgxsN3n)jI))Jo0 za-St-TjMgplcx|XQWW&*)1I`MGY)v`jFA&#GvQtN+c9e0Z64nz1*!^*(@ob$xTu`a z(#AqwTP&CIKm`XSJq!JqR!)ylSf-$LT@%xmLt zNf?}$E2P~vo#%u*r8AhpzT-OYV+7uAghlW77Y`ebDew0gn(g5@M{MVD_itTxrR&Z{ zyH&YHcjV^-f%KkCKmP9_XY(?Y`>fEE>~z$O6?j%`@4pBasek#nsf}>V@X;D$Pgt6u z1wEL)V}D($mdd(Xw)32Raj?raymxg62IA>GG1EE4o(kVgtRkN}$^GVw>p&)6N7J>IUYkW)5{g{w2(Qs}m}P4NhZ8{6E{LP_kgmD^QUNo^XOl{!{CeJP`~SMA{BMk)MAt(H+2@k`*ZaC@L=J zH?}$5pn8`CYB1Ov3`y&>*2#tYAl~lpQ*-I9aD}rb2Hb@qag&@i{K-A2x9y=icq3r`xo98`6mXvhRa>F~?A54Z((HZ`5|s+Cm+hMC*Mt0s)wlt<2O)e5VH+Q!1ub17u)pSo}k*4=IRQP_P~h2#Z93H<23%&_``n3@3EemE+*cCuqe_ z_TTgWpn%NsO72Y34`=YHbFQisBritBDrAB=nB+bzryzO|*K-^Ut1tAdHAG(9wpRlH zd!>zf>F(f;=j#9ZH%%wYWx8)Um!?S*N+2RH0&oXYLCM=^!~Q6cFM6^6&4nhQOayXu zJML~ubA{LI7TqbilmvD5%6V}>_#bbJcaana>Mn8-&>Np-2zkMswk)*%1Qs~2!f0#} z)acaH<2lGIzjxsrza=c7qZLd(R0dSd$p{b z9N0D+;jn4b8hcqDq6Yg3-S*$u3Pkgs|GPxJ+E)_o!WxSY2$px$G~^W)-MR5eva`)8w- z7hHv*Cn47+a+86fnQxMYCTQOb!W(APpVC|QN0`DA<&i`y;2yv$fFO$`RUfhK>pl-} z#AmS{Yl27CL&X(l6^@TnT$UB2lO@GRl2vs3v2HN393Qc+fkhfQY?w-{8Qg#1me*cR z7N0s!PbAQvb5+II?ebfkwQUy5JGy5I1X6|9`ej#XlAn~mj~Ci zJLm1z*}xhH?PwXOLt6d zb_;77E;vCo8f$J{z8hRaYc5~LvkcYYlz)_I8X8b@eUKOUEnM-f&WOm2{$$Hf=0&4m zMLM_&?WkZzOEl!C*Fyo3w06R9CxP&RUvn81kwX@DC3W4e$fDlpd-cE6Fg%e`I+FL{ z-8a9le}lTd3Dmgiq<#--0`=Q(pnk`Mj;9S;suM#BT%rqV{IE<_G`gT>>Ys^2*fvX8}_9vs$-&Ldi@znX{1U?%)Xo+a1e-Uz{q^JoyLg%$MnxbN2dTh zl2fpR0v{*(i`F0q>*7oG4K3RQJI>D+&Gq>PAvS7w3py*Z#IU zsX$8Z%PT{R-AJ@M6#AIcK3h|+rHF?TbXvUjl^L%Tkl)h$l|DFRT%{}Zw&v5n9|_H zQOwgNins^iVpMV@b5d5$s1GVEkj= zS@;=8mxPN5V{PQr{fp-do!&tg3VV4#7Rvu>quOINzUZg~eFXd0FDobv61736dP5j6Xz73; z2PJ_GYqO$Rd&F0|4U}?2QckYPF2O#HqJ0 zj>X4` zvzZ~}=R*#ZIDLxcwnkTC@MiusKWoz|fVTa|uf;Lf`Io@sq*uH> z=XdU>Psi&l8ChfD$z*@hEOy|gZ##i-q$tzzS0qVYhT2*=SsbC^Lv=jbyOxDt8 z-Q5hRZNW{z@Hr6ujW23o6zs<7(fr~N?QOnc#8Bta@!O3!tB6ra5ST&$E9&=57qR!w zi%-yU97P>_SCpwba%!K+_pt99&k~yC*pxmA(9$w_md(+WH5CmR^bh}|-{^a~(=Ua2 zD-~V+Gr|QHDX5jZpgjT(o(ekIWZFveWrl|`&{{Zde(p*nQMNt?=CQghY-mnR9 z9QR14k1elg=n9|5^OR?kvI{@6y=2tqXSJdp?GSztkDPp5TP{u>UrxJcQUMoGPlj_< z0XgBXyfsH>qNNxACBvcU;GNEJs6X5yL!XOeO*?`3Z&sIfr`>|zsOYn5=!Z{ECkECI z7a?tZ2J?WGp=6+;-RDOKl*f8RV>*4VXb1*CZ8&36;29YxRRg{FR3d4n00vtn@5}m> zaI_LRr?RIG<}&HruZwc>;S(1a+~WbI6##HF`BT(4rH~YT{^321f9gHV^2-{@7QK4P zlz!3X>_NgB>>rRy#R`okR9jnK#mZ^*9QgnfpB+y|y)woMHvqu2Gl}Q^h?HM`xd=bo zyGDNUyM1xKYmI+gT=%ajqlq5M*}Q1qJ)B$|6ROYM-+6&4?6pgS80IW1>oR4#920H( zV^eVou2GRq$;p2#>VzRTtEMSQUEI{1*GW+(Pt;7&S_AtcPT;!G!`ndO{9|Njiw=Ip z1P$m9zNLp(@u}4GeD4& zu2d{@?f!B~6&m|?X0J>3*^-AL$5DNq1TEQUE-aH5)ad-&8C#6P;@`5_5+NEV$xW#4 zoU-AoAO)ocYGTToWW1}WZW7Yi9w#Q6fsv)CoHO-bp^WV&6v@7-gX%Z;)q|-!Wm&vFgt>J7W`N!U{ixT1RzT6KQYL!od@{$Y+VacxyUi z8RC^8Xn4V`V)J*~JV_Ici{&W-TYtV0A3*}n4VW!;ZKXC$PsmOdgHD5UR;=`0%0_2O zziaBI+NtFW4urm9K0MeHX(`?L1i8VXF2$UB-Ptw_9ex%7cTJ5sPIGCH(L~NYF98CM zJ2KMXYqnSan_s_D%jP`A^+j>UKPff#H9*}UF!tZDb)v>$IgfX;IyNDz_K2*aTZ zqPYmlmxpA^`Vb=K)rLcxkToK;6ZuhFg;H=?;u&YDy#-y6DeBAY?y`!eR z1^0%sX#Vhr`1;jh3>G$J`{^LEj5xPIh9l|^*-w-2n}&7*WTIxpq^Pc5mQ$MT8XWd| zg05E+*+?0SLY&VBUkFwS*?W-y@29RUWc^Y0N#ML&zWn32M9(?76(O(mT=|7Q5h(!}rsUI11W=V+XzQG*<_UUnWe_WG zQK^_LHyGlIZd^u}QL?j!U(ss96NFWQ^?EhU@KL@pmsn{lT~{D#VFLMyvKK6)WtfcZ z2KRy%$2v~{YdleZJbFf#FC&+qWB-@fsW^N8<+^oVb%`<0G78`u$f?aYVp=Rc%L2|` zIv^7qRm+n0T%fu`H*~`Q9AJps^?=u9^`YUX{L5`vQV((lu?L`0c=2YEmswh8%zQuF zemD$$w}OH)tyu$h)LrrbjlX1VY*U0C#^93G1N-2NSm_EByM(GAwWMfA#ker|z>NudOU0dp(0;_ z+%=yE%GMbboAb>0kLhD#(I{mEG*w3IzyUE0gSGX|&wS;Y=6ul&&cVL|J2B*KjOl~+ z54!)dH#%#X41X@7m_5>bp}`1@s_u8V^s2blCp?%9O*h*A?3 z7IrbxHtzF9Cgwp=XD;$PB#g`je1MpTz_rEA%V@LcU8Mjx=OtWaE6kbRSrGCgV)~Hn z{hr?tC_`7u_aKztJil+rsqkAO#68J6tADzZ0Iq0vPT|#IIrWjc(YnzHxfU|m!f=1F zNwQw|(qjonQQ{i@WEh15iS16WLFW=k=OM%%dp&QNJ8ww12yQ|*vx|tK(>6({Os-ZY zO=in;eD^?kxqYADHPo1ywl^dmj3V47Ye`>uICLCaw8TyEl5|l`4!N8k+eY9Uo{=&G zN@@V<@EK|Ht8P>c z8iNPjSx>y){%61-slP41e3fjkXTAybK>Za ztIz$j4wXVg>QcD_r-Fp9d*8>CZ<;VNYv`p~s=)+>EAxTcG5bnm_qXjS8!sSJ8D>@M z;W8wz?NFWVs3D5)LoaqlC5ofR4%{ReC@mrCFutIRTm3mvqSfSfa9p#R&l*pz2wBZW z%?A5h1jzNKo9k+f?aRBr*css9i-EQW_z~Z7#AfDJm1~KaNOxR(u)5)_vq@Eeeow-7 z+mmYD3hAlVC5UwDJ7RnKnGIAwEd|2o-fR#|9ED-Uw!x!B1yp+aHKrne-(B~{qb)f9 zH>?nkej}f$Wx?Z6?3FljCl`8+W7Z5vLTeJjBSEgcSnKebl`no%tU&;g%+s}rvg$>+?2HkiZ!9|gv80P%0#EJ#R1?(NLjKSO5=EyJ16h@@9to6#^;KL`P&y|rC zjb-mGBsnekHR*%@_8eT`%D*ZQ*N3rRDFvI?s`{w5)X3sdoIRPP#ik<;&3yIT7d64i zQ967g#9fBX6trFV_SCYl=bnclD-#A6Nxhs7sc>N4r)OrhbZ-k{O464&qHziKaU(4G zL4Mf!@zH^41=-k}fmNs!+OcDOPy#OagH;ku$8e^_J-*#c{ess(eWV#QxrZ{NBE+{i zbD%H=HfMUnFFX0N3ve%aZR|1(d)+5#?}@A;q(MKu0HZ`J=K${9m5os{1laR@UD6n- zCzdF*PVPL^>q_(>K2Rp?u>3D)kGsk(7QN?xc4ltDMLcJG$@I#3-x)fng0xllxxjJ9 ztK)AvU4Kl)u8o~K37PSRha}j)cuJXORmS_8@1JFrG66_u59=`Q(}*#;`%xQ@V3yVA zd>2_E8TpoVFkn=HN|AH~8Gjt!X*CCk(-7EN-fTs?MeiyHz_~2ps(s&;v718HcFhwa z-wRlWht$3yH>;v6M=+7RHStq2ss56&r%Z!ZeDh^VV62dcA$0EX(+7izQL<*^1F4=* z$B)=(Ka}rdmFUa3c6%Q!SO)%-8rs8jV+w-z6*MtO_2ckP=lQ*284O!9;JG?@;kv<9 z34*gOz367<#)T24fp)y(zXES*0{27E8c;?qP@ANH#$-C_&k!gcp?l+(V+jJ`)fo0Ep2HoZZcEZ-o(SXly3TIq%d}f z$oh(aE8r?N0~<}e#3FAa=GC0wqQ@8c%D+A zc*(FOG6}E)?C(4Zg((^ANkY^)?2hMsSCGg%O%9gjc`}&LseiG41c_l+;e3AG%MyB5 zPQx3~kH8Z9K&_Y#c<@{Q?xLm_V1n)KY}mhqxC{OCOtpfjPOC5N^sO^4!C-u&5_dZg zr?p1~O8PBF2`;`^4}H-JgQL8oG0<; z?=}wkITFbj#Y-;zzePkuhXabBI|AM_apAH~Peg&S?oBAy)_2=l!%EAW?N%5;20jYD z>wzwaICYNYe@ct-Qu({ld7n59gomKi8A{L+iRRI)@dgBeO<$q<2$WI&{QV3N! zNOLW3e&%aVyQo=1j}3X7OcU*T*MAf4GGv+jhyCS%d@qkvMxcP_B4|RVQ1k54YmGCF zwcO;5?7B%WKXoSIdnZ@Ulx@lbbRm5AcjApoBboUOXHfeSu8Tfzq3 z!iqV5e|q*APZXOQS27w_9dEICrLuoriHeMzIBQFrX^0SfNZE|b3lk4#bEfJ#i{1;$ueWG4drlPIgc>T1q3Qughi4f1}Ij=n41DB>m; z_H66Ru2HXv`FuFZpB$5^9XW|y=v@87zA0JgSs{;)Pb5J-$N1Vp!2HVYVSNKZIab-D zX8M~O8Ha3cMlCXoSM%Z(LKU?w^~`X3JEzAK*5r@`N0w=pR4@EFkJb6f$cz#+avyhf z!$w-9k(R6hix~kHr=0Waix9q35RwI&3q{|!iD@lLSA|m% zDLrj_KVTXDGU6TiV~7H*gEPH4XTSE^FfC;Rq`&R{fP%)=nWjJi2Gh`0mH($`j>x=6 zR5~0IgFeoUrS&M@^uCg=Ow#8%o$78zMcvx(#U1&$M2~5w#kCANQeV<42cU!y`^0AA#T~#N4f~lx#~Rmk@q(v zi+8+2)p1OQ%sgB>d}OvG$*%MoZlYrvSO&H2dCVI<-5PWUNT9NbOK6uI@$bDP#}b@7 zh7mFxn@AGufw4}n_T3k!^PEcb z7ln_5aHcd58R8+uIS?OvZbvxaWi?j+BgQ z8?w%RR-K6Bj5)6({I!dx>$C^6SKT7G44hC7gN`Jk`(^|=Ed>{SiwD^xfx&k$fJN6Ul7z9oO>_s2-1(WCKkX{!V zn9-1pWH;J9z}pV$*T>NK6z`>GiKkWKx>DE)N-y%O*(==uDY(#Uk2whZGzl*f`7!do z15UOb52{eeG2&fZ0=TTZ0@W2Jwim@i+n`RVzTwY;4{3F)4VMcw>+ezWI!p=KTXaW= zc&*P0Oj5i`{x+FtLt!Sr7(E(0I^|fwqd3tPb}|t#{sK&?g&WTgu;%>2A(W8!l5;mnb4*C&-N~}nBfuOgR$)&bOkrLwOY4h<%V9@K#&eMW z&^s!4;*<5pusn-r z8-eZjJ`Id}fGE|rv9$K;gS@oU$0HxkB}(ajHfPzkn(p{Dg0<#> z^j@lZbKMqkeVX-OBx}x0(2S6fo_c*YM4IiL_jn3ojI_i^U&No4YOp+KF=Jn?LH}mq z9sysa85L>`$QDC(?fqeo6JEGGr{uO)C}=b#k6bNb3>Rl%{6K2Y%hE2FrgTLPE=T$* zWH)L}?r@}DjaAmZ*X--2#+Z2IC;Lgr(atsA^I5bnD38 zF?nWn7eHoZYxwk4TN3gk%^(+jXJ8s8sdxY@Bo{_{?Y@E*|1-*dceb(nNHi(LNWbrq zS3=N2YMQX*#fNssa1*~q+$z&cgvnx7hSKyJLbeg3fJX(z#9#nSsk>(MynfLhO-9jo1x*FUi_dY5x9OS zadDii3J*&fdp%ZZKHBJ!6o{a%?P$>cx!|yCR;fo`e8jI$r$?B-1%WPaNSqmtuen&8 zUk`Sm`PbS7*_Mk?m{yjZt(mQFviMm)jkp)bLn_eSJH9x&7lURj)kob194!u?e3?x8 z6Did-MedXlgYDqQ2$>3*JME#|1sqSy>zTJ~=|xB8xiu>~lm0`Jb=O{4=o&$fs9*xN zyL`6pCW%K=)FHsV;-rt)Qbjj_Uf5+(?F$FO{2Ntx!xAsad@>%$g6c&byr89)dnVQn zFM#|^e_Zj}98QyK?{{Q&3z_2ysW{8q?$l7J7VYR^-4bVI?cT@~zk{_qku zuUA~Mqc%cSJHe62$SbH)hm`p0@H?bGN5Cq?_-4(QVrY0X^QI-e#7ZB(c)1U$J|L<0 zJOK+bT<&N&oc6c^)<%=y-%$8ZiR?@ZQ&jABWwo2YeHIgPc3-%oU4`wpu~kt}UI(5c z5TrrWadoY>oMvM|Uj{H1pVS@M;xwuHJqN0)7KV`n3%D^)5tin;TOtS5L-{wpl!a{l zmBzZnM8y`%$lyBL^g8(|8gBB2BbbE^6e2l3Id!<#{tMU2;x=(!fCuQA%q*PQmRIq9 zlFW8w>qVl1KH!5&C&Z22HJFwfd}aM8@M=y@7a_&lL8&gv-Ow_BWxMopPD2IA#$)Ls zq}$V=Z6(X(vHQE#c0_%Wc&(5YjV4P;_SyY|y80p}r9qBP=%usLM17P=u~q{0law41 z!^i-^;I)zlJr1(WSA3`aXR;NO5G~rAS*vQOV&FxyfOT z{g!r~f_B8<`}f0yC9IOWcPcWfw4eYt>_NF4e%tWNso>R_WRb4JtX+;5FJ&92fSrXb z4tF~xQ$5|V%QDixbmL7HvLTPiSS}&Kfh@!{b&(Syy?yph#e!?9L&T_SA~e6bt=0^M z@qb?3ccHXEc=z0D@02>E$x`#H`?)B|?o~PKfGv7MOm^!Ca9!}wGb3?eR`!3IYTJND zO$9PQ_z6R0Na|%^oO`y$Uqj}eEBc#}9{I)u`C;7%*n3xZSZRD{N7k&?j;aYWmB=|_ z)hOFa1VomX2>Tc$9?Asby!vLY%vUjWgFr~GV;PySIpj0j)2cos*1Y^_Rofuw2Uj)D+>q6XmcK1{knn z@(^8o_uN8ofsP??3+!*fUV=ID!Y~-1`LY7XnDy zp4+nnPxC9UvpS87`&+& zwS8Rr`r4fY6tI0WYQ1Dk#U#64yIv0c?^Spb1*mP;i1}M zEz=C|SBSY_%e%N&u0BB=TSFp@7SST)B@uWzWoOa;2%az|CMtdFVDc*@RZkJek==1TUm!te@FoEIcXXVT0HFAsTUH_#u`Qwm^F>>+<=ri*CS zR4r)1PT5>nyGE~4H-tW*z={;dnAoJ@is)x%pP2hL>6;Rv6| zM3gRAmIh)Iv~(#xoVKQ^0Wl~@0AI4$Swwo1J2lH2tsnAUnwF5CO~fa2oaO$bV#bmA z|1_@OYzPMT(00(U8rbUg?Bs1gzQ> z{6*tbm=5^Pt@DvobUecxXO&AVfWzJM6g&#o_&S+UNUmiTnb9# zZY2$OFsb36|GiVO85Y#^;lE~t0eL4m!Buozpn36_WzNE(#@2fBuc9erIEK%(Z22K%Tnub^PH*Da_$V-X6q?rwmM zbmuz9dt%6pBA^3~O=U>mZahx`A3W=wPzLVafM+DKjAvrJ9wle+5a>xz$vetA-jz;+vsXb0hV+YQ}@Ia^;8|bwCYw@%G$d zu@nwXplGhnG{B3=ji26L~j1joia5TN#EXAO6Jl z-le&1DPA(CwFB`jaAm{7m5GYHSn;R|noWs4xvVKFYP;c+B+03YwGIaH@E+`x!e*JJ`1PkZ6o0L9Si)6Y~L&owMvkvq87Lvp3G zCf=jjPy4&aA9BYOeZSIzc0c$}CFb0S)Z6!_#^VqF`A_r=#j zBi-HDS06SJWb_o|3lqUofLX4}qPv6m&iurbo} z8i{?d_n8ejofKjL9cMrAIFWRzE~xnpV_R$zsiecr{1kms3Or;WVBVER484T$ML)f~ zuIQeUS7bZM)(Tb;)fn?*@;`hB)*|>iOI7BiyK~j!3hg!q>Hz=57}ahvmcX zUn7HEY_(4-y|OW7sYMvY;S)qNPvc4yVpqKitgl)D zcVEgxpz@+Jl7>6vTQnmzV*rl2J%3B7RQENta6OHsD5l4ND=vq~-t=OL2Q-g!b$EI5 zj@jeM6i9(ZS*~+CbpL{2d}V|smZgGm{wWwe8}nN73$$*kEdFXA-}%HH4K#KDUv0Pr zu;@^Gc*-?D_95eyNqJd>XBfU_r$!z2Zwk6?a<91%v?g@R%68BExq+Q1j@n9?KIh0* zFQ;R`=}ATYhpw+1V#Q*%p8$>o{9eq8QU{WQ9%N#(y%b27VQG37E0^p7!Hw6hgD?4E zVtV!++j;iej>%1PMmefpJcF?1ns=cX5M~Jaf`n?>?N5cn#30_;x8$)b|J7%(1LgX; zXTUI{7o40sm!31^;4)9*Cs0(+B7z7UfY3Z<)hB7&!Ugf+8GSl2%3QHoq*#?YGiI$h zQJG%~Q9RD=@WTtj@wE|_P!bE;+G8;KDa`vaiF2Ksa*MBD475rgkbF#2Rf(DN@ZEKd zYDB-HR;!u>@UrZ(zaQ0Gmy|I*B0S_a`fKkNr~h0JohXmpsp~%H$XA@<6AainvCzNz)}|#Tt*Qf@ znC>cpK8V_Qz^U;fHnUTN9Q)$*Jf!UodHUP>XD2Pl++ce(!78 z3*ccRw=VFIGM(oKiFb1(@zG1h0Jz(u8d!q))D7YMwdz0&JYKcdy}x2FHWu7+8MStM ze`3r7nG?)aiMxUl$_ooYiubtrYvr6^Vr7ISl*OXH{uqpX0t=@P;=D&S<(Kd~>L+(1 zUaLMjHAc-FKerZVN~|xEF~zLr*wW{lPp(GtY>=&cZp=Pu_{9J~Xb$+*TClW`aGGs| ze2UHf)n#o~LnxU9XH7}C{b&l{Yn=!mW39RqKRR;RG4zF-BO*CW89TSH0lu6-b zij~Q;Xdc5)A`)| zM352LQ^_bwju2~Rzl%o1&Kh44GMfLX_L{c)zy3Imyh#3KYD_(o5H3R)Rq_&yfHoZ; zW3Sj;u2_{kI~HG4UtP^zwOA5&{Cr+Gu{y%wiegS)e43R{2Xwv#A7F{#g3~#*7a!3M zROfM^fOnIb#A2qpl+ufq!-+g0vT}~<)y5KoBV)M8aVml0E#F*0Oi(XvZ>;?41D+i>GHSxVl$`8MWTe;_d&8l2^s>+>G z(f?Iin=^!>kX3unvZ6-;gaxI(2v;ASlY8;E_s)F=+9Fi*)|}}Rt2p~phM*0# z`T{|w=05=VqBJ&-;81CLYW5}DQTD5JdMz@eo{-xT!Hrh4kt@sQ=9K{ab&2vhuREOb z+4e_=PFMoNyU8$bRX%tu07HJSKOBnW!X;awWJ<{6p_GvL80c=?O6}c3Z z+Vg@M;mhu#b<2xR#?2^Ue@*nP&l7&o%XM>^Dj-aMwMy`odh`C)uJ2q2v-lbGhXe63 zN&R00=pdZul$_aoMg4OsdPmLu!>_KbGrE!!9|@?Q0h<(nW@L|s}F$J0#Ln5$jtnOM0hWFAA`ae2oos5 z3LTacPJ^5bK>`b&x<`8M#JphO`?v+zu{dTGGU$<}W->KIb6O={bevrAYB2JCR%Z`} zqe2|OTlYG8Day2K!A~y2+!N7kBtsaPgk?@o?5eM|b!G!`Tg&+^ag)@$KL{pBvq0?o z|6a9y#Y#<0#o*VDJEce9L{b<8V(D+&`172{DaG9_wQ53bF)NX;RRaL7wi8H0BGlYp z)EOz7oh_DGxNi&yOL#cj&K35KC)OOVEY!NvI@<33>3Q+Q>gDhyp{T9zz?jD{|I0xf zF(uf;Y0CE)%={FALKIz7qyLlCiK4aiUu4;*A6nN~rx3Dm#U=nsC_R|$4vYvW4s zvSWHAka}{J-g3~yx2FwA(`rPCMUz%0`DCG9t+tZP*tSbV=LIR#(21p08|b&`A%$SZ zYwr{q{wAWGb*~>NYtC<^zow@GvYAI8o2kszKJUMHLziDsRr1PoZAVWMel7c9#eu3* z@y7VboX(!y)6YBFy$1`JK4?jZAIvnUA0a6gXx=Q*~$1>&}07< z5{Gwh-ywP>A0qk!ACja-?nv{=C<~uui(J{*>m^K(WvTIxlGyh0*N!_1hyBscJ*}|P z-G^#l$^8wTX4_)ia^!0H7~po6H=VJ_GO5$aQRd33%?wnKdrdnKO+!&K?9$eE?$nuB z(g21#MrKKyIQ_tVu9z$80_+HX8v~!Ey0fj)3`aq;1+@SJN?;)e<8d& zz7#JzT9Egy?SAmgwzSbW;hppknTce|d8*#)bwgJX}j zW+#%E?kug?aPS();Q09~AJ4G=%q0(;dT8A7oZooRZ5i9mm5yKbzdRBPBshhO3gh4N z9RkXr9(ZS|{rSfESq&t5<58xz5!)ITllRjhRY&SXU45H$I6Kt zq+1@-p>InRPa?n}KsvX?ii+s1=q=O)~)1+|aR5_^jV(S|RKQHgRSi_eb1>f+zZJfM4J zEUR^^!=LmnAYaQrQUP26`A_hFA-gbqag8c4Bjs%j3IOVeufHeKxAtE@8&5Rc+xUK~ z=?O2-4Kc@l`FZ(epOe`>_TrhX2xkID!2J^JDQI{zYMHr$M9p}N$HHbU*A(7WgxW6O zTzYm?d)6-e_OXh3Pd1TdmZYM|ph;d?-GY`!fjJNFoRDIQD7kYc@D1Ni;C0`G`0WO< zV#II9#Nn@4a@d?|)&QPj7?j3)Aaos}>LAUOV0BS3mCtzZpB|X%1NLG3%0fqN0x-ws z;ttMqO4nW+qN4`=|HSR|j7;+&hHSj>8@wyik5f^+YNE1$k`^TBiZ0j-O(sp#a~5IlBuHF`b`IR6P#AAAF1r;)bzj-!6mi zvh>qxQcfgi1(uPB>t13_7o3hXH>6rrWa8a<(%s^GrSfpIQyM~_r!66yA%ENY1&xha zU4fI7;-un_E0=2;#*^ZF>$~CRFFq+p$2A7vmx zaxrxIyC$HWV|=ce9KNbJ(UQ_AI+=VmP8tUFg#agm86mZg>68WEErst5!S&JUz()I0 z&}-i}MpOipX4>xA_|?~lTWowsPHju^tt9*KV1s z8y&)+P7e0F|2>px?Q2kOy}9L5gLbdj0lg1O|Ien0m3Q;8{8GMGck1`^g6l67;ha0} z2`u<#(n^C6j!x=-sT{RxK_-FSNp(Dy`#Qh;!T#>Y_(W0ai(wNWTi1Ste1#nv90X1y zWR|9e9c>A=YeO_P4R5wXmya?5zlhP$Ak{qbXaH_}rs31`vlo>`ZeP&#)A)V=iiW?8 zD85;U17C{nrcR15?&$pYKT>nPtwI8FGMB1Wj44MU)DwXSCt$r{xsRs9Fs<(cDw)im zvE)kjVjw9x+nAHU6fF-}M*AIDniufa25vn?{62w&lnvOf1QvH%=M&oOaqecC( zP2!?xd<6=Uib7^B`|!rLu$t#z zeBip!-Tpx7+#t&TZ4(k&msl)mM~fh;-v=a4eCY|mI}qHuO4&9&Bma)y_FOVQuNn!c z$Kw;lA_WrFVJxTCTYNi(?Huu*PkB}o*zqYb zZ^ran0M1v``9cl0EX{S6NYi|X!f4lMT?*~O)7@wZ<|L{+EGhkcs3Z01;Xk4bQ`8D5 zL4bus{ylG9=H#I-%#1QtXia89vny|pt8CzTHzU0g<~yE0KEHcq9I-nPpgIU)#1OdE zd*m$uTmwmq`W@*;2>i!suS43p-Gk23$>T&Cb{ zIj{1wW7eAERry7l;%(kPJw7iQUmIbt1wJG77I8-POB3DD%Lo6n`w;B`*bQ_9%1#;Sf`Np+h#SDH1|v(q3j0}V}JNq zXJE^kDRR`x3+8B_a;Z+abVsB^i3a8A!?RlGzQ6Ad7`P}*2|>IBBm16a|4pLzV!2R6D{iNJJOVpBR2?9Ptl$U`(l{s$gPHJ^l z*DWef>FNi6e=VKUX*j8C>-+-1ht$tZytn11UA~ydlKyHx_Pl5Iz1OL`nw%s8V65Jh zdH(ot;6aF}@vr%$kIQ<8DSHttyK?`p$?ebz+Y$NmV>fwM4|fdj!$AG$7GVg_87G$c*XD8smoztZq(5M-skcp2E?`7l zPIieYav5=Om?{yX3Xjcys|~TQw(=@gQ7W^eX`$ zA}4ave%(P(juZFVT)<>5+J||;@Jt29x0zEaHmU3Nu#{Nsy5d98wXUCC^=5Q^ z%(_f}SGv?X5p8TqDHO%B>j3RMrQwrQ3&W|J$#5~uvI~-v;*`9`%g!}bUXJmNu%wX* ze7MYS(Y+xTbV|2`lO!8Qvg2Uo_$0>EtJ$YnrKe6m`Bo6I@o} z9C@M7|3*(Y_Dt7f{(fUAQsijS(YHkLA4ZNPtIyd-<>;i!s#D#POlMC0Rd;{m!|1N7 zi$b7QF6F?l`TPSh-%{L%-`8zQQloyonL!iU^D)?JC8mgAePxn$tSC7$pEt;m6-`JtnV~5 z{olv;3v`{QrXmpAq0t-b*j(~%fG-c0Fi-kXqp;tY6ee$+C(8v7) zYf45zt`FTBOl^GVPUOOiN4}y9z9sPs;j6!+m!w@8-#FeJK(C{r$OIgy{+MIi?gOiaerv>k$s|9%D4SRrVQ>X5BXyQ>cKyG5 zSDscrNXnbuJMaz>wUoE87rfd7+j5URMh3bzm5+|(Y%hEl8(`hov^;}5%E@AV$diVB z&}1lij-^11;6-NJ%$4NFPY4qV9wD_0gM7Jf_)+v60>j zN_a{hl^7;P6;2X!W;I@GT|-595K5Q!0nLksT>yN;QZpk7uPa%x`EfHS2LY;$py}?QmLbP3Fdi$nK-#(ps;$fM~gMw(@gKjWVTY<8`AL zn@im_{7`$xeW`;Tu08*IDh4kVwXx(=qNQuNaum?iR29cC~XR2^7u93WF)UK^Kfu_mH zU~~7%w=9Fgqyq13)wiy&j0b)lemCAm!zgds^1YY_eZdq(PMx(HdNDdLvvwytu|*K4 z$GFuK6UqeIxEPdm;vc4hC&vSy{6DLq7TA3+8|=15>px)eBPG3JHh$wa23m!C^OrP+ zI0LBns^N0lvVsFM^P%AuRj%mUYmupwi`4rGLQxDkGV8%tfTJnSQ@5wGhCWSeGdf|t zZ^0J8e+)y_JwJE+^4WNzz5{sS)&BY<#;yP!`jR)4MTrb{AysEJZL^yLT&vW6*jk?% zg1&n{K$$jw2)^7=zmG*`d!GIO@Y0U?xLBU8?1EZpEFaw~8DD{-q=Jy$n$`IXtC|kj z_svuY^hpm*f&aALzeu$Q$h0dKZ<~oh30XzwwVVZgno+sw(;p33TbSw(CMSS>!`eLj zW-dKs4$`~*#iQlura1m3Y-Yz3B301s&FnNG$X|3YwQ_VqVE|&;v?zuO1_7Clyp=~$ zn)9D?vuIh5NLksnopEcgC-T4uF%_Rmq+=FdhAtR35#U~i+qF>z>pgFDK|hE&yOlZ^ zlzqL_^c|wfup=DcYs_H0Og|Qe{O=jcnki1jE?ENv zkPgx%@|fdz64|jr%H-a;;{-3hm5yF5V&)38kOqjtQk4s%8E z>QlneT;QWs>h~>Nn-z>&ro2M7R&OC1Bd@*FjLe*Ba>kf{H`AuHOef1*j#tR3Kfgph+?)n^_OGB}om!01`SHI6LA7MB;KSd@i>C*EhOLXlJM-@Afs8Maw$S#V ztQ)04`yzUmEXl=q1|(rNV|S)%<_08B+q!Ya6^MY{>@u9=7~YEXKCffSyLZZ%f|_D7 z5rW|&N>UxUtB?3hn!l&N8eG5lx6KEhqoC44$4;dAH}k$)DA3Zb6G=g}>5dok0PA^} z=ODR(q@-Ev_O*r}%<8*GZvKBUnicj!B=Y-nM^XizWIJMJW`jJ(w!|=D*6(!nWxr8t z6%*!VpE`fn9VyBrv=0cqij$?R<}PWJ`cV;!r)X1QjBObZv!ixWkGSJ$-ZK$~a7;h&v4@wDH@TMkS= z+zGzMI{BEbzsAPN&<($&%XR9x` zIqFojpEBrmRXd?%xGZ?Zw>5S-ax{amy0_Cwz z&g#&qLdr>o|Gp?JrvrwWz2njgjQ(q*pCHbd$ zS)^*|GhRR3eZ-=oF@h~6aM_Hc2l?fu)uH<}o|Opagy44k%`2Z6X!jUK8NL4cP!+*B z7KsxjM97X+f8DPS$e_Qc>0ikBG>6_c(Ii~q_l@XJ613hba)N|jT~FJ^?CHTeXG%v= z>0rBUCS#U~j#1<)#-MCBHgAaP*Hbb4Y(P!;`uVBziqQdBPand-5`dRtxO}}_fV_w+ zGL9tqUwa{4%zK1Z6dp)8L&W!cwVN_t9W?mplsPF5w(a<0$K_#M76X%@(;hS)XfDu} z-{WR%686`)bOgf$b;hLn$jAMd%FuoY0ZjvI9e_lj)B3ylG!B#KuMD*#4eEWgR>y9sF~yAF=_V+n>kgNEK&of)X-_Z%EK=!9mcG| zzJ5WqY;x&SAi5|2%n_Kum3Q`eMjV>NX%~m zm6YX9Z-vD_^JB2QDH`bxSL$Vg>^D;_zRdC8{5-%A@t;Mn9Ak2H=Emx)v1x!Xx zPEV<0AWciB4|9bDAvQu8KG7VY{)7V=)gAb!$@4wy`DxGjElwr&Kh>}7*>pwQVk5&n zEp+8aj+3VlP-cONq0mjLA5ps=4Of?)MhF52HYo0)OOe5rcK|bKhp(D&^!!$6NAy@B z4_=~_HbTl3#4Zid@R?3lNPQ{>F>dF24w(b$ku)+dC;aG?1r5`51D$#|Is%@2u;j;N z|5!FZGn{&|mhZ8&44j;Fc0%sI=wWd@DXb}Ba!}B9E8NAMc{Fv$Z~5?Ii_6Aw+9A*Zou`M z5BmwhJH2$NGcmQo({CD|XriJlzXZb%Fb?7`FHNAg_fZ}X!=ZqxRP0y+Um28(aN;q2?*3rY>kh|P(Q4$k%O1}H` zw*CyqYZ+%h?+3-AmkV2X7(OegK}q}r64pqApDqV5qSM;iO2J3KUB%{Iu)ECZ`wowruR)RG<-5%57`CCeM&K8I*E^ zl)GogJ1~QW6g1hbQ&TmNMzSRY{+?u3(5YnYpv(%hLR~>iMsvK~oblz7`>anc&fC*>y(IkI z^>RP$F2|+L(S;+A6wcreQ4a@jrA_zZDWTepk1h4;Jj7?D!;@~1YQBZQc)gKM*9IMo z+_{L&AmNHGeZ%LA>ufaxoJMwq$nl3uK1}iVm6+hz!BdX%ywJEfiue*U-?CRcJ>YdFN&(O zNfTsLxN+%JGx?k)OmCuAK|gPy`ey{jz04{l^EG-*_3}K%OT^4%FftG=3X|GsvPUB& z9plKMI_UI4RYBNUOAndnA#_*O5qpqw2^#Z>lFn=46rA=3T7LzS4Ek8mthbZ!yRf8m zDMe)$<5y2zFm8FlRy=uS#w~<8<&cZlXM5K5c{t7PA?L>M6_hDCA|&?``=8*m1Cgx) zb~larCfbxGpHIrqrvsQ6KL;;v9b=>D`d{&)Gs74i>!J51VP4t#(1><{Z;YZ{)4RFr z6jZ9z#d~bX9M`1pvgk}t=5*4*l4O0fWpvGCyO)R4W(F%?JGD_CV#l48WT`&1NXz1p z#|8?L`bD263^f6JX*^-hC+P>Z7CCaM<(yZ%+;tjeFCU*N$C?-e-Czg57caG5u8R$D zJcVXBN-362xx>M8xYIJ18<)`sx2uHIFZ`T%sF zln?MN^W@{*yTer=FPBEEL%?J#t>UY}mg(5Rlo@e3C%*im;e&e!e73&?1ZXf2`oAX4 zUrqAM^jFKW-Dz21^>9LXnGhks80E)MsRE4*IO}9cTt0H4SFA%yu2uW; zH~$P52}c)K)hCa9C~r^O!|$}0RJqDDJiSI{u?JmBRh%g zOZ0Xl(hcxwc4EkcuhuF4chin%RA+r2A6LsDRm)MkxQkaO zib?A9({WIK1L?P*%>@+k`$<)~<1_|@fpv_Hb6?*+<(?GPTRFc>?H#z1LFXv3D&$$^l)%FAJ*b^zEElYr z6bb!fsagt0JmWHATrf4`VT*xP-2y_Ew{pnJzcqlFAPyDPY~}d8P$aDjUtBgVumL_t zyB;1Jb1vuhqJrXTrUc~o3;Dg*@~_i{osUL$rV^7;UPSNDXT`8E)m}@XPgu;7l!?Og z_Ag)U(i&182(SzJj{v1WMnJJ|1v=F_4!t{0(&}HY0?15j^shcYdC@L7Sk^8Y12e zTgGGW9)Z5kdu3ktW1k_f@|(Chi>rwB?;`0r0!oa%K^`kh;Vg+j=|=G#&}IYdAKse~uz$97 z%fxO6TIkB+FPLtPNfI=5=-D%GP-g*U2l0HB!RSTyH_dIl1w?~QeMMDQVI(+8v>Oi? z{mmbhAQJX9QCNw9;-C|IxK#4|j&gAj<58Zga|>gUI1$HR?E$60>VUrmL9NykfySe5 z5a`Bhq%F(T4UJa*-WKv{x^?-8RXT}CskaX)qQ}!}zv5p#S9c*4r6X8;h$(*o`77O* z?dS{%>y0Q@X)MFp&B+f|vzOueFr0!^_Gl*dkTjPVpE-ibyj=!g%@h#@Q`E*hd$m3^ zTSG7L&%Pg%l(oS?k4`)5tEB>%y`jx_dC2!DB(Qw=m(}>DpveNi%&ry0IpY)(2od0` zae2e2F*oeYH}wIt#=w#=nS7<5D&cSiv#OhIIQcOzQI?OmKcbJOm?MGbO7P3OiJW_v zK!j##(@s6XH9D*ipGbo26<=L{9U50F;bHDiLB?x&1KS;x*qFszKTp;?veRcNC|Bfm zjswVUV2ziDDrmC0(WNb&mh(7p&`?876$+mb0|-Q^FCc|H_VhH}8KoK}+0ovBy^Y@Y zW(lKI611Nq9cO}4u9q?dvZcNxRNS=yCmXytO4Hl^Bkjc0^Lds9$_x}XwwkJJX zTzq^NFc*k@ASr@rtWeQRGaNzefHj<37Sl{v@7`{+DeS^JL*UBP z51H5cr&kB$L+ZZ6CCH7y)8!xQi3&1a_5HFGWhdy{elvWoZFO$R(_jG9x3{#Bx#V$>U++wv{< zPcey63*5YH^i;kap_w52t1jP=t%a+9bQu=xv3xo~q+=hTrKVvs zOCSp397*^Z=$7Q1kLn;LjwJL3iY3W(i&#Q9qi?SEH^#-MCXc==#;3dhWyjFTgIuNg zkq5v9>U>2lnEFqC_vDO*RPa;0vm;RfXU!Gnvzt7}dH3>)j~CmVY4k_d|8V z&=`ERINZ zqIC=Adl885n^sssy!*Lui|rKQ3zkHpFTs-_fk^&sJ#lRXltEamUswjorkiEa=5H#q zbK~yK*=`)OMw3NQQP$NS;Pxi&cofhaJd)T9nK(nHutvw6RB#v7-EfCLk|kw|mMfd& zso+e?7{^Zt0LO+d*s<%ggRW!*M_*6ua z;ikCIuq%vj+4zB~N=v4i5ZHMFJ=@sl8A=NUDRIe?fMaKJEfrCYI)(V-Uq&ybzjllE zbe!3?$66p-p14O?Rry^bB*US*1Ixmz81xa#XR7`@#=cGRYp;cK1aNV_Y)a;h{g5!c z%&D32+y||-f>}<@d5*Qe$7{n2f1lAG8tTNbi?s6(w=fVp-^0$k>CQlfs5Iq;t7+z% zW=(uD;j(?-IX88-WIi7OR`em6_2wqQ60=3#7%yfjcZAi55(OQ!)GN2vA`8?bmVN}# z*wh=Qvux}jCB=7r{e|{~!e7u5c46DtMcKRNk@}%{53n5^aDmY`a^5}ee9zt64R6G* z=Dc|+4)b)vlG@8kzd}NJ3fd0!?tjBJ{QC=W%acY=o6=^RDYBtEKi@xR>CH$%Qs`ly z666H}RL9bikZn^1W5ePlp!UutxW{3k><%R6Ft#V5rs+@JP1`-}XO=xBLC7) z)7j_&X*92l=VDagKAXpz^uI0C$Sh*+dEYU1n1|9Dlc>was1c;CX6n~k{J=0sVIKnC z)+7@@1z|ct@`7EkEj`8-@eC!IUxc{K=1*{y1@aTXn7qG@AHT<3_O?8O#~>@Tw1l@x zy;JemAoyQ!GvO=y|EP=FM*RByTnqYA$;EpFi;Y2Ae4&G3zbtG!tv^F_otV_mqaWKf zbFFyYHt|!`v=Ki;DIYQnw@#yrrnGTA9fMANSvhz4^>AL4YldG9@QW`mZRuK#;c)!8!h@qKlhmjR1ohLYr%?A=mR7WxsI0ld& zp>&A5F70isOAZ<{1Nz#!Z%NPY7st{qadpu2TOY!Zs*VMa;Xfc45<66c`=?XU3NOBn z`^UhcfGP?Xp0~c4)rnlvNu#twE}q9L;nfZlx1y;gz>qAy}et2pXH~%q1R^)1QM@Gq$%gL;vjj_ z3P=nq5y~^Mc~5XI4h$@MWu_O8SJI$(GMeg%xSa%^(sAxyI;o!q?F=&~PTDQt!ahB#*0b-i6}FAg>yr zr+HokrRzz+mB;RbVeD*uZ7Ed(F?&W0(oNRi883-)OqKq zAkH={OSr~d&yO3|?XC;N5#B0hnZss{4PCKIC}7MPgvi*Qd;y(#7f?Ew^yHFT#HoMF z4sHH4GstK%#^U~hp0lF%u=Oa{ijjaDPodCV0ky_^*kz0x{*bzk?9B0R4lc1kBF0*g zO<}F8ncfMo&Ogj!-4#v6SB2^sgC!2pyLuSu=sJpB!ER-%&(SjksE|nvW7?fA^S+?q z)X;X!Y4wcdiJFzBpwM3r+17{;pB+`LOp2Qyv*B@3yp=Oq82^u3(Qp|2G4tB^Y^7@@ z8}&&O8lg^gW!=JXvRp@SW2B#b@*qcLaYSVh%klBO=_g#e#?z?=)v;baSASkNux^db zk zZqzzEq8dnW3{l8&YKM+f8-M)bM)hK@wlg77<%6|JV7yj?&=t-dNz>b%7V?dYWH+OG zps6jbPz6|YS`4k~!Q(8^{wjH5?h%gjt)26@lnSgVKdHPMBehlzj#~;f^xYb@AYWBv z+CXv(eS*3j7e_nilM+ADGCd^`)-;6f4U|L z==9Pt#Rs#eOVRpy0XBpuscX$Q3SwUu3tUTU&%Z?tM*|2b$aBqTy8Wpa3QPKqYIlTd z3MwN)v!Dusf28t~Ssgab19nZ?(6B zZ?(5}wj&@PGv(D`Sz39vceEy+*dI+(6@Hndme9YfdnFjBUeMdQhc71GMN9 zs2^9jyTFZ)dI>E}P7>761HP5d)%0MXfMC348zbiJMyb?9yTEAUw9T3%ty_vcV(1TB z3!ocB*lsbps~9- zWlC}UB&4o$=Nb~YLz3KWd8rvCMb7bG$ZV2nk;j5#wmEc{ zS`EU;IDO?CyzIX{5W2xm*Ud&^3{o6V3#d#AJjf|Uh zqf4jr&Npz!$c_3AcfN0;J94?Az1lH9C4xG!$!T%79&uo;eZY}jcYHmCfiHmcCvXi$IAY*sR2*34sZvng&DVuS9SZ_pZ#{TyYdN3wdI4iW% zJz!(5t#<}*blG2ea&OT7`JgOZ)CV(~HyW^QKuEP7K%=1{z@S#Ai$59tJwq{&^~_~_ zx4H?XcF|)&sahPdZtNb$hz1n#$xl@Ykaz*)-Sy+mfQq)g;hqdS*~<6gmuClL@a8+B2P??I9q-ErH z;)v~O6UhS5;bE0#+sk%%^eFXtw_USgct&xfd8>lV{P2KAFzY z!QW+(kc3SNbjZRN-WHeQLIT;@)>=q#z7?OXVruyWSMu$SYXQZ6h_B?Wd_XF6ydG9+ zbS#$h_6;$2aTN2d)1?D&$%udZIW8S!qDykPqWvl+*#5*V5-Uf&kIDI|w~iEC+F@L2 z1<%jZ4xg@KdSuy-NY=;#3pGAK+1xrNufL@`l#G-C{2ovNQ=z1#e`&pJ#d0!UIE+ke z8-(Z$XQvexD%0TZT{2F?9H|^7%8b`L_060`bjqSK%QRAMR)G%s^F zVv?3p4_u{+qP+P;FA?JReS6~HhlgYp$q{-DRDS~LZ61r z9PS8I-cyf&G6AXq^;rh9h@ypc!+JFgXUUaP=Jj1Ed$^tuZZYIC5`m%-b+R7fkpw6uKDN+SD-@n>U>rf z23bIRbh~RJHNAPG5$yQ>zZ+*?J|cy-wPVyHJcd zEJX_8iPwhG?jBR(f2`{hgV4JV2}7Djk#BL>D7oje{a_^3R_NY4+P-fx;atE1?nN=g z?P5<&6nRfBR6KN)1{5qK6)ZIu!*%W<`FJRYigOIGsj;zcV{n3;DP^%sgo1+8SVeJU znS=nLu{zlRX}I|i*fyB?%hP>96+q$WUq%v$5-r*QC`jc?Oi8Yc{Hr1f(zuI;7AwW5 z_kF8tP?REt|pJ{T4%~xjV+N2m5@n2P;eI=~)HHd6H$->kYMib@37v zb?8yYdjul8%fYK_)fpuIu6F0+CVP!%Et_~7#7#3epi8-o8}!F7(ad(IZ@D!rbyG#T zhH7Q}zmAa4^ahKVBb-<8eV*{u!|g84w-^e$^8V0gG0xy+^_bY8+v!PK^_B53i}GTa z)O-T8WsD{>R6|1?<2k5r3eW}g=o`1}Ga5u<#dg=$Hr~xon>%ntguyU$!^` zX0rPi;8}8@vINKvBKX-(Acd5tBvxCF~EBdpxO9 z4Y0T(l~0s_-o8)#u=benZ(XNTK=PySXw~#8MjWo z9WZ_{-3L;mE^-j=sc+CJ68xOQR}c6~@ktRPSQ5^njH93m>0wD(DjUxO-PzOhJL@0G zKa0RJJ@e47)a}PJD0ERPN+sT#QZcaz^rVCFu8-){9`ro6uw;t8f;`1t_{Ro+8u0?e z-3{@rUt9xo$kH5lJTH|DLu~?=B2ptv#Hn?S8JN5$8=b9Vdc_4y=;wDy%GB>SXd;I{i-e01MM& z2B7Uu`LrgW!uQ(ip{lip<#xyC$0ughWOtR1ya%)7Jc&75h*iEF((aIU8>8-c zes(-;MSMGh3@`gFvWg}I-PQkBTcFSo+?Y_;{~AmJ%r}+zR0{U`)hJflGwR$ z7ovC~(8nFX^C)!DLvJd@4CtacXGup0`P08jya5!%}NW^`>>#niL zG9)z1up&rpLE1T_cn_d0#(>#pvNsbu;%hXv=a#1OzQRz|hpbmI#@VT@(0Bw*yi%tk zc_oTE#?j#D@gQ@M&J9QZ_5h zFlJWTpX2iNUez7=V|?ycni{`?qz50~*xB=b_Q3N_?%GUwp!nHb~}(R9}F_BePO;Qo+V=Y4Vbw{;%Ok&8IDuy^q;MzQ*a zh4W<#FSQI^zcSr zKapADqKz*`h*c7hFFsQ4=7&+slon)a?h??lW{A`MRXB05p^kv(YIWqXJHP*DH~#fF z%%%fL551`tQdN#T*W9=?WnRmY*$yuDiQjPK{)qgzpv=mdd7xL#|6Er2M@)mj*;e!! zGLdKXj*0$7#<=(|KN|HA;9W z5v20}`Qu@~<6-p64HHyZivVhCu>sHiR_;|KMkL(*LO1U;F_SAREER}0W%$2Gw%pJ% zs)O-_rp#Rm|B7R4VMyGta%t6K*VeVd(Q`+m6dd4_@GOodQp{RM)k>kX2TE@5# z#Z09m1wJ0~CpF217oJ+`=2C`pRe((d&)CKa;;m`LGm>m@afV|#@huJqi0z$z_DLAY zZ$0+E-{=x&dM0p6xMKe1X!*_mcufq~sO}_u=Q-9C4FuM=aMAC{nGs!hI8l@+FxNeo61wr(F@@7o{S>F7(kpRgKlfu ze$;in@qbrHY0?bx2Hl+r0t{w&W8@~5Q;Un{JT@ICBhZCxHD8r^l(uN$1+mp4tO%oU zs$>}8<%_0#uVk?_aV3Kz+^C{Zyv=sWzMn)z;3oa&A6_i4Xl8Xlp+ym(^^>nb|AA;& z)1%oYx*29Q!ECde)t)X+_?RbChPDBO{bbMsO}qV7?}f)2(@*47oB@3sPYBYrd_M5z zXbl5Y&UBo#r>eW9kuQN(sIsfp)Lkn)UX)}`dw^-FFT2$&Dd#X@i=9S`>u7_ia*#R` zku{38-vllqL35vnBV0po*@-r_U!g_ej(>_e1wb9TTtnJQkyM7KP#8!`fh~^3Vz&ky zXEArhz!9jW(z}_Nj3erwyLqizw@>y#4Gn~DTi*oQ6QK07h(~sJEG`g^g4bue6fO2% zFT!Fe^jPV|<4Zm@A&A(0*Pva0SGJsNxz9$^gaI}#(--UM2LRvxEkM7V+=i~6lhy)o z72-iaZ%3bgqH__N4&!2k(0?EC)9k@)%YQNr0(%QpBdoj*2mJTT);I$Ik%$VIS{9`ks#7qy?gq=*(yL zju|k_`N4D%GYS>h9w)tYV#TL61QBac4%+m0X^XWPFppvN@5VDg z8xArz7+|v?ruO7Ua1K9k>fukfmhs7VCH-v4n85cl z#fJuN=`b*9TvCoMbB-jj<-;Q%AbjC<*WldGb0O$#`w((~)?vKcTC(mq3i zRiNE@60Gx?%4f;rq?eDccBu{2Wx26FUO;Butl5v<7dyLLIbpYpnKNhwHVizZ1WUX#e@TO@OgT8r;qN9F%GIqbQllJm&cz3MZmoXj%HQo5|xx`y4}GO<4lS2W1#gu)!$qwcJ|^x* zVWNm#4gcL;Y{um0&VR2F3DZ=L(wsy+9pKlHqpAU`1%^0^|29R33Vn;V$&%( zzUe5zmJ4Ty8%&hQx{8R%{KpuS$B&6gCJiuD?{>ds1$kPt;H21Ef(jvJ?M1wpdrf{V9Yv4TR(-%uh4TPIGQ_99B7Xmm zE+tGvbVIjhM7x_D?5>D-yeJ3)3T&xIF^YpUc8NWmz+{pN~5kAtrzF9-kLuAwor`ixSdBPQ}NzIQ?H=}1yb{AIlVmc?_AWb-rF>WiFC!6`}qX#g3Pf2 zqK+^*_n?sahp_{a)@i3I5;-$No$*!?VoZXKLL}Q^Y4{9{0usDcuXW52XUOmqyz89cR$(; z!{HJ#JV?J3Tz6*7@L|PTm!eRdIb5W%SSXS^FD^Zx&7O00 zS!-i6h7>|H@NQ(Q_XDm*@BkTq=B{126cxmJCva!+2^JzKJyqa=S)Sy zx)BcuD&+l^RJf)-g#hK$eio{bzYLdk72J{+1YQHAL=oT2&wXwaahsPe8{}Yvb(voj zfy`o%PV6CvfpBR_E}*^8c(LjSedSLV338R;)W)QSwxqJ@iKqsqU<_KG{G7PDC8bhy zZo}Va&@!iVEkyY=P3!pKaH0KJcC83aHT=>8O@N$c1W7Y{qRr$pVOE-&71N?CYrUXI zfWCgJ+t8skeFXTB)1eLCq2P3=aX6_BcAq_DV(+Vr?W%Fgs21iDyV?Ylk9&yIn_^oY zp%1_A$;P0lK|h1@98lRz5Ja6GCpC7p6p|jbg?@+%ZGHfZrOTeZA76Q)SqBFOYTK2{ z^xvjH!E*I~o>;EJf6d^A*m#$n&$4)2Hd0Tz|c8ES9SX|u>Mhd<6M63S!($EfYzLx@*7KG z!(3({W^-Ho+cv~~xhp6$PVSO1NZ=(XMRWf#C4NYSN|?E+kw{@?$IfGG6iZSmX2Bg5 z5sVe=AH!Kp64Q3+jN{J?#V^g>#yWt$mWOzYcJM8r_s=DpahHiWg{CuiZi2)Aq63_$ z#hq0}V_<@KlT$gHR31zZc8K@d5$tToSQx1xxx)ZPK)JtHh3sU!uF6DS`Bhn)(I5vn zyz|dd$fJ+2Ly2g-j#Fqpa~(x%m-|pS_5?HD^yIGPzg2m3Y~HU?B1)5h}dz7w(YKf36g~9;M zad_C6=?Bi4{Z@pSG|b()?7X7qkK^L_Vr&I8y;2gJ&f@ILKu83WvP~`g+hUO0{?Mm^ z{w@tdTi=mC+2-VaWqZTuxGukA`m{qzTf%jcjo4MrH3Sf^c;}|v{Lz6cQzy=)-LtUE zfFh{{LyF!x=BoLP6$SJA$ylpiWO!#^H^hcr%m-n+V>4HONRHLqlSrKki8a zv+%V&y~1!F^vP$O!#HgF1JELl>zhGZ^QhQ8hp09gik=#%D!zG-$C`=*v-q_=rN&sr`2ENrfO$h>E+WW2oOB99GeASIYtK;D%}++~@D_T^ zz}D~VHisk@^h#0K461>)P>fYfXW8=x(20D<4+6mI_QMrOfjOWQl`PHm1}X?ZmSUwN zyX?Zx9gU++d71U7N5)%YBpN33Zt4?rEdLaIF1ws@&-eh!R(WtyTXuR0FC|vt(ZUNw zzJ0^YR)jOb()uQ&OB==zXVSzh^U26Nmb7f=L^I>KCFJ|fX$KBujqp=8Iowj2`3a^O z>sAcqi%9i{w_#^+rERwiEu{NvnUF7qui+s}l3Cf0ZMP7^F#T$BDH5S8tooUT*Br&8 z&#_kU!G+cVbMlpN^UccCg=(RC{91pQ4fYrG`rHcp-rrUBlerD}O!&_jnl^cK{~?oL zA}t`l`Q#8sT;boxDedH{mRxRkjae7?*YNXNS*nP?O*W?~2P4yMIph-YaYgHVAIc6THMR8#Q z9OXuc?3ma24U)L=(+$8tdAS*gz*B)hp{t9ZQG``_Zoea=6A1VF%};N&ciIjC$>#B&k*PbNr-S`1He|wE#`ex1cW(|}o!Uz!>8fIe zk&V*MXc?va7(2ftg&Wn`t*0Y^d4BK@f?SPC(hm7C3E@Ax4yJwX9RT<-bLE?<%+Q5@ zDgQe&n+&WEPsi-0Q!Mp4QbdYa^Df1#blxchmaY&jbBb^XWv}qfP4z{nVRItG#2l$| z+Ne5r)X#!lL_19>M#6@n1dM=AwpP5s=wc;oJ!ZNXmN1 z4|Enn$WUX%3?=y$9~N<b6QseYiH>m5C6f#a z7%qS?ufhh+OOD!uyzsFMXb4>t3PfK}sAt&@KOBLDIoy$k4xF$(YyiCp$--M2?!kDt z8Rc|<143N*WUySv5|s4{5F-b|YZ;f*lel0OALJTpM8j5k?9vDj&PH!&GHMC>ziCCG zr|*^5^Hi#nR0rE%ea9+Hn7zVN&#_{jo};rf_fpG`X?VbZQDZ_k%EV}dY^Ku7+!EB z$qcLa)7d4)e-Qbg9FZa=`dk{6a>u&1dOpCW3=*&~wk+4&rT`d1g-M2!M`5b|8=4{` zSq@by`#p}2yN&JmqYF6X55obYy5OTflT&YgWIep+4XBtTLv5pbigHAKVP> z6hizrnA=Y*nxf7({u{xMN|DO~!P&Zw^gTP95FGL3YQ>mT%1W6Yq2qvbM{eb5zS-Rl z;bkE$sKl-_@VH*u{N+~OIT~ze4L3`K<=&pRoe-*uYIeB@8rbZ;QGzA`n!@9ec|c6L zs%Ar5{xessrDmyyY{cg@k&%Jnw2_$Vx=-@_{#pP>T>d&4oq!#E)BqgX+hLNWS9b5H zya*>wc2g-A<43O+RN*B9#$njFZVJBlCKJcv9@=@bU=hG2H5s$l_BY=;7$o~s=-n4% z;2$G2mG&z29^e^EOUK*05l_gOYRj=pik#yv!9N9m`1nfkir|I_*ABLha$%EUxqlmq zZtMdinA2PpzfUbc!+($)B9uae6SLC58Z&{7>vR@w zYO`07$hTz9 z=-flZST(L@>@VUIfv`oml67RN9;&ZeuyVjUH-s5H*)NUG-zKk2;zo5a2?b5Q3we0MOX8Iz7O3w29PfKl;2 zVyB(@hsNxxo2|+k+sg|f5oMgxl4|PuV3ipSV~riJt2d+EmLj&o-#XjGtv> zpZkx2`VM4=_5dQu=@t^#Si`oI;L_@Wf%b{LGH3CxhsJtv#)V8P_A>x3rWv`v{=aT; z_v6(IsYp2l&KJ@A+ty$UfOem;2V5>yVNte_;Q2=0vX zaiPt@vUJxhnirCad@g>c2wF$q+U{Hn8{|qBJDE;IS~Hiyi-?4M-k>id z*5J|H)%<+&2B`EVa;wAR7w+%DpkqR1ej$-{Km(h#Crr@ft6^ne%-*YJDu+Ni(r3u3 zq$WMFIt7>rJ8+$U(Lwhr?84$vlT7SOBAthNHZlrBh^$X4_b!`UAxMa^qGn#>7dXVnAei;xP{Zd0_Q#7;ZO_# zgYC|)?e|Z7#R|+=w~=ZV&WRI_OTpRbvq9_ieXs2Fptsu`8$B+@;$Q(6k7v~$5cU2F zpnt1$Qs~hG+a5aTOv;RRT)yONF|!#|$hMG=WTWx6|7oyaXxW~bfIs<-oAUUGot+zS zNBYYJho_FJU|0cq;e63Mp`E+Il!5o`k86hhSv+zPlW3-bM-jJdE)p&9U}3jlr*D7? zy+>R_piXxBENAY0&vlM;??-Q)e8%#Jf>UkT?Uq>RwWbr`aT>>}#OcVcIAYR8nauPA zGS>%%*>4Ay^F1B(yy4V&N`q%Pg9(T4kk^DMV}8Y0l0*NT&}ln+XqvsM|F{o|yZ{|5 zJIAvQ&Wl=tDu~nAyMWWa@+Lif%y#eudN*HjkPIJ(4I_%WV_^G_4mgq$3wl}1Y=%^_ zBW7dynAP<@2VP7h?(n(&i8)zk7cbSE>}{621S?o?t6S$sKk=gPz02E%LRFZuJT&pg zrZ{Z)tGj8p&z!aZjN?a0hdr=|q9E3#4MJU=B~ld}tgnk;NC6^PDRyXJ^w|q-V$k*^QQB4kXb$`EZx1!Vcw?wn{}$-CYEg|MT_ZN4$-5w zV9pU{={XA;L-#kp@xJqcW&18d4JSM-lXLnN za0)ndkm5b*W%xWc7WGCs2jfva2C$GY2Q|Y){j20iUIwZ>Qi&JBWPJREp(6Y~nc$jtGym~e){=9Ft{b(kkm!YHKaKU_sozLcefGbX z@5w#W@)8Uqq5RGL0!f45q&`dW$K#Vdr`EG0rQ$TIn>EkY0{!?4U^ z4Jj-dvh(Y29R+H;X=BTh>>}Vre?;qirlGH@I>TExFEro(86gzSzs8)xJE6upb{Diu zz6-P1gYT5X1(FoppwLOo`VRTeqisDy{yhJAnBztA`8&wn*eRW!m^p$;#1Y!EfInMT zlXBvkLkp-JD}Aeq6Fmp0^KpE8)rtfKZY8h2IR8U@{AD2q{<24}PR8(mhqN7WaY`5! zmz}8(og?-l3zs~nn;~e&GbNM3i9RH6D+=O=8lx%kdE(sS-^3T=sTiX65N#U3Fg7Vu zmZ^Cc<> zkcq7p$EKz6y1fIFi{cm8+=)lq2#Kc3aU?^g{3LFK6mq@9Sb~HXQM>N*rAZgVEGH56 z9TBw8$frpDRJkFU$6-CQ?ZaF5#qG~HGszNje_4_DMF&< zg0~pN-mmT>p!Y{##u^3Jc$#11xOn8h)4(n-yy+C)p~ByjC;i zNtf!vYzy+(_**{2k!JlVS+ot==BOa-NRkUCTx1}9C*Bp;%jUjtNQeTM0r}rUi>|*j zd@0~#<~SVk{|nZvAlGn-YH#^S0d(7HZz^}KvGBdp4Ld^6=TQWpSj#pN=Ay#a&q$rA z=1mktwu@aSUf1>BLPecJ5f`7)c<__g)nPue`L>BL_h@Ar`9xrswkAnZ!%&q|H46Ge z|2jYBj-f|7^2shQvTzK?Au?@p zJ~GW0p4?elFk+%H&z%9jtI6=(yqARjfMQQ2!Yf{Sb2C`6?u${D=$~IB}bXa;8I{y)z9Fqnp;H7L^mEJDbH^4=B!Z8X`@j9iLbExolzVFJ~M3 zmRJ+JE$$sHgU5}LNF${sDY?a6^ z=D4=Ny4K{^qs8!}fA6ASyt^|AEyPQ*T%~CcZwGSe9=BJ8eWFX%bo0B100w-$f>N18 zArjdcp*t{^EX7GbN4RsdSkYm7<6%2b+dR9$umX2kE+s!E=?@dy=c9q+A?;AFlre4s za=SX?zUxWwZqbDE6=hd*qb!2GQ;%t$tp@5T=oiD+dhK>$@5YUn4xs2?ntf{XGN4a} z&Z5~CO~NUl5A-WFe$MC`i(U5ZsY}flFjDALP%iQm7n1y`$NpZC*K_RgQ@Vu`wfLflekAWoImzie;lb_7 znjs3PQXKi0d^>ORi&C%a5(4S4`WCLlS3r_l;&4i5o;o}+fbghaDXnU|p3tf?h*td}Z>$*#YcX>JxQWFR4{v3p^N+LI>i>{ zB3ld^7(%(~{`%(p;D6tm7&6qoI_%t=@ammj(MI&K?J&7axf%S^-qYh^pN-KD=|R*Q zx6wXQwB9cI+UhJZuU%hipBb)2t;aaT_3<#<};-EPn&WKipYCgK6l ztKD%lP6%*NhndYQBT7j3Aq zNbHXXPm{)<&>Ava=svgjtWUL#gx?rPEx^qjOXvi)A$1%D)|xWRuJjl@p0@GK`FqMv`&`z-fLNeqmxjfs8x$U*X&H6aqw zZ>{%?@M4f8UkjIS$EwN@WE*M~k^M)9ar<7P>H=9u#kWb@*lC|nu1>r1#PD!?(c&Q0 zX+^o90;hC$p$1_;xrttl?5ND4&RfiC#S8S7H}2(ERY520sLh>}8&DipINQ|*oXCCz z`ZWs25Xg!2`BF@beHja}#Y^YpDp4f{7)0wA$BhA-=Z$1JQODS(|9o*1$eo58`q5>Z zOKk`CR1)nBP`&OrbudgF!OVJPpH@NsXRT9MZj0n&{t#UNy=qwmaCPRU7Ye*k6paj? zAx-f11KMcznHsN6)tjms3&X@fy>P7*@|Eb2KKO^3(Dv=bm}@mIiLekc>s4nL^{l?_ zTeeAGyfX<5r`$9MG@7&WOnDg_{D^4TYzOnb~0@P7ZQdU zj$^6~>hBrW&)c;en^Zz-vkk$EO1`Sv2+fx_hov0fPAHEnCog?mrX|t?sukSuhbYp6 z)$@{&KAxUa@kDU&wr|`nY*L4)156-p3I0v7E^Ihlntf69ot9?qTl?a%66QB~G~YW(xbw5x zsV$oo%RI%Aq~8H{tMjAr)mrD_J^jVnU=u0JGN_dFSDVMH7Hi%ChVvwcYiH;2K+rxl zdrCUljM^gBB2UW(fErHigL~-tJq7y$bBF8LJBkeD@GQz^~N=8Vb(}b+6>lc}V-cuy+eJZ4_{>zcx_2 z?a$Y)!{sp4!?kTo2Zp*Fz-Z%%nc{VY$yVVYcDp*owULu}3_PSzuM?a)LSmq^;mcHWgAE7)fT`V%6VHvi z{i)FStt!Ri2iO<2nLC@J9hTx;67f9)ANgNHgATuc;UX;Fmm)165zQy&vM-bFIhD3a zV`-We33^hXkKldnJ^iUg?a;L$>ghyaZjOMl^%+;b@fD;HP}wOI&k>C}M_b%bEB0CV zhO~n{(X?p<`mo00m4tT_)(plck|&!^-Pdrf0U|W)D&%B6S4w{V*n;oj`MLaFZ^3B& zS=I763=!0yG`1|=@X{C$YOOYDkDMxfAKH(CP3^y;ZYR>`GVI?t!#uPlCY>suBu0hg zE20BgdEHTWe9Jy@(}UxN!9wdjxWemMG=$YQ-n6l}@XZq`LDe**hRml=fTo2(pw&5Wv)*9^rmi z=$G!e`fw|@EcmL{qIrVU6CrE}bYl$s{M@=SzqjxLH6%no2y#Lp7Pwp7K5t!cd&*V< zKx3GNDdL%+RXA!|e48+tD66yK`!qoun1?))(R}U|6a517NR`DkHbpS+E0;A?C{@Cy zgc&`9FNESgtL(+AzNwmuhB4wz0;esojatY9|K*u+!B~rRiAgr~W|$33=E7+4pC&JK zZJn~2fRI!tJ7;^g24}*i-^9!y(A*Vu%eO!b102@_Bb#$$_SbM(W%_|vIW>$zve9Co zRQBQrmt^`A{Rc?Z9}dj`J0${N$jNoeJP4HVKOoKK?u~SeK0~0HWu9@P;-fmc;xuL z2Q|v(wqK|0Wrp%NFu-kqJOtXk$Nti`RlnOzYz#2Mx)GcF=6=)7t&ix% zt6!;CHqdTd86|66k$xv!VmDf!G}e_YtU5gy2u~dA)StsZAER7SofBo<_2Dn)#6FG_ z$lIREgt1hsz|ccfdWYerH;AIO69;O?isTAW9+IYaQV9VK^mAXdWc{aVKqwpw?F;$2 z>DCj+TM3Gg4?Nk*gi4MsDIx)Z0u;Kgqafhhl)m{MLnLpPtvX7p>^J1`l6v%jR!OAC zk8tF$S96oj^NdRi`UfgIOo=KUEaU%j6LZ!^6WyhxAWnf<>3mF?xvoS>$`RnPldOT` zLF|0}MIxLKWsGaL*e?5&JzSD<=h-xdbGa$Q#+FbgeUbt;$t!^wnwRV;Axy8ZWj zP(`Z>oIw7zbS8qGu<=6FRX#1ak*2sAI(+E069zCOy;*0?Wk3vFWq#Aw@TIoW7g%c9 zsx?0HB^cOlU4_3C5n&`da0Y-&tQt-b;|vL1Bpw+5kxFI_*}-gvk{Bg%``lth!;@T9 zQ$cKgHI9_!XCME32^opN$$e$Sp1i{UH{~UcNl#smf?!D3Yf?J~M@*&ygI24$;M2MwDEyy7fm4J<233t2MrlfT3Y@gvpU zbfDuS3BRPd@3f7N^y^#ql#565RE8%np&-XI)?YMR83Xk zAN>Ws)Dw&mrB;xJ|9JkNga!AYndfy^!Wr+9d;!6SY6AWXKL8*2z@HugAnd(cMU3%w zajkDv+H-0eN5j}VC(@QZs(CcCXZ0VR+*!hMgSBRHbaP-)vCB5AAx%Cq&ctOITo0jy zhxQ)Tmd=M&moda$sEG;G5oG`31@uf)pKItwxI}bk60ZjpbfClTnq>gVZ4SDP6v~dB zJ>Gc|)pB%79aGCpnoa=1j!f>=<_3iN3G9qKXDCB^o2*8p0Ps;?7c6NUdGnW|#(b=5 zV@in$*cqUD?ZqIe#mWPoi6zZ2kfj~{!+T+m98o(Kp5x2ObDujKS5~*e5jVn~URvvR z>2bT5%@)w0U0g$%D=YmaPzSa(OkwW_L!5At(X&7n2QPOKqU?mL2e0o4hEH%O0*MAk z$)b4X5q#G^F~mi{&Jt&_KD0CrqY!OXNo6j}+ta?QNWd?}v>wv;2A*Uo!m|gx6H_2b zKx77ZO6Sef+?5XgjS`fd(zo}yl6?(oJolI*4}6!ocI!ICyIKWbb}h~bDO=r@W36_9eSp6 zTbp2*^=@^bdR}3Ci75~E?d-$tV+YDl8yqDre)?L=zw|Kcmd;sjjr7`@Q(O6@n%Hf3 z{^z~2IxUP=Ax#A%;HT)(#;d$IJmgrs*bsi@{-JjGQF(n~Evp8su5AUJ^fVlQ2dubm z7)7C%nt|a>K4QtoHYr7u;JVEW{#j?95gp7i58V@Sw-aX&9cKq~PKuk?lZWLkxIRr} zhSSlZk)UQK{|vW#KBeH>z_(BEpIanqB9RW{i@n@tkPUNp+?W zJfk5#b^kxh9z&Y~5@vI?>%vYx?qsv1@6dS~F2tD$`wA@`0y&T11uLJ$xJ$R49`A+6 zMnTkPJpPu6ltGS`#&i!fO{8W+_&8vv??TTqle117>Rg2S6%2O40{=!QLVBplD*%|Q zk0S6&KsC~r$|=|n{H-fYS-dAP=ADWn0V&(6m>XNuptgqbdHG)<^x>K}=C@;B`HfLwG!@0!rJty6+BaY6qgrlDb954oFaMvnV@E7eHPwxLpM6# zI_Oz7EPu_}G?v5oLLlz}o(K6Vz9mU8Wl8-%Z?%8EO}vf6ZFwCXS$k>*?94Uu_! z+_|f~@W%OdgVwWL2(2rC*UImi6)z*sPL^JU`JJd&nIVhrrAKbp(hVNO$(VCR!NKLI zd!!I-+Nx6TumBjkzw-I|uPZPw1jN0{()HL;h>|IOCX6r0|Hk%=@n$EwXJVWL?bLwn zrnaq_`E237=#BaXdVPec!yxs;oPJ6llk*gqKX5K!>0R_vYiK8TZyOL}FHYIWeH7c| z>~9b=9JI`2%(kCUh5T;<>iW^@%*v>YjK#+u93fvO)>?Jnh5CCjxz8kjkMD0Q^viP1 z|DFuTR7Ol5EnlNWj1wT0_0u`0z(O>pa*mzv$4o`IGwTcxO!-z(;bYw7qS z@e6_u)U1U|fjfiTg$Y?U@*A&`#}mSJyb1zQJ~P25!Q1w@=*_on&A8Xo$^ijW7x%4{ z++Xdl@x8X2zxI46O+!_SW|mzhhe6?9XA>aoqFkM`ZV{%7g_awK$bXJ=wO$d zW|#iw9oL&#Ga%@Jk9xWGAGZ<(BgTy@oBZ$aIG~3!E+aO9ZjWdOgJEDCQ@yQ<_u<&A(l#ltv|B% zxiTKWJB0Im^`0@)Y!InXG(H-i6?g5W#k252!qMN@-Z7ds=kt$~en^Eg2wSW1IH3T> zr;rklpG&%@owh_L+KT<;OkT5!Tu(IqDPp1gOS_HH|KW-G881=yQr+Z#qOwW% zZ+ zY6f|$03Em~4W4Fmp*%Rm&Odw~aeH%xuL7d~rvU#7ojDYG7slz1{MPni55->fklH+n z(3PsMUi6E;S^1fJm!FD~aqFJxU+8pO)-M_oWx~EK{2!hYovly~hJ*|%AVDp1-gSf) zh9INI;l+fbzqY++blhCfee_3^0xE*ojQMyWy4RZRj7I$;RDwAtB*_F>J?g)^;PFPw z43{VI`1*D~H@5ksF^C4iZ=TfnSqecJA$>M2Svnj$n&6F-G|w)>%@E><{6x6V>7l-9 zncZ@O+vWpcc&u8drQN9mlp^K4S3^caZ2jiK2k;@%PxE-9cXUwU&pT1fitB_uSPoAM z&uQ=M_IF>TZrWCI&5k}qoTBERKuyO@C zP|YLeJtE9A09Nna4n#u0sUuK>k&GD2Nz%QnXQts78{%@Z#Ffp38z-VQ#6w^H_$huR zpLKxd&eetdRgE%5pR{*t4kJ2E4G_;lod0-IEYU*7K0GjkPJ6GL+Q ziaVZ(%@pXT>Zv>SiR}xc`=)bn=HS&u6jOslsLW=ts7NB?15pY_tr>Hhcx>>Y`bjYW z3%^us5T8PbQPj*(K@(zhA-r6W|Fx}!(YY|M6Ps2JD$DB;6E`teo%hX8%=7aga^G^& zJyBRwK{AA6W=KmvA0{{tYye{0M0XO+?6<9>z+j)WU!W=AGc6&l*V&H5i9(!EIKU4e zcI1-}AmYbb5{!btQ#$f_r#qS!(tCob-+vHNs@f4e6aB4>+xn6IV#Wu8D@Kzm57vcL?5xk(QNgrLr8mVB&!r~w3h_Li5pMmWI zx_Gq_%a(vNG&svjGc3cR_U?6r$wMc(Y-psg!XjzU3UmEV{|uL!CU5~qzk|y=Cj3my z3LZakTEkE0+>uXeHU-xQIFODhVe7PDt>_z?o5bIjCktyH$|g*pu=?bx+%Psb7Z|Vu zlPU%^kf_F^oyc(JdU)~7MVE2hSkN`6<%9U4#xvNshyrPu|L-4UDP4V{H-$B@I%fDX1Rfnu~9%j zgACq8DS0r@Kt?oCno{f?79zY-71=XXrw(@T)FA?fo_P z%^zKYc?ZKWHS%ZLX|W6a3su*mL>rx#zzWSC5NM0J-$`7|V27X0wNWJOw-obpVtB<# zjdHo2UqrbC?4D8mN#5%o@^mMf)7Z=foc90zLFkj{G?VBv{1pT*~JIexIkIi=Jk6+qKPjW;-R+LImOOnnQyeOBdM z2&+`|mbV%jax%T;9g~!a99uhg=U)OEC2aM zXj5T^>~tR3kZRx%;bO~B_k({vcK(8#bM^OZt_-cSQ0IlZw>jd&(-ue?MSp5AJC-qo zFuHYxQ%qH@e<%sbDgN_8n~`AC2-_(|(aUp7Gpau=DlbGM&86+kk~=m1-d@k8;JDXQ zkjJ224%0HL{W$U&zMtQ-EVoTtRF(nOX1ceW0>-=c`YJZTInB4IJMJ_Z|`pOfSIqxZB;{(Xxw70=6u2JJ`9M9>y zChuB=wTa!~Fq~0iBrg`jwfYj0s2|Cy=9WaS=W>8|x6v@JeMStK;~-?*HjI@|4XcFU z2W_$}gwgHu&C-LR$djh*@;3Z|ml;wp&#a|5Z7Dd#RWAh>h0@A2glBJ?Z7)_XnL#dV zO#T;pgZ_t*wjV*viM#}9x4gXYc205ksfD3v`h1PQWK>dW%#m5A7sZ|eSqSwKnA{8S zZ#B2)^AyW&RTrh@c!&jxEA(3>XejqAsy&SiZN9QDv_J$95$r%vwZ479E9)cNDK;0% z0Tev>uk1KhK`hk>cW;lo4A<8*lXY_g&rC<|S2_0Xz~8|1@UG)g_4$av=kjvI{Xd@; zn^)c>&iRKRfVhYx`bZe6&Vsgg=mG+PKoL&zXy&F)-k-&7In^U~TOBT zMCna_d1gi_;{IdlXVq?eqJEJZk5iP9icTT2cZo98zY+In1l1{(5a9H;>#5$3MivVZ zUOr8rSL)~6TDz-QkE>RC9E>qO z&BW(|cMFtlU{Hes!5nVRIoXMQ$;8Euh|+{afwWm%Q(N@(B!b}$JO2`zJ4)F^zyeD+ zUPrE)m01e5hJnXeOhWLID~npbYfpf{9E?BUL2 zjwKxGc%AZ#Nf=uGfq)tw&vOe~p1G!7I&JA1At@NlOCnG+^1&oVKElR(i z&s{#K)TN>Hgg1$*L6#$w5)P z=k>^$;EEkR=;Cn;Ihar9azj53BQuMv$7_k5{4IiqbN?U>EG5hKA@Q8zQ2sR{8qedam8ib<}x4NZ#Wd_q=g+S z3WeO!GywqiK_CMa8e6SCz?qOa z3E^9KtakQc!Nj>(PDU-8Dv0EPY-ZP%F0CaoBe`ZS4o+QQmwIqVc97Pgj}w2|duqla zVB6$=LF88QqHPI%$O_qH)*Z zjomoDesF?6?`{AYJ`wmyJ?odpHhFkEBemoS(YiIBm4OQqy84Nvz?(=XZ89NDFvOZR z3+rI3ak722($+sv=dUk0ahyu=B*-eYGhX~$^gLiJ*@?H~P;@IG96|4wvNGqgM_ z3SAQBgStkj9nR&2eh56-ghKjH4)}Ty&z@y#+6|t%jllNj(3(zNplUHa2}~ofH7MZK z^(_?!b$iED$whT3{Hb79k(Pw}DX|MoGm2P9TK}gdK>pNyk2Lzv|M1Fw7MJ zKLr<_gMrhL#DIiv;I?YZF{(wh-=+{TyEr?vyg4$STOm8$wu%sZY}FPC-5c(Zw8Zk( zJ?qH2P{317%gFEOs21|qk76?w<}n|Y0*9<58_(}zvAJ>?tkqzLX|SF=O|&4We^(u1TWp)OoG8mn$c&A z^BI6aaao;z9Y+}aq`9VxL)XyWu=(KJ8}~8bIfIwHh{vD|qHxqQ30~cB`;5%?%G?xa zXxg{)+2&?LqHZDTKofqEC&%y8lEDCESgd_Bg2=6KQ8jDYEUMUF$dvLR0y}+OcPzm3 z!Pkazsq)@5RBo_?GAqUYBnG-gy`+tNh+X)6H0}V&VhZrdr{REK2MQ8I3JAJ1GRcUk z!Z}k1`{fuV4nJ5n%MSEyQAVFO=I)RYFT$i_mBPNRKITL}v;Kz^&A%5bO{^<3|Igdv zjTy~rjkDdOhZKP+GZWUD#tOR?qQrS|$L))p@fOHS$w~Is?D{uY#Ej3s`z7uyM2b${ z@x}4|7(yQauW4@HWm%->8JO))o>g$uVW&q>*}_9T>39o8mqz?c$VPCb*?oS7n=2ol zdrtIE!WKnjK*w2w`k43BVGBNnE^On3W+26Fmh8IjS1!2FVj#HkH_zE4o$O-%ac@6T z?FZSYVcEQo00SUsWnmf86~oceFQGl#)3FToS2N380gg^8!DDG{rKtfO?xVSMwgff5 zxD_tAxTdbW;qdfsYlT?w6uk0sy4d_n%R%Ymaz8EaE^FH5#Vzt=zJHUj3#~pZmo}z@ zY1Q`#fEn&oBVVbpaJ9c5IOAdvt=k;ugWkfAr#am%S*f2>{=ovW z-cq9DQjPFf1}= zcCjE_B$ruk^4{QrviIC$s%3q9#a%MPNd$PUd1R~0k^i}f-8$i_MI{l|m8>=93pXkO z&b)3Qm~(k~cK{p}Io7j0IpDmL_4W2}U5IIg!}{5AvE&um*dXVC39fd5GadW=k8&Cu zO9D#ll}ld|rX$Y7Tb+z>znbc&=Vb}@{m#$ z9xYp1a>`rSPqG6jEMeGM@WkHCY~iqh<&H3_AZokfQ4(zRSZfhi*K517&R#eA*U&mT zq>`JEXX{8%8;0rwGjy=7q>-uQfzxJj2w^V@(>x_6akld`=P~E_*sK+qSr%M8_l^+L z3MZSEc29XpS%@4wz@2VLx|pcoF_&2s5d|MfrI3GATA zjis48PHGDKhLr&WO{opW?OEIj>VL)gO$PkVH0tc8=xwlB|W8-*NDOdnd^9up|h zEWOaeW`|!VhSMx+_EVCu5R4NK&0ZB=omL#OTQPniFTv*_c&p$3FV7T>CIo$y_e_Qt z30fpbr=ZD>fjV`&{YBjTU=mwP# zPNUTx^S>!rOZ6}*>X;uZt|f|g;@-TfX(I#v(yye5G0&H~YzoU)*|C!#3*!9dZC>d~ z+>#B1Is-!*GViZ0uKe}o#-{v5IQBiFz!)iSSMfk^K4$EC#VZ@kc3*BZ92$TZKI z0Xia9#Tju9xUAW6>@6EJ9n2uoM7>S;;Y3A9XOX#Fh@tYpQTMjQL`x$py$9Rz-^ ze0Uy6|MlG0YF3F_eCb@Un(ks8VY|m$osI~)A8xc-N`%8A%tiG@#jgu`RXvvnD$!c2r*|0H4*PXmXoe!^!qrtO=Ja5nb%6h_ ze>pTxAO3v|C2;levTSYkd=>*Hmj$pdqzCDlCsudESCT10x^E9+nu<6J?jblr0pt2G z*TX*8$aS1LFkBiOz>1gss%M{34gM+!Mgz__iBK09nJ!pmpYL3nlicUKuGJpRc$02M z0dAygY*Sy}BE)|?w>T@A{1ba9h9mjnt3^mtyRlau;0LxhQWGtcHb(#t5+5nb(GIe0>n-w9jOTctreQuJxOsc` z7%km_9!w-OK~_0TChr~>M@?S0EHwq={{K*pRhGA!VWNTY3c|CGI$_{D>rQrGO zPVMRm4${5&gF>od^d%>9mB|Ht4Om}PY^$Ogz0w$8Fr;OM=$S&YnWzJ%SopfE&l5oG zWMEwCbOh9-07WSrBN9^el1}$GCO%9&R6W7&Q74`IcM<)a%J`qRc~UX_bNZ4s8|IMK8P6qv?km~H9_|CnWVB+%yI4V{a$S@TFL?d1N} zyDAVsN-7IUkObQ9XVuWBaw$vmhfc(cH5HuT#wT_${nEZz%8DlwL1U-%pFR=$lJbV4 zxsJ;e|J%Kx@>G6ck)T`Hdx~@l8g|mAar98LI~4w9Q!EEw!HUL{tHQ`|=-ia09Y6R= z=M!l71oTXmEQKlW!06bBXQLV?1j%MT_swxYI?Wu}I=rh@mqC3k3AC$!pr+XX@9HPH zD6SsEiwezHB&rK}9YXz6>@RSvxCt;Y>;kJC(A#I}jAR!BY4cH0&MDq)zY(*rpC6G2 z9bk^4`~XWpw7<{S(Jb@#ADY$e%#P0~VfPU8|95YySnm^iJyreDE_d`COFcN0@t|d=6?(WPIMUh>VUFjyPTCm0{s5x4qd(j|X0&BCh)Y zzYAOtXk*T`hA9mB5+t;(IO>>#cO2KV;T-ZMO*Sd6^YCzbRWC%6r_zNC^RLNcVU3Yz zz6@mzfX$Ed`Oj@E05mOmF;S?&@>e!y-;C|S9A@idb#X48&L;XlOyk?)fUO!1@_=lOGNaC+FoPM2g6mgn1vR2s-Pjms)vIGu`ls+5)TxQo|(TBjq$ z7>2)=i97lue0=ZcD!!0PLt``iG_iNyq`s;vXt!mRkzjPE7ZrI2o20nN?>7TI8bR3+* zXXP`jL9K9&oSU?8gojVg$BK^X%uzENFMM-J)#{2c*quMeILV;yd9~xUPgG{_j_f*W z<}2#F0w->rxnqv>xK&JLoU4D>r&#PyDujbv`B*vNsd&Wq6-ATu&NQpUhPWN)otD1z zolFb(xy5 zVkRoS`rFS5aq-1b7n?Xua&i@^&F!9g!khhTwOzD0J zq*nF(n?xetQZ3-iJ*x(fZqE5=H$X>KQuEnzW>a^&;>X$b^W5NK1)GYKnskgoN%q8t zqw8b)EAEPOXlE6vLJ~dh#>eWR!bh`^KTe0rrSEqSkYgb=%*-sjZo9!q6qJ-B0gg~E z3`w+_jaXbUE)+pDC3H`Yp3Axyx`1V z$HT7*I4Ke&@zviz>_B7HF3Y#um3$lHEXC~d4dX0aFq8r)%Lbo(Uak{Xu&1R?O7*Kl zF5aE>E)GzAo6kwQftCnq_bOMM=X-kO7G}?{cEw@FEGGHN>U#}x4Uw!nUK4TF=#T3X zr1(FDnF_5s+CA05_Ej8JNGWSqj3cF>NC~3oKDa!Q(CCOLvtLES z3ebv6^OfCUL$~4aFmhA(0)ZexPlUbSf++&S} zeYqTAX9?=nWgn~ValmHTRIrb^gPIw~D(WL5A{}vh%Ws0D((BHaod6>~8|vew&|40; zT)oqsdE8{e`wUxMuN^-zls}1oO32IcvqwK#aY<~*xxgBCzyi%FWAZA@d^UBH^pp!;Xpse$|N19l zL38&AsPe6JV6O1Qas4x5r6enw5JUGX(%1J#h* zj4J=qS=}}LP^kd2$s!E>xYv5<87tt&q#u=L{obR`70YSf8`kju2plM}uS!EYjq z^G}=*utTYOgioW-n*t?)#_N%%OB*qZNO@9r#J|H$ceuiE;2qdp-+c`ut!{#4vjcU( z3`$zJKWE~V7@sp7lOp~Y8piI;urV^F#WA49Y*K|SqvebkE{d)#sO79ziupBd}{o>_6n2%;g0}R86 zAD+NuUsqfV+9BLeT_<-RTJO1ME+R_5vuM_tSqRUmk=CDKZpuErJ8vad!kDmENP5{g^|Di0~sAppy?GjM2$#VzG*< zfabYAJQajeHG@x}uWG|Nkut#G6*Tn^@OawBHZFSF+uG+RF3a3$dzvn{n`hAMx0{H5$5uL57?$M7XezbG-}P}wx+@+1 zSX%4d8%`2D*6!6b=x6x5$W!-%YOHWPC;ls2Ixpapk4d2qYTbFBqGHgg0fG-dCfiBa z3o?R&wmdu`*va(65{~y+*Vzr<7mjF5O6HWNdLOZNs0ePB80X`FttFmF&(u3EWut~K zs{aZfKr@numdzYSq!dghldcU$afwIEul(x+V(#?oPJ$XAv7zvxwA`C?*>%RsqrF~T zh1w$CL$NkL0~o23Dc`=D$Z%i#RLpPg&W~?x=XOTQJa$a~lDMg9dX#t2=e9sapxGB) zTrV7Fk1s68R^ytwP&6H9p*LX4O+c@zKoVDI;z}?i(CqZkrA_?vQuXU zP?dp3M(%tJI#H_4i+rq`9-D-9CmOl(2yonN?pj*%O7Pc&@?B0eoc!fz3*6lIV;KPN za0FNiI=H15&VMQY!7)g4sl6@1nn}!6sH~4SI2!!UFVae>Thmy5wAW)OQG3h^6lvoe z0UvMZ8#A}U@d(qmY}c`e!th}-$5Z-6ph@xuAGw$7cgk;lt8Ly_t_Br2>rr`7;fSn? zMJH?)k95MD&YNsc-w>WH*#h$0MCu#E4}A0LF#Y2ZEl@giX(t46WC%O%EoT%?832{i zPaf1W;U=hPQNRI9!s(I7VrKfcUg$I-0CRU)=51Vt1d2ukP$fP0eV9xsmq&d;zi%jM z=5%57w!lNPD!2J8Y9SF`vBOIk17`y0kWOZaVk~LSNDIO7pv5{0R|A7IbsiAWy<;-KdXkzVf`Ld*U=^ z-e86}H0OyeV-zZtRDQ!ERf}CWL3$A6>sK3BT=HWLVakBh=&$3?xlFbdb2O~NAp3+k zFu48%|I1l9c>i_OG4p12&>0}xpHL^@)T#@$LG_+)qj$d|BdyDU^E2{&>7>sE^p#U> zp)(bv0_XDEugd0D0$+Wn){*5@XBP+iMRS(2eLu$jI7+=1y`tUeCRcO#u2kqeZ{}F; za1GX24i0!JmGJh|`cobJ-A~Xoyxh`I4@1OYaK5mSx zgaJr@^RL^RN0+ZzS0(C`8|1W22=xjF*1A#dkw0w8(`#&Jtp@DlTt#IRSz3g*e(y~-OUbm|r^l^<9QEI&r ztAkLnz|e_$TJyh55Ut@?wzXPsT_?S8$3pw+*@%e9?J!8+4zw`X= z_1QZ|15z9ZDd0|s&J$WMFV>|E;Gpb=JA^CFpaYYgM3ZaylWRp6B{$Q>$OiWDoU5+t zBtLm9OC8f!EbSjBl*EbLmNVe6HwK=z*tjEYB~vA9l^D|KA+#BEH82=Zils#K6Y zd7q6L`+lXj1KYyTAqo>#asW_!+52jLV=mt(FW^R$4Wk%l%k>=Tgp(yA(|@tA){v zIJHK3730G`)AjLXAZ3NqcFP$#o4WPZgK~6I89a*qCH4tRg(3}Ajm-LMTa~Ibi^MYQ zH|~n1?eG$vEy-uiq*ZIOZT(_l>oNOGU@Kv!r|w0Jdd!ewqz5$vV~d5;1LusDLmdYq zAF`^A&B5jFE*HRIqb>Yz^P0qZ3|yGFye{qmK0 zXVNCbQYrIZ0=y=xUX+rY(qpYYU5$Q3yf^ArejdO>Pp>qALp5U$G3jl`^iPQ4+$T6J zif%u%#989dgT1(RCGR`1AAw0w1E%l+%LwzcBl8Y-{lH|MGT)^tP_nmf>@ch1;O;98T^~l>2N2!=Pw4 zJ2HyYPRb=em!InPCN@?96HGmHMb8}=1HdHSkVgBTLyw)J3be!q{kk!%ABI8kZlZpS zfNDaT)T%CyJF^n+*uDTP(8z|%G-#1w2z|a>|z%}q*~-#<{^(da}! ziyV!0?m#<+5N|s}f9J<-yShHK(~fG>MO@D)@Yym-xnjmJ-a)H z5g>9$;~2kDjJxT@TQ}SHwuSCo-nVhf@qq9{?Bfd1eV*^MSQpise?|xeaPeB+?(Tbf zXe^8Ip1#kdmQ^RCD#jJsocF2%hSzxMtjfo`T1cJ3np*vDzc{!&TL-zOfgW7LcJI+))m%6 z`8c1|pvE`5C+&=T_Rio*YH>1BG*M>?Jp8pKzf344ugkYWy_5#VY8@P`20v_46)Uy> z{$vG^Ch(5id9%B#69^5CC{NjD2Kd9e(TkPd&QIk8IjOr3U2xd{bNJp82RQ2&)z%-K^Xu+!kguhKOE-6t_Y+(#^sjiylg}?ma2PTe z=l%B1!Ai~!m@7VcRR5MF_~k0PU1aq$g)@|TYB`tJ77?;(&@4&xRGroB@Z0Y5wGj2s z58A33-(q=N-c(Z{xc&h9#j=`mIU971q!&eybLL@3qk`M1&c^`Q+SYsEhv1P|^WUOD z3PD^1{2DgVgYwaCQCYmPNKM>jvVVssaun+#5+t3)}kHjxoGNDRLD zy*1_rOnCf@)6Z17k86R}{r>#@q2s|-TIOR1*$d~TYyBIsz!m{NTwp|W67;4#Gk!X` z0t5BxsFH9CAzhT;kOvUfL@s)j6p-Fjvq=i_pM*+I7;j>?|L|wh{CK?0xai%p&`|CE zpvrxZ${4UfE0rxGegaT25C_P~0GprnUYyt?bA8^}`-VF;-)gSHf4m8=?79#tSK_Ui zV}+%wp6r}kZ`qxY3{YEDlo)#aey_&sLot0k+E@SEn_H`!T-Vv^@BvrwhYWG>bevAD z8$g$u3UDHS%8al&$-=7X*@oB^R>q9zD6JA}ju1x?e|Z?c8Z3;0w0at*T)vS2&4}Md zT1T!A01Hg=?gjBc_rk?gW}r_KJC%$U1bl5194}kCTCRn7%zwiutZcTn4M6LgW>g7B zX1Tx^NHY27C*6^IE=`@GqIpHeuuq-@$8~i1I9HRH3B}cHShSht8yhjOSa^0K{X4_j z8*iSc)&P&3GJ#ltvtRFU5stp*`OC5^(^XF`VY5sM{KVoTr>XG_(u`bxHg=?tTpCIT z(_jT<_^wjf=56p}fItXx{qxvCf^z!1(W7xw4Qzaf1-@mlIRhl&dIU5kL8WwY<9_k# zw8Ugckq;Ea3q;J0EQjVzLgK2qr(Lz+vs;u(OKc>9%2t-|x}(FUIVDA~dua3*fGYrsC$b!4Ytws$nIU)SH8mOIXcm-2JJvVCPRZ@|tQi`y~3 za#%4Mjabcwd|h_bm;fJ`o0!Lvb*VSe#(~bA8(?0C`90D|X|Jmem3bl8>Y*5gc&$qJQ<>g@&s>Y zqdLKXTrYe6M;3;5^Bb$HH;I1Toj-O60cq1`uMZghz@ZA-??RxTV%TWLAqUZB3~(_lIxeKJe6cAdU&ryw!LCA!KMELIUIwRA^win z{5*1DvKgy2M1Z_%bs%Xn>h8Ga&*8R%JHAU%V-mB(67kO1Jg6eqBF2?G;k%KE9dTi} z`#Oe7QVs?}=UV77NiN8nWytHRaNe5pz)u5JCLoYs6(B9{`Q^?}p1a~o;}DgkEe^7x zq=<5~baFlpnyRHpnmSshy*vfhY>UhZ!adK#yk^k*J;*Q=fxLGeN2%4W8pX@0pX}9x}uBC%+&+TtKzqm>NL|?*7X8pS9 z{@o8p!|&a>pB}o}tIQURrEjEXex3pQ6d}2pSi!)MJ^!Y%>Zx}1&EaI&nyFhQ}IlE-E z0$-#?nyzK)D~VVpTMu1GnSUq}nJOHs?Zlc`jb&=@u)89%c+odMrJOOCM9DewtdrDA z`(MBaePfU6!HlG3i}$|{_n5UN-r=%gH>L7P6Vd;UtN-jXAvym)DQaoUqj{aXoP%ns zX@~@h1bshiz)XKNdUO*j41Lc{6FUllJo=&yyMD0`%OwN{BMf-lN(@p zyw$sD4X4}CH{O(Ij=MquZj_(l=8o>^pG75goLg)UK|&iwCF)dR+d_Jn83wahp;whE z3R^1e<>ho_BWh!g-b5oLXmtg);9lXdA5?P+e6f&=sNOM!QG7Z$m2;)kq<)`~ks(kK zw;$7A{V3fg7+T~tegAPVG(R7Zp_L~W*^^`n`c!qCMA;-*KW?GH(Rbdx#la`3Sj(|Q zc_kThMrz^p6yE-Dc&c!`vJFr{A9L`*ohkA z=Ij1bna&$n_;+cApXY#SsX1;;Q;EEhMZJ5pcJdkKEcP(r4rs2AIn~6AOI;jrvditk zJGHlbU;Sn0rXz$9L4t0iwphDtV={b5t)I&;JP3vkP_$I&4e)HLsnK2$p0#`_^52dQ zvjtqim{XaSm$NEx)UR?rvm=gAHxi;q?4gC{wBx(==5*XEtYrlq=gR~`@&n4}Rp*zL z0V8rSy5rMXry%rVYN2dN@$2P|F5KgE8H(u9!-JlBV?;1VZSmJ7a@peDreSFb&`hg+ z-;PSGm3-LL4^JAEded;1%=I?TTwF9fa#V|p>d-gQ2j_YS%@uu<$>A`jpyXO0`5KtK zkjyl5LTGi^A>gNq(jO z1N=*K#FL34~ptlSApjK3NZ}a7)(N(5<{NTX; z?=r5nUGp9`L_?Vqk8eIgOs7TeRHy2A+;QZMQ_4E$gOIsIq=g5+$57MbHeOSQs=A!E zRrHaFpOZkG>l2GO-QcJ-|A6xX)U<4{7qcL#BC?QxjUlX-to7$BGjQ+n#OB2Lxk%~e za0c{N#dCd@a}Op4jTWPsh)jWH)5XmlUrWWS}|M4oQ*PwH+tv%zR7cLj|Wqsrfm_5j)ZgTvUSE%4@JK8kHTvqiP^rnc_zT7)Oohj6`RDMap%sA8dX}2qt(&BYmwWl>Zzbtyv{s4J)KehDpf% zc*16{)*k>C!*rT{?2~*^$P`e8PRyJ~^~#jJnXz{P~cnStEc` z$vKChP=DmCPxLVHRs6z2wn`y2tuC@&-usKITDdWK#*?lu-WU2seX(Wj+;PH-&C&xB z2fJ<*;Fig?CIiUNc&dBn-GV+0D=QUyC43E!6nM2i1dGC8Lq7ryH@XOO10$%didP<) zEhRcu3vl6iCTi8Zx^;2bnOXV0y;`?|YomoYk4}-_%nXtAZ6Fp%t_={{P?sSL-}Xt$ zw4P`o0AErINnHpmVo|lXe2!y`q5KY4e8;!y!b7&3?Kn9tA=x&9BK@bCpK%-E;E(OA zJ3-IflVxuw+zY*&AUdQQ{?z`(UD)fA({SFbWtIBsV@e!}B z!MgzMSNy4+>1G!&|5ouMMkS5<6Q#Qr{P16Y(FLPzfS6>w6>cU0^Cv$NlXCvs_E8I% z6`!(^UeDMrxuBzxkS?vNGN5#ku@F>-lfmvMN=c|3bY;8P`lb9IUDH}s;Saj*v32D5 z7CeRegM{!O%uj8*-+i>VmPv1nyR+GvNWCfnoOYTf0fMy~$T@K^$eIYFXR;SM7GKo& zTT$#V6-F4Mou7T&F&uIsVx8{Y6kePeX0?P|!&!hygAEilp96(3hKr{ zVv9!>g1EV+0I3l=q&K$uaFVcj;QBN4sz*vtGS=yF zXL zsB0+K`g;NLG!O3;7V~V@m9}8d<0pD`Q4_WmfGkm^ItG;;x&;24B2V0W>*|h5HJ_gh z>MfGu|3DfE6YhwC)VB6v5U)VkfaJA{e4(wKcHNji?}MdZ<{Li5o<__Tb*BZ{zP>hR zRv{uvxgLlHQi^RUz`fpLHKhM4CLOiP%(RgyCAw|{Jrl>J+hO6aaHL3Ao_aruS> zWWSDo@_O~B3huJ&2KO+v@SsYpWot|W^zh!uuWOh(UuPeS*DeP_!KBhJBcTo4;U>eq zA2&vQ#UC=GxOYq{tuLjhe1@eNCM3}?C4mdDULZzM?c)Cq(pQw2#s1u-$`Chmh87TJ!&XVupy){m4+(yz{bJeV!ikEKD&?e_G7za~q zVWkScqW?5uCXWrGVqDDhdjh+(WWUhX;84=JnRGw#huhWR9%4r9pP3M{6?n|k;3SL4 zlSK{^B8rpmV)4>afC^zK9(9$lZ4(qc#f{WfwV1583~nJ=`F($9%! zDNjo|AMgc3_?~V&?d=9Kva;}^`j_P{8-gD}^G}>N82t7d!05I=&n)cg-Hp+Qi~c8m zWyT`(=3SDYS^up^l+%}7;9l1%t@{^m$ki-~ToVT9*a`%t;f%;$+&D1yyU7-MKh zIyL%q?!$RiM9H2qU2^eGZskWJP$vKuF!oa&-jq5M0tK{OQ3zfojv|VS@a$E<*Du8^8RL|_0#*0 z8?v01*$5&p=5fk-rZEJ(O9AZ09nI03YjXI4Nkt{UUWpZ~nFp8$dd+ACP5qrzJq>Xv za2ps$9vd@HM%)$}Gk$BwOnpL?*$OO+$eL3ovia}u^3&MVWZ_StfS!cdLv`uuOGd$wV;e3Gc?7(W?_x6FM5WE&pizAmRv>WE?%iN5|M;m4JwB~$p|D?13kEa(>j&~UL$V^~?_%b#>4 z!qWE`vmUoG!kh?DShmu_M4r`BU^oRWsec9v5%@Jynp4%LJhq43|40O*odX`rxaUCiXAztoK#6Q+oD`Ni^m;8JIb0k`?N?UoB zSo&xQLm_*7tz(yMObvp|U*0sftiAUV>bHDYKMG#$9*HVjroT25Eh zL7~fkoqD;An{8nvS1JO0TNMxryJX}A6f$6mL25I`t8ut+oM%!WdKSHzwPc%TUa^8EeZ-b_# za3>jkwwSR-%4)EK58}MZL|v5#6{K}Rg79IZ0|4ZW$Alo=T=IMuy!aGlR4ge){Zi%Z z*AM#PW_{VgwOumuEU~`^4Em|HU)V~JRHb|WYNy?^(~w@(7^qXrBkfWvBO{iKyoHH@ z_!=;Ce~iyf#OsPgP+-=eUZM;e8Bkp=U|f)TE_u`gH-7UOT4TaByYiuh?veo-d zp+NpeOtnVa7-3c_tj{GSfgF)T>VA=4+)!Wq5g_|be@ffNq!LGP`+_OyQa!8TpDF$V z?xm~g`CkYu()*r1;)1E&(eqS4R08w&XJ0LeyT7a0` z6EqGy*SO?ya$|3I*f7*MwbD|Ie;%t*Uh0U^~gu7QO;9kdq7_ zU-d2-{2=;Y047uVtML2bs-LSjvK5g^HC2vb3I|4RMaJzL|3u{1GOvHEV+ug)lEh%-*zuVn4k5e+;dg>8jud`SVbQ6KqlYv*5{_@~ z^*>o{%yc>^MDiXGroCR3>f(Gi)+V`KMJ1<01a$vtAE%8E0A#xouiw___bov%f}jCb zMbzP(DNvoK6BR5%B6`l*31N2PZ8selTOm%vTjA;OP|&{~A36b|PET*=j6xLSiBMuI z$uV3+&vQ2^ib&qrx&yXosQ6Q6SdS%bq&S%it(Yj3A_~0>q_BRke-g?pbSL3py3uP$ zNV|Om{hQ3y^;J14(rpHC_hR1kP*ZPPKF^p3j#5GM*4suwT!9}^jF(kh8{+V0!dQHz zj^Mi0=|J?fN(gE^0V0AR$Ohi>h>djvuQo0Xtpu_MdQ-$umuguAqRq*8(ApSyG*N3B zU@@W4a#n-rexp-`$IwvHBA2uecpQPrA3N(aBuMm!1+^s5WU}OV-;qijI%SqKwDXCN z%)4MmT~%y33Wm-;kjy8fiauS_)C_osbk?`!2V=2rXz=-3p_{Fx?){h{?9cy%nbza` zQ#`SFv7M$0)Tk6HdF2FWtStu(>4V;LhC!+83!UXSM`LevQl8}xe9 zk}!4X`h$*GSo(>NjTL4^XT2H{)_0^4QvWZfD?bLt7IVLiwR*d$Z6wacC?so25+O-T z)y#@}!^NyQ4f-TxwmzWqHa=_Q$F^&Xj6+2&)2|-IsUAr_ICQaQZZLk=w3Dpcn+gWC zb_>Is2&}0kFIL(&>k{>I+Mf z&b5lSt8bOZ5|o5-lYZyv>HIi@_%aU&O%La-TGRM5Dlq6T9P4nAU`N@^=aIS<-;dOF zm?A}1j1Cz?C!o}GhQZN;jY3oE^DT^6GTkZd;x2+n1%3G}#(;ll^tgo4H|(faJmHK* z#UC)XvLu|fR-_^u5^bTFQDu!!LFu~uT|Cs1sut*FmA6aq4*w@=Ty?Sw%3;av zk4@9?Bn$0#>tjsp=y?nm*?G(7Y?Ar#6L)*t z(mB@{i~n?J%=XVLzI^z@K2}R;wRrB`%L!cQv2t_wN*L9M+B052k$Ogh6`CiZSfe{$ z#D9y>ym!=B^p;csKEB~9%K_S$2;<4;eMm$oU~bGq2v{dssYt#TX11=mVkiTAa{TN` zQ4@hlg;iOaG<*)jk-PL7FUHdgIIF^JkhW-^zlK1d!c>XOj=L;D(I;`@2}_kEl8Hm& zABQ#uSsAFWh6-J}V*B6iMhdUpb>lGO<&6Pr80OW#dtM-jm4%e>T%z3WQp!mTJ-72# zMr^E)c-MVtooG>}`L6DN_@AoAZ2QdOb0%nWyI_tWX(UwYO?F;E6s8o$5_}S2qh?xU z8{SxSRiyxU%Wv{{@|^~$a0CK)(jz;Bq(#*_9x{!N4HqMmE|V?h2GO)vAMq5dlPtKz z&4pL8qnOSGy`mrP+i7cp=4qG`YBhKzP+W@28DI8mbOkU!%9u zU|!@Yc71tn$~&K4B0zZE3tbF47x%B8j)@UA^1)DH zD}OI9ylx32Vjb$PVPuJ(t-3<=4eskQ7iM>H62GU8$k(+^zlJ9b&Oa-+n zy!cqPmOmg&*?D`{WU1TytB85|5cEhW32^4SOS2}_pXGVwD&p%F`&Czg^~7A+>UFYp zhtPOaUz&BZV^vFf07AAi2i!}oZmFAf(X&d5lHHaW2>JhT2Zkc8S_FD@dGPR7hX+_& zMY^?OfDX??y!>1rzEeE&cWWCrg|NnT^fbs)mYg%q*nr061qdVFfGT*^&4_^%_MghA zYW4nyQeF24V@~(?F-Bi@k7n^{)&X49cye{R4|?C?;+OO4XO^kI#S zYh9hqRX0$ic!hZFtKYKCR`J-tY+Ka?E#;^epZqWwYyvnDdvg0lAEn*vALaB)=ePO} zC6z!p1zhChZpDxHyeF`ja^R~1J8#8jz6u7LN9yL8so(uF?r0i zoS&64Yt4|r_m;dTayb2Y&GS(8F+jYHCGDH(I06TJdv1lmjowUHtpYpHmnaaoCE_XY2i72 zzzmd|nh-`r++-M<7ADSs*Z$dHgT#X1|Fs^E$J{J2lAo}sShT{)Y2Y!k{=T>*MZoWY z_6QV8-LbJsRlkY^z1L93jiv&nnEjI&T5*mYD67%%wmhGo1t(1NtF7fl510EwPiK#r zLrNhxAquYu2_V*Y79;xyWSw}j1n(S7O(Z4}Nn|enFgtbI`oRXl%N?_s!P$mF_4kh_ zIV-WL@O(aGP}#R1YsjcyK|@s8xEqgXub9GEc89!|#7wAYcL>C6cFDRX`46SgQ{+*8tyA0lNh%p}CzUh$Kc z>mG;VUA~2>?WubAFD)-R*dBmn<*o$}|AQRa)5Du#^1I`(O$u)8!~q95E&8pO2qk(3 z*i9gmx@glMGJ4=e!DI4Y{2Bs$`}@M9=e;1$emQ2%7yQREbGe<3aWd(tF}Wwygv_M5 z_#F6)=v{Aw|Cm%yNXnH%!STQpN9>)3EF-o)f|7R=i2BMt4E%+~d(?^y4Qb0i@+GjK zsq-9<*5P^D<4Ds$rUf(O#qo`%3|y%%e=3LO?4H2mx&6TSvlxl53jd$I`sK=V?)me3 z`h4$_s=>^&ENM`e7BuM4N@tEXUgEfo0l1@nh@!we_q(Ur6lenM4OiTEO?H)Qd8K&u zJ>-z5Bg7P+e7J$hc#Od`vftC-QD5qnQA8r%}Qg?!f@wd$Xeg%V7fJQ zJJd#p&H8-ED8P})W%yOUTuRN1j6qj%-vI-LAZUu5j{&WS`Rj0{77AwPXsz-xP+PfVm+||`S7ILWd4V|tic9IcQv~ns-1;i#iP_Y zX>1=bQ_>JH6Q$>VX*0Ulyx}tZq+ci|T7%QjeMjGZ1Kb-nN}&b7Z#?%7z6Ym+!a~7V z(DnCP^VWcKz!pa4=p0gBuT!RGJASpX{V%gxpC8w_ou;WXw`V}nn}`oCaC9jM!l?gE zwCKtgK~bQgDFiJYiU_WV^)2=jOZ>uz0v${BSiWA))q(xSBkDVlxu83;srIE$Si`~M z4|m^~SqZ>Al!sEt*zx_pqpO%+RJMp80DiT`hs@AhMss?d z;+Y$Fhq@BBhN_0Ovc@io0OV?3)C!VR{kb?u2NL1#`MQlcbN(;*4YcSIu{%lOvNDsH z6|zj4ds=Mxxo;w9$-O&TB?^Z!<)Tvo-Vsxamr`?WsKfk}U#N_Ip=q6DZfsm7pe^}} zlM6EqcGgt({lnu<{8RWGlrL|YrU^Aogxl0QRF1%~qF}8jXn#D#3!&BN8lyN4`eTuHr_um>h1cQ3ZpV9lmyu2AeuxRS=ASv!7i2M)C5O)sn5O5hXgfHvTKR%e|2pZ0a^L0if(gq5|GdMI`L==iwj_D|lg zsFQqIEQPYb(j@^$N%;k*&o8VehaFnE^jKD&t>^b(g;Tv_tocGfNttfRc{@Th-Hy2mvU`=ybDp9D3@?7q#w^g>^8`|z$rO< z0lEs4U;vBvs)JVlJR!rX8cTi&7lM;G))l5n3=3w;^CRPxiQeNM zbSwuO9dPl}yu6E?_6rCgz;3b+K~T11W6kl$Hch9r|F?1V(ZDvaRsb{)ub z$X7gPOY_PPnRXz>o0IIN`UPQ53M*$97Wb;Oz5wMPlX1(Rda%_MOK|IzZnZq28+-ou zFFG2EKWS9!gep^5hOjdH(PCO&&?LF$EJto)!e>CZ9}igL!yD8f*BD z5sz!NDnriJcjDnt!kNqo*@q_MjlkUfL@?V-enfWi&kF+bn_N->z^?)xaNkZFzr&rV zIZi|;%*V^w6Pupbx>@$R%Uk5BJV(QhOl}(b4I%-j37*izB3p97(A+4NJGm7g!e*~O z>_r!H!!Px%WTUh6Yy`|mXfm-O+>Lq7VJQS6VFlGP!KTwzGXJ$@dZoid)$!fCLHZz? ze>}GB=0&C6fzd{Zv!A4*cvO8EI=1U&GpD%X)XcarK0<$bDu#6^?PTZEo*CW91yLDe z0slCZ*u}9beyi7=Z0BO4;gdaX_k<~kq2)%`GYtfzNf2q#*#=q-UhV(Ln`_}sQ&jk; zYGTwIh&r>)x$~)Lt7&z8V|CHtQAw29e{IL1^XL_Q?j-c9y}0r-*+l1@wM0&r3Yn(r z;8|#IAMa`ZINBjWm#k*k6nlFxfbsq;D^ru%YAx3j!Yr0?<^acW zVJ_i7AFTcushIxIQ7fL{C-{SA&zusy7)vNZG$Tk#fEor6yt>HZ-gDk{is&SlZ=yJ-&tl>o*4viGzrZXn{Ph%0L>&cb&73p)H`$42 zof3P1t=&`oH~e`VYrSa>@eSAapv&8k1y}(O|JcFR8}Wtp)`9)018>h}u73qQlms4P zM(gVmWdFQpbXRM{t>&FlA|7E9KzsPsQP#1KBi4e(r{0xZUAfoy^2uRmeh&bA_-eLK zWdw;(8ukr%V;FeFN|R&%bRIjTYRATLY4wm31jpQ_p+xqK@QH%Flvg+noD|XT8i+lK z))3=epn7)iOj<%If%Gi4rDrabQ^e;LIV2I|79oD+*$2Z-S%d!p>83OhD@i9DEiJ`P z_4JndpcUNXl9T%%I^f;*9D3#Dxf8TWkAZ@F9*X(F)0QG^Eb~q^l4QNb7AV7-&G`H; zg24LNfp5>8+oUS-Kgf(U)@_mf^HZabw=(V+-YH|$BTjNN6wlUqt3g>MPjdq(;?Zej)mXx?f zfZt@G2av8c-@7Mk`@%RvLMy}ssYo~D~+4;H_DMc7>-2bBw+ZuFKh{g@@ z;PkcS;+}~xO308ObI+c?9Lyy%sk7w*0BO^%P%2zeUtUdcNz+-M`Q4bs zSUO!6w>3!W}etb5o}c2{w13>zmgSd2p|U+k74AvT)PbdX!6t*i2cHrIV9zB-l-2O|#e^Tm69 z6N!Eh*8hq${>>vB-bA9S04yB$yi4%Bb2Aw2$RdbhHGZ1^vezGZ4o%OY8H1W*1?{F- z!@a~_n@IcKx6NL^qKURp;to7Be)9dXqKb)`Vt+*GnMsi!1C&5YwID^}dk|m%0|z7n zpwd8b61OvruGU+V%owC()s3>bHx>eaDe+^VR^jiNz`wTZ?n12}JZK@)V+`CY&mnUYka< zPqSQ%3U0JT(0S&fjv%|i`2!?PrdMeqW2k)y6seK#yDwme?Wp98n`xE~h5*w8gD_>I zK&ngysNMmQ@zA@8gof_yD0LE|CMJeEYQx5IN9La<8<7}75FP+704@P2t6NBRtDL=a z0JqhxIhbq0MYMx*?`qJoJxDh@u5=jtmdbKw2{5NE{K1`B7@Ub4E^PnGo>0xBlP)-2yAV5*zP@f~Z5gSa+26P~xdm}+ z>E@M|zN+G{sdd1;-8IJC_cJ$b4Mi`32%Fdpz!IjIk9SQreOpa$1qgrVz#ki364Ue+bKm`UxG03E3> zZt!td`V?72A*5l*p%A2_V$6!01!bq=Iwg|69}QQQD*&q=VhY|3;4vL zktS-C#E+^#(@%D8z`~vg2ykMPl*a%=#+_e*1a-li&S=6=p5ohp8~ZV#-*_#2F&x{g z^{bwNhzFOnr(_d#AM)chiX1!e6lsS?zlP`;U-$cJ3w?*iI_n6O!%erDhD#3DDDfi| zzBR~K;V1s3i_NkyD4VcI;Qg#3%jO~JXOHM*SPT&uH_e}f7s=migKC!M%{;kZ-)>Ay z6LmU-f1H;@h&*N=ixqGwn^= z7%X?5;c5Fh?03rcsBzGKlX{#}&bjE%B33*={|&XPwo1#PB`frsm4Y5#vVwW(tuJvO zvE+w0tsKxe%ZVl6_2um!@&of%=1jMK#SUnKM423-QY>2Zy?cA>z6u6F@uur$ZnEay zmhUjj@=WtrVt$bPlT}sK zc3nK$Q9B^kq8qG#YW62C!cgk;y((Zk2^q|vJr+K@;5n8dR8E&`dub@G!)^#Ru?wUm zmm{ZzBtX`R6=UBFvK0Q~j9Ga94Y)FZ-t;0~8$M;F7v6eT%ZruCmYy+X>I1?ttCU_! zRP6Z7^ya_{6J8mY{N?B+6G%y8xHpNw+LKg>lFj&=nGgnKg|E~SGR*jBoXA!>UR(bx zthgZx&=w16h|l}eQJFt!1C>tu4V=T@ao?x6owvw`@7qQ3mI!9Jv^Is^UMBT3dmBQ@ zuP$!w9NbZ5hd1WGs%@ryCGS%TyAXq2+b@UtW+!#nvdw$Yo9O_+Pewe9Sr%|cavoT(~-VrF6?1F;CqZd0= z(Wqq7I3hy0Q4n9_0Xwt_N1*!+Roxx1QjV}gGh-nyaL>i;*H`wJZXxn0fE?0tlF+F^ z^7E^)8L&;rD>yi0)>imN3B;Oa<~+WMb4B+GDip?OTTE%)&SK_|U&=?$cSWOQnCf>% zz^2TY&L0+N{CXncLBp4}XtG9O^cD?Xz;QkXGgkHs`j#^e)(q3xbZJRNBHyx3h@Q9^ zQRh9SSD=9HBU20j-be9zyz3SPt>aZ|f%C*YhxDzM#8gqIqv-8wSB5L|%W&0W9wAUb zrt&6sTgA`kt^9nOZmn!1tvIXbMgY zxaXd0?1wBe+Lvls2sE|6!QjAk!}WV>apc-~&<{%26sF33716Y1BHk@T6Hg+pqXQe&3l zw&&0vvm&4k9~@I;!<4|EXDrB%ravcthN~!PE7wAJ!DIpDM)aR5fU5-4RblskSOnF6X7__du+fDg<}ISG;-kxY zxS;PIHpnM}d7Zb2<0WVZtrP{)XWREI$bq{9*E^+EeIIY)$bJU+tmOE1Veeh?)NlX$ zMashX_TofpCwvLSd^(NZ)8(%(Rp{C$Dq|8BkiQ&NmAzR5??g`)7T_%PbAAI9xx!~e zFv-1jjcP&P6W>9)=Jo@;s^Z)ft%2em>Lb*&44!Uji+|b&`KH*1io=qXfla1~)X`vT zVh(${T$Xfd%Re^MgW0WG80%Z)LFzk)0Ct8@ww%IjVQT()+e!8({Zv7pkxxl&iN7Hj z;eAv0dn?Z@WIh>*`qViH#$SEO^}n3WkHKfra~(k%w2UpTJoL#&mfloNb*q)h&!&^V zMNW9sKNHBDeec7tX}C)R-Ib_Dw@JJ1QOGIA%=}QsV0nAB)R%Et$=tEf$w-1)n;G|G zZjC8sx48f=0|ON(o%O08^!HZz0a9Kd_S3MgLw2j9fi%wl3ek&~0l3#9akN5QbA>Rl z1>zW?T$~8w@GDdh6~n=DqQlJ=C@Dz#5zL~l92NHt2EBIzd>6nNM@Fd!sxe|X3?atd z=?@XUEY1v}uX8ovTf*1gsn6yv+bJrzVfSX-nvals=8-#kmlqpN0Q1@$3=rVSrsrM`)1>k?^X)x@T}d;EoUh z2&`Lnc)F|gsE;0RuG^yc=RIzZ1?I`- zr1UW7%h%z3)jNvdw&UK`{hQx@xs3<~Wr7V+;c_qV5q`_WlMQIZCq%IBIBqz^08& zmt`;K1;=6-&q0oWRZZ(}ph;cB7sr`b^}y;9zeWfM9Id}R%#qLa@^Z`jUd)(Psv+- zFE+2-`UO$10nw>}!<~kUt|<^DoQS zOfRY`v@k3TU7P0Z4-ry{Z$-XXxKP>d;_)N*u$5h>RlfQg5IIK8iEoQ4j2+9}S-GTm z$-Lalqs2OLDTTwIwvsZ--@scHvf;xzyt-Ex~CS;Dhhhyi%D21n*W>blw82 zp09QO2N&E&Pd3*jC^PfZo)hQF?igN{QS9rakJc}@y*BLFg@v8< z&jB#@ZC@>c#Gk)dr?h{!m$ZdhAOi|71Vm1Y#5#kw`(A&c9P45FGe9tgymK!C<1T1$ z{alqk=^jSf51V*@}eE|{Pt?gUDM@&-<#2><0NDq9!cIPp9gB-?6%;YJGA~) zWmf1FX+{Fy%LlxgI9K2KHh=JFrrXs)8rM6SggY1gQtvO#*7IB|tOJE{4iv2QF+Hq) z96B)XLuBDtaY=4hVP{D9&Kc3+?%WBb2yoUJ{h0g>o0?PiTTFY{)E0X3QQ(6ckk|8! z0yCy0Ybc5ENwT?Y{f0#Zt^;MxJglE*Y_cl}I!v$bAPc75UX&o?WLv(E=ZqYVd4y1J zXp+ZRVn0XV%Ib@6pijd#nqMDw^5W+8O^ehu-<1gb>C$?nQ(SjoCO=CXd4Vxw)9=xr z!bLi3|A5!xKSr57c*Ajb^S&*Hhg<0%yaAjiym?hSHYxs3LG>*=t_sp->$`ElOJkQeg^)JGS)L@9GvNnmXc>*Bz_y;#m#O}SEl^>zW&g)e~M=(8_eem?&V4}COTEbss^ z9Xk{>Ibh&FGyViMCgY=H9W+0bs34uYt&Eoyq!Wo0aG46F#3gw<@#NHz9wK6GH$0Xb zl__ydEQQj+ICwD2d7m(^n|Aap7fWK$hk51i$wqTV9*HT~=!$^}NU9&xpOO+n^6Go^ zqa{w9YT(p&ndDU3B&2yM*>5q=jEx}Yg(J>%^jGV%c~(i#5oU5>-Iiq>mKP^JC+||i z6P-3*qwStQ$Dy|Cs9xm^-sru*!Lj+fPtxdHZvy9@kN$qUMKMxAkG|<0g58_lRm%pm z%+q30NR8;8jT#;z6zOb`(#y}TeAigG?{nc3 zNAMhSB5n`)X|B7vH85?_)*uJxiT!0N8#bfIDtN(QZ;9nxS0BB3n9m70Wc_~WBe0ki zc}e-mlEt;APISrCkZF>Ag)h~AglnDh&}z7+pRKgLHH;q}>Ye3TJXrUl)Tf37L4Q=X z1YO`iz2?=oe?yp>NS7t;El}$>fHH4B)`jWqGfM)G6ehR6w0mh`lbJaknJJ_?3$!;$ zY8RYO=w0Ux*$y3`h84&!ZDv`1~clb&hfCIY$E-&8odDM}kdGuf= zcPYi45^_x2xC{&}6Hxwh>Lbg)<*TIXaAn=4f5{HGO4+^S))5}Ushk-LpP9W~tq%mA zx%*k*>;$uayhh%)_Drbeg{{0XmdWJ#MEAoh1llKc?pR0t?R-|ui~VAV6M?oDiEofV zq@_wTpr8^Y24e2{q;!Y@g00E8E3Mj!gUDkfytgMoZ}eBMEKDZiDIker#p!)OKG>rQ zNV|x@+1O8jNbWL=T@x4xazRII3JZ7qD;IEte*93tSy0%zRRLkEzBnx7-@D&-K~0V& z*=t9~^Sm0May2?uZtd<3>3T#!hi9nJ)&XG8F~kA01+e6nmS%rOs3XOJeu(P(ZArfc zQBb(4V?44;M84e9N+u6;A1SnbkjaI*U8FamjYbg=4Ay#CJ%+ra&@voYJgzd}ZV@k9 z(q;N@B4|Y-8_e=kj*x^bl>=k+k7c=$MP9dl4_VgzWNGehXh<#+l>&3Ov1!Sk!wt?O z|F-b!XfLAI%bn)3ys*DcS~YAco28<#WeUQngZLxyNj*xTjmhlb{MT; z{~{epJdf&1g3sMEX5?jB zhNqFaW*tLrD~gIivE3o3IXR)j*L)>6R%Be^J9KXUxv*E-jJ z+T9PrzF>6yK(B{C{1GVYR+BF%KA!xkzXu8tBKhH;77fn+vK9mChFKxC^UT&-{LGku zaJ{bxy41EX*a7!e+2Eogn^Y0x-glTb?j>$L5ZDu-SG<&rCz5d+xr>ad;j#qkk{sM5 zVPkj^RCf|nk)76JTb`zmYAZ}^B|?7+`2ZlA4#XyG_E(0gC82JMwwm>5Gu%P;CvSHh zen1pDSu)I^Kvia8>DVp|>DP%C#+Xa1y-Zom6N$=Hj35>U9O}{;qePpO2|_&NcG^wZ z25erX#eK%B>VS8-iFR^1@6$iW9DT5J5n5ym zfpi*qS5s%%tfSWH+~mC4GyHQL>p!URCS*ga-+h;~4aj-S-~p%C)`DRO-OrRh^Iw-! z22_?-h(2G)VcXMZSc;@r6A~l+;Xndxx7&*KA@4Z!!t=;Ce2;tq4+%n4!V$SvOD(lC zdFY)1TBhh?i%Z{|oiSGGLtZg3H+?EUM=J{g6y3-Uogty^wQMJz(w+<$sfY{DuREwR)IX?%Wvqk z0@7WMGq+!XyAQ^_4Eb)*7R=Hx`N4=COT~IWd}??&{yuZR6ayXaRof_d7w?ZJj4!pP zjZyb;uw^3%TYeRWAouaFJ)1KnA(?sk@m#rV&e4NXP!#{{l{k5LZJs^#YRf5flg>^v z%6XK0|9@_#Sc#lbzH(SNkQ9{y=VSHg3Gv&!4qq~dy+b97txO6nASC;>X5k(MEnmI2 z1M6z~@xNHuz} z@z-E2391=kW^KiPxw~ii!RL8*giJR~(Oy#X!}y!=ZP4lZQ60zdg~?^e5^~hXeWOd& z9nWF#lAi-xbJ>LWk_%q)Yddn2WYl{r-p6_w^((|JwN+L#kJmn%vNl2+L2veaj9p~S z`9Q-yupFxKIUPXsJ&>Dfd!7ZZk~2-42&(`b@uO7^Qptl5 zbRKwx^=9HVBl-B`k!*P}9nv9q3n+f--%qPgrSmdN4X_^Zr9HLv}$i>d5KU3NN>XJ>{D7He20hP28=191^RJCTs0mYW~38 zHr@z;B0&7nNMB=~c`j3!hGXi_D2hqUq3OaGI5N^gX!ap=%P``r-h4)Ra&OqdxPhtZ z96uT4HH|p6w)iZ=2rBmwDtLFAIZe%;w3!vB6`y(gdIXuSNnc#`<-Knz< zXY96tD`b629C41#F9e7>vYM~)tWdATh6YRRQWCX1wR8<`on({-#jMjJ$Svz*9Ji7UUE+fyb#4Hs1J zBKPgjbI&41MIseJkuV==6)`Y~auvhK)Bin`xczMuLlnZ)zjYwmbZ?5c&2Lt&KDMZ3 z{)XkL*^zo#C$(%sC@3n07zQg|itL002Sp5LJvsO8tH}6W>B!4Ek*0+V_vnF}A3S7F zNsRxm)@^5Uy9!|ssChZdTAX-E<_5LRuv`^4goI6Avo9=FVU1&HAyd2o3Jnfit6KFg zJCAninZD~qSZ&$82MJUkvE3$@PtPP=VEEQoQU*)3#$9aS8&sn5zS5F|zL-A^B&y0V zrAgzhi-2}+@Yc5(>&n@mc}tG3@DrcX@r9QVqK78N6N)w|m6(tw&m6>=mC%HVNSIIY zZG$X(l9d+cvZ=ILB8E-W-J&QaGY#iZnsEI*D*bAjy#4>;#_h=z>=%ecVgT=6j3Kf3 z%@>sSz3lxu@}_RqDh@U-W6~?`RhtjCV}{5 zevWg;?UzPdsq-y<0ZHf6FYRg0YrUC5v8!H-hr3|sDECCN(x#)Fu-m`>rq@QCUkcGa zcX!=gdqc#8lJZY0K1&&&Rbg*6fK;#919x->`*DJY$^E{lkJ4nCKu<_Z*M9D;?j2}d zQ3YKays13{ms4gKidsTGl^^uASAAP~^me;%T1%y}R19T8JfZsF@=H7gmtAXX+Doz`&vr33r1)EGcd-lZ>StCrhuR2#W|YM$5BB z5ef61i%Ylu&JH$ZxRtnc5aVaViOLqCid|6#x$fU>o6%5T*!_iwcTZXDgs}JvfnF%) zu_hl7EhoOGOJkdy6Vkj+Cv>tGkI+NWZO3D9-MkCe=4^|PF01^0I0!Qb?SN7GyJ^P9 zBY>`gYKhfom{{83w*4yYdaWJLvzV=`XVtR=*tB$|Tf@4PWeR28Ft-F4DeDN|6FE&y z`y^W90^wHLP`!{h!@J`8kat~b);Tt^ZY5Y{>oB_sO$0SzDVd+NdisdyZi3MP#>;lb zK4#&(n1exsIRRD~rM+EMaN23%V$dOG?&;59>=Cd-*B%<|OkFN>PCR*jH|`;iMS4X? z;SqCwx$z8uUQa^uK8H1!-~Bz9SfKM&KN&liPH~SSB6#i225}&ek4%dvQS@AwGh_36 z@H}0>fQ2PA--PAcFf@l>L3?te((39`wgbE#jJ!?P=L7V6!>?}~g(hs0TQSXMTR7M0 zkIl__jS3foa@D-wNrGj=$JnEshu(R!ttG8;u$_ujgr^y4F6shf(Q&f zgc@Cb1;Gn`>dHn9R*3O^$_(e~Et&H682G+Ot9vlLs2xTf%uTJIh@P&FirsKgUR;5X zOtj;J1L10e0%wu37ihKdHTh;ZTC!F3h(>3W>yk-?Q^X@7s9`*KPV;<28Ko=F-&KY=?GtlVEKVX^W1*F|)te z)Rwu+p=m#f3Nwe-L9-t9Dn1^)t20aKTaBKGl=2M|vu+`{Jg8`rKWfF5$PUYQj327u z*qNhgC%1Bsj&e_(i;b&J^!>OeZxBk-9l0wHt8?0`iu-2LR1Yatc(8o6%@xH$5YLBX zEP7&63GgPta{QMV5Tl(CHac*&a!I$q!+NZ9?FDmKgx_TO$Ks)pZ$4RY0yOsAz?)mE zMQoRR5|8*~@qru8u!6(jb3*Mp!hHG7H;||LyLj2dFo`{vsrL3a=Zn^9QRQkMFUZ0v z#FAIf4$pXine=w_XzXPt8&>`jE#M-3Y6IvxkdnQGQWT}zw{{Y^e@n+X^^0q3KO=Tb z$(6G$+GRJbv*e{;?dW8r5-;SCIDbb+HzAFjEM(a*<>~JB!yg68(K3T!`HsSixfq?g zrNUO|GPN@b45CaF(ug$^?tLmUM0oYOG@)ccmR~`RN6j*%jYz=p^ZPCzHtQ`3{7=2H zg(gox;~iK2IZSox&hJp9her+56t<$y5-9qE;Q?`9?YIp~0VxSKOyBczaB&KP@B6EG``Y#WOZ+^?OTW7BBi@Ta48upGj35#7FKQ&tH}^3`hX&+c8UGr9 zpY_avXyR;TspmAebjs(gmx%*)R7M{_S4!DDYn=;&jr2?wqfKFl<1UqCEX^je^bkrX ztRZtM{DMe8?l=UO#tm)o!=z(K=RT45+4rvBIZ{^bre`~#fJ@{hq*a^qEckyTBU$3S zdyd+RtUAHuk(#@JN1v-KHN5^$KOmiK~MY?apix0 ze%GcGW#?qrH>`Y9_aesPl;L14V|uUwoD6}&;c--c)syR=*=5(aYl?wOOO! zNR1p%Q*{loUxi@iIISTnW|IFTXhV%Z34o_clO#LChx=iGkx}d9s%lg zl|<)={viw$#o?A2(zwTob!90~)@8zC^T7Kv#Im7DQXB}X4~6b&r9jw;n|~PsaMd-b zAGd^U-SweZ*0RH9Hdw+(9@5PKE(Hn|+P9U`jH2pA8@ z%ee{mie-?!VV>`3_V*SK@V0{MRt-7l=G!rQxEmaXlEUw>3#-RxW%qy|1~I6#hh*Nn z3{u)9zOplU(nkQ#@aT?OGd4CdJ?39VsHV!L92aa+DqICcc&>c8z>aT4v$twjdD<3U zpRczgr+ln#N|hr*DZ7?G(@*y!oDeMEy>5cvK_(BhimYX zCml@QLZ&3b<)ilQf%>kLNabP6?_+2g37r#G9X%E2hyDl4WArl+Gd`BQAZ&>uTbcZn zHgoGoiN(vX@}bi0I{q2NArP^p_ICgd2iZmk2qf*yulAc_>D-p@=Kp-6;*lTk^0%D& z(N8!vS+|$y`q%UO%T~n+oIhSf5O=e=xrA9dn%7`-L9qG|(O%>2gX^Gl?JzWCna1*} z;6;#xRwg!EG;|?yFSEuJcn0-A&og`EulJzm4>9^bErXuivRJ_94$XJZGFs1RK1ls+ z%gL{Ek?r2shQ^Vf(4-ho{&{B&>gDK!#%hd>wjNu}N3n$2?sVtw%($KboW4A50I}Ig zc7z&zS)7L+#MX><{)}@fe4I5?yeJ}6di#EWDj{hBN(pQ)84AX70*^FCLG=8wIh+nn zJ&`Tt3VD=vOwQ0FM#Y%bLdTExLnV=a2XWd4yNgfW`@V$}d(WFwlWZfiJECYIuXO#TQW_zTzL<$T#G}#NQQShz=IgrQQ{UWwMjPp zngt9=yW?*B^}pl}4qvQK79*J+Da7(XZDCu5u>l9S?hJK$@;ew4wtWYnE_84Iwf$yH zTAo7R^(EJ#ff}B^@biz~Vs2-3U@}II1^9s$d)oACrtO*v8<8K4V@~e#_}&3u4+aM= zrgB9-udc2SPKSW|!u{H*5sP@zwMt^2V`QA@X7VKW1MxgQWnrVjMd6YQ zyI9i+Ref!U4qyk>EdHR6^;SW&=$!?_x6**dHhuM->(ub>#){@LR=C zSX!wA4XRa|qYhw*qLnWXT7@8CK1~Q{L5*s)7t(SqNKiTaV!Y+)eR6QX8YVZ;vR_Vs zSbmF(pc`$sglX~NUKh}R7K9_$y$n-E^CJ$NP(2Zq^opx>#)AW^SU518% z&3dGRDGl03oQaa2S%#0FoCf8B-?`Vg3shPmbhKQeY~s$;=wgtf^MT4b4>)JM9W2QM zMMm1En`A74@0l2l0dk9b4)kF^2gfX_bH{!0z4w+V{Z1Zr&=Cu;(fP(cq>opTGh>6T zd-p5Y1-{|;)K5bdtFOU5&yE!=G85as^3}V`iS!3Y8DNYPj6cR{r8vn^2D!ETXQ={a zG&J(|>U!V&*V?^lrL~N@0>E237}#R+|D&1X;3-;4*SY5UDXK zk95D<+pJT5hhH6sYc*?;XG3+3+fYzG;gJ&5AKrY#>4?AlYSkJA%wJ^?S0Qzdz&#eL zrNYVO4Chy@YIzML-e^=Q1)^o`0%3S1IT@YR>W!z|6&eGMny^W}FsLxw0RM8(-=))! zE6iiss)Qxh<|dE9R!_-@b<-vkEyi)o7Y9~Ln{{0_*p;K9@)^d;VY%_&raWPmIiC0s z$7)lb6j1k*Dh+rDmBHbm}1g!}jH9o#!iqp=0KK4==voep)8qMSmX?8=iDkh+@qHw>(uK zFQ9Y;^SD9K<4*gZJ+o4M6_ks0A1{CNs-7yZmlVHKj5Pjg#LK^ru!`D4np3YMqkkqo zz&)}HQP*9xQ0jyNkujhdyRp-eO^E1WQ0|5L0(Jo?FBbH$r1TPB%}RoO9KVYQdJgp$ z>kHVp=4Gs((j?oqz5Fvh#5BSC(qMGa{5Bn8heS*3eLo zf_LVg**y{Q;o{Fl=leDBsV(SXZj1Nk9e-EQfP!{ZIaSK5#C`xquNd*c|lQ zE@^uJ%5CLQ_w>UL9EZBCIEO#RisA`i50#Yu2=cB!mX$0}=DP{aB7pN#9k+D*&ZCv# zdOcZq2ztLDh`-ezjqD06;PC}x3os%Ul<58yCH>a)*li2;<@?WyP0r7qxzjCeYej(p z4AD1!-Y!15Y#Qu7sl#=}l>L)b)-Z$Rq-~0ZqPMN>(l=yLP#SNn`SP;C>~|EGpA3&J znL%>GHpN5X+u9EP=Qg#7R+Q17Fntg=hX>p*qLCu`@2JvFR*GGbZ7$sV3g3>Q%$p9h;}O zh?H!a@TN)8EBgoBXxn$0UB-OeZ|w9!?7rw;(&Oo6tp32K22ok7DO)Calf__$`y*-C zw$95=WA@>acEr8p%+*f?JFfZRyQA|uLp60KuF9WeY=9nle@A}$=y&f3<(}g~t3oeJzG#w1`7;TgZzQAHHaOj&>y1xUS z;z1YyL+_d3f7g$5X%6sdce4&+>~%Tb=K_A2y30uxz;c)JV<`K;o@VVnv(f1!@2Fzt zKJeS8p)H8?>LAZ$Gxa7C{YX46qS1t6CY`6JA(J@l+~CD!p8L?zoB}_kd9fLgMssNx zrnS$G=VkV5-3`NZ4!g33&eK&PP3oTt^@8I;0-9r700x*C>wJZnfsjAlJ9HWh1%k{0 z%+hoG!$-hL{k$@ZhF?Uqubw2__W?hnysy(r4*zIBV`oi^+i;>n;~ycflJBTPUcsB( zZrwziu^%CvRNw1Ak=;W?=a$h(4!pxRgWRY{N;(jg>#~ozTR6}Q6*Huno0j&jh=~5-TVu5havee=nm;~^mAe5 zFrl6u4Cpa3HakC%bkA_%)1e^P;C^-UY?omZ(Oqpjor=;)n`I%lgB30neUnqJH0q+( ze%?l~t;8CBdItkHxL?&gdxYzBx1I9~(kYwe!Qecq@<3>sOVynJ`-e)nv_P%6RKnb; z0xCfr2o!`L0unaQU%x|Fsd8KzzfNO6i=AsZvq=~bcYjHUG#<)(kckF3uxuofz6A{M!0h)+Bq#GpXBExLAt`DNaz6SNp#|h$=x{6Vd4%up=iA!qBN4Q=vx=c=CLPGrO;ki<*I3a^ZP6Jg|{VDl?N|}`{IHz zS7Q7TAbxVZh@W=yi=vjurj_vxq1tFolq1<&8Z<9Wug(CpcYHLeXu~hMNIx67mOJgRW2riV(>DhXy(*(hAX0`oCc7v)jpX?y*erVkmp>P6JaKyQcQm zl=aG3Z{mX7W6VS3{|fUddo#I^ul7PvA%ny35Mnu0@-OAn^gtM`K!=K z#vlV7c0Y5J>{u{i%uQ$1p`XA*t5@4`U6FqxI+u`+ukYh}emNDpVi| z@eyKFQF*i7P*$o3eYv!Kk6voP&kij4o)8awFWdBxuM(Q!Yqyww1HB4h@gD2il$H`M z!;jww6WCo>(B*px9rkY7fk#=i(|0R6D_xOikvdLXQ&8G!HB^@BLHvWXeV=}C96vs^ z{JX-qciDC)Q@{$v9|2q9g5yfux0E1*;xFbl5*kOCyVl_7sI<3Q>T_V^DCi1QdMv~r zR_cpyWJx1z1;^{5wvU6uqLEg;VhhD;3%ju zOiJI*%^r@NyvMrEAN@?k%N*-U7e{kX7;PLY|^N@w8r2H5RYJ`K`(kSmGDKXq0_|fgLrAl>aR_yucHfi-y zpmzlprhw=MBI0!pD8ov8qFZhOzr{6|0 zu;@Me{5TJS(zQx<^Myh7Q)ugP?cf8=vJc>4PN$UuDLwe(b+iw6y1nZ#&P%#y@cg4A zki0}YbZ7aq){p7J5inu~oV*@9SwiNv#gK^*w5OPR7HOKOTIF;Xmv=?cAN+!(d{NvB8c(hxm6aFmsr3O|Q?$M1q6+P_5Ns7*GET|6hwF z$G|wPl#b+<)VrQi+-uB?g-$h2$hC4F-EngGS8mT^kbQkhbmVi<8?SZfp{lc|Ble~k zU%bDq<9c^p4d%(xj=j1;18zI){pysBA(0HGxdeP_9FeH1tR(U4na= zp^xW~qKzd3Ml2E)ska7`wj%}4TagiIftZ&B1=B&w6f%D$7 zb0*h)gQJc6*SN^lxVqwX?doA~hb~RY2$&3f{XyDgI7-(uKUJAe$8d3wO&{@)hST#I zr>`f_n_#xZTX}qM&S)`>{Uw^im0JYEGS&PH=Kr zi@hA&ZuRi(5_0=3cIRzkfq0rjJu#6Ie2tmaSiF@AI$ALt1X%F((Xp?lt3D`IU=&@V zhai@U=ItMt)l;TxxN3BUk2YL}WMyJ(S|zpQQV#|LCRsc5OgP{HEUfbQfF&s6j-Rhf zUzYOCIBe&o1@&(-9@Fju)a+}iYz)TsVtrzr>KtJ`a8PX71 z2UeuNvY_RDIABzRK2Mhi*+CJ%vXE383lOsRz_e}C96#Aa0#&+2X#u3sR0^LTwUX>L zmK7kN{ohm2&m5U)UkPIhd2!S2rOpsQ+`!`sgPB(357%vZGVsLS`;+tMIkT_L33HlYvpYNkO$aI?28gCar)}w^M)Unfz-z!A<+&W)=9a z`HzrRxLWTQg0FR*X@u3$puYAB);kd&$6F>gj->pU{QbBIllgCgTy^WPI4cGo24ENn z2x0Saud}tQF({Q|C|#z9Ad=3`c`fbBbQ-s1s+gz~;HeI1_fhro&V(bsCe{3-Z9~#4 z?EPGVht2rfhEU?(G&o+XVLY_>0IjEgtVuR^9Hq?QM=T~EFskvf*SYY?eLcl6Fud@o zIB<*|c-DCgK9nhClhXOv&0w)QLvs%wP1gZDZyC)WL8_6u^VHgtWr6 zM6^-fk)ZQ4#@USofe~JnJ{ekk+?Znh)JY?}Rq0^V=jP7zPKt zhn`ALQPu;_TVpp|%x+)KwZvSCw;j6w<91bAhf*V@FJ-@vgcMu=@;=2 zI$Nh4WeI;m^2X#g>rt=#+vVuw)ZIbc|RY4BWqhcG?ZW3F-Q!dwc&Lf8IA6#f2^txu`ontN2V4U2Ka|+3Iom zvbNj{hr|JeOh)U>K4_(RbRlMw95o$t|I9BuoDoq3#EVFh-}1Z2b`%B7rb%I2q06g7 z%9TG;th&|t2esdV-}Bu*;NiTX^X#EeqLQVQ6WkBddA6@)mVx#v+c(+VpKr)-8>Duu zm4>iahqzwAvcu2BB+&WR*Cs+T(#H^JOnk^-i^0hz9;bgBhNq&}$h=zRN~!E()xvte zkoF1Kp6^x`&N>gaPK`bKJv-94!mkxHj@iD|9R@Xo!f6g&28X!>j{&Yl+Ec%ghsEWZytypBGjoVe>Bpoa3|hd9)i z&jyo2KmJY@4WwH!&=)%46y@IUK*YY1flc6A72>YJ3m-%N^N}4t2!l6hIKt2=Cg}uj z`E{axm8`8N@qYFiUyQ16C-eY5PGV>dIFOZ5-uEA)Ky*JGC{sGYeWKfKGr@wJhiNdlkkH z`lM0-NkF#0)Dsqd)^?Wv&QMV`s)!JnbJeS}3<3u~j4&bnoA+s&IPgUYCF9(i7?QTp z3@7&#KBI&dF8uMZB|ix0f3GX)WiO|+-lK^$oC*>bz=+yWC0xE+y0<}kWEF5&A{adkKo43L6FSZ~EBs@Zrt9s1F` zD5F9ysk(Z|ld=yv(cvNt&-LgHxUM<`MU19rqsgYQl6?C);-G??PD5Op03WVroh{O* zZ08Juwuyc#vJX0}>7d=OWLOOc^A<>)m&3bYL>f(sF_kYY0=?5|6{0}!1gAGiFgTuQ zP)+4gL?4UQ;T?h#`?-5SYFhi3twh#;Zh_VL0&1h!gvCMb;ezzzO?1&bKJd|ZMVo*3 zK@XMkdYm?+IdMVl4vP4f6y$_^2sYHay$4WM$e$S8_EgkfvsjJ-w{P!gBEx*nSV&F$ zrgX?^Tj(6Ry6f-?uhTtDG(?pwVH1?$(?@RI9^ag%$=g%pLUCRHI|AUMq zowq=O5m<15igP;*;qmtgJ@lL;ikH|*=J+e z=`b{6-w}WwH1E8&Z_>xM^(8ls(P3~%G^ot@0_Z@zz8{IlM-cap!Q%Vr&>T8ZB>(w< zYyY>7!paIrg;*Qh8R-8bn!#fe@Y|U5&!W;=xD}Yi6@0Yd8fQ8-3t1Jh!wq!$apD!* z&0cRk3Es}J$TnvG=yR_BWl>Lps9kTyDf~%hL-R#4gE9xdt>4C5F>`gRvm(Fr&QMN$ zoK)m*82vcjCWk^b^_;I9n{P7O4Eys}IV?}5+wwB| zJH>Dp6SQkij+FDxcFRa5y0e`T?dYJNIsATv8Ltduwy{DC-qt?JGF_PW?-*w!SEu9SPZxpc`&P!^{n35k{U8*vOP znI@cLsk-$zda2(Tb3R=shUAwudJM(o6Pv@*t`q1)vuoIcUpIz5?X-j!=>Q@bFO?SV zb3pv(H&*PuTEsqc^_vKEZ)?oIV-Omcoa3b}S5t^zs-8Z3OWpCWHU675q(aWQ{})#q zN0^9}v8x1}0S&go#PlsgwDl_`WGX=Ius?`IMOym`Zd~FmQUGJ#fCTPR1ZmiOron>w z7i=PUD}+ZHG>s$B@B9qS>b+3zH%Npl;Ns3XeHcGG{b$^!+WUX}Y^irwb1qQ{SC#%# zH5>q^s9s(oB=$$&{gsZ`U1Z_P;wYaI^!&$Qf$JYb09d}4^cqOoSN3!AtHpjp_CBpw zNuF)^bt5thXqE~T)<}&7Qvrza=O?HlNxV94rGSxe#AZ0C8fsNSX*ePM-?+p`4*N8j zT*rSpdT5{h5Nw&kiKaJ7fz8SqTkrMv(FIuKNH+d%)q_dntKVMBs zPYszq2yW1>yt$(4Y0R5nqy^Bw3K}Z{H1s0YLh9)s-ZgF>NJOOB9OlRnfs4E zU*Vh&sBocH9mTjeaecL~dm1y&H17{DI>nb0t%~pLx%0<8;wds%tSrtBf)yo9*Dbg9 zwvX~hJ0%J-8YM5;>~uzwP3+D()5QD zXbiTtQ2McrnNEDo8uF8FGtXd>nxZM?-L>{OkixmM4u`jzq4l=u?kjTwPcCcm%+2I_ z)?}Dn2JKStv^3$3Cv$3!hd)o-eTg5re9>*A^JvSHD2jh!At|2HfDf=MZ^67Xtsx={ zD`PqT`GJA($qMZlYK5FwrfKw9e@0gC z#d6BZ>&b$erN#u7u!#IF~;w;l2aqMDeC!`GnUq-sZBypH|9IH;exmqtms6 zw4|$Lg@*FGD-DJ7IeyG2vB(40FHX399)fi%u{KACjAA7ozyLY$Pe~T8u}Wz{Byv1e zAJzUzc4T>)GcTP0-5K|N-F0Er5hAF!BJ0?t?- zA-HSYIFnd5`*5$6>SY@@_Kuyq^)t%?_Om)3V22`G@J$(i;Nd!Yn}^$Z?p%3byYkjT zE_%X&*orzi-Ofk#>&lc_Ba6(U@8gn8sOtHXi^Yd!bKFjd5w2!Q5w|E zg82%MBcVL1IP%pb++4X`vJRY+Tp-reY7X)^d_#m)9EhvXCGUTXIbzW%vwZmC#REAF zgg#Tj;2d9VQb!G$ei3ZYuD-dh=xi;U+h{|KCd<_)`)chLA!0NEr7EF4Qsg2@SexY` zogw!#sfO#rtJ|X3;?w@#=?QyDLZG#}(QBxvoC=Yeq{4m=TrTVUYTlcsq|Xu1rkbT7JT5>HuA$Sy@{u z{N=p3cZ#ejBVk5cvXq(@I(LomV|j(GLxfWNeCTr?oL^6I@GtZ-^}lA|Dc~@C?W|h zor1JPgNnFW+@69ypy)fA2vy{_TY0 zAQ4|phrDnG-Jo=EYFI<{$v(;q(Qeu{^AeFdTi#5(x^7g1d~fHqxv`6ygr#)F|+CZM4g>08)RlNFb+p-IT_v}!w|C0nb>DTUx2lM1L0pcTqa;c}}39ou>L0P?c z;KyTG!D+sH1BlI)!4&trX}PiUvJrcVhTb4y2GyR!t;{5-Y?Xs3MVgeUKUlXAj_L4^ zw7%9c#lL*_e>FNGYH`i z@}KTjhUD(Y)fT|o&UmjVe=^EHeps>y$qH-uEZxS4GcwwBD$|Z;!;i&?Wa#062`*p^ zYY#0@I8STA<>X)X%c=WhgcrG*-dG{rtfsI2RdZ2{k5xq{hLpIrpujiz$&*8mhrOTD&HFTx_7ilmuzHJbo1Ee$Jeng4Y0e=$yT zj$U`*w(fu0bHZaSzMA;q^Yi?hFeN@}YboEdaiupLrUEhNg(5Zl=tvf#1|JpWM^ouB~I9gY;!UM8P@gF;| zRAui%X5G#;f&Lyw)CT|);j{VasKU+t_xLUyi#Ez4z=>^bqt;wRnD!NJI9AR3{>qNb zLZP;@0Fw6YSk1X;654haNPYJuh6c75i8s_JZUpkcE_<(`Tugm)``-d)ZLiNaB)sIh zkAN}<{$|EE!Dk*w=^yJm`*Y86Hw15fpMfGps~;{tfuLU**WW$+&rb|_1OnLe_Y13% zL+TH6yzsSW!n*}V;bpwfkh1NAq+7hf8ZNGh$xbA03-wQ)otSskDW&nWM_MowDeVnh zu~HNCXLE^uG<=ExfcPtRP9tblVh^sev(4-fbq4Qpl1Y0N|dMW53AyrwtcWc zCe?*H_}k3d4_sz}9csMi1}IHIOmkFg8lI2l+~@?w?3%<{Gu+v&mMupjHBar0j*$u~;liO| zPFuZ8*#r~)gcP-*_tH_hIE7d5x*=8t!MqF)FUWB(9!lDllX8c9!Lv5p>JQFDhhFe2 zP#|USkZg2W@^%v`!!cG(QR~?ZWzC%CN~>qkYI*F!eiDN=7~Bo!yr5`z-xRCDpm6ng z4h2sy9Osh2qU0DkdW#MV`~Gu)!i0WUkjK`tZ$8kN2RFN$K>vlv zs0~xSVGSG(TD|k#d;#^7&|TzoPB@<%N^u-Lc&Oxppw`lD#cX^1X=s)HQ^Tl z=i;M(oA@>|wWbiZWQq|p{VGKVklYWxq9lu^tSgB(`Kg^RJTnjKN5AUQMfU{k9*zX0`n!yI}{6)Y??yUUE7bARc1ijmb zC57=6Lq*ONhF-U}gDIYhjmKY@_Q+>dce*k*!^G2n^OAO zgy{7L{p%V3lN)G3xhR^HzNMi@jcFC&P2&5|-}+N_JZt6=H;TN_h@&ZG#Um7mR|^zq zUN!qU;u*(yV|AgvbTslpxu0#y)6-LWH~hnk!LI7Ld7#X4yGIm_x0xu4P=&d zzkaJo|C|WDu)r691-=;h-$mixVifAD+Ld|>xCH|Pm7Niu-OYB$4iClxtY-aO*%hi^%@Denq1@Fpg!?_kR@a(os5?M`6-1#KRF-?8b! zsx|s$jpJod1cQcM=A_e5S`l}-{}@}IF^BN6Jqh87;L-0?4%66XOt8z(>7DU7dsmwJ z3a|az*FCeel5>hr2~(d7oK%3##X1KeQEeht;-Qz+KB-o>AJ4f%g3Qj%y|$H>{36Oe zWwrF2cE4ebc@8|YNd33nDV;Z0eHdH>5?KxT6jHMg{2#jgJo3a;%XIcFO#T7|P1X?C zALhD|Az}LWfA`mkC+g1pP0Q}Ft749?3b5tf1GSp!%2w1&?Db~#gR$?RfsfxQ9#nob zI$^fqxsd?P^bPdr#M6aBon08o?K`;hWsNIwKnBl&dy0$D*Lf7ZKQCgbgu+Sqp{7W+ zid4ayX+4xX?tY2B-LEd3M#`M~pow^{CM+ozi<)56SD?|RgU#;@L$8jd;69N#a%=l> zl!pBzHk16FPF}R}hP6>N@FcmFWc$nn|D*eB;L;z_$BG)CAmyIcE9TN};!2l&(TZSm zLZWE$$lu<&3A%V^v9Weo@9BTYhMz^Qm7Q&rFP*#WE+xx;pM)F|LdwZ=lt|j+%H}fh zFA$bM_!=B5O@JG8_JYkcR)aH8%-L0td?C|EtE-hl4bYjQb`(5P91VA;K00AZOc2w1 zHGrT5`ruJO_p10Y9dNWtqjof&YgC5_l<16ozG~mNdpf+oLcpbGOoMbJW$b1A(&ibwnJ$ zQh}5+2h8Vyzis~kF#@3OpE*?)uO|l$j1s!NL@xyl>H|2egQrDKP}!TG(ae-`TEbF> z;GLgd^mr4+7q*{-1HtT0pl?aw$~Zt}b1WV6oo-yG(~)_ac2Xv`I&u8q)!s*g_Uz9G zM%tLoU{(cQYkv0zyT%ya8P?9)(8DPN!X%~3WSOt|stx|YhiH)g0XButeg6c$**yc7 zQkeqPV!elA!9~!mwCZW3oB}BPBr=FlAf|V8=1kp+1JLa&Qtm8yzwx~1V8Cz*{#y2- z9ckE3g%b1A$L2^VTUaG8#LPAnsUwY2FTHj!2v1stbA;Drl}kCX0C>O6PH`peXof2= zwzH1EI$q{R3;L_yQ-WNo=kx3=;pO#;b+!Q)xOXU?LzI(t1}H6()j>_^hPT?Tf;h|( zyb?6$j|t9X2t1$qyS|Hh9(Z(xcrBk~qey#C1xm@zRvA*bg>K9TQ(?r`-15xySzn>f z1BEriCRl(8bs~$8MiO|VkQaJ^7@Z2~Ji%xpKjgQw76kJghxwk8-NxwN!#PtpuCPmE zIlU<9m(k8rdnrd8x9;F1R~624g=xWvtJLEuN* z3WHXB=oEaEk{cet^J(XRWRr4^UwEbM)EvBz7p9*n=TC&Xm(7bK5$9E3nt`|t9OIZK z^}wP4G7W@tQy@+eUMeuISN-4|{VTAOLt#Wx&ss?2Xz^sUNFHC+nAKj9Wu=enzmq=v zZ}(I4J%v~M6Y3~-znt1z5^+4rn;YPilH;XykE^w9$8wHvy2LJO4`k$IlwB09>Urb8 zW7?GYfAbrA!57Z@jF24dvCK}g zY!qU=(nNA9{_bQizb>Oh;`B?Lf0ev)+(+uD^Du^jo7t16UmXkkyt-r$+JmH9!n4rd zpOYk*2G6!IAuQcizsgjNYJNs?<1p{SgjhjN4 z@XyYiRu(iWI_%Wb8{O?1ykUtf$b1r=0fQ*ohQcPTltc^usa7yI8LP9Rh#YFlvNIES zMglcZYJyU*0euAGDF{04*w|w;LEJZSm6zDo98^?@z+N_#Yx`{QlCb72U~y+ntr*bv zh>ww@6^{V;t60-9vYgZ{9LR#S}KecCoslC=-ECV90E$<+OJ6cWV@q14IGl^bWZX7q z?DW$eOa)Ow9bLOcMg?Y#QjGk5eUldhJ`~Pd!|#7(LxJ`#{qZH(xa552T^azt@j(~O z-+?LE-F_^G7bZ!){m@-L72aN!Wr)d9C8{Ay=TZk(7LlvCsM@SWWMPpZW@6h+*;h~8 zg}`LrDj0!r{(+s#e=i%}c`hSfa*$Recc>80BU{}(jh@rS#Z5(j- zoB4$F4adhZ|33Ic#>YN8$2N((km6IBRh(97cWKxd>#4ugyXISd-Kfbfp z z*96No!y^n!LB#kgh^uztP#kf?tzg7j@UK5CXTP-u0J{uP;dtWs5w$8VFuiW&prKdo zAowVX?UP4&lFuxsk#j;rRl8BD19>SPKUUWJzodoXD&XMytO#&h(WH|z5EuE9x(;{@!O?Rt+UVS8YgLnd z#JPX(uGV-{Vs}CtG9&)fx^OQ62$Z1oBR9nG?(^K{Hl&w#(1SIsO!_4gnOH zR-$-oNu&w)RK6McBrp@H_WRZLim9mAZkc-5G24H^cEN zWF<#=sW|2-$sdhjBwO5vtJax196@vk!tMfj99jJk=dd&mjF=fgXhweNUmwmdtQz1` z`O&o`&#gRUtb}p!dhvccHrX{i*4kxLBE5sWn4NBDa1OJ9T+}1P!|I*DYk@9uvtK7a z-QM%Q&@0hQ*IFfR_+%clloj(`n<1enhmoNz$r}_*3|WqJ9vhrw=j#LRq(#W=1R?ibOuf*o9hkG(zCfRO1#<( zo;Mj+W{69rgx`O^C1~V8p;Xbfjy;SVm~idWL_vRsSJXebAOf1fOnKctDupqKZFG<9 ze*Agv`6&_^02p!r)Az0}bRNzt{J3{%Xa&6UULD*Jw;%TL3m^6OOmz%-&emMLn5zJe zwdAdJ1p*{qiz$GGc{4^$?jO#PisnldCsv<04c(MhL#!7LbFh6aDVNKwLvKS{Kr9ki zra8ccW32{vU$ghhi3z)y#~5XLe$2hjdUbj`wM|#|5934`-OnJeP+xV%rq14?fM_rg z?hCSZEeyq^-))T4t4&v?Ct8NGn888WzIa#9Wy^S+DkO>%&pRP~qrJipkNw;$BmMiG zaz6%s3v3e0QhuQU=RE{OFXr2r*8N1ST?DX5yam+oKcaz9_7rZefARBl=i-~#yR43x zQCs#HdKW>lu6Qrbgk`LY;eu6X>as+_g-4)V*S-;_T{M^9_Sr5xYCGYT06- zg1038D%|8_4@lf)L1J-=V*l6q6NK*u8@{>dz|JZA<591LfHf@TN>A+@^PY2_)m^jp zTFlX<()aZVG~4Fd?fUj4CMMb!3dD?E3)Hhx$8n(An5ZI(n%y=A;S%T@XY(EPFZ%)k z?`d|(_NK50;nq0KX^$z1*p9p1Era)~UjN%U~hPu<|0hXdrMr%6FQh9|C<7|hJ(7yh$(qOs zg%T}L&&%jvAsn>`yH(1ogMcHpH7%jYLhjUxWUEP~SuoZxCFyh(O%9r8)#&Jm3e>r% zVcU43Dr3JmdvFHZj+k;Vpxk+lj@q8Rw(+Q1DY!}VCndY4?h=l1o4Xj^M__&pvJMwC z-{3V)|3;*O5SjU!KT|^-q_+%ViZI00QDJ;Rwmq}K8O93x`{hn;VafQM6yYSBiewqm zl}ynUcFXFIdK-!KA_mO7%HR)cd=Ca0V;Y6qQ~G<%_uWd{W)QFTzzUdT&_RV2Kp&tp z0W%Dp_V}ZZ-z#-`;4h$JhknBFOFmb?*Js{;kdw}DJA7JBr2qIW$%PxuFTL(S@LQ4K zH;wCe9x!P-{)9|bF|5RQ1uJu3W<;;?{-$Uo16dQ65haHLz z9=dZ4E9p<~c#xY8^gH}&dR6{0o|Pxy&gHuT^iNTsl3>ZaI8KuJd+@ACdqMr4zM?6? z{jKk5d=Yjrd8j<}5ACOb+1R^i)85o1M=kU8&b;Luxp-CK;4`15Rn_Mi(%yB@nus)qqP&Vi1R$$$Mj|&&a^TM^9-FsW@2KDG8!}W?lIL*NN3m!2th^|N%3>zQwE^I|^BFW>=&tX*0y z{ta%d(qp?CUP6LuRtJi}caeUwzMrv=@gKOW?h+lCWN-1zcMXzM0`|=f-pwW}6sVi1 zZaB+XwC&%}Dli6&5AI+?t*AazrQdfP6HgB#KUOh~?}}wSk0u*x#SGMX`0OUHp;(=z zOf)*@~mTwXE2pIPkypv6rnp&wtVGciz+g zw_kTS7PBIJjm1%ZcCYisq|clT4mS71ppt#9RzubvlX-;ftmt+&TLL#ftSJr%+~Z-` zj@j1<_6<1V{?l6)Ih?OMsTV}BZW!){-k7>qC_hejguJ7C`WU?vh9|t;4jyxB-*C*% zfndkigsoZfUE_Wce2j%OZ(!dFDqzgx0&N-0$|8l?@B+=_B!osx=$ReNRT;Kj`^` zfu27Bl3Xq<6c=P^_-PHC_?iMpl!Q`S4{cwIe#9+=`c)>$H;d?-;AV8}eY`itgo1tT zCY)2Lot2Rzz4ZIND}E&4eam<33wYRK98~Zjm%kotBx`hoDJ{CvS1tA4e-l($8jjwh z)Ef6eNB5V}5e;+?q5;!EBjB(;bx$e_ao`{s@C>EE??yx)i#tLyu%r?G2k4J12VQOltyc(63T)t zh%gO^Zp-Quw`Cstgb967Ns)@5f7YGchuS^&;mK>HM@KL2za5|*y0#!HuAdR5RA>r8 znv);%oI5DYGyE`QKIOuIKXmoaTL z|00m!&L8kbw2NqB@6V%8az0|1(iT7gZz#7ZF9Lwd8^XiM@@9WHoEPvuXSeBebAfXb zk0#>vD%i-UGuzFnA^qx$>@t zT@wx7-hN4c0NE@@s?>$uom@KIkRA&eN5Ime$yBPMMM@HPVy~fv1U&n%bRT9=9W8(i zBJJE@ZF9yE1Wh(rh-l07zG)K8r!kmBLN)m~xS*CaRO&SLV$tS!DHYzN=2UAhK8YIq z76$)iEa#3MrUI@8iXk!n?C1NEMEi@XwJ6;za=$&4rR~*qn&0lRq_DJ!GaTEa(JRRM zmm#x1**)%UZkKKYI=`QQc+e<2dWFu zwSHD~y}H5gF&4fxDN$+Q(arddSI0){!Z9k?2buTWUf4D3jgZ48^V$jTILt8Xd5izV z+PEzHbVfiQW$Spsbc5ubTo5o&aIe!?Tw*581P#35o{p^|QlX-5;;(fnsX5kn9V%3u zPUl=#xI764B&L+)&xqz_*9I3^lAb3T^;T?@9*I~1(J}kAfHc;0V}Mp*Jho$8)wK!r zn)sU(Asr(1lKs(XoJ%l56kjcFV&k%R&cQ2Yl9nxlG9)g>L=@joiZ#h7CF4beeh7}z zN0Wo);`!h?CDPN8i^n33W!*Th2>sz5<Mr5Q6W2|E}l^`B~RvqpOicz>xW zfUtQM!#*O@lluKbz&nxLjFKNDXnVZ;;G@sc&X}zzKEv4?DPzRdMSEM#hQcx($i9=T zGiB~a0zR>Lr&B<{trSnb%(-Ky;E%a(F(+Tx-cD%A#C7@;&jr5OKKm{lBh#=9#GnEB zh02L?p;{QT_sOsIfHOtvvT!twg7GLhB^hr>Zy>xmYd%DQh}^l{{+BHQk_rsTa4iW1 zm;!WvfSRX$YU4BD0F)3fgRo2#Nx(7!rGrd=dUP~fDUbX(Bz{FRp|Lc&FIdFNT*KJs z56xKD3YSR00quK3wZ0Wql38&2io(2-CykwwL1aXI_sk| zJi{NifHCthVjW=vgNY=*VS<7Ao4n)=G z=Vjj#n)_mtf3Jy@z4xO7p5+e{dI&k=AU%atoI+avyYQ_xkcn4pUIL*-z3A0()Qpy7t`nUKJ@$>7W$!Eh zbN^MjQ<|oyG-vW`#Q>R_X%8I^8vG`NFSj1&5{VqJ%)+$QztxFdL3ql)bM1>++ z9Freo{mD@ca6{1=I3iQ+bWerg#5p%$Ktc5$>uTULhV$y!@|q1eAbME7ExLSJDy0=6 zJVs2Pb9uXM)W4mga}gB2Q(?RK6b7m%z^j-h!jE17UH^ZsNVx zT4tmKz7jC(#PQbGTa2}ZKXU5ZEpihQ<_&Kz`oIAXzp3@wG&JHsaoq#z!amlK9&3dP z&XIIN9}%1uFp-`;&JB;@cw}oIj9*UkJm^h9Q7}d%cI3B%C!^mcv~@E%N+QS$pNOEz zOA%$4!!|cRvgvX;h!K3i_+P?p9RFmWl@X%tv}RXmk?eo~nom73hPEcPG$r9NvtQaj zMCXDpANuH+^M#~WNzOq9N8+J00$*@_xKdHYb&amV0Bl@gOU%1Q^F8n(fz)%(Qj7SU zI$G?*$v>^>mimro*n!>M9-!8jOv5l8D^1hr_wBB9ovwTF@F}sgrhJG;Of7gKq368z zja~jc{`GCP06Vow=@Z;Q2 zU|wx#6919s7)Ku@gw3>MOZ(ed{~A0X#;&l#(V&tarxa|hCnz!5T_Pp-XVhhocmCER zm4rd&6n=;oLWYkB9nE}uxCAhNrfAps&d>K4Mi1adp+{iBCf#R=DU_? ziV#X_8*{`EJe7$pv9ZQ_Z9WL60QM6If5EN4&i)Lh{wxgG&Bb;GG;QbFCY9Mm*43hQ z>suSmc*@#Go?eyU!CtIy1U8yd{SA&g7BFm?i)?`XMa*Pb)u?jGv)8{Tz@lO?aep{* z4-kvLX2Nt~4QN=rXrB6=g7@e#M)st*!tr;6O@N-l`4LX8=4o}B?|=d&s8P0%8s+wz zz&aFSn)O(kbC8&tBRtnccUn6x>QwzbYPJx4sGgo6oFZXN8d!Ke;O-wI@4Q@>d(It~ z)-*S}(tQtL_YlRIc;ZsNm|YH`Gz-r2r?9S5Y-llLu2CT?5(HTSu>z zDeD+_j!^g-Ae!!I9ML9OeX43QD9zzobx>@QyfrbC-&|yD)S^{u+zR?ZvKM~tZJO)V zP58HHFM;fD^CEZD>w#8yJZ|x7+K#R1)LZJG!KbGCE&NH?WD&;lO1lJ;?x}*3X8t=@ z0RZIs6W|8Ws!whzA}qm!)0^RKcqW?R_ClHT4{RIG(i_&6Yj?6mKteVq!G%vgrg7IX zD4cyG@$^%>8*-q8B|z3Y$W*}lvYxD0(KPBdRznD{kKUM_jqs_291ZS~Ytrsg07s~1MT0i!emzMjE|Faf87BEDq#Rz?#PUvSLg4TOn+YfsS^-5z_EGBXr@Uf*6~-hq#dnD zOMy)leRTrZ5@~TQz_p{7K9w(&aDKtB^Mb0Zvxr}k4$RO%%lN?qZv8(ve!fYaF1v{3 z)wBGE43hGNFLr9_x*98IZH6R<)L}3Nh z(Ru?R4>}oH-AK_hUrT0bCu#lHU|a`jQl3uRV;^GGr(O3)aJ;>l^Jf0=M;x7?FCrJ3Sw05|kOyEt9(I8Jo6d7-c_T zOoTEFit@Spz$Z$N{2Sf7rfVbsN0_5d=S0v$uMWyeo>E3sY74L`@p>R$(GgYhyfQIW zIf3}TQ#R!d^;%Px7q(CU#!X_C)@E%Z%BLoIv9)?QnjzmGrlIML-0{fgUTY&_FEGIP z2Z_T&WTYvb*t${Nm=TZxuhiRUVO4u|_*v4BGFSqAhJwjw0jM$?wJsFPy}VGKyapw8 zGa`m2cPC`DI)Sv&_xz9yrJTS)>bIoQvOKX?QRb^qR{;YmG-pAAk6^YPwSSipJ~=CT zG$XCrMHZVp2@&PCmT<-N8i6){FW5>tN95jBzbPk}^dHyQs5_J36lnP3<~bVJ!QXK?jhjW3wCFvMk% zW&(;XtFmpl|EnLe4qbisS8uZ3muC6_svm>%iK!RSzLG@scya0$^DHt;|^r!=p5uXe4Ngl@JvclA&Tbe z88;b~wqG;~pX<1=b4VCbwJ;l7d6t27@Kqbci9K*I@aBEZ-uXzLFD*TmCnb^?{}r^j z6||kVAj{V*H7fmS6vN#x)=D$JBy4Oe`~j;Evs>slm&u!!2xA!zif<}vC)nd4TRy&S zP)YXi>(>B+7(`y*+4r`}u2=PiYt$OVpcj|5aQ`M`Bfb3c(h>Vn zny%RcjwHdeF{pWTa~z&gW<@gsLmUpH`yb(>iN2_57IpIXfDku%L{c5RIdHEat|rmM zj_H8F%bJU5PWsS+&nrUk1y7TK9CI>uB_r!)sEYeFgmL2(ve)EjeE9H$z1&yDec16w z`Do(4mRXgQ4}kP2qrfnfpmraTIRHXE@+{6i7l{uB>N}Fd(Uq&BH+IbTf3Efy z9ViymgRry2+19#I_YVdOeXWS^>>+rR7E}MBBnn8CVDQ+oC8LNVl`UmBFhPHnu+{Fk zGk9b%3g_xA8CxJR=$*ElyM}99dS*OJae5byas43@@FoHhr{JcW#n)3mM^#p3Rw*&ffx91_|LVNz zp^&Sq7aRqD^}z61;NyYoytXhny3*@Bovn5KBvyhcdz&tEb5J%7@53)O0#8>H-Y|-4 z=3N~KW~>DK?PWubKR@*g@Fe)Mht&7cbe#A^OKen%%_r^hLUVz_nSBKR~&I1cV^EurV=7{OQ_4c6qKG2|Sgsa&pDy0+jgzkHPS zoSd+?FJn^RLIQT{GvRaPbbx6Sm^>56ciuzhiN3~tC<67FZi)=!KOoAfcYi>M^yI>~ zt8~Y{ClOT-sTgXZ7F`RHebsS2l8%t+jtPn1h}O6cwNQJczvco-=I(uy4B|Ee2EQp- zaUm8{qa7NkLPg8?uDR)V`;6$q9%k-prn`*V$(~~QcZ1}c$zop+4%w2f)`kD?Z!VQIR zH)QnHt_Ht_x@L$i<`d7+rJ{t1o@*7qWZO^s_Z#L zFz==hTQa)yFEC7Rhi7QYSq*y)xv z1ScwwPxww)o1W4fQhfg5iLXis4hYuzj!?=d>UKvK zJoAI&IS1RkgZK;Ij|9DeHSZ>kC%G5zqc5<*WMP}7;hk0@M3{w})s;|#h zjSQ)%d+m5Hdr48T2H$-(DFH9~AbC0rXnnp1x%O>$-{nXK(cG7I4(}zzx;l_xd6>u< zrS2GI1=(b4HpV1^h_8aP;C_!9A>8=FcLaDSEbc^h`etd`t*=}p8uM71C zpZ1~cCw?a#RfMLOkXpPWA>qQwzU&P$0ps00>FW36>>u1bniCUl*Pji^5qwYExY(p< zg$Xt@j9aS+_?2q{JaqV^ahc$ztM!&EYdv9$c;2QJ*#UnrfY1J6Ze&8HTlxCW!V`1YX0ymQxW5Oq$Co6L179!g$D+eX^%eETHS?7X6T9S5vbe8 zn10wXEu^m}Htek@%R0=SC9Ifmj5uxOe4cs!pDi)7CX5^FbFz0@T(-R7>H&0ulA&CI z8bhffwT{lyd4Lj$reXFS6VFrukEJV*%sagvpzB2iyQ$C-%%5^eI#j)utvDY=iq+b|(hn{Xxf4bTxg)+=_)yM{9yniorkd-b?S zR%zww!Q^fD`^{&h=)Gq4TjdRd$-ldcE@&ST>pl=OEvml_~@Otm_9?*8TpKa)mT(i@b(bt52^w6TJ>7W$(1Q-y& zcMK4cqji0mZYL1h`SWwlsSGSIfZ#y_2XB~z6Mn(Il=hF=_VvS(K++YGOn&|C0-6(k z*B-?b*Go_)AN+USeVu z1=+C=;UcMVb}rGU*|$G0cANDdaL$!WOFP&@R@z+kS}U1aMI zK4cD;LGYPiWrBpA0npZ32Nbq(Oh9Ry&j6KewSK5==a}Gt?Vdojz28MN+usRvJJK0U zJJoww_OS0s>`Q;K*x&x;;h;z0=~PcokY~F!N&a9=Nb}7J>HhptWB@|M35FPk+D~@b zu2{D}8)TWK1ozVEfB$^+`?`}ofbB!O{=VqjCk8^X4c2P|Hq?<$E&;i=j|`R=(Nn5Z zB%I)6ykN#XLsjRk{$Mw2$Sda(x2H>aVtqNYoY21#XHvf z4)WH^Z@1a2O8GZ(4W+u5NZsPqFMxr&i(`bAw=7kATV;&<+rM=PbmI zTMK5uS=_GitBh@ryNhpc`kLH6^edJ9=r4{AdN>v*JqmYcczQftCQn2d5He5;z7iZY zj==8_lu?W!+5W6tIYkNy$mkntD=UIg>EHkKSN=888~-16?0->u_3tk|y9~y?3l6Kb z|H(hrq~GtmZ0j3xrLSd6zfg~G_D1ZJpa;FcpjW|gMlh0d2_%tf{;!}@o$g#0dcP04 z*I)g+021NRp25^7-r2i*Z|{TF@CF%+&bm8M<7*P>AOO*YBdd|%3h)G?HXGsbc&c#o za%z`RqYAUi6jvuwSjaplN+(&D{q^^dc*jQczc1P@Ig1 zlI(=AhN}0+8!EL^a*I1^z~pje_SSWA0y07%G|f=3C$sSGng*>vgQ0Q^RuY478-Ce! zw=8>QYTtD5M@*WhB^d@)LLWW5q+Kr`busl-brMec?aT*IVs~`22&DZoWf;tN)La0a z3_30q@o-ZKrX)(aVAgdB?`Hx53iw)B#G4=$#gmV=FI)v8(>$eFhV!0uun|%XAP-|5{+lmPd5BUP^`WV^ri~b3E>7-`-q+Pv>=egCUEwmy-@$9hV!nk!W*UnJ#uVubv zTmwbWWUABKQ6VT0kDx&J;a-f?JA9zI@dl87;`Fa3l6xEfb0 zd(Hv*4CS@VEL2JuQx*};kWEoAOqHDw+{krAJ5qoE^1`4Rx$v8O3J^YI>cnWT0^lp zOG|zHN0Cmsn=|d5#_>}L1tXpuV~4B8(?4y4mZ(|9C$5sNb=4i2sTn!#3Th2@=cd>z zmhl6{UBNQBn=V1`?QkV(xspAa)^*04R+V*jrL9kv zBg@fY_;YnarIwT6wIhKxmp~ki(^B{C2C{Y`HdKUpu%sRu1~VT{1F?9hm^f_Ln9?6c zo7lqGahUfWJC$(`)?KpU`lB=5dSLnS%ZnKa=9Te8${;HsPJ&s3Z~@LPf;A)uC|1!N z!Lp2F1bYBRYuhq zQ)gU*qnb=;aZH;@9j0_S(Bp(YtA?C47QtxJJ2l5z02>zBvc!yKwyk82RclA@x(#`o zVAd9=Y%^^~(O-_f()Vpg$+&uV=B>B!{=>8rhr#0GKjH^}0^k4X2uG^PGRDUS{bmGk ziAYlfL#s3>xf~T?VhE|Ll8;L9$2fQ{p6nf)Z6vYQgD+v9cD`|II>@CIp%XPsmd2I#gRa1Fz{7n~kpEHiE!78Vl7yzc9C16CrjR&`kGFx! zxZv6S-a=56TAWj39-YWwLnEIg!C!UPmh@e{(dm2~pLVu(_SkFwL#r6hX_0 zR3+m#o|;EzAOv7DjPq5E!-U@=_DD;j(PMg2gw>A?e66}kL}pQIu6o=G{*4US`F%&M zw&1o>Xgu>|+n!Q->Ct$!lI44D)6R7qw&iJQm0xz<<0b{#$t>Hbc53MC2vGItqh^m0 zz}@uf@$T_0UCTPR5GTwIIyx!eo|sh|Nh|Q<<$Ql_gGrP-)a$s^r*Fcp=B)$OZ1c-g zbtfbF7Vg*ndSdnRIE2o=#SaWWuFR~hp~;8hRbIavAVH5Kxw?AlW@7Sb@~?>2$(jP) zkWK3nr&LMuFelmF`D<;Pd@74KfS-KytZI3tcdC}OQi!A!UiMDI7>7>ixXVjNa$KOp z6L9WmZmTyYM>wWN?5(*|JPb!>GG{Lzj_U+49a+93iRlauUkX6iI|kW`5M^~NE*&gs z>yS}MRi(F(u?S`q&MbmaBr_<6(M(_(L$kf1zJC)h6WiLWGIlKLW2wq zG6IAUhK>k4L}7se2N)D$u#tj~IBX=4+}K76#>Oc)NF#$ROyuB#0Sp8*FyO#|D-C|? z1C9l)qf4Cz#=sUx2ZMKtDL|LTVAa;P${n$9of|;=B9qGtZ#mOr@1q!pd5-DbWLNEj z?+N3mR$4cHTIwOOe`SK!5Gb^1Z!cL?$h(6e8XtL>^Lw+y)!>7jky-1>3?c?*F}MuX z-^g)XKU{SIU5-HP32+2o>P8WB?XQWdMOxw5S@QPH81o>zZwhR(GLw1P_nu+151!0_ zJ$KkSO~9kX@g6kQ+-~{J7>k;UTiP(%b93&V#7f&tyW%j9@g^wjSfwS8NjGb1&vTD< z$cyqU=zU8&4rgM^q1d^KA;Xd57*p=SHz^R(cfuZCfnWOLX|%Zd zVMcdaI8Nd+U}QUV@@b4>c9S~iEah7hc|(hEN3PPa_=|Z_V^YOm<`ofmAdmtA4lzI# zOS?+s90Vw!fdU#RAVC2YG*CbT1zOORA>_)GaInBusdy_S+mL|=J~-fRo(CS3$`@?# zp@a%*2vjK55J3YeAiw~D0s{&RAQ-x0An3jd2t}1rsTv6~!7vzuxH5zn!}u^l0OJHJ ztz@NWi70Pf@0pFsAIVgS5R#aQf}G(uaECoyrh*)tiPYx<1RRzhbGH@)u3-9-D{i=L z+fgBfuGsXotu*bvSFZRbek06t-IYq68@!yNl@DFI;Yxedbh}$#MPqBmOJ97W!F;+^ z-fZJ}Z_p;%oNQxp3{c zI!$O$PLXVoDlp%IzzSIs=qCZvFd;KiU_BDYLm86}>GEi(z$%X?;X&_}u2#4Dez8~n%x`jT;Brf^69EUY3!Bh0vutQ=W5NAmwPjks zc#PQJJX+H&>T_GBkXkOunw;$%mXu`TfTtw%KR|cXZx>TwIO3p4o9+SzRFOcCDt#k) z*;;2$oArFw>6GC~QPBmF)!}p@eQhBY$|5&rAL9um7jH~}v6k=~JVE{_LokNe?{?L$ z*$rUo?n#E?R%|bp@COL+d71lwy$Oi|tV(~Pg9DM-R=YX7ll54yb&+mQ_48ZikN3$w zZJV`Qi$B{J9kijgT8Hnn)3S9-XDsX}+IZST9-T}IIkaweQ-1$H{fDf$%;lcx z=GniW zidAdYy*d{H6^qV;bP=ztL%zyxM+fhf=hVLWi?k9byr`F&|+=YF74OFtmQ$TXLp74V?O8q{K}u2 z0q}o3j3@9kp2hRXi9AG6)I~!yK?}4-M|44V^hQ4n#%#>PBFwH*VV#C(##SEPLJKFJ zNAVR4I79SsBQOVFNP#@K2#v#D=MSzIhF~6+U=<#~8~6Zn{EOg#1acT*g(rLvgix5m z32yL4IEoO21Z1M}VztToFoZECb75&Cv=S&>7v( z3w<#VvoIG6hcNmDg|TIC_(dlu?x!2vB>c_cx#A%K65jY`)wXyzTns=VLQRj5X{(t! zt9stqt^Uy>G*Q#FSSz(boAt7G>Vs_OSr?wgv=kp>gLG(ppz0rP*%dTr7c?a+tW>dQTXK7cf2rO-$!5sF5P*Zobe zyLh|ORs7bdi>B!Mc}a05*SbPV#MzUb6>1>>f*=%Pi5xH%((lq&TGF*)4R8zEp$mFo z^!>rkz#J^X3arCjxDT7K1yA4^?7$wpg7+YU3$)Qm9tad{*o^ID6NC^$Mm9qSC%D|b zud)!RK%GA*eKHTyVF4>LFWHJpc)<@r2qp7lB;sI5zJyL#!Wy=)hYQ@`0UDhz`SSIF z(;JCs#3O^ff6hML{}8%V0w18*a6{Lp+>fJb~dUf3|ygjPsJT>ZD&eO;}XzB~8wdCh-Pdr}&Svof=N*nup_3U*Apz)Ap`N&Q!y=+s)lEoBnOvLYe4W8$vE2yudK`5AZYaYB~*PeZ+fR0W+aq7%D z(D>h57r)vIEDkZ#SP^?;4B#V!{uuJ_3E?_Jvws||T=;&=*PK6Yx06e}Q$Y9dC?Oem zZ@Aph`-!NcYPw-sHUr^b{y+WYZzli{1co@fxI$rY1QLbDU~zZ?kwm6YX>^QJk-NH+#{ZPaFa)SB7U+-JgKvt<6P%C z-vusok&9ho9*`tt{XDcNxoqu2vfdRV8~EhLkdHhZ>;}(reU1@;X64O?HyB6-S|Jg zFP32z+M)omAtTaZ)kMZ3S`Z5Z$iNj=P=idML2gW|aPb59z!p-7V&Df6sxrd1md^j- zO&ynSN+P$A20R;;5ZuDSp+s;Sl#XVR&KpVO)L#Fv%ovAs(6tk2B1r&&FnSMTSnV zf;i&VAR+ll&cU80@qbVKL6k*9CBOHv#1oD`p15Gb0R%oe$H-rMC==f+NO=d4T4^AT*6g@M` z$#v5ow3b8p(9yDm%jo83VYpyaO;2IzEl2R?(r_-0o-OX{uj@V17QHfrFQ#Gd>SAkR z-5ncO{vchP#gndas1VqVKkP_{^??2xf3X#*FGa=^-7}QCAyVN;hZa+si#mmABD?dA zt$b};*xhK5)S8-bPj+jPdIAfQ5cHDsn8eY1wyvd9kkQ99m%Rk;X8({GbR+p+Itz%C?n=EyyHc?Rrg|Obdmd3u1%^jOFHhXN=*i6irPlY=c z9FPsC)AOtegs-+S4hJ3$aH)qw9c&$(*gJ_t&Ig`YH7U~ws6|2zVyY2Qg^)@Fy3{FE zq>Jf7D%V!{qN^qY`caJ>O8=z5Zco7%Qj@7@aDaBP6{ZSrnh>2RA(U8T#DDpNxkDan z7NeMOlH+E+z$DrtOU&8Lx9>T@8aUSKIm()C)TvGG!LfjV{p}}51LKYg8t;;~?(s%$ z4*VHoykk40l_ElzBKWqn)*dsgb_+?ta>Dmb3BTSKm56-0$l&_^{Qs^^8_a@+yl%St$wq>qkvl zQBGPyRM)`%=%<>>;@tGa=+K_p^hVR#%F<*>-R=wVe}#x67xEY+oIk#)+ypEN4&m(N zH$SN5LN*nT1OvQdX{;7l9P*fjm#)z?8?>fzrxs@Z`eiZcHARacB`+c1TAF8S`NO(#y#3JGR@lE9>U{P=gXD7e;K`j?b|6h@POT{C>0Pk2Ds|6N^ zJob&}tK|~k6q3Rm8i?`B7ds0h9W@0h5k9ugUdm^Zv2dVQ-ZD4T=V=u1(5W-E3cmjH zXS<$wXv2~jV+ODrTk$G3Vl`gCBFw=wOu#4%MSt`}XS78NG(sIzLj{yV5#&P-WWrN; z6#vHqST&OI4s#nA==zgr*RZoc8pQ!6+#$TNBDubjbS*4u}72QV(e zMQWU-${8w*QRW~e4p3x21@@3;8;HjAB4VUm#oa0c=@J$amtTuw_4 zry-kDlf|jX%jc``NSO}c~80-Q9Kms3l&pYva-g?m+zQyw?j(7j_>OY?S%cFm|_cym*v-OH= zFS+!BbI)0O#;K<)Jz?%KQ;#_Ikg*30-KXy!U3WQjhql`^-J$zk@ z+GUb15qFWO3xu5~=p24$@j8QhPUGO7!nVR5JfLqFpfzo{?wYHvShi%*f_Zah&6qZ2@;?D)KJViK($Ck&+so6#-Obg-*~!tt z-p+RD+q)Cw^L7W&-B7_MM zB!C|uUOc#Q;l#$m#6U+wML|YFM1Y5bg@J~Gga8Kv9sh;ah(+_LeYvr*vM@6-GSJiU zprxS(2e1b_umu~i1}m@x3or*WFa;AZ1|vQWHWnrZIvOepG7=&JJRB?q^5n>pAx(-T z3F5?v5+O{8AOZaN@Z!OZ3nw-fCI&hhDhe_ZA_6=dEDSUhBm_7Z=;vOYA9%1K*b*(J z$11Dq5p99Y=A&4>J5~IP$p{dTiV_VL)lRWpmQ7b^57?XS zvm|b-ujaq}K`my`j?k;aJw`anvGll=Ghwux6gy=^PFLxSRWNIX%!THK1ugC@v3&cA z@o?1?xn_=BwiZkiXjmfbTU?&RrR&EcUDx$pT0`r1SD;E_GHOrD6Io;>3@FWAwm z9c2wE71g|HMTRACBlLo`&wTBrhvry?H7cpWdsH&KaNq_~@&qN2P0M3?2kWo}6EF?y@EqR2XXx`az7dtEMLinP2OBYuHPrZt zpMv$K!5lH`=D;kQd*-2eWPVu4QY_0#tjfN!eyF%cb{@gm^$uIRoLcB^THEw|Ti$N+>i&HB`Tjoi(t7>$`r+B=)&KxvpBAh^iPfw|)$6dnYEo}?UzgQh zO?A6&)>S}kwc1tNYJ1JE39aF`o~4yW>N!X?mCWUAUgdta<(=HT`1JkQ?ZtPC;bz2* zmwnVtz#msS+mHLBescG=?^pYUe$rozWBp*?*VoQp&e?n}r_N8zch23TTVhQ(2_ya! zTX8tH#D+q*&?z`KiDwJ!P2!+%*1BSq*6vssJ&m3-j^{rIqO3nVk-wZjmml?i{F{B5 zch1u|EvM!bohToR;z-U(DoD_BCpLE_XL88T-fZqzZjWQJ-`f@2Y3ouKyn zx=8Pr=;Ex{`D@F>f2JUHD)oh^5xF8u_$o-ku>Q!eEfanxOl?2b&eK}e`gi`%5SZ`s zC=anCyQxVhh(vZW(SJx5-xVK!Trf1j{$L6Fu^l5=g)#K{ zKl_P(AN&dr;6B`i2`B~9-};TdqsMilF4vc<)oMs(tN$pO5{Dm!!@_?HoeWilYC;yT zMP|!B*(q<5&e9}VF{xc0;y;(yef13lx8RstVnp4 zjL5WP3jfPv=AC&{-jKVJuFbwVHJNzjm^7cBOFxun#)EicYBn{Rx{w-7J(l(KhxXGd zU5armHEEMNi4q#L{!}2KZU_iHr54T8N}qUcjb-%n-QGSj`o55kggt3l%6&kY2sFpz zJ)@2IaF9evBFO^}rUlLd3C=H+Vkwu4QUNbhpN&TKDyXii)yvgg%CWP%4}Uj$W&Rrj z+aqu1&cWHWB0MI4{?_-m(>IK+2V6NPBR(bJ&2rSHqWjOYYv=PX`laqF=NAA-4+>=v zA+18F3HaCvj;6(dx7cJF7JfUMJjd2Nbdp4<1Y!wgX7RA5tnpWPYASv*tJIJI=A`lX zqR1E0v4v)#YKs}!Jl&ol4@es zWiY7+MxEi#e@5_{Q<{!kH^U?aC?zR4mdrI%CgbcAnQl}=&z5pV+q&*sgM8&A6QR@Z z^Ir)K*xEoR3#!%*tU*!92rQCHN9?OL4|h2d+jZEg;lX|^-vL7ia><=9&!&D_kFAB1 zWsHc_6hc9WB|_7*LyTlBOWf4`LU$k&`jREmN}B5F{}MIhUk^eTOyV&8eJ2W-scI&qq>+Hv#~o`VlJ~7Z77sofuH4f~YEw zzB`%@Isp}VQ9t1BpU9r`Kbb?LEc9ef3+H{Trp1V{I)f2R(R`yV z>uPj;oR6T#Z65g0^&1C7i30=%w+DhYyRAOLh`>(W$AJex@WAN;+r!bb6Ttw4mYxIy z2Jr{nwB%=JO8Pjy@o5bStL8((b3uI|5>E~XRp_Qa(?}9ubzKNO$J64H;cI2A@n$?KY&9TY*zXY-mU0)#*!NOtQ;@QKNY;dcscNs6tqI=qbz z#kL9Kv08(uaM;fl*yi;1%Ow_2hEh7LA}{WRh2#0nx9hdNqhwm?6%J++!s&Kh%M))B z+T#GPp`vgWiGx~N@WgchYsy8GwK@XI>IHKS8C(!b=I{Ymr^SJX(i1x1??Im}t*nf2 zv@t}M9Y2!KmW-j4 zy0caDSxASjV?0@*CCjhD8f``p3hk6+tm~B%(z16wHH6R2RgRjn8sE+pKsCMITEo2L z3qK1y=LJvaiBI!hppF(^IBLroFijdq^<-=B9m$XzfL5PW>|Gpkcag~l_9}O&NX4Xc z(f0fF*tP?bG$BcHLZ(?48{>oA`81Aru!L8H=g!lvcoOhqu3BtC3*N}>w9iq#@>b^~ z5B0>^t9CBAirX~D^9vtJ*v@?Baf}Ph%Be6dw?U)IaFp53X|*_BF^3}h8{}#jX}jLf z^0-FZ0z!!#S(@*IZFbj((eAZoEX>)*X7u6OVt0g9+Dm1B-3MkeADPzD+Plrj>NKCd zz`R4x^QgRc!Nm$M8Z1Nz7HDXq>>3NI*_(&|sl*dNMpGz{*!VpLvJ{J#IVF_{QO7$j zrAR%;NBOfaPe5_0ym!GFFY)NcX z_rP|?6gLW%YE>628F=H03=2klalcY;>oJqh0J@2Tg#;=zwlV;Bq^LC)=#e$yjt&8Q z*cjwoL#duN`Q=1VfC#FzR4C;bFhbW5n#!$rN0o4pA|l5Ffv_3`3|Lqgj}xKh;-^lB z>AGX+<qSA-coGo3U?2$o zf{AAv1Q*(&WMdkFu=zTG7Bn!3fs|1}G$quNHnM@#P-$T}5n3Mfqnyl=ny7}xfeIVe zAKzte_)-0=H&f;{n7G!V#Kr!UP)9{om7x|*j7ekhY~I#gsw1k7qB>5hw)HF_-{SL$ zlJFa0+K`iYEh0aN{$(xa;_~CNiqm_seG|fqA(YcVY1?BX)im2uBfdBvAM(gbNxfJl z%Kh^@j#%0khftHNznof>rha*_Ra!d3RWI=w1UUH4Bg%D8N0}R0)^m{E}+B=!- zg3qmbUP_;B{6b{xrbm}JIMn{|ks54N^oO&5B-wkxt2Gh~cXtWr zSNMOOh~xAZC|f|~RSpgh-{-`i&KKuZ?)=(6k(kQ2iKChc=8b0_rWxZ~fMam4^86kT z?^-?`GXiDx=E>0d{zWQIHG2#s0m9^DcU%;%>EJWC?5>z2Px^HN@AUP3%AF1-9`#2w zAij<+O$P&8yPQ!lY()Rv&x^~NyzO&{z!Gi)@-hsN&?^(ofFYLvQ@C@Y6k3bL1^(f0>4sQ+$@4%w9=%{v+~r zSdG0b>#VJVp%q4cXY@6P5wH`|wWd#bLM5((Pyko8CsfM!>7~^t@!PVe+$>S zTaC7#8NTVrck&KYH5NsNa;~qGw)`qP$r(#J59{JuH=Na8dL_TE2|T)8hiG2E8wXZY z90s>JYCZjk)s+FB`0N+>NA$~A5(DYk0z#sE=cxvHZJZy&P*vxW1{!T_n{Cazp{+L6 zmer7GUEV}3)w&UE?DdI@Q+#q>*1G$-uer?dR0rHQs5irVhWqV%Z4-RIL(h@EC)wxEqN$4oXC`t}PXfsbPw`)PX* c4Vsj;q(Nhly#~0!^?!uH=e=bKC9(|w06Q+-s{jB1 diff --git a/website/public/fonts/shs-heavy.woff2 b/website/public/fonts/shs-heavy.woff2 index 15f052a5525e370c139659c7860fa121fe108072..dc17e941064150d70e40377e126161b54c09eaa6 100644 GIT binary patch literal 243916 zcmV)AK*YayPew9NR8&s@1Gvlp4*&oF1r=xj1Gsbm0RR9100000000000000000000 z0000PfnE)gpjR8nHXO)Y24D_^FaVl<0X7081E**N1_gu!2Ot+D7^i$&U=+0m;uX2S zd$vv|nITy~|5}W1b4Vti)gBf9}_8|ZD5jskMCKqddn zxIO#-|NsC0|NsC0drC{xW=WP!W|Em@AKqP9QA894rCQ%s?RVF!t=IM*1s3O7RKX(; z=5Sz+LUI&`*)a%aVL~Kx-P{T&15~{}4A9W`f&0(}8KHl~7?@;EEHjFC_p&Ujk*caHvOqGE%p`N-`98IfEX%SCYBMw2 zI{-5?TNYr&AuOKZ zOfr+qBqu)&A%uJeW@ctc&r~(GV78@1gc1=-IQbj0I_P%0gr?^_>AqDVgsMa_J-bOq z8N?Vb-lCAch73iFv8Yf;%L-lc)%Epqt>%D1kf^%>k410q{5yVsf0I417CArWaHY^g z4xM};KAO!cfzTGh=o8;B#26;_;G4To+%r&(iagXcm=6m3HB5mWYCb-qqeEDe&C$xY zC0syA&pN^9q;ei(j3o}~y;s!+-=*&hdCO+@h<*D0Aj>j@02Q+I{YidcGaF!^p05d% zh->FUXi=f6`WAanGLvi_`-==?jd6f2Mc>FLrV0_W9jMLB>=1iTGLy_5*izpwg=nTd zmkrVK$F*J_!nq)~8Q@;eQzFu-KKb1C$AiD|*Up8`{Uo277~=u96#eSZVmHPZ=S1kR zvy0~JJ?g>kPDH;YWa9r>*vg6!;$C==YqP~Dco?&4iTb%Jc$E19ZVvnKw8VGy)iL4t z{(*2c82FQoLiPZq{#N)G3UR>4aSS5{PaGhgos6!w!e2myIC4t{_3S_YSM%im_-!U; zt*ydlw|EIVA;5G>Nb}MzMZh;#(-q{;vQaJkhNq>yT7{}t_7??Oz^f-NEI8r{G_PH6 zv_=O%N{V^TD+#R<&P^TRj1T1k*ewJ(VAow61OwgdEC|<5VHYOws~+?r@?1*qD;R^0 zwE{ENQyFpw?1$png9jf~l?#Jzmk@jj3;wP})pFo%CY101DRKo=XWMO9&qIJy8(DWA z(Wz>-PlZvv)qRvJG^1#|RjBtE`KqZE`(dWg%wmgzO(yE$fis@^2)DBqJD5zDg7&ig zE%l;qg7N}f!DMX}BiWiCpl-4gP1(^GJob&%Ay-Cx1E4NL` zIv8z`Ins$fD>CR~gPH$zVjemX{TmZ==FAl)PiO4eEekS0b8C6ay6qOX38?{&#Mx(VN%sO2*lgRDAi#(coPUhb{1$SM z;s5!+`0aCNhDu7(Rsi;Uin&LWopag!yi~D<1?7q!+)0DTw*H4Zdd5Gz;HQWCp6{`P z=1b9#)^H&MMiftwAP6WXFabl{1r>>+ptz7_2}_6u#)KgxF6u=wRu7Gz;q`>?bA!(s zZ<%fqM%b+b@CABNlO{z{9D%`Y@&CSCsopH)U(2t_6ww>Q#}39|m<~>{=Xu-w75ClU zy!idZ2MHviYppSgN?A({QDRN(DNSQ6EsC%!YGRB9Se88*;8{`;WK=K$t;PLXsekpu}JR z)V=)>Lw8m8?Gx?rhii!_nxFG+zsk$Af&~!K5bPgpHKlLME#p;zK|s_51w@V`?x@0h zY)o1+BPK43z($*J=OoW*uGr)vpSAOWZTQC#B7d zQ<`I^*-6}R#h7Zqm{vsZ1_`=QMM8}xp-L+TgKHnBI@9~U${|0sz|b5W9v@l>O#2=WUaJ{JLoF^_`#REdQ${fUQK)o?t=6iu8zx1hFAVj|eL) z(o|TM(jzs8~^`H2Cv;X7|+57(Wz7jS+;or)bMZ|_o zhKS0%Au^Jg7?Ft?+D$9nO#yL;kpRIgVwgvDRoz|ZKK~z@vxjrYqePXZKH zMA@wwQ1?Iu+9Fn?{C~)iXmdm7!qDZAsZ5m;zb1IGB6A{fC*=a$qWP26B1cKhLn{QHD4u7V4Y%D z%VeAN|K3j@KiAjF^Td43S!0EoOiOJjn^Flf6zQZ{Ad`jo-}C1D{}=VtYw0cCd*5F| zRc)6=$i@M1B8VV@2qxQvBvKGTq$qXw4z1ALyQ2a@A#EWcWkg5|Nl+(KVENX<}BYo)n4oLI*Bh~8*0J^mSq9qXaqD8&j=hRW6MrT=r9&JfK4wD zZ@H87P35u-O{MGl7nIhU?GStcUwI$%0v?fpW>{)9pfm=i@dAZ_WxEf+={(*;*(N4f z?TKHm|Hn_JdwxGB-Mkq{4?%2^#e#?}?z;{vjx6{twvbE&jo%<4!IB^W4+%lc0|BqT zId^8QcfXvzO>UD~C2{~xZ^e@j&kcR#CjKKzqaRb)kUO!1}% zvF=XOWW^Y0MhwQ>UL~)RAR(HZ=wsM+kY!oHf~Xw9c-Sm{JbVnFZP^{Z3Mx$xB&c@; zci0fb-mp|JFb-JD+Al(a7x5(O8wkU(=kxH$E0GFo8-#d76$KSd&EKz?s!8X4VM@oa z$!-Ao$Q2kQAT407LJ8iKR>Z1{ngen2H{^n@VfaQ-|xLQ zkGCu#?_d3m51Bh*C2&I^K*ET~atC*<3L@gh3mI4oNmxS&kPyHMs5o|<=uW4zeQEbw z){f`7^kDzg|5E!;>eWPDzJG?QJ~NJbmoEThIZF^WU<`?ggrfn{9Hap{LnH*tG6Zlb zgqtj2%V|5$|9@Jp{~o!w>eYMif97?0S>VqPxK4`K&DFFq@BYx0s@`Kd!LAjU6;cUyvXVRI-AqCPKX!SV;<@O@awuc=g z6ZQnzgxlYnYPS3M833L%gMYk0Ipb31xM&pUm@DVn{qFl%E#5wUf(wu%E>;{!rYg0`7S$<0j4a|}v7 zD)lVxS-s7&yK9zZ|DWG)((Xla&9eP`&BxEz{LSz1^!+`k9t_|DE&v8EV5al{Ki2W$ z!;i&GDOh1@Dv&?~^t?OoB*m|szGd1L4^LO)wVhABx-HNJOYu5EW&&E=qO2^(j3tWa z@mKan>&X2iR~GRQ7{GSOdvo4je1X4Wh2YSjuK0tS>P|8A#(3*-!tU)C9y)uU9?QipogfjWvGPvM{GvsfzRp0XtHA$Ii^|GIag_ zJx|ZezzFn2~0rU4JJJ z?G*+0on&&dnG=J_q0VsxZN%6jaQICo9 z22WiybK2m}bq_3~%!B@ARF8v>Ti5bSV)kfOqX3+{Lm$Tk8ABbo$K$RwWiY62LxIN=T%I_9w9AjB0~S#*tvDUO7aYhE&&Ss@8o zkW5f=15+zo4xAz})?^06lPH}HrdB9CmCctZZ5{p8i*5uHhlG-mrTVLz%Ee2C7JVX& zIXOo-XhoviISOSOof#BOq;rL!T5lxLLB6w0ZItw=4#R>qyVA^=?%^zTRjS`TjF+$P z7qM)mHJGjU$6__;jpv)=w5vO6ovtdi8Wd&C%R5B`<5Dt19g8YDH8cx}PRt0DRJQGy zkRHqnM=R^&wc*;?wd&d%E?(GtzT@zLttQPFnzv-tF1v3re9YvT^Ome!yZz2ncA7i9 zbk)Y?4OM!@Zn60oq0(7g<`x7Riz}3C4Q4P5nZ=iD90)Xk2g}qZyJxRfE4v_`tg377 zjBJsRmff+qs%y`!qvBIC14Y3$^$m&X!GhxQnx^(NI3JqszG>a}#`DeY$1kF( ze5DzT!u9U)|FxhSO|s2#+7ds2+&o+=I)-AwoZGt~K|F;CIf~>OS9fy=5=R3>pjvMr z&_IDRs?=LlYgUVa#o>zyC1tR>%rVv^I-4tys&%Fi6oC#%R5~Mx$%RpsLDu7r?yS6` zL{(jLS5$05T6S(xMW^n~L!y$i@=L4h8UzRoxgAiy975;R}{D|iAc zNk@Kqxh+XSb3(Y;UsTIKXZ83Qbv(T;50Xfs5{=OkZKFeUfwm;Gc~Xte#0r6XjW zkqB@_sLFu5efjdj5-VKe8D7V`_%wA{YTfr&uU{gmLT#|vA4`pPG+mzVdx}ZW5U8Mq z7!x>-NIZ=#lsW0m;RL!s?Lc(mi7|~OJm^isH6lY8jjz*-OaAUt+>Q1 zu<+30GoVq&#cbn6PBqaqh^5`#)dq8-3iculw7*xdZfX|4#OA@h;2Y6DR)WGe81H4MG)G z;f+w;t3MceH1;S&+tIU*Jz8eg_Qi@GvtzZPZa2<;8JjzJ_ZO#kAHD&Ou)@!XxHNnK zgG0p`NXo!;uSZg%$z{T%6DSW4=ZFJ908kYH zk%9wM!`zQ`q5!Y82ge*>W;1*ZFOhAq^pXl#34zm_k%>_PGamJ+f+wzeS_mv4BqEPX z34B@{8!ag!TD#bMl9fsqv7It46EF#yz;#Fn)D4DD!!cnXEW(Vr!ez1w)C(6+DJaiM zaxu~i)W^xqy^Yfe=y>5f8`^^rS4N+K4~k0tv{Hq1`pHi31$^D8PoP z$unuzSJb9`2y{qxw*%72z8+`oo4JQ<2T7C6afu6vRYt93#;-2QE>u!*rf_aO6qElrGsM-7m4dS1Z^(8=1M8QW54Fs&q}q zG7C9x%5xWR0|_HcU^eqyic#VKaY4B#XG{*+%ED{*R8=h+Q_X+q7Mzjk&GwG4dn)0*$&_9CmK=yNDgAJIm*B-a5_E-6A3k*f;lxa2{KDrsJ0QkWPMs?=A!D$Ny|$UjKWu;5fq9O! zF=Yi_k2-d0{=D`7ub%dLpzWN>B8s!(VBeW+p2h_U{SaBQv6 z7@AyKdV)q}WwYd_O)rTY&QCyVs+j_!SWu_W%_Oks2gxcXUvw~qd#iMIzo)|C0Z0lkykWz8)Dh^f}?J=eZWRzY=`$sW3HIF=S4b2b` z=}?$Uh|2n#sM|EtgZHkWOaT}2;I%xTrKr+jw1|;${njRE013Pl^R$>4-%BLaP_?S$ z0V@_a0_0>Kv_4;ZN?dxD80@DS?sh6HF7S}u5uZpW2GnuO#Ybd%jl(WDVXs9# zu1*?>LvBF@IEUAp&Lq8ru3#8eVlR*IZZ z`fhkfMPZ(#PA#;;E#6Rw6ydTl;tE~mkqw*P3T(hAqPpfG-iJ}iH2%HL=|$Kj=!ZfW z?Kvk#QvxQ*<)-f5Z(6m{d=3Hf=QBus$PGx)-l-k@A?Q4rn0h_7Ktg@Kptr*t!Rd@c z!6`z}5kAJTa!J4lQDjK!TWt>iOiW=+L5)nbbImf*oJB&s_sF#+7b)>!QJN71&o}dg z8MhuzOb)aWaC&uiUXJnb60MMRkuEYU)t~pPj5ws|Cem{lS2bPJfVqf2Qk<$7Ro6<} z^Z)TtqJax8h+@-I<=Jsld5J{SXSLa5{-E4+POyDOe5WaZ70VYVqu{n5^-M4QJ>D} zC$Rz<5vmAsZzy(YR*7-x8U^Nih)gFjnsY}r2{Mz4uELIAP3!=({ZFxa8pS)COCHMJ6}Le z5l9y)egHc!nM4fcArVhW*z}^ARTOoRM48qK3&}#Zkca_V^B(a)Df^S3pd(h-GnQO} z(M5rRMwC=iBqh1G8WM4q`o36gaZ=@Wt(x|(QXbS-fX`mxsMGY$baR87$8OovGh_IM zWe8+=qKIQb&m)MQg0EwS(7R2Yo(&sQi)5OYZ70VGR0QC&K#YJXTI?tARwaB8*C+*_ z+(89fbt$NAYHs!hijSc!+kxJ8WqYHUUjW$Wl5JlaoQMrR-t$^w) zpj8U0s2~_|L$si7tX&PuR<`0y01Ij7hAM-?b6_%8X;o#hF6&8sDNtPvXc`vaL_Xt5?f^Z`IykmJ#QDt8c&*{nLBMJ!v!DTF zLsb?N2^Ke$mO|h-Y3s!nWN@Po0mc~*1jJS*m>wrrmjPKOGOiX^EB&EOTzbu#&?01F z-JZ?5F05x~Is5tuwBKlIZI3>M^FuXS1P!R-Wh|l7Wy%pF!?P1ypSz4Q>aNg?&^OFh zXew=wL9FcS<&r?M=$AJqCZHI;003670RamNY3zh0gSi!viyRH{Qz71@hTRAB1EsQj z0|a=gbV&HK5!YiHZ9FcRtZqZ5hQxDfk6a`Y{m(&1By<~;Tf)&E^CyJP35TwEKW%#d z#n%_Y@dEAVZo{BzP~4>;L!;|6h^JQ_I>$&zxhLr%gb=6j(8iz3o(%$SNr}=S-}7=C z(T5X`zIP(4=t*|Kp3rN)fSAee#>QaYS3By&#j3i006Qdk?`wK$!1NS>{S5MQLelb! z%)UbvTqR;-`Pn3{7NVb3aok;p#$+`^IB}^U3|=F(6U{Vm!WbF6Qv;+rc6ieljBh)L z+TG50Uk{}Ow|3e4b_15wuck|mR(teLa@}Q7tR};j!dnf8Z_MEagm`eEZ=jvw(yh5z za{I)E2V0)pz1SEX9Su2+E@s`YND^La_H2enD$)7g*oKr1_YHC@jXg$)ms4V2eP>9) zb8SwewWNwee7ijo=G5Hl>bUkV6{n|xiZHWy!tTI=`ji!mC-i{&-?84ach$4qf@Gz> zW?;38N3tn|>zb1pkSAD#@PD$M8jN)i$}(_<%T3BQY{7f|u9sO-7KZ2z(7A}sWA24* zm2oC}EbI-p>b^8D;al#ER@7!(1i>5~uV|8@V__8PiXT`w_Uaq1xJ6$i7osGH^3LkT z!@%*!xusad&c>KDvnOlLm~Jv(>ioqe3|a_^WfnA@ z8C3|TyB2%5R%}crs`47A-R1NKnL@b^%8a0X6HlEZ8?AqQ-T5i&c*m8fIX-58L+cJS z3kNHizHz_5cl}*sx}6gnI%{@9-B}dhTk{tqgw{WU{#^v0E^}NOCed0HZfmY@JeY7+ zJwoWbA%2%ts;k2LvwpJDFh^sp@!*YB&PV+u^Q65S?cAS3vBnWhQX1muH)h7}?nd4* zq+>&&5MU>b=id$Tl-c`2Q+IY{E24_|eFPf1Ly~;#qQNqKCU2jC8d$nMFs4;67{m4! zqHC3&+23#&pZLNiYB;6$k8;&vqeX?qVp`rxGsW|3MyweKi`B;`ybq&(5wEp%Ve{g%mJ=sJew*X7E_YDU50J=DAIaM0k1GaNya4tJFN$!BC9{37*RYJv^(`c|p{k%ro-goYgM7 zScT-{AnPH(3)Po85s~ZmEr~Vux5)rEUrh8R1X#kbX!d3Hpgue3CC?|CBOzhLs9FwVwn)A2%c3ZEqhPeerNO zE8YF<)%d_XKV5<5HZY_=vHt}9#|6>H%=PSdI6!Zfp-#(S@q&qSk5_K~!mPJPwU}9H ztK3p2ny#V0yjfFsukmi*36?$oxJO6KbQ9v6GZ&mqeN5cKelIwuoPIRGJJV3z5{C7c zcY4uS`_zCv)p~r+WJ#|#KbIl!or%Ku)8h}FsJ7$CyezQNR{MMU(0A!_2*8VKD|0nC zr0jK&L;CfYcUa$6VIYvzA@S7RLdg+IhM_3Dcs&;fo(|cB=d#b0kX9FAQF`TqxZcp< z6O*m0)wgHS5y3yJGS`2JF`~;&otxIDIGCCRA7-ni*G@rDvb3qF-bt{{ryV|>Z8>n} zS?}RVK~sVV$jaNhAc67zY4bNpS3C$_m5=z@G4_=8G9JZA)L;GHlTuoJO&l8Z6$&$L zd5iZZ*p{( zYJtUb&WI1hW*lFnog+94b!u<2wb8{FW4S49es|7s_7h`J`a9-fJbv2k6VFq4XM8+z zJcE>64?gh;;PaIf&e-VXH_3-PmabfV%5qdp#!aZ#ct||?Tmt3lBf>4qn<4wrbWZJM?@Dv*?gm4HK%EmHJ#HX1L9#4}EoP%=Lk% zTO)g~1v3iHu;X*YsiL}~spRK_kOEl(IndnG>ovC{AX9oqq#lx$HyUWvyA4F~y5L#q z(Sbrxo?$|Q+ePh_5JuPPop^40mx^x?0^cM8jvuEd2LmdQ-pZoCysw zDVMPjvXgax24i2+`*uLe>4chRt-`pyr9sOn*a{Oo7dB z$$M)k<>#*7T*sCQWdFV~xj42y81AV( zBOrHm_-X~6;$y4OrhG-Ftoq94@u|Z$Fe);R?nfW4T$~>}Xe!wCq?3&k z3N9z$zQ?^p|J0~^hhY2My&h>|3N^AOP$;Kn`OWp7}g*E0e)p>%3^SYgM)sz$3N(3c!<28n< zR>G$cs`LUjPkmiPVS~Wd-P+SX`(QO?{=lGDndz{2C}a=-1k?w78m?ZUAI09sF1l0= z#>UI&{{}c@s-d(J>bQqzKy^{hwb{7`yL5fwZpwtP8<;i&Q(`q3!2n}=gadJrYAKfO zTASh;z}SvLC8jreCuPudZ7q+)luqWvZe*ke)v_DsBPxOxuw)0sQjNmMu7wyHahoqw z&9`i-z%*?sd-A4)Ym;bHd$=D^)rQr_C_tdcx~A3W7wt`)@GK{1^5NWiskf9I3V1(| zNIObQ-a^#2aogutu&m{-+A-c9Q?Vn*U=1^J)&1WAnA($KYj6kl$-;6=G<{ZNbTUn< z6fJa7ewa<42&~CwJ^uvUH4k;WA(V*aG*DQl^GL_P-T12XJWRwDejWb4MdKq+84h&X z-?4lNxQUTAzt3j%e|3@n$sY6&{jt{M)XYF3UEx{0E_guZD$p!cR5H_Di26|okQRh_uD6BL?W`A?Wi;`QK{lUS*M2J6JpC-a|rRAO!~Rm5gXnk#GEo>XMbz>wA7 z5|EwN!ufc=UgC6gD*}v$1IwCSIj^|Jpo|E4X zy0O%Z(@-PT8Cct1?^HHcf>&NSvx)mr6;P8i@}F(N`u)R^$iKFrU>;W$jZTP{6}vk8 z_^3FovMj+C4j*8+nRIPn(wPR4)pq5Tx6eLu1Al z_&3vz_56)?ZbO?xg(q2n`;6p%F1>N~TiT_Vri&$t40_eW)6d;m`32p1hgrUBp2&FD z{0H)@`2;Vr-0Hk@2Qy429X76hz=H0q2=-&?Z7taxp4lfn!1!8y%{>i-(1ezkK&1bq zc@6wM;;p!|zkQgu#!1>o(;W#+poaXaBWAm?vSXNbw8nv}YmIlb#DU8(A3P_=q50X9 z(PY(ggfF&PD+coWPlu4_l#(^Ey^+gz3ZA0o@t#mj42qYpi*(|21N|cCZf~NLs$gf5 z?_2(#4Shx0+Ge=Oo!H>`xk&cnz6q6;1#bWsII?)vyuS~bA9g*tf*sYOterxKNBqDm z##G?(>$G-V7MyaXy8WkVx;UaF5N;gR0CxlEdm%ryU-J);1AQn!&Vml7bOf&Ca&Le( z0^3LEs*(OZ8?r<11-2NK_fRt{6; zhq+qa*Yo&FMpip~G+$@`FUQj8mj%|XH|wFyGfu{rH|Om&AJ*sJ567RDW1*IVx{-BJ z(@^Ubxrg;5p3YaHf9{i*as%tN$#9&;&6LM<>(0%y*)pCzFJ3k~X1=XwX3qHmiNm*9 z*Vovk13kHwP3GZxTFe`G--NvyJZ{H-ro8xk_2Pe>$Nri_?cB?Y zc+^vn9t5{e*giO&)h`d=`;Meva2`7IoRy!GHePt{$fX6oy_40tZ1GM1*{0G2R-Zc2 zc~WPN)$g_Wlk1V(30Hovwb*`d}vzu2id4OH!Wg%O?&wp)8d6N^6mafmk z^En@IGxc2nZkN9Gy+3631tJOtzk1W&nX=%CX^`S?xGsSmT_-P}u z1DaQ6nn&B2bK7*T7&)X~E{lU7EMzFrQ;gWQ$hxFAFme`Nkl81eaHps(`y-<38J%iO zfe=&Nlp||o&oj1Ci0%4ZP0~HZRrH!sLKO;A$r>0X-yU1jUqf#i#$k%NmRNq)wf;K4f3wO`R(1Bi=JMlX)G?C!1!LL%HZ%QEl}%)M9t%S-ur9El=~kkeZrn zdu{Lk>YwLZ???N7bc%lTLjN~IW}bhyNLKOdzq0*T#otr@_2%=}FEH+dNS<5{x&}bE z=&px8`Wk5TbzA^W0GX`+wTPFm^DozPFL%%;P$-Y=eej%VM5|05f6RUmd#EFvkA*w? zGUrhLR;A$lp4V7OJUelZohP3*NRN)?8%xF?y4(KG2R)$r85-`)vj>;PxgRAqlN61UfZphDj3bqGlhk@u};pk@|oi5_;LQNOr z6y)bQ5C6}O@SEE4zeWG&fA7ZnJ)i<$gWQvbm>NmPXSj^qI6r81&aPj*S886l;Pr3y z^~?Di;syp@Hihw9@dzLCz(M8)?S+NOdcBI&dlJXC?^O^M`anNqo02bH_bBiNX=vxg zqHBu5mE!X45@?50`~zhhz~AQ7+8U;}Tl}f0B>hB){VGdft;`V+`XATC4`0S!G|x)# z$Gy%kGgb&rqzq!09}I~6HD<$8%Zl=Zzoq7Cq2e~cKpE0DkZ(&X0Zw7fH+}Qm>b!Fs z0|69mEfDR^T)H!vPjt}-1C7%~4T8eFhOGbD5z4ZHIspak7tJ~EUxhxRyVnnnz$sO^ zH`%tqrNx3#1^)k}@Q2u(Au1JB?Mq7v@1JvR?7PfcjxiGm0?9&>H?J56JYe+L@FSF9 zim0LsCSV5k!xAKDj55KpNX@lVpsU{cTkV{elnDWX3v9fIql69?vxdE#Wdb1!Ldac4 zVv8#`NfoMCC1|I7_;Y%c+QN=gb1ad;5&6%M1HR!3x%$H&L;n7?Uk)d+T_69sU*3OZ zfA`tk9)t0FnY%Bx-H#miibsHWwN&}pS=6h&vCiDC{n;mKIvf%1nd<|g&uYKdzq9%J zhx+cZ#9B9V7?#Wg_N~y5^M+g9C+UGxzR&E-CHIv3SB)hGv@2ra*n=zZH*t60)i;S2}Bo$6}`G#+k~BK zTHrX65LCR&{K^bXyAC@FR2K(G(YmUfl%{Z|i-Y9$(dinlAzJTgM?)}JC7!d3Kk~bq zFk$}G86#?IHD9J3Bfuwa2A~=BPha>kDYIxPm{y&uo~Jf#Q6#UCk!@aAc6b%YIR;zN1srKIs$^-;906+d$Lh6tejWMHmw>hJk0hj z5X@(@Z+yAbZ!voK1IS~%*}wbWdxlNdILYk|y_cmQeY-}ZnoSwc$6)V{AK&`7Jz`Z( zutD65lqcrrHCNuaV`-@+2jl8{wv>Os%{l9RB*Q zDep3mFV$=b>iZxuoH;tS$a$4o0XOUKlwuz%V&A*#-IuT%E%Wo|C*qErZFq$-Bii;> z+`Nmu{jRJ_l=jv4I?j9h;3uu_g&a=Bt^3L3>47X6bm9geMcj1(%Zd&x}BpdCNUAp3s-dG(puV&i_%z6AaF;J-;%ABLe#{jCt|g&(YLgeIhByWB?5u>vQ~)HuDa90 zO+tEe@5NEmXXnD6pVX~C;281HE#08-jmZ>j?l|9IZ*kz=r3P@DX)H-aN9z)IPH0Se zf~LTz8s}m|`qKvTc-$KO7Thb0yU zJf>w28t1604Mg$-iO81FogKk`VlrYwJ8JFTSnc-$gTOWbCh#n!9?MN$h{1XA&#Tx!6>s z#^wowqaP;#wmZpBy?_C_8((s5*W|hSWD|A@B~u6~CITdGrx^1@tRUkmS$qv66(|&f zQgLqIN|D0z4JY<4{B10VQK7&cvdSGCpZhrkBJ7)G7s;~p?bh^h4Oh5u`8vH%L+&S^ zx|MR*SIOa2p#>ZK+aAcL2*6LAQQ)7CdCxz|fMQFd{2!;G$diN_GWn{I65m;J(=w(fE z+#6=G=@lN45lwI-GYv+K`3T6Da`52<##GZU{h;yyKcSt=Z7RQUHWB|YB)Hv~|9z+G z9xZF5Y19XFjry5I8CQhed5A^WCX&JZAD_X;z2wcQBi$o>UXGbq*ZTZ2YOnTzsWr9n z1@r}c$*QI9yiyE-eMTGEOSI_b0<>fQpxWydiUtcXz~jX&hKU;-YZd< z7f;hHx#=91X$BPh5KoDp8sgsJeC^+;tzT`2e9$V$yF+w+1=uWJu`q?*F ze%bz-K_|TgH+PI3G&P&BW36ebm*llU(^yGK!qY}lDDc3?c!->6Ac+UVv(qEN@R)>y zKa-9~l@ERo{M4QlYrTgr3NKm9$?S&U{y6QM0jHOoh^8kqsNI|GSIniOcU$u^S^Vv3Ych_y&Ikx}KUCWIOsjT0t z{x!YLf7AScv*qobHL@{x8b>nhAvw$pY;d^Fjw{#N zFZ7c1tEh~D$y_YV(3Fr!WHZ@~I_I#hKT$SqV5n{!S32yM1_&DYBn_qf-QM^;HCJnS z+1}7me`1uZkps*pF5q(o&}fGDmUvZu=LPdSc;xzc2v`N6W_fCzu?k02)TB0HOzP3- z2N7=$H^3FzcK7Qy>bEH)I7`DNEC)!=>4p z>pJ3CU6p#1OfgMsJ)QUvxFi`la!pz@ZYYbPbcNqL95<~JfNnd;cN3_Y77~527Llk| z@t))tb*8~!FJc!>%gruw(FHHmjn_@okG1F~LaceSk6}z21u`NV(xy35W!F_!4HXR) z8j978g{p6N>XZD|K+ax{+5n=dL3EOLUqWTZ74&_6KdLF2b|BQLT%Wa*ikb2Yqj{4q z?4bYwMzF>qaTLa@wWp<0{6#U=a3GD^s!MKs(ggO-LE(Itgm|{uva{$)4jz8cO4VAw zH2Q`IHCZL^q#A!PM(%*`2PL}h?^g4`j1|AdGG*kkPbR4g9{#E(92lY0t8iL``{pUK~ zixx4cPAo63)@Q5m%#yc23ZI#ivu0yk#Sqa|^Cd21`A2=~d+J-Q4SxZd?@*1dCjv^C zDL{+BA2|jgkaYQ8CmB(0Wbvd&lZe~c>B4dQ$WXzKQLV@7%tlZTl97nXA6V!#go}dL zzjr=A=(!QEM2K;9LLyO-0V`23)vpdgz-u4_;m|F>b;Aj{u)O%D8yVCw@!%SNKs0?-W1i=X|@UeD9{fP@@gllsf=a;Y6S%@C{F2qJ`oYROye zB>$vnl9{+Gvo_(Tk&8cBKR>syv7t{+>CtiEE1EE11bDjO=z?yc&f7xF4{&U$bdzjeyeU|FWUw#FOlq)@?=3 zk1t2S^W}Zl#;?H9eNCFST~8Q~Tbc$daZ>!*y0Zk!1AM_L_Y^^E+v0@_ zuB69qC+RH$EmL1Z;JLI^X-s2eh`{Hgm9bP6fR<G1&n#r93eo zbGCi+aXr>S2byP&R|~`&9nSzsK(@bNj^`m)fLS4e zLi@ve=1WErm7Lot9F{M2+r;vYe-&N!VQ zgpTOR|AGDLKNvNFmmpD-F%m#dY<|6S?F^~8Jt?8Cf78wZq#R+H@= z=o!Fka)^vW+dv=1hv;2tkrO&>k>*{={lm^r`~nY61F;!O1phW@d3D~y5CbjfZD6sZ zZ9#BG$~qKeD%0g>i-qLTZg?;vq0ix|l2^f*R3It!!Hp+ipBH20}XBinj< zR72D@!Pb4_SNlmqA6k&w-qwcENu4B8z7}W}>0DCajer=g4xSldK_pmbnt2kaJ$@#w zS~%mL*f(~Q@wCE{Lo_AanM9*zZN_L}zlc>Jn1&NTyiukgOV_W*MfUo16Q{(MBZ>OJ zD+)u}ha5uoY=g>x3-dRN-enGq5=nF8k$(73kCIHX?AsuT!F&G|fJc1M<06Xj0-vqq~wS?MwBoi%x8n|1oW~M+e&jJ*#$x}bs%AttnaPT5>8dJq{PiBHfBeTek z)yhAKQ>?w)9!g(}ri)Wdsa>rMXgRtA<86hdvrl+C#wSk>G3}XWc@kJIAYWlGgqyDc z)r59*yU$-$_-dfn-zPC~s|oN`VCOgB?&s1EE^2X8b88b`Tyq7&JlRgxiwX4P>aaxy zd5sy_x=K3N+J?ck=e&yUT^_>{K6yZ3DlKxm$H%8vUD0^1Scw!OhsJmk67B}=GWdS~ zCUG#qnfcxU!DJE8dF%&yvXc)EUi|9&);oNo9c0-!Y6H;QNlBJ==C{;5LjL_`(man4 zbs#BA23uPc&3Jgi?=vdqHm%R4M9)MbE)y76v6t!`#oL85y(4KH1DkQ4xTaS2#hv%_ zNkS3brk5put77Jw-mQb~q(#~zj7-g zaKCUslg;aRX5kMteKSN(;cV}G`ae%l38wrbyygr=`i6n#J{Pa~P@Yp<@_j_UnS=!y9wOxEvFb(!u!9hyNFbGL@+pTvBkiDuUKoTin1ds5 znr{g`0 z1y`H~2v*qRiXLnn5aNO-QWV56lv>fwc&0Fm1uS7T8`#Po4$%#T0Y+iMLyVF|0SY$FAp9?-A(gJOs+fo{a2gj+}vK@=BA zO)PCXbdChA$TpOu@l>PNH-n&wbdEr#(L3wC14esA=U! zaA;V#WL&s22Zcezz#*cd=YoQTN6bZKO31^T;Dw!zIpd$eP?`r{ru%)m>4GqmdexyyBXS& zXv5a%eB26&r?G`H8+#{;6IUcR+T44o+0mUBO;pvlMa0CVWabo@tZZ2NXu>oSe#Cul~G<`}Jq6Nx$A${Ko9W~$$Mei3Lad!9t) z>}MuVqOvs-=q#ZG(^@Q91#_7kp@h^J9Z1lM$lwU%PHq-39F;9rI#5}BL}irps8Kzk zXrfzFdqglUHLF8WW!G*k!(-EOiYjY6^j~VApt!s)UPntiJMA2B0RaiffC3ZP3AmQG zZd9EgYl7F^xatSla1bfFWt6_MiQG0fa#4s1G}`GsK3PWU= z9d|YkSd$qLPog$hAqfn=M5S}0ump(Gte91*obpLsxx2KdX3M@~Gfy7b#BrfZ-PFz9n>)Hk@G#+{ zWg91c@|<(eGDP_30f|$l%MdYog2d^=Gb^=9A%YktFoz0G@F-EHeASxWH)z(TT_-gf zHSZ^jo3`#Un=ys1G+YaJ z!ec2{Dk1|5J7;22@~YZK7B(Ig)r9(Cebq5iVmW)$Y5Mb+YSY# zwcT2T$ED^L2HUpploBY2R5ix?zHaZTNEK?N7HU)NtJBGuxevdLO)qWkpS`(%T;3d? zT|ZCm4g!F%g%Kt=#RXP)!UrUPH8O~l3m-uuV&IZcv*&`2116(kp-BQAVv~??k`qm4 za!I*VRMR%{>ic5SD%ytT_Fh$m2IjV|wlF;yrI@BPql!*+k7$*Wm0Mh0*EA$HEw{L$ zZO4Svto-tB>&7^O5sB`jJnEujayY;CZvXV^?%C+<%Fe;b+lR%q;pp`0@p6Kym-#GW z_iSMo5Kx$%o@vz$i*67>K&p9fcvRy(9&r%!SjJV{#cO;*D<+$4~C?kTZVIE8g=Bjv>$?zEoqdKoA%_sakI&F}M%6%Io-1Lt6I+@Gh5o;?ijocB+?qp;dnY%tkOGCoVXC8 zFf9}q(l8F+t={VGq83cnKhqvgm-`yoZXH1f;xV&w=fRH{c`9`1GiT481q3__CO!!z z9TyaQ7!4Ce)^YIQ;_B|ln0dR7TzGLQFA&-~3iKsbPS&V?RzY*N_s%6N)~?sAP3Pv} zajCf_RqZ;b=7bs>&R~Pjjo!qqzg@IM@936(U>K$Y(}$VDEMT@VUuQw6-hSGbaurcR z6{=OE+8BaaFd}0x4ihmI(_u?kijA?o*iq~hb^*JIy;N-tr|a{PCCB>IOG8a`stc|4 zq^~We&so0vR%7R^+hz8WwYw1QYEjGErXAZimPnYmBsBCaz@QN^3CQWV0tm?I;LJtD ztx)daL;SG*2<6>~49smE6x9XB_718-V;gx&Avto-XO_Qg6Q;~L?}bjDF4urWX>!RO zJ_iPY0lek(%x9ka8HJ-m0%s2-iOyGO4P=1tEYn(pIm_!~;~v8?8H=$U*YR0K!HqjT zQyY7yt`)V6ZT+mCOrB12vL}C%lb*JSKzvHOf{Lzv9Fv|~R@1&uWfzuKx6~h)%)y+@ z#oW$2wNh<2uKU@VgCCk=m*h@buS+jBLo~zYq*0#^>=kC0>J@>Wm zv6F`uEM2o<$mBUoH_V(pv~=ax$pXT{Hg>QJd$1S#Fo3Nv1+y_9E3hl}48c%XLWRzW z%;YQe_@m$G9x?hy>c}6}qnC84AKtvSr^{E734nkw;)pZE6G8?pbTP#i4-k+6kfX%_ z9X29R)R>`Dq)o<&3$NVxq8MkMHFh}UKOOcw(IR2@TuHBpDN>g;lj5jW?s3|Sx*Cr6Vm+VoXgP4%?WU4(dbodcwV-+XUV3WMrrU7N(8T(^&;pIClvq|IDsp80>KL`!3Ep_0vynQJ@^dB;2Utm!haaS8h!+M7{Lwv z9Hg*?>$&41m`ia<$bx+64G}D$gR|ihxEHA)2C<1lY>oNY1xs*@9o~jr{58CQONoOx5;M@p%aT2f!Csi!NbL^E2`Ptb9?z<6db!r07_$yv_ku+2Rm!xR@(>QDlikB#q`qOQKZ~5pj_d!KjXY8LP!% z91!z(RSe@V#j}Z;NRwH~!eoDPNO;MTFbXJA;U$ciAr_16f)lkk2#Vl|rL4?Q)&JR6MpAD2xIWO?i9ywLDT<<-WSFO0Q;A3#;XoRDtTMwe?e- z>C?Kv}`|=|-cuY=-7!^TXzkX<$mtCPNv?SSB^C`LR*7)!TqJYjwM^&D!s@ z%U$`-w;Q`%-LCs%SJFrK;l1j&_iaD+v_WN<3=Tuuuy^Q(uMDHZzs%Wn8)-LK+zys& zWe)1rT#DP}R0mw7G*TIzj4fD@{ZjKSN3faDEWn`$p|-tX zLB9#I_qj#`tnf%|p!E=-&CL~#0qjAzEO-W2SVdF?5J7zBHaNn1!V3Vwygm~obAZLi zQgu=WYP>r9$hcG}ea5ZAc(00s4*QlKds;C4F%v9P@|hwf zfm)Y08)2Wb{WDxebR{jh_*1C~%IwhV@Veip*~2(fMQW* zQ4D+kjDcFK%uca`x zg&h?r2|KPMNdhSvAlGV*FFic#BSsoW+qxR#lugr6WL9-~?O^S(dEc~tVf0UDxP+}G z;Xd3Efb|)mP#U^iW?^wJaF={h`!gpwxia&lLtg`IH&a@|QGww>3t}8+IgX>G-ZmTo zGIekOgd$fZ>xq*W@IMt0f>BIM;$IOK=o9k9RTX6tdTz%<>LyZncvwnB8M7K=eOT;$ z{eO;M30d(?ld1;Z`xY zxGf|AQ8iH|aQU1N|J=P`l?hB>OX;sGrxFIRF>)+@>;3wwL1P^%vLxls{cE|9Du&ea zgn4F31ZtdGFzZ9GddR|yZBc~ZaF{d|8wE${6g=Dhh%up-BRN-D;Y?k7H$4`_N@YKW z`OvAqRul~y62fjDLA`bYrbq$of6<{MI`Shb6LD*!(Yh4Qc zRg|tK8JEZ-h=PR|>um0=h75w0Lo?aomr7WeZT^?szNI!1ngf`P5Y4nvJxQy^;Kq5% zsUqQf!#_g3-DlR{kR=oqxOBHpxY!HBUrv$csMPgY(ty-dFyy=tVuvHajp^%ok%18Z zID8y^KXa7XLe&keREt0jhceSKq6zu{E@SmYJ~jHsU{C|$U&{s2yY(Ly0oT`reCVn zF>}$ktt{|jTQteWe!h3qr}S1Tzw>K&ug9Bt&;`!dJ$I>R4mC^tw(e@S+v6DXc=t}> z5UmEMAcCtjAr&JJnXcSZ&{QTg)TbQMQ-f#xk0dTbR(s7Q0Igzwh^2H?7|%fu(G#^Rr>M}&t&cESs?htq@&9lvpZl|Z8YFm zj*%RN$WkvYnry0N9hQ%j{60s}!-1pPO9LD$MfHnDEc@m}^yNDUPQpOX6P!p`byanC z!h-#GWOEi=0}kbBQ5EoCc2886kFHC)rhFE!_m&pL)AIo$*a}2aQyeGo4O9Xi=2K$r z!LqCoFzj4syzkN_o$GOzh!9-h3raFxIDzPhyI5vXnx&;&MgX1W(6$oa6L2eKMk1F zGSJ6zL30YwCV8ezg&9whJnv<~8I-mcEE%-0m7p{r8yEP#YtZFWIrI`0kA{U?mo_bq zTgzOQQ9d>9y-+uYAr7Uz>hmPz>{NgyxG~;8>tnV_04$G&DPjt;ui5e`m*G*D^h9+b zNvBSM5Z7cBT*AG)Xm(K!!&I2t-VCA_Fz@?3R~R~rpS~K$bC7fhf`RmlgjPQGuB#LV zpKvb4UNsuuM?k68^~N=7LD-iGSokVFT~McKL#&Uq9jR+OM@avoIa6IA&|l3F5eoU< zjJd_?p=D^FfKPlQ<+VJV$6FMqLrBC^>USAJ1EIOLyadu?Yiq3 z&^AsivJmq@Inp<&@5NRVu z_l?G^qD7sr53+u$$KJf)LDQSVZJ()J;M)+5!|t0UMve|CB8|`Jm6_zjV#i$|<4HkO zKwlnB>aYgilq_3?4`vcye#Q%B+U!bh0vMs@texRPs^BCWwlZ;V4#0E@oM zEdB+Rc=7OK15;S-7uuZQIWgG}CewpBV$86Z>*Rg2jV22m28XCJG3e{b1-_w1D8>;F zhZ?1nk4$p@yMj60R||k7q32fzWf8Jg8e8vIPjK?03H4kaP9>p(fcsi#USzP->UUu= zGN-7mhrieK@~MVSTW6C=*GLFk>*DIcokxPCd`u&T^U4e~+Q_6QlM}26K=O}qKn=rv zG(KsP=h)&Q)-V7mZXhfV5VmFxTuoFNkanu9I<~lvW~;CCf8r=31nWjD1P)^DNjzOV zzy58yP(ur!yvuM1(J2apM_OLGKSeE^Wm)S)$4rEynC>q|TlQmnY82f*WSQ$$duH(>x-6NL-+gbca--AUIUPC=QdB0A&*b8gb zkv<&HOw^c_0dLMDF*p5a9QI%(S8lEYkbUkjauNSijx?We9*21X%B&0$U|qJxhDDuu zSpQlHGN-bKj(JU)zH{}iSYX%KRjcyIt}>uIe8zAHK5K4!FFpNp!pzYrazlrx_x5Am#k!t zh6hrP{6eqf?wS7d2tgX7qOmI?#b*YJbO~YWb~Z_@kzx%uU#JJ*dp4sP#x>-G3E88F zSyQYz8Ax3zZw326iM?)WLsDw_?_tyZ|CoIkRa>H)#>?3Lz%>(DZ?WiZwx_GQke(=-r8$v+LC-Uh_K%L^hn z&h|E}#w^p6q`D?}CQ;VP7uuLeCgEox&GVKzw(YFlUF$+iq?-noVHhi(SuW%u>C6}`NA|FhrNiSStkBfn&TZGr) z+ns6CwA(`X>$9!a^}znUI(~bKhd~u8iO&CDQiHZhloc<@@Cg?(VFYsdOZA;-Kibki z8%dz=&gA+9+zvt$pLkvgA{6y#;JxgY-6@))H5#FRv#}6F?njc^&SV?9vI_=Vv;JdV zi7!v~I#F(JRUv$^<$-3Tvm8<^d+f6i*&jSpHuHJJLtc{q6Kss%A3vcA{lhh3i%QHXUS*+DyjaB1~UR@>z(5_ z@XwSb7gnj@IuM1Jf(K2^NXy9N6z01U;&Ak-$31MSBk8bbT|+Ndy;Kd~92tMHul441 z%2D5d2cuR5b4x5PhGfy%icavgo)Tr{9d+1wD}D@Qj^$T@Ha>Ny&J8m5F;aO75z)ds zJ$>Smr}?~b+6v`qtOFrY0uq)wkl6M0E;Ryp%5Fw5B33X{iGWZ9p-ITON_^`kxSEl; z%ITs%2xdJVBq4;j95~hGys(t;5KWlc=`4hgEa0GCvDIi~OMhw8#!*sn0)Y%)JTnwR zGy@w~^B=v37CxnooOoU8J72>7nG+JU>ou+X+PH$X^C6}r_N-R=x#M}S$TExl73xt| zV}pgUX(DNpXLTo*?i2+342P7zRww}yN1QpdlFQiI|yN|!VyL$`$Z$bD*-sEZ2bqJOgM4#^(&tUkkNz;tqZARbOjgj z;o=vbc*a7LE$%icCd|*}2p{G~T5(=p_`-R7JktLGj3{#qJOrJKIEMY>IvyY*Z?@T% zRRV&q9T62Cd*ME)P{B6q2(4K+Wp?UCUKO{&G|LZNAIGj=cO`w>nRqS-`T%$9S{HkF zDJ-3Ftql$#92wB?Bgb5#^u%!OwKcI$%ky{MP6I>YZt$FQ#< z2_ZH^Y&b29)Rg!%axXH6xRYJ}_v8quIpdz}FJ$s^U3@OuO>NHgjg7B}-|Yc%%z0Be zA9F^BYM8x$YFLiXVK2p0pBZ=Whcyjj$EOuqdtLI{h0ass=q&(`{O<=r6$zshP}m}t zGXYK0xr>a~{9dRs&JfE8TS_f0FDOYlZrLGjaT%L7Rg!bFne|52|0OMMA?=jq*NR$v ztAPRxDhK^=nrdwDNoNg|^rxmhDFAw57|R*3=^AJszeJQQ=CI&c5AwLq0#xErGo>N~ zdvFR<92QmMYo$H7Vu0)r_vhLtwvz?mxCJuob)B(ULSg4o3fCUUaD8{%+D18hn5<5v zXZFN8q1I^`T-{nJfb>>4{0zA5Gn;@wX^P`QtJOF`&8dNpn2_R)E zzt=JP66=d+32(kHLn7D(2&x=h{~e{AzH%zwd|LVcG=IS;&dw$Hha~cZi=|CsW77cd zwql)(4IAE?VOg6=r>FDH;?NY2 z91xSUm;cd5Vd-<=*Dw(-0;d*+ntzX#)qD_4eZm%s^SOV6N6j#GDsw+dHv3zDn9^n< zyx;+ACbaas(62jR=$aqq^kHSGKoZxyt;sCRMqLJeNGbH}_~GxYZ&*A-rcX}F5k?sh zO9$$sFBFNh(RvU}OTMuIKJP&VrO$G5ai#mpSSX z0o;;74`LwcC+S*hB4!W5FG|PYzlmJ(B)^#d=rh6)>SW^V4YN%C^37JeB>6PmnMVoq zv`&(M4ar1DgqY^)0X4S>3&EQW1Tg!OA=|8g2hw8BFK5NY-s7+xC>@c8noFm4k!+Xo zSOZXcB+r8P05n1O0d5p#xQ7Z9?ul4@pHU zUpy5^ev}Q9e8%Bt0O^Q@BeR&LwZ~<>lk!kJXo(t7dTc^}$g(V*k!_zf$Jlz@vVnl&5O{ z{D+b(sO1^EXxBpYpiNs9e2H20Di$nkg9WG3eB!Vq-{S?hy z%kj=7XqFM5K1+Okio5Tak@-Q6Rm6cVBlsY;b7Fd%CmWV=^o4mV^2A76lzCRufx6z1 zr`CohWAV4`QiqMC%uN5-h@ufnSnd&~P|#s-5+kDgMCFAu=?G{CW0<{a9hbqiK94fd zGN@+hPllmH6m=!(bmLeLy~rB`RWe0j{=rddjScgsHkG})HH;m<`PevdD&a+q0gWgk zAZH}To3u_y+AdwRPA>-le&O*qamcXEQ95ZpE{u5@979oI#!U*g*Jx-;V+?vxRC_`~ z(RVn{L5@93JB%K76QRom7FYOxGCP$OiFqqj)@~ueXI%7f%!WPpiX0lZ1GcW)-3Gge zb>ef_v>K1ikfugN>pFCu(4z<@zP-RCvrPU@;qGtDgzMPfWcgx+X)!o2*V6`5%@+a? z_3ZN)N&*|z_v*sQZG~s;@YSB-lw3IKSsH@8->s+ZicN%EJD)Ju;T)OUV}R%kEtxV+ zc=BJ9{FT-uFof7)C=+HpWre_&H)e(wsFZ4JZ*XLA896IHYHl*ry@*2eHLhwB91WYY ze4Uxa@RX{am{Rj<So?JF3vyd(yf*iJ8-D^ER{TLx=Jr|N9WxL;e`)sg(Ngb#==XD2R;) zT|<7RCo?U`ynjqQ?z9AXg3`yL3e8lJLzz#--pN*Bx*Vrr`Q+}lUu#R?&L6xz&K-*? zOaMD9vpVO`g2^WQNDw+;*1|8ZlDzb*Q|vuY7;{)@B+%=VTtZqqk?@xN*+_p^fD+sHtk5S6 zwWCa*`71^Qaea;OBD2`^aocNUFn@GKX*-Kxo0&XY8Bike!AmSjIQ5Tjz-6{B3Meq! zR``jo;3$8Hna>Iuko<;Q$YetRk#!zf@WM;0Iq}at*>7`EZqn66cXVx6&)CSa_}xAr zy6_HA1?F1b``_0IeFG%c>>?aXs9PoY&k0FdFb$Wby-GvP8OIzZB8;<5Thy;lrE2#J z(S^Is-qJR8zG%)U+T6HhLJ!zJ@ERVTRL5RW-YTC zZUe!~lPkoCFOmiWLdWo?{0?Tk)|CEMrA@*_uTa#Of1`W68iP~ty_fGjmP`Bkh9^&q z`&GbEMudyWRCW2@H+B+mGj2Y)_T*F z1ipKBq&$w&BKpHe4=YmzQX}oM*H=T$>qEfWe@0$o>IPe?UQrEWA6#)n4=4nke=95n zjnxTut6GvRrX14(86?3`pNB97lWGUHg_FDqpUIY(w7KtYJkJUffCA~E4Un&UB+chc zHKF&VJ_piO{Czi;zGg0C_nH1nRF{H6^7z0Iqhc&b|A1yO2WY~m2b1+UgS z^Eu>41ygT%ork?Gjb7(O0I{c_fi?L(I`Klk(I|QR8`RuAK`mP&^_|yIh}-%b$kzsS znIgmegAIVapGMv)zQ8cqOn3%RN!h@i1tiDh)(D{LlGfafmf8$GZGU;zv<-F)JM_nzj<8`M6sdPe-Wv6&@4n2|oRx(Xq4YFaHg4M zy6b@|72eu2^(`X?IA^L_q=gvmU z-(wh>=lBv~nf79sV~twY&NBOzXxo`ja5*b4_QGQ05OXq;X_2m@r~Dfw+AeglCk+4B zkR0$W9yLX>`>pHWg^agpxtU_sf8yU8o}1mEr%t7{vU!3r3v3KZo&7Vox&OkIIWtJ0 zOh)5C6?eJ$feiDkUJ0tMsm^xUQ&1P!BgF@*638b~{ThgG`=^# z4S*EyxaP8jzdlQSAud4fxA4g)U&{MyVcO=QW?#|cd#|zVd~*|Ng}&~zGk8G+_*Fy;NNI103e&aEBq;G@KTv|m`NzLD{nc|ZED{s-NycQ zAqTO=OX~hzfj1`N6aw(zItQ3SbT{< zi>||iaUgN#0X!8T1kQ|Kc*t7>m*mH?3jhj)!SiL-VM8^s##9x1fhbwwD4E`wUxsrOt8Kh4WlrMoA)4Ed#~8J;orx!wl9Mw5+S`0! zm#$XREq!&{=E~#-v6u`>taVgWtn=MJWFmV(OeD$?gIH>3RW!Egg;@V1ip@=q<+hi$ z$Z@mGj&lhWIsnls`!{~aLd=G%U#nYT>A)vtOES{;v?&h|Ey4TG2acl<7u6C zBXxv*MWdMxE+`R#7st8>&~hIg#0Y=X@q(>iE2nUCr$&B2PCh6M8$D$7ukvJYK40W6 z+|ZSrHl^nx3Zhk`K+0qa$6F;PbHfcqfDB(a*D|_cZS1Sk!)n!(Y&ToP1OeUJs0!K4 zw3eKuohF;^y&z2o?#y@CL8I*cLKPN^Ha{r$QpOo^8r@%EW}pZJe*nKMgQFZLM#0z{ z@YMf-(xQtJtVBU>N3@t3#IHmCJ?4^#!UR+rbl~4v%2gKavqpvH@&(X*WQ0*4F0wO(ufzTr3G4AkMK%nE%cjZpv z^sc-dXn3!P#6@@VVy7YG#ZkPq#}gUYQ*cCy?{;dB8aTpC2y2vmkk&nFAajH# z&Z|UD>spgC1_yW&#lqwFEOXO{V4B(qQ{jx+huF7VVjN2!Zp5R$;X(H3rS1nVSVx0@ zp%n#wTRovsI>3b`Iz{t|hMIhS|AWMLSA<6V#US(~8|QRlMJ!fNDMe^&u9mPZs|=>N z`<<=hO@_GFq9af zy^?JZBxKyDlmZyHnd=gb&%{$7zX4_Eq~?|ZsQp++;E(ye{A7a4(h?~ZB=jxGq~xJ- zeLC(O%(az%Dwdr2dSG@28f8QoyQ1Sp#wR=#FDp&^QcmIo2LP%(1<%)cLbh)#an~ox zPyzHSY#?7B+-ZWTxKR?5?L|Z!v`8igg9Z{*a9mMR?Qa8dQQktgGEofsJn1>rZtujE zeaRflm^fC+5c?u&D3u!CW~Doz_bP{yL_=j(ivi@5@s)IuWa+%}Em1Vi#7Mrx8l>(hFra#MT<#+`#=4bN`o^L%d5w2^uM4jU9Ec$aolr(+csB zqKjv2$pnn2RNt6R(=z8v_ut=SvxXsGXdk`zS;oVU?g6*B&OPO{IfbrLjaD=Y&HAt^ z25t4phvp|@;`3>ZjH-oZmy*WBs^c(Kr#2i_98PNy)OH1>l@Uo%=U?XBl7*Zs{Lt#Pil2W>6 zJGOjlr=5$La#ob+C)l=RNRNo$XTus>wi6e-dKs$6J=tH(peZ{#U!azf@_m7 z;C!x!in0o$V=0F`k*lVpXNX$-1GFzWR8TYpz{w-IXtLe(q?fv=+{Z733IgV3?(OHE zenRku+c=;v)AH!(&@TQ`&Hpt-Ltq~e)FgH8Ouwq4@fTU+ye$IAMdaN(uHp1l zG9wfJR=~`!?!tsC?+avB2JXNPb^*J$XkT)WNQBt+Q@FqyMoGr=M=@Fp&e3HhFF49K z;9VtiyKOJ$uQ*Mch0EPbZIjhVE15ROYjO&n?x=W;S=NuDGD zRS>=EP!Mj)*z8g-l4-xlU1v5I$s2Pv?Ub4W3bnZ-6xXq;Tm<7oC|F9eYVHQCbD2ch zwue3m9f}sfDCrH_9ng@{AB#0P-IH_MB5WtSIft^>jv!ZBi(}D^J;?C_5_vc^a2iRMZ!63%%W4GYQ1V`DgT&W9T;#dbTD`7@V=P1aWX>$6v zj5U|07TeLn#Yb?FF(F-50_uCY!r|Mk=$GyEIe0D<0ncA1w-x zMC)SvCN<^rHNnGparyfB(h9KQxuriv=$B3^KlQ>miL{X;G<+jU+my)T7RXa0lVf93 zzS%f&|0IFid|OJuO8xQ9aCPmK61HVE>d|t{q2DK>;3B1xJovU7)g~J&sif~nQ&@s- zC8~Q;DkpMe?qC8m0K*6a6E!+`*R$Xux7E!udHBv2#ckSa-<3#igDQ38UbbchxAQfS z<|tpl?gkS)Cc2*i!dv?VTuv_Y{m;5Wx+a2YUh*ui2ltL4ksdY3TgBr7Pz#VP#`k?0 zPejv{(-a5tj$!C4sLbYiDIEK~hOhr-OJY5?gWdFO`#wiOm1>4IK4n{qdCz!~ow8&7 z0A-Jd5}4lkDeErfL2t{n`o@*vs9H%j&okBM*}hir^7m-^?d4|m9yV}kaW-tz7G1hj zZH2GiPKEVg&|+xXUA3wlAzkN0P_;nxo|7#~5Ru|zZ=gb3BdrF*7m7#szqOdzwBdzJ zk9em@zR9w^S9%TV8?l-H|M`;6s}ew2C*yv(RSCB8ajnW+$Ztm%-Vt~3kYWJ-x9CN# zL+AlpHO{|hhgPx_ZAL=Y)l9`rbPa;GXKPuh3d%v|&^mP|`*6WxLwxr0Q-plsgz^(F zG~9xz1yM;^F0_*G-m<*uH}aNZtj~>?&(t5ClNkBa?A3~$SH#sCSOu+8+nT_STWZnp zxW4+DZBc1*f<|Tgw#Bux2dxDcVydr-PtU3A6);NYtoeTcd7AQ<_zum0bF0D#PTgKXqskpr>|B9SR$nF zzm=t*R1T6}D4&d%AaYMcA||||#UzudM<^9`K&lomLwnZEfDdk9hrrnkQF0L$xR|>n zzpN438v~5!NFB!t7p#v>n^KPuJ9AHV%RGHD<@26VU&k#g`RGf^yb4L4y%LI1dlDE8 z5hj#nJoe4F!3Yla9Lx1Hbscn$ZFS)nrI7#Ms*MtP1CzZTJQ#uAhTqOCe;@0^VINc4 z5gn16vy=u&5*+Fj>y`_hoQgjCQ|gvvQkA^*djCl87{hs2(E7#A#{6(?+v$vaj7ZfA znzeuC$~K=5I@(bC+^XeP4|o~ja(T|F@$ZGvyEhtT+uu1?@zx&b>+bCV*tN#LQ*OB^ z|L=D)qNiz@lKBz$A1#c&%D)S|P7WT9W^E~AwP<)9l)(qS)SP{nrw!U4wmiwwzuCuC4C_|{Z2>B&MF}tu6E`}s*>1RmUJ4h zWe}*M&iX_Q6>mT*Gpuw?umZZF&}q+04T{&qQN}yl05+0-^6rxV+WZmEp5VBx*FO4G zfB>szmVDUAlF7c_%gGPczX7rWzM52NZ2 zUF%IH+gl5L|GitXNg2(4v1*rPs~YQ?5=$Hn`elOa(3p7I%z-72%FW6_qCEJR+pf=-$2{gBgx+Kaoe#tY3lEYthRx*UMt} zqjZ}BkIPeIS3Pw8ftw_ol$+xy`;_ZH>h@2|yP)Cy#@ITWVkXYg2o9dMf6scvTBhgM{2JW)$@JGLQu#mpwN*uNGDi&d_pNK}+MaH{z4pY($ zDB{K1F(?f8>SBtSfP2K^WHyNor8+Tuf2b$A`SDIheq56g%DVG&^dk`%e7!tRYUOpj zCT}6HNRNbDtvjo#$!NC8TiOk8wr(c2iks^qOI%$p?-^?rw!^P7KXUN@frL4phZ;GX9(?KeXN>xIJBNJ`ijn(XUT}nj`K-y~F<{w#abA}Mfy7b7hp08v1$ zzr4Bi^LNjjw|G@8{po8MYi9B&&{E}{>W|Jyt>OaKs*LuDad9Hxbi;w{q)sMITi{cq zis$GO%mbFm1Ri?kD1Os=g4}xQ)@L3z@)XD#KZB9*fgrzHX2VQ0w7p-g#U5nud;z>M z&-J=}Ugee)a0ne!r3l1Uce-b)TZr26+#U8>%E=s=+dPCv7&>3ATAv|I3o+fEz(4Ws znqXf~Yb1r!Fc7WOL^(nWQI>{XZH68rl~zNy7&o35qp2FSB^ zQj;jPb;R7c;HI`o3sy_whtKPm-1CvKT^hV0M9Aeb*}^dDDYSthibabqvIj#$`5g9O zJLc%PJI=jja|+~YrPukRE37psS$`W8nxI{h2mqmssP{D%gm&|vySWp|mZbiL$vL5b zKCkxRh)_wt{W*w+^PCd3iaS;c%2vJ^WBi2IfL6M6GA4WU|9M!6p7`b!-k&-e#nMTF z<>D{C$L+}C)|P*P)2J@oKRcwx773SRiZ6=Sw*i`VFbc5G(bn=de#3f=mk9bD&wZ%g zN4>4To_u>yk4Y52%?~Bj?dd-L9vKd(UBs72-WSa`@0)M+j@7L$&94LgSbRWNWKf|L z4Mtij7W|`BBaQhzMioo&4`LM4zj#5qF*zRhPWjc-k9|F*i;dcBEn9A^py7MYF4A?L zt!jj##V-}MLpM6pfOrcHR};$;<>y(vT?I1(lS81>wTW74z$~60NFnGvnDzZFpxWXg zvpuPcb7DQUMmWipo+PgR_>i1wZUHMYRUWu&?;Je=`leK`Gm0#mKUM_B7F{k{<2_gw zs^&yT=Qcv(2u_{es+M#bkTn%_|a5 z8)rvcXNNfWHsP$gaOVF;Xs`g6e#Fp2Nx1=;RBRrSyyBLtl!52~)4$FOkiy3FP+x@@ zPqACCU;0$=Q?p>o=aT`ENMbCpA=JPdWvRgBjpR_x+`tN zX0#~q9o?C0yOuu-CDhv8Dsox*W#`l2SqM+B-|1O!xQ`J{M@T(ASpEG4;5KP;^i*Y& zNi+r){0^4rS@T1=uN<(KA2N?YW@gm1V z9Q7Ox`Ml(7tVE}4cuO9=UQ*wOTn!&VIYKe_U`~g!+jjm_%>DlqVP8A3{FN88qv}ox zMbbdJO)k9=4$i>RX_-!cA(ib)jB)dAS66bEgsY6$UM1#%df6);S-$Co>TYj~#C4m` zv3g8?6qvW4CrC#*$TfyB^(&!~c(%qoVB=rve7qVT$~xP>-nG!?bcZ1;(80Vhaelb( zNP92}SyB4H-~yjS@Bn+>rCFzc^Kglb;Ih4lptY(9Wv$sZk6DjAUpsl${^*+Q+FsKy zp2pA4Rd7l4;fE zv7pzaJ0Wi$1Rj?_=xZxxf5jRTvIbIsj9EWA5luB+>cUf7TZs{=%^4f={zv&4yL_iP zbdVUl=pqOv;;<_NYEZVqTm;|r;X08fS|5oNbPPX@sm&TbR0mwz92Kqgluhnx`!OAK z=!l6zq+1c{LsxE8tA%T8F5hYKZNI+Cq_afku{d!x4WvG*CAq2EH$z=DPMWy388k6Y zJFw{tMY4&w&g~sQI*u$DIUC=L)c_;sud1XXyK=*}6g@9vZffo0rZh}=%AJsd`oUOK z1v@6Una{62>wwJIPi~g5ZMq3Ro9;VAo@YN;YV>IqY9`D{OxHwIfk`z-{bx>GgKFei zCmm{v+H~2@x=hF0^cG<36>CG@*r9#^&}eaLK~R?$x_SOkYylXv;OD3^+WD1gAtovd zH1Izo!JJT1Rv6KSU#`_2^H%Kc%y;G<=`MLt6F!%lx$`$)5_q&~W~)2`EU z&$j}Tcb~u50o}<={j0Z3jh{Qp7SyEaH2V^ z@aROdQyn)SQ~dE@FVg4h%xv(HE+FW^hsL9?6nl{h2+ri z2%0yENu@vucA#Fxm3l6zRFev=p97-b?RW?kYk(Yn)th}ywM|O-)k+{_r+*Onj}MbS zP{aMJ|3TWWn(JQ}nk#uKA-vb9%paoTSNkSKh}~%MO`&O+IY0Q_31zFc(+M#+|H>;t zuH}qkIyKxdKMnW1Q`ag6b_cBY+6|P!dHbL$E zzw~~W{!bV^l1p4^) zduuG27(q-ecaTn|^$4&)oIuoz=G8%h0V`u?xG-x4bcr5V_>gTcFEV&vj8L}RpVf)B zR{v=dN8Ivd>Ghzc!PFQ2mkjw7tC$_T&BsS*3TSG9Fy4r<*=8v_-6GAI>9#O?&hmz^6UOAh|3njM_-g> zhb@s>=PHJ;XJ5OJOHGZckrlI?AvD~7#+hqoWEdRHfw922*R@`Q7t@`#_0P)wbB!lh zO#Xjv`jII$-{PX3FkXp(92g@n-~Haih?J%DPC%f=Z@oF0psKX1CY2SX#O}bM!H+z> zrl|U0V?>@9y;4QSM87(XkTJ?0MHaCsXPj z^x@#g{)D@D1#J!0Ie}gOe**+)r<{ZkesTtR)wRv4On81JBOy~KbkBaLuJ3?~f@rY~ zx(Z@H-;rQZCk?IRQ~HF30&B``Xz}gm10NrqHoE{mb~A*4N1C4o+Ax^orwwZB{J23J zV{seGOcWgnJAS>0mXyxF0dc-WV(pQk{*mj2I4bD_N?y$|5!wwXbM#NW%cAeA5v}Bc zB_U5by;g%a5&?PmbSf24Xiog6M`A;J#t__peIy`X?dZ9ZD8ipt@~o8<<}v(uHyYMz zBN7y8CDB&RZ6OcNjR5t&c(-n-9QO+Ohmos~zrn>6Y9e4H0|sGI&P#-YpIG(7uZojK4*kpqt28(xt}TCuSbEsAE@Z!qLJaWm(w4d`C-e{`hxSbP zis0`+RQLmwX383aO!`|-jm7AB9eU5+7slvX0^9*!Ru5+;7Z$kDr?eX#d^A-C_dcoNHZNDQ?z!)3taOyJrr;ljDN?orV z(jBsc@;7Kh&ghl({L$`JQ#^>v#QlmeM2thfB}Eu3oel8rs|49C(qs^vi|LMXCkHlc zp)=>$=cDpkY2HST<9q4iwS8b#0b=F^LD)%EbUE^XL zWau7GGfME{dgdwRHrIgz>c=cJlQwCGy$whr!!jh1sq1+ba@_o113ebvYNx3~f>;l} z-jArtICK|&!TOnRgd;*8ka=h**HcrZT=t*t>~QY8eF;0(CYHsfSW)NJNZM2X8T&A{ zxq-v{`~CNyK7{prsvI@2*c?35v()(!#X;9C_(9IG5~Iqny)JlP^3A5zq=7q`u*`8X z;XM~c%?i)DDaS7GZb*y7&>~td0~G4HyK^{^ZrIHoG;>ytr5QJ%-f5kFhn4kONSj|E zG9U;a-&*zbnFa1!IY~Dsf>@SHv!j_j(VynY(Q9&D7(<%V#BK z#i)aiSW@?>fTiIYQ^!l`Hxha67L2#~BK@B5)Yaw(kbydD?OaM_5)2=TxxoEgR;h(9 z1q7H81q;Sseklp{D>x_}Or1FTajoF(QrE)`>eY!v|ExoY~I@r4e(V(VGlp4=-CW zSxeOPHXDdsilNlqhZiXiiqFQ)E5I9%VK!e4yWrG6y>qT%P?YeCoG|R z22@v~P8{7I)>W?9f^jxqc)%0Aa;bF;WgcjAnE@k9t=Y{)cCjb@oO%;oI=}&1q+z&Q zYf`JW|5SQi71w^w_QM>PrF9}Ql-nYL3VM%v!mrzUt$z(7Qu>NbbP*``F*_CCl}drp zmc^1NIBm;7DwDB0Tw0>}BkG|ASVS?d&&)ib)eiumLXFZ#48}4o(I1}Ha(`kQQ#2ZegJ+@oOA=h*~C)8PmQVC%< zrqvB_7f%ghlSG(W2x4t{GkI<4A-!3y*MXbQgpp~tR=;0;!PGo_=(d?qOB4`+k5V1h zTa|j_l%Ay$Mn~k|A=_1Gn?R`&sj6xL4RQLzJw=2(G345mkZY=bT8}HRPtS16xrit~ z;t|^ZwdE4H>F}g2{2t7YO}ZF>Ep#)fy5$K}J=*_Jj6X%;=SKg?LJ3}mhP9DLw-wB1 ztv`E>W*@bw0#c6Nlv6H~yN_r}3YFEV!%9hK*z&0c>zvlv*ICS?O8@Y+pD^bjt~s1U z4m~`4q}8Z*ft%2%#qa`r@Lo2pl{gF@`PZx=$ubPNo-khYo`mGTZ+yf+_R;$oFv~%6 zL1OM1Jz~~vIX5#!uMJ2!Imgg(7a-_7JpDQ=?cUPgiCvi_6|CNCo4tRgfL}5u!UoR` z&y}ZZz{QLwYid@K)|?Sde=+p{-aA$*=bhZ7Y*Y%X@VJx>@x0jtQSY^17mgsWE(%TE z_S!!QDIwzrDZGE8+{{;V64lieP_I{i(qqXxWR$fEu%lswF==Yc1r6&fCRIz;A*n1? zFna%A^VWqFgIQjc|7`W!>XAwWTV1HaIG+|yztX*aWz>As>`ext{~Y+4>aVNlfx+ie zb9yo58OD|?3kIq;@*_(AW~6AH@4g2i@6_Lb!rQPYG#5FWQ-A*a1R~hjFd^+_R_|Mq zYyK8aj4IpfEE6X1t~Bj||m-1yHnu~iuB)5PglG`xai=Al=moC}(n zq=gz93^s$%tmHF`Y0n6@LS4{Ny{uXWhJR z+o;#Gh>S|Z5KS)qk0Bq^Y8XwWm{~Wv@_7>Cz+%N3FUHl|L6Dd0GGt`+g18`F4jHh= z-Vo7|C!lz zjNq|p!QsKoB=(~5262!t3Wazq?geBydd6R3aknw4+vh+NN=n@Q{Hc9R^lPl}!J@@M zKh5mS!^4H1i$&^%II34JLs3>vYh)SSu(VUA?TOUVv$sqS;lFAeJN?8(V+dsa&mcBV zylk^NaqIlKks64zjf4k0F{_v6P9QzC-Apt9k_nD!df`+Ib1 zbD;lBSEXOl8AEDbF0v8Y2gq>rOuoXl2d6;P`@4U2zaTbG)O*cs@aPRCB@~%1(iGvQ z&?RJ+D)THMe2IcN=Y#qER%Wb+3$YeJYxKb4!)@iK69lq;#l2f zQwPPo%rN1&9Z)E|%*svyFXGSUy%?i}F|6LecnD#6Ps7PMQ+$Iu`>x^f1pG$GRlTE{ zQ+$$Ld`AMz!9VeFlks{#iqc3L+c-Y-hepzVACN?NBx}>jt@hsJ6H8W#Lszo#OyN1U ziU0zabg{P^?ixGNYlnk1p?#ZLzgCCw%E~t{)?|#2PQN*v+ri(T(mw8D znGLoQ+tS$Mi#4MKl-e4n$Y5i1?f1N=jDP)spdlKXWv(RP7Kb1h!>xbsJs&I0oXc6}c% zFH>y!h8JdGlc#|Q>69?pNjG-nIV9q@KY^BX$r4TwpRFYdUl`g>On;p(4}{%RX@~g<+_5n3uAQt2T{i^=h|U;H zhlEBL0nBleIyvYr7G|#~lKM~Jc*ixxkc6xv>*Ukk$zP7P3;9Hna*h)7c7a>Q{uqEi zrjz7%RLjNjif&;P>~v9i6a<<%DH*EdV+zV)=(UUt`bpxo`gX3q|gEhK;6dkJX z{M8&;VoK<3fnPy9*;P(3!QB|rGhH8o@Y#KL0av?2eE7!@7r$g4v=ej5oBA+%Ngrf> z4^Npd;D~X5_J^SxMGsAU6MBGQ*WR^(cT3b?*dX>*N5Aom;G-7-3feREa|_m<-S({L zvm_m-JNarkUo^1(MGLfUhLZq$WXxC8QRXkZnu4&H_#fSv zwNd%=zP;bx-IGR7B6wxl1j&>=U=wvtI9)yBz4~8oM7KvkO?-I{9J86klR`FyB!gf& zFTgoSu;5Y%YOuOewUDigQX`Ew(`F~!>@F8Q?iqV!$X3uYQ0#Cg0d#iGNNHj*`?$mi zYy`~no6L{KnGE0mE?TM_Nu8DQDVNn+kkHug+FI(Elmv|BzS3F-0P#o1!rgd zaBr&W!kS4WEZ|**<34}xO+#@6YQfdpAQ%=*Mxwz}i6jnJ4j(sqi!@F-Ja(kftSI7% zA7y5CI#K+^COo43>?3Oa!<=i-$v|U%PXLXFi|lDUH{k1GCV)nJ^Y_Lr6hJMYz+nav zvKZ3`C7<=#RTXy`OMn4^>&gF-Na85v$SI=Hm7VoD9&t#O&{r;Qk{6MudUV^hLKUed8*=-8;)(JyW@cs= z1QXUeXDQ_B2*S|N$r>eTMspXDyo-bkoKNcd&f~lo(u(;NkXtT}M-1uybVLP`$bpGT zOs9T?#NgUMOqF<^Fld#Knwra^L6uCya8fc9L51@=A>vBjTvps4poMQEf8LX9r6-8k z!%s#(G!(7HAf&)GF2;3V=1|{=BPwADJ~-Z*^l>fxs$}HdUIQ@-;qFZl;F6-a^zBjA z#C=XBpEk^uapBJwHFF*ddAC`E{}^N$LFR1^feV#V*;wN|Ul4tGOA0hbfA#vj=yY~|Sf~w^tSlHw!#e^iPq&iI z>Fe?fhL3MET*7`Y3ZbQ9Dyd$Oy;!ub5cj7$x znI+YM{uXy2i-?12;e+pZ)FXQ(DoDM(AR1I6`VBKCQzLed(|Jv~I6!D4lWDTj0naM1 zR25fLOF8$Xqw_#^VV3{mx_fJ!*{ z!$E#i*utSHkdQ=a2IQdvT(L<;y}xw*{8O$%#QGzD(_8@K>+e%VKxZ5riEOx&f0|Uc zaJBg9%)dESAsvPhJYe~`K3Njk>=P~TLc!J*B3@6 zS@)?^ND0@bQn3`;l-6vyvog4&{UI4cjHYhN?!%3?yj{jbHDZj65+wql*4Jgx;KM(Q zf1Fcg+mTCRvV1R|y5cn2ex!;;lBEaXFEa`@1-Ufu&7TMou~BmJ%eyrG-yB4 zbbj4`E-EG^B{pU*_PrS`kV{eRwKmS4TTA<;AR;VZ+aePAjX3xTMYJIJGq+F{yx^jn z@W!G?7C|1TQi+%kDv3&Oc0?A+y-tw?9*OZd@u!-o`Ks}XB|Eng;z>j|KmmiqBQJmz z39+Ya_}+6`P`HS9%Btsn!7jS(S!&P`R|r)}Zb$|gU`XMA^}Dt6 zo|sw|n?%4X@dkpbSPjj3D#dS;1>HG^IJ#>TJp1uB1bdgkh1t@Q^i;^AE)IJZ%&wMS zFeDS3$3@j+15SMR_)IELr;f8f+`Y2jQbL&W%WarCbEHu%XHI1?bwH5#oh>D?%z^kC z#?njGHXhE1Z5oc3lOqP!d)IeWx~OYZ$6?2lIfiF{_HWtLhZkf|JS~$JrxV2wUH2Yy zJzpb8hpRq(B+1SVWmva>%I{V6UG=mdeT%OhlHmeo%S0R0hJWKJ8(bHNu9DQk$70vc zI1YV=f3Eb!U5g9@v#v4p(HJ}xhoUqKY2~@)#gB81Um9HaPDUe%nbz5p7@&ByU;ba%yNnjeSQ= z6wjvftRa;MI_>BTvlhf22slS}czIMypsT=0f8zZ=tSJ$# z_9!8aINv0ISCI3JFDYD|qD{c7zpRLjAX@^`A{r0;RtueT@mGLLl~^oIPCjRKnM#f~ z2BgIm81oj&Nz01Li1ggU`C+VBTJ>B&g-P`3&e+cp=oR73S#I4`5(8hdWg94vqE?o6 z6k;+_;3-WZ+5rRzMuBJ+HOT7*O`4TLv>9C*8%vz#6-6{Xn!#xFHyAF zNjrs57fXVa%Dy^geZ`RSRib)2@r`(qscVUF$u6LaRT1q@G(EnLhRLJ;K z!YOACu3nvd&5&=6h?a;ctyBgjjSv^hl>c%*F+f(Ds+zVb-B3GOPj+;8mBK-%lN^| zM<*-$Jx^AkD>ll-_>L6`I+fsY6N4qRXDQSwVnayzgkLAIMlM+`eki(x=*j=Hk%SSp z@|-B**}fv+^I;7ui*E`dzH*WadrYGoYTq@mcDj7TL4C#nP|Q1D-Ws+ymyELRtkeWCd#> zv}#cFPVrbM_FrC}oj+c%C?}T}xfJ*zhbl*j57(ADr@M(*EZOECqG)Rpz$FpK%S5x% zNo{_xWY&T$44Qv9m_k;qN?#ugSbLR$kOaF5SR$s| zw75J;Jb;wW1w_U8gpsi$=0pwhlo+b)p-oxV^G-C(;B_*$*5@Q*5JaG0$Qz-7JJP{d zJCyX{{CgWt8rTvHug2k-pJ*M)9wF8)HFIOrQsUxgQrC%?Bo7shs69!i;yD>K)_Yc$ zGQ=bL5T@pv;JTvyh}`IzBfU^4?BiV57YOwNfiO;b{|r18S0NnAbykYstLs0f=1U*c z4d3^ENzKb!qU5TFrWFRK!E=}A)FM3Oa~@AL82%yh!~ZpyWo9`qO_G+ zWIyl%YFL_&K;&~@en6#_NAn@7qr9DS5Q=JHl(c++`t9yse1S3NxJ zaWBZQJ=dTtcf#phh1$V~KJk5iLZ_srR(Mc`kMk$G6HWC){-9SlmtjuLb+q#uZB;J8 z9&ET#`Grx(?4p}fUZebPUrxen>-p@WU(pd2r{EOz8l3Y2ydm##?b1JR>w$aWeG~39u;p=YfJb%m zGEuwbNsc}7-NU&$IgMYgeudj~Hio=s)8PDQ^Ta-2OB!28_ZdPD+R;1Tz*Xp5_@xtA zAz4J{>sR@|AfT2f`yGL|P|V3O5nb}X$osNaRIBA{(JP3lL~0d!kBFlZTJ3*HoIvts zsxlNrsGA)Ud*xn9k)eH_;<;oO$cs{kXTRJ&`Bh%M{#wC$SvB*p?9F|dsz>CG=nQ#_ zD67>8IWH(`nC*&(^dU7(7+H7uSnYi(Mp56A-f4Xg8ppfASNT>`(OjpxLm$?1 zgWCT6P+L0f;hC+$l=T{GF82@z(dB0+PhYiblQx`@?1__@S=4g2>PUP%w*Qc>vxC3Q zdg{<@y&n6lz7ZUCCTOE@z2f)=1Dgzv=Tuux51z&<13*SM9^CV&JC7fDI*Mn1vFoN6PrW?q zkc0H*b!@-$W{#sNZ~o!n2FKg+!S09wked@YKZHK-*z?Xb%!|%8`H>HO-)?z>^LM-O zneI}Y??F#pE*9oeO)l5v$~dSUp-qOK;l^wRCNUUT&bfWoosIr!N8WI!-oC@#PmC{N zq92S_TrYXN7i)vZH+%AgryaQ-#r_uOL)>*<4uwCSK1i?_VXgj$=r-><_7Rf#NbB`E z|J~zLpFPW$A5d=QYg6CL@&2?QJJ8fOxP+wxtW@&*dj9>Lzmw^!{%ssU)#bV1+k)N~ zI-DQ;P1v8pzY~!vyuOI1L^Topme|JP9uc3V?o(-{NnDrqTy;_<-I?yEnXFB}CLZmR znr(>EsZV5CRKr@=ud@0z>x&}$XWokA>e^&^e=~8#3FF`G!7H*wJDq z7}3GVrbab1y0FpD7t`99&q{iyxJt%XP+3jozok7gsP(&cKU(|iso$yNyY}y?>%51$*!xUy!#$+e`e1gZn2k(|Ml|T4&?;C`dhD`@5s#^UEi_)djCo%i?%etQ_psKcW1un z+vUFB-tsihe;TQvm(sm_qMn<(TH34UBY#!jv;Fx~)W=)-G5XqWwDV>R{`5CWZG3wXbz_bv%H%AlK@%?H) ze39&?J`M464)D}Vep%$#etz5H_x;Yl>%uO7cK6pt*S_>mXa9RT0OSBP6C49?fkgxD z2JAMfjX{Nj_6L&(Y&~%Q(R1``(|*WkDX-r2>ma{m{*t8)D8L7;D0%}%A&d)QmY_htPZk=Ydcx{4EbYp9IjI_May-0sb+*8)}WrYpk4y?4pW&=RTnjr4A^4eIURl) z^J)5M=T;+IQM*%5H0G=Wj*M@iXN!sBO{!}{XB*d>mSu2+8C%S%XDpAg1I~{!ua?Q` zrnXx6#?^f0%r?cF&uvSjh4=2BbU)ONV;*$0^M{ACZ3wmdp2tgVI^bzF`^^s6u+7`S z0EevE8RLkTqeUFsY@de{Pkr3y!0v+^4qf=x^IX;Ckn?9rGfvmPa-JM`?PuRfYVDPf z>osop-;BTcZ1CdHpc`{;-WnZtJM&(d`w92IGOZyGEFcdpA&)Yi#y9Ba()@i4@zl^Z~n}c)HbDQSQXx`R*Ip$exVBYu{ z`SQ>9oHujx%y+$_3*Yv31ZVpfB^2c@s#G+8_LDy5jtBaD>D#)~<-R}qO_=9ne+O{h zl3iMN>D^`id;wjb-%z~Uts9FL&s@;GdynpaZ*JXV`N9t1!u@+*ytP`d+qZ@Gp0${3 zpDBwwfQxr3xgQtVck+^v{l+YLb-?F=HsDf`rDaO1m-a1lDI2}?qrsKRw=J7Ez;i(V z0T+hl9XM_IT`M%MI5xs<(DIcc22Wqv7F@a0kQbxlhb~^#JZ$!=PsReS<~BTT_^)vn z$DfEVF#7Vulraw`wHw!Ye9ZWD>wlm2X8NHST_&BMb!U#x)cbS)&O5ST#nvYm&E7V4 zuKPSEaQmxEuP=SL%pTmqYkt-FQ+8Oi!^Ry>FT1&1;Eo9k@-7&<@>Fnph|m47xxuF6z5v!e?y}UD-Lnl*k$9(ME6ZSH(lN3 zpka+RpS{y(OOGwL?sC$IsI6m z(PPJoW8HTK@9enq`~yXI-G0z@cbnaJ9&+7NX3y*s-ankVcgl%B9;v(U?4!1tJoe;E zkLBEW_VFV7$Dca$)b*$CJax~hm!AkYQ2apk11%18KQQXFm8Wex?ZJ~ynx1kn_rdZ9 zYaVQTu-UnSFMyZ>}$cE7_-A|=y`wI(gWp}kQ!LoZgWHGN$+U+rFV!xd|d zmB^aD+Jzq(S0Za&iL8m~g3qO^1EEl-e#UsNqz_>liqM1yf(A<4k2IYpP`KB3J!p1= z2ao&Tp%M6Zsr)A#qZF&Ouvio9w!_YMgLe2A2g$zrDIP15L9&mYz%%>&3J3xK5&&bz z+4DFDB+rN^5kyD@KuOLq&4oeb_H1Ke7G4tS6RRylATvu)D6@!W4(II27eda$uGFmDnm5(+5I;kmGzU(@) z1ci&BSc@ba<0nt=0T=wcuYNdd@k-8D?w*?UW(c+XiOpbHQN6KYIK<;ri^s#Au5z4PbLJd5Rupq8hDW%5<@c6mG$vta zcx~00cgLnK&n^;#DxILVHf1VlE-8fRq@niIc!+(u8Ew{x(><|&fQe%w{$LEM017A& zrS}ve60315venEKW&S}n5Gx~nq6m>Tc&~tlpw!>$n7%~mF%Gu4?8X$b;O}b|eF*otmFCFpvXilUs^7--T?ii0q>NFx?^q95G%v^UY%#v73&w4$f530!6}M9p)NQF+TiQd5 z_O6Cr!|1y{i?6Z0kj3v%5dSUH<@PcjYRBTC?evh7;^slFf_|=dAWyi#HP5Y^Ge;oD zC)-mE9^CFfe>|fp<@R&RXUKRy_v5P!&z#PoRgC=>QX7aV53YqZ3SjM<;&PrF(m(_n zn=q>-2BkEmD?y{Px(PRAH0XiG*=EjT+<|RNetPBd`V`u#+dF+^t1?>miBs;$S&u#M z8x^R_byiAH0AWIGdsuQCo>AJ zAXven15C_J3B3J!`a;o(oQ9^QDc4vC2EgpM#{ft%^n>3LN6CtKiqNNt@*X;JyS`hG zdrx@1K)|l!DNyl&^URY+P8~kP~7?Ox7>U24&o@Tr4z?|Vv=pMG>&3Tm1#{)j{b=f^0eI=eEXQs%Y<$_<1J&) zz-bZm{dwvsj#9{T)1D8D>+WqLp?^uP*j8H7aKMWCye2}B@wdalZoz&_i2`}U>cHG! zd<)?#+OLL7P+b<+Y|GSuEc0vQQ_!jp6a!^}cz1=MnQgAn6}aPuEy z+U%VM!U5R8@{&8`^8BLqhBG7!5yT-NMApt8`ZgyQWz@O{rf}b-LmaN!Pk;W}-iyi8CE6v3qKlFg~ z+RUm*OCcxV3NT0rn%_Puqs2ZnT9w+KqA&my3zsxOES^u=y&5mRR`WH*s?n=nQ3sNK zgP8%Fugn#G;{4cIqbQDMNhCWs6mqCHRHOvUG4vw(N#~k{%P$p48}t~!x<7a9 zozatSj{rY?-3VpqCCciJC(mcY>=nA!qPA@~_AzH3nEc6} zZwMGxs9CF z_>WlBU3t7<#Krq?;q_C=^O+Dljc=T{x~wf9FLJ(&c+eJiUA(sNC5`T`%{&ZsRFy%N$bqYc%+)P_6x(Sl`Ydl1Yd5jQSWt(uxdo9PiD3}Bq8N!*Z7@#-!&wq+CU%cF@!K=V-n#oRXvSSzstt_<{C5h zTcg^6hl6vTw;@#+C^$DO=qp-Sp*SoGvT$wV#Bg-f1<-E@gS2frOI_w%+ z(pZAGhItVY74CPwL7{gqTSIxH)eMxD6iu$xz?d zcA7DxcS|7Skiuawr|{}S;gZ1~Sc8FTtWze8wJo5#4vuA`S@Bfeq&X{9Dj{HTR;OGh zo5w<}SvX-2T`BC!n1S0Jdg9v!WG~tF&!AP(`yGCOH^#C(#2pMCI7JvA{JV$PD8s3U zxK`bdaaA;y&Jmyc;lrXjX z(~r5OLt~;Ulx3JGEs=~OGy(`Xi~_i;mv*#_kX9Z*=UEbDr2b~VXThZ!L2jUQ`rYnTc20nTFnZleqs!+2ptYiouO%q=GXv6K)Jun3CfX*QAV?)INoVF zh~IJ)D5l?;bHSS?i=w{P8$P5i@uwM&I#1A!`UyDI(ErT2c=HVz_1nn&^YACwce!rt zQuf_i-V$&sF=DDxS?Ng5nBlfgM!t6N=_W(*3<%eR zK^7Gm{=3|*iwi%F?pCx|_!jO&oh%JPDx0&{`hg({6m%a^74!W#P@YyBqtLyT71;;5 z#T$HI-Wk!SmGh49AUk$|i)qK@XBBr0Sxy97DuaqGgmI6tErk_<*vkA#xl@v26ebE; zeW>Ekl`4*Q5u77$yBB~-q?rHcVJ<4@%0|(12ANQYVf(WPoIAwZ4deXJq5@Gh0iaA? z+r(5^C(yB}^xlVwLxv`Nk)J1XW;9LEP8N2C;Lx+deX^3@GgLd2f!yDkxK%Vskjklc zI=1V+y8FdC;?A@oB^yb744v$0xJ0L+1P&oJ4E`;1Cr6WEr^4CnSQ|lJJssKKvshZ* z&LR>xzYRX>%NS54BK$;>J=T{L<_yef{3H!$tAcl%Bsz5x7Ulr^6zs~cHyVnAEx76?iQ$TkS;tJ?9(D6E?$CW9?2qQXA>_ivwItdGNfCVfduj0j+ ziyyIrMnwD}I`~usNU$Hix__aQ#^Y~tW^Deim)adP0P%!z23o+z4!|+g7;2#|_6$XF zycRNeucKm`EnXGEezB23# z*w=>)Cd_j~!@r;dArx2llU4xP-<&8rb&8;TjwLVoywj{*(Wbnj}#F`unBVTuKR1-8c!d}H>`9x zxG=BxrLYJyCn0dDVk|YJ1(`%}2jw8h=4B^@2W?G#=2YNmTLdPu!WE)Y^{ZzVXy! zImwBf#s1^qk7QsPHL;(joF-8kN<*lb07~L(b3I3qDEk2-&TG76_NO8LJ;!Vz%T_CRt)(bxBD{Duup;)sK``ZE}8Z_v9 zk{}OHk$)1!_iXd=?7_>uvyR3Qa83Rt0$)KVDR70P`CWO3xCN2&P|!rP=PB1FkXhJc zv-2Rukx!q&lB*czE9(7LKW;24e#@AsaG{f*3DirH56c6+I^G6H*8ru^d-BBewX@20 zuQh=x`B!Lo9Koth=N{q~y2(%)4vQbL7-lM3X3b9AP?W)fODc_fszoXnhhYMX$z*rw ztY}kmCiULFJ_IqL4l<{u1!Cv4Cj|b5nm2L*YE}JTUFXtfEPI&LLP)GE`L5=)>bu27`fxG zO2C7mv>0wfq8*ji(F!d}Y{MvS^3f}!t#fWwi_E=jq-+W|7kQU@$XRQkIRV>#7WAc#B9dX486jz`eFcyR8(RpD@_M4E9Eh$cpUdDDWrD!3MUZ~;Az^?6cc|8^UY z2NDjAEm3WEp~bn;P9N9YIC;%sYj3vl6&yt!EEPm5^o%ne#AJTw(y{Z~X8q!?cJ3he zwiL=!xZnMYc6+Vt*A(+U&?ie4%?)VxrE@hm3>odqyUk;2B`?8OKJDrDrUmHAllGpj z+;FO)1!(Vvn&uL`eWiVaa2)Wp67&$>i3gwHad-WV#J?$uczsD5&9?M{G>$;a6CTmd zRfMr@($OfPe-Z0*ND|3jYXl+^am)Zhy=wd8W{y@3CGxmFR`-m*Nyk$#NY~qt8f~B+ z25|_t-QQ~otVkRn{Vh@PulJM(@_JKMnDT6P?gR^q*789{i{t zyucHN$Gx&v&#peWej9P>IltI-iWAejf<&cObWSbLKDIw=-$4!@kE)IY$bgO%^~6YB z=Z>q}w~w=ld=hBqcU#fUY6gi1jz1*-PCR=J&8k^E`&UC5rCrX}-PjCn(gn`4m+>FV z;VPfpkr=$x%9m;nSKCzb)LY?M#id2HX=`L_r>kNe_g-Fs)<|_@Ci*3MxjY%Whg&^o zYU)8T8}is4$m8gWE%_`vXRO5#YJbO3vDN@*-&s0a;iKQ8bC`RB&MAY?lLdo`rNnSU zdsh3Q-4xFD?>;yTf7irr1z*I!*yA_Xym;}t#B~0)54U2aaEl+2f9Y?<%~-Rcy(irX zsSUZcaKrd*O{`4*E2>Ktr(B!%S0jx7%;Ai^=_+Ng;CF--Nt&5(7=1YFZ%M-N1~9SD zn)_U-|MS)J*+js{$&U-z$=_JC=>M4VO<}-PsAr*Xvy88^;~NY-cZSsiLGhdL5}|6g z39fY=?3Fdjc(~gP5O?#FSni!XQ~!j3F$#G=4c&LohkGTFs?LWAFk80S8UnXQ8?OcK zrpw3>{iOGc!=E}#LlEMRg_oL6#3oOV2I-BCPPNUZZWzP;zL>7%FbkE){U=44+VC!G zu~nx1C~-34{t!rN=#9H@ywp@W8J<`TeS}+w`2k~7ax9IrbD?a#H3VMAn+-lTE3{US zRYQ4AreD%|3>ow9fCwXNP92l_YN2TYeI14po4|MPUit%pw_z_f>RPmTx#ufJD@RrC zeS*&IRx=j90@zQE*K&r5(bn{^Z7;jB6v1 z>uT!(R0p5wfKU*8dVxey0Q=YTl_o&}&&0Q$&jKlY5(e&=xS>XVR^$W49A>*#1!==Z zjhCtwk8&_oprgBJUpL7XhM+bCh-s=h_*Xiq~WaLM`#6u?;BM*#^_Tb zk~t|XOd<;g-+C0BRlPGn1wi=w#-Kahb_k~XESHD&P#|s_`Y?P`l()yxs?JbTjzMOr zPfsS_`s*ze<<8zhm)^7@An>;-u^rk)=wCqx-t0g=kd!b1uAgwDeP$29zS6#~!C=Es zvm~bO<;1^)TFXM&>_dm+4}~;MWLo`NCvD4;A7E&ul>cG>C>W<4{nw;X&6(8zn*i!p zPsuF=Bl_cC439^rd=s$QBRBvoi>y#|x80Qp{D?(8mzO~g zT@|6E`!QL_&8@3qk0xHM&e3yr!kBl`Kj%EGzR}R-r-a=}1`9Z~&NJvW zG=HKEEbM=2L`G&heJyo9K>NA@y#22$ejUcXyl*f6q+dPrAN)XE+9)6lAOMED;p z{15*0^-sUquQ(Pf!rnMG+-cCT$F*ox*lI_}j$@1JIAdB;lkDm6oC$gJLU!*TX>eoq zMPE>Md!lUCl6W3wS3Fu-_aDvsOC?nYAZO{shWh}BmjQRFlIAId3DiY?8)^xR@|I|? zob4Sc#_Y&=ecrOT`+u9DEHaLkI4N=UgT;8={8NV$M#`Ky1cG~J`t&q3a~`Woaz7*< z*hohyWRRgW-6B!HDm6hjXa!tU0o?YQ!<)0wwi*+GvdH|&`e6rGP(0yXGGrzy_!be{ z3Ol=asEe$%TIy%9x<%)4kir_3_Zo*lGvKzGU`kF=q55f{mZzO0>_Z}y=nvS8FFrB8 z$p**y9ZO(tXhYr}+u}w!w#m;KL)&PciuiMMhEd3z;`4Ev6IGeFi;Xemi{fuxgW}p7 zcel#uHlvgMlc;6T`R-1kvy4=$aLwA&wN6^{yqC4)@GXDE&tosJua;rc72}o5kD6;) zi+?5bLifGKFw7|yl8b*m;iN?r|JLs=l_^r~L>R>w1vCAaCBn)foc+N#cq2tcwXO8o zbfLnMi-Ysl@CQYl5L89s(YWf^f%j2`?2qHOIS*Evr9ws1eVsh1MRacj;O z@8k!3X1x8{t&&5A&wllTaG+CYK3YF>4xur|322P-Rt)jwa~rpAMIT)IMRas{_{N4a#!Ok2?}pCObr;;sET52Q09ffD zo)_XTm@06p-7Mb>U?tsbXz&*<9id+HLNf(AdOO^+(+t7$mP7@Jp%U=ixM4=t7UYfg z62@91P=vls#^W}9ql{IHd3@d}F&1T1Sc~3sAk-Uv_T)ksxF$9AO=!1lpGiU}IWwr6 zl}CAG%@j}700NhS(0L1@zlTUF(9&JBuWPcKf8N=kcJUz0zQg&-d)w_OWfl_+-5}lm zcO2I_(oUe=&*xWxFQhM=qo9Cj4(ddHoFiT4@mQf0QC*Nh9n_)!{A|L0>Bo(e=Ev~Q zNn$aI=l)%@6(jyp+Oh}kF%}-zC(LkyiZ6i+8Uk9N2?+NRVQnXbIvCoTdI6%LEoe-W zHCu-UcGdLM5S|%1GEN{FnHUM+*1pssrIDwBOZ3rh6d|AgQad%#;1)zv-8~@wTP3Ii zEj)ZD`X~s&E#L+v;w-<@80XQIf37`Dh;WF3YFITvRp^k##gb2^hEe-MaD#=StKpad zr3N}BU{<@ffDIVfOL`4OdNW&@nxp8=@bwaCYknXLb-ZiC6hHx=QRndn&WpPWkD9kr zFKhpm@=TL)n7l>-Lu>xG1kwJGL~B*xsKBGUQMOWvpx*1`CAdTkIRv4p^*rNdpf0Zs8~?ei<4azti76hPD@(* zPoEChP>CRg9*Pl0?pq4Gg5y$lK#5_bu7dC#5<#$C79lO=itOiH1h34j;|X~6@aDNB zM}ge(>c$xg3WBg-5cHXQg?u^lr#)|#F244cCf4pZMSke=CTr+{8GB~8LE>shU=j5k z7(WSUU?x>qZTdorQS{)oHf?fdH%iYJD{x%VWWT4-7lvihA*RUDz9Zt~INwoD0 zJ2*6Z>FT^$7Sm|97H(W|-)K8-GX@nId^UV+TLy)9RH{k{{GhLgMS5Y141)x{FD!xo z9ik^6Pl;VfFjps|c%Pn>aBlig+w?aSUcA2*@ka5JAkXPXZaUU2!>U#4m41b+D#>23 zpIaVT7#~$S_Vr4pb!eJzL=3|a^RmAzTmisBJb-Yo?RvS~yW5Erug*4|!joO6Q^5Tj zJXZ<{-zjcO%W}_f&gEI>s(8q8`q5!UMn*WdvLgZ@fNlNe-(Q|z_7jx}#_O41=tF;G z)*4-0W(L_lVwCIpK!I6d#Z3MkCYC~J88B)BrzJrT^aaJ)Bnq zw%9Z`xEIY@#1L|p)tQtN8R)~{KFVfG&$qP#U*Lm zS85gUgzvYOs|ED0kWN`3ki-rnftts{nAItyd_-?O%E|(Fz%x_eD4dYA0dvMKEyxHJ zLf!f^CHZp!EQs6+yuZ`$DJwsKB{9fJLk(?aaIli8lC~r`=BXd4CFH2{osG1D7X)gB zw14OjvOgwR`#p=7E|Fjv9QUMxd#(HyP%$VZTWADZP`s__``-24rQLN=Yd^XY-RTE! zj-0Sk{Wu9x2;A`_?8kxDKO{d9u%}ugt9EZQDQHsYcYD}{v(Gw|J z%AKFev(`O5Ixw1c&k4|+cqfSGNYDb9b-(=xVfC7ST=C`JuO}abj&f0=1bWIB&V)M| z{!c_cwfL43)_$CR(7kU%n3YA%Z(dmm+{|?KK(Cg%RtyT~x)1QA))X@?Np{E$2mC8Q zpf7_{vt*vbt}_s!owNvqDOOATYU0+qxa}{<40dK*}8z2qRAeLrfMQx$VxgFrxP17B6vdGsyjKR-AKsY~H>YMwe$uO?H7U zTxC>?w9#jiOjVXngEoXNPLryuZCdiU{Nrq?v{j&s))y->=bG7d0g@e^n_@!WAr=)i~~HdD=cAkWg@+-mwPS9$u3-mE4W%o{RI1pqTlf&R9*e!&ZnC+X0Ui@$UEHSfY*I z@1W+X=rPZqE<9NOTW8iFbnw;R)KS19mj66T4$z9ns)KWb8N?-~B3mwjEQ2wwbP4xq znciBL&Q!CwhtfADIX@6D-@&#OXesr#mRK33z4BqRR>-a6`F@R5y4g}hFLJ@$#-!upGa zpe!=vVtrg+vV&>dK|p6US;*fQE5reAgbrg%Iy$Rxt1 zqhFoy+P$jyK2-8T-sTx*eQTb>*<`=A1QZ+b!yIwr7FlvMGEbZ=-2c zV}z2|4*Cg?OwFK=evlSBZtC&$L3&l07vpy%N5mc_`~XcnsLNZNIe+LnuHs6&vc8*b zy<0crcLQQ%ee8`UbxpljpL#;`Aw*Zv~2R)pK0B8ZZL z;2Uv^N6}Uz&u2{bBPW$bNx>@+4}UucU-gZIwovwY$MIA+1+|cZA{BsOZ&4X*r=5$A zaNd+(ze-9S=>;0c&=Sj(hdjwhkO7!X`LmO-{RcVvy-2A7eyof)q#+-WTwxakAtLd6 zLctI$KosMx9BdGDbM9RjX*5S2>Wf;A`a1)DKt=WgoGRGe#;A(r68okeF)jBv?F}5$QVX{t^@qh!Q?Qc^@^u6^(jwezJ)?l1Jk8 z3mc&R;EP9T_v0;oZpS$;ucR1UGtx}N`xHjDt`4w+e18;`TM}=6IClIMjLvUUS{yd1 zXC=A3ptJVP;ICoo{N3ClvP=m(ai=5e@bmp}S{&Ia;a|Iu^{=G2jsI`Q16q9TzZ>uW zntb++Q0(y;0HB z?s_^^)<(E3q>%e(fkD@hlat59qnWnzs(4yv&$)ZcLdAn0YQH>Evh1PresTWA^smHH zZ-xRfoksWkHs`pJ*;J&5VBT>JvyhPMo1l2i>AQUpcwEoCb(EJ+K}(ub#fKlrZ-upRTy8+Oec#0LmZFUuIwlufc^zuWCH zz^|Iqc9Z>N>!GypM1CqY78yb;vy<|lAAWiHh)@JKD10h~0~vP$&I0#Id>ZdMz-^2M zhP=DiEq#w=X))_x0h&nQ;@RA59OpTf{OZQ=gZXlrzF1rM%bEPXowf&d+#-6J zV>!j{u*u)%a8a47gm5MlkniSt7`tTd{M`#PMh+`~5nnla@}Sl6_4Kw@*Dzq+rTifM z@sidKY_d%u_IHtT&AeeyNGLWEtb&W@uJb3;e&9*YPxr>i1OX_NBQyu{A!-?QPm{Va z`|N$1*)e{VBJ6Tc19K{=9UO{!pVqHidplb^6g*dc+e5ydbfe?tm?y{X2*nW<@F~tg z_nQ=nBB}r{NbEM!LN`o}^QgwK{9|FT%yRoOKqe#6==jez=h5J5IHwennVIH93V-G7>$!%`=F|Y>?6Z7BETcTh96IR#0k;QQ_`u{nHjiU!H7dAD zg@O0;`sT7_5&T_-%P03W^ERR=QRvhpVOwaJaTdEh0<93yhFUOdP&~?n&vIU5B$1Q8 zX+nJf_d>-L6NqvaZoD<*=A?`CWu&f~Eo|l;sqcF$;=pi+V`HMutcMuo2*Vy=xO|{| z3v+?ku<~8yzSoqoSVOhYS386EzVp3~1#S&H$FF1r`!i6ey`!}igZKWX7KO%0;_;bI zq%YhxKXlfcDJH+H;d(nR+GW3ppEdXfhNc5eZf(h1o7MP_f;S*jxo^x*26OfXtop6i zsbOAcp~xJ2;T#6Dds;SQq7*G=i{Y+wMd6>02MRI$8|tHSQ)&(r@o+MU;J=@ZV0KKS zmO0dILA4E<6iUja7z)mVMUaAj=@QH{$Fg-Q9ad%4#t|+t*6D94y!d^Na|{eq+UbYm z8q_S(G3^;;Hvkl8VEUHJ2gwOw*EY$_0@?+1?M0Bl_xW{-2(+8@bd>2JIr8OQ(g&DR zx%>8~Q#gMDW^St!sM4CZoPj8CGw>^i#d>07dR!? zV180_v(Hj>l{xfOI5(8hpLc^GbDe=ra+tvCk?}%ki=XiFZlhm7;ukpgGcRpuBKsDm zELGoYK*QZD+e0Xiu;Hl4FP~_Dh+08fEy;!mA0b5Cg3urug)IAkPx8wov;(kiW^At% zEpbujFqS66pqkrcW4g3+gUA@-_R6tghT=eJgF<^zdm?n?t4Slbx(JIS;+LfC$KM6{ zfB6i0M4k)AF;i!&IGt!0EkbEMl_MvK(22SIZyq2Z?l=j&A`_Hu6h6Jss7TBm9;6GZJOvj(@SG7m`5founEwUa#+Cj z#x=eFMxz2PlYjG!A@%jjpR|!K6y<#m51x+!NEym_j6>92y;o8^ ztb?7-3wNwQCXzo}a=Xn*G+8tIC*%^g6v|e!c+d)duMc$?ZE}D7Jto{AS|d3Jd$orH zpx|!?N1{N%jn$%Kxx~DM_IDfG^QAvtG99Z9g7VRrHF=e>c9QqkvYO2$JBJ6&SY0Zoa+UOv zXH?Y$sJ!?)iD91+R|I_papw6-M`XIZ`eZKO z8JA~E#X&2|V+u&z>G~W>!-IWPLTU6}1%R2KN)!I8K%nM_fp3Nh!&|CeZ!!X!K8?Js zF-wY;{tH4W{BRte?+HCVx;fL0{RskJ+cxgsSD=_C$$`!fASwX_#R9vfpFHLLYf#*M zLwRpZP-adG@MnA+zgLZO zo@!wiQh7qI0&V@hPLOHiX7&_JIhUX}p`_;5++AK{Bc0YAgQTW$7X6?EL*T&a9 zh-f(f_cfEe1Q-5rLifT@SNi?_fRbCR5`utnDc(`qR7RJc!HxYe|%#J2z>&_o!RNVH>)noefW0Xo#zrP6ws48E0u8bY8C<3r~_ zrUvAu3)ve6Auw!jU0@bJEH8NE-d-y~2`~@Gpt|uO;Qj^u&O17suzNX1-0=0LBb$FL z9jTs&#g~ljltB|ZMk(Gf(!3M;KnI2sO}Ra3tm4#la*PaKFj@`y7oeIz6|-pJb_yNe zT3x%jy+|h`LSraA2ZC=i^sqS5zOTQ~^y&4k)cSV_yw@SAK&m_2TGF=5w&qW7_}cX? za?oIc76wTi?!YwMFL*`}m~DDlm<{2AV6}n~wUE8{gd7iv|7xu=QA~ZbfPsC^m-xyM zfgKt>tBdytkg4TEM+r0BtAyNiB0gSCaaK>+ES|Aiz_uNR!695|E2M$y-?vC!+oZBI z5E`WklQ$S>#w$g$UDPj(rHL?zGE?Vl^t0_~E+myqKhHFT5L%;~Hc!L;-GR)e%A65v z{AWUYx(IIEFf=^M<<1appXulTMCY!Cin{l+FJ-??HxYK z&y#=-Kc?0+bzqlZmwaC(aZoV2bWKelAi(_QfClD&{XB{|ZXDlBo>u8eUK4sGL z{L)+Q02*9tE$AReX$r8VuD1w4A6M4X4ki$(gO_Dza;O!0RphPFE7E_==Q&t>&&)Q3 z%5X?Fh88XgyfyRs94#q4R?0r1NzJi zTzQZa(8C%hV<~Z%nltb+gVWVLJd%s`I06%1M{fpELD2JenM1v_r^?Jw2^1d`NwSqg z=|)1HS@B%l@VJp{Qe^HJHz+d?v2$6g+WH;4O#+&W@JgoB#x&tFVV7ALY9bX|QCgR{ zAtsar$)uYZ@~+;6@HEJp_W&SZUcBMTc_IC{R(kOVdfBC|Knm>iUiov~%U48(#{e2P*IKY9{?&od%MG;@P%KR%squzy-N*Kjk-j{+fTN%(uVm8Fsd6|b% zJ4=KYX_h3Ik73SKv?6q?&H$nqFaquV%G)gy+#Bj4=}X5?oA;ZlH6x|cPfH9=;Hjrh z`8xu8m!Zmv{CIQtQr6wwd7sHwK+so`oF|&Ljn4sX(8T>+G|X5SAU$;=yeADpbJ2*k zRh1<;CV9|c8?X*c5;O>jxp~yLyQ1PrhiXMn$eYlSU(9)zm-u-&@xn5B`LrG2#hpTO z(WsRL`RO=h)yNmHSpoa)wZY-V$T{0k;>5?xjB`42Ij#3{Ean8Y(>4uM@X`er2n$Z` zKXCw{noj$2(cpDub+tGydC+Lqcm`bL0mJ46;ww?6rA}3aIazr+uK|}duJX>$&#ZgM zL21b0GBWZ#i_bF<2BH>ZOIo3bbWl;K%@JQ{x8Ub2^1(p`qIws+;g3OP}5}=pJwoq=vWw zS=8`FOWkdyYDJI8GvjPlF*ko#xt)iQ((knF4sNh~K>ma`Oge<`XHxCA$X;HlA~$JL zNjX4)7K28P`^^D2n%u)4dYcF;VUf;5f@t>f_ED&UaE3|(At<`aZA}ZHRif_CLSweq z6qn;D&9np#E8(#0oJx~s4J4pVK7F+nAGHlHs|ZMD-Du05%)_JBFxso>0hI*4UB1N2 zgE|~eC2QK3fKZ~!Gtubnjin7Z#o9My9`vhRHH*U2;UEO*zbuodM?cg>U?IFAb}`gR zDHgl^d9LJBCCk7aE51h?m_-w*N1Yg%mi*eA@kxO-^p@z!C9k}*f66TwhdKGV2_t+< zC4ce&Ju>TrRBLeR+WP4oYuobNtSIiY(~+jTjq$cFD&(PS7* zS)DbV4uO!>2z%sv9xZ4|9q_ANyI>6>to;zJ`cZp@CR|N2GY1535~BIgWweY4P4*=;DRYGSW3x4s42kR80OGI& zuQoJMfd({7s)mN+n@Wou1y%XrC3u$sIJ03KTr#c&0GER~AIMEWE~yM1^=b7H5daDl z|4Gx@PV$Ast4K-s;trW;Z;(K)QIQ*I(t!bep|B|?@*8rN@vK4w>ZfC4=*V-7tkkpF ztaZM}+4F9+jz#Ev-}cHhd_FqLIPGjf7`Zc7awIbtsN2BCR+E|rO#*pWw$FntU1ze3 zs)%Hv2ivSDjdTjXqqvlxh}go*TR=)D%HBLDwTJ#ilQ>X!N3zP2;>mmvxg!?rzy|;x zveW$xP^*AiP@WI%{(|(hFu;00ARwFRM0b<(fr0se+6Zo{6ngnpz&-WG4R0ynI#m+Z z58TwzFgr?C%<*Oc?R*(_lJt9ud8uc=b0JXr$ih&6MFD&Yd5__!&y8oeGV(5 zT+5+uI#FXYjsDdyl?Cpi)viu>Lzmg-t#5KsxV}O#vLr2e;8xpM+BjD1f(zw^ZX(sL z+PEYa#Qgw2b9%#{&v{`*9<=mvhEBbs%y5K83Ut{Wgy0Q3EQ>5U_m98ifjjM90e6IL z5t=m}&K87|r(G(pWDsx@=(d_PJgU>iH@)Q@vv5H&{_*?yTEyo5XmN=q&-qc>p7c{+ z@iwfhHJf98Splr~JDS=dtVM@Ln7(q4v&7+mC{nXD7@T$y)ov0KK+eViM;>f6D0R4) zA<_vVSnVelO9T|r&L&!7akXExgQBQ`rJ#)HgX7CiAGI1EQhTwj`vlczvxyPJM_og>fu8H2M8~ZuZCVbq+uKemlilkF>(*YzbmO-URf>{(^K| zS8M`JOdyk*_&K5>Zj^GH1B9TPF-5-~bTFZhyd=`-^N#sGK4}_S>9Utk;-cLwE6jV4 z^xE}z|5LV(5o7##QDBvZ+0gtebjtKkA3KouNkL0E>|7YZ|wRU46cx_W;;pL~5|HZ^Wfg84}qrOoY5KhpkXyruAL zkv+Nu^8I<4CU>7ft;ff*YoZDFB*hMWi%=86XrV`qyRuQBxedX2k)G6^TIRzV&U4w2 z3GlCtkB-&|kq5KtB!$p9Q-l@-gj|HBTiXeFy#~qo(kq9IC#HjaIcVhO(yCNED_|9* zP?WCwNP1fT$H?4eFZbZ0-9y*)Xkt>wJ3IelEOcGV)r=o@Kc^?Mv;cH!G`eKOC7;T# zmoyzs&aFI_$sdjl9Zkai%gQ2iN$iEj9Lj2zF)Lf-Wvwg_DK86FI!jGfwmyla;Pw~k z9gqfE_NlBWN89!pR6{s-dtEBw!QEKDV4!T;BllZIbgiTmTJs=WWdj(4F8nw<#@7=S zuJMGg?vTk|1_HnDRSI(b29p{h{~=T||0-W3GMxC7gBdMO51XVyqs2r=E%UnudD{Ks zQqBL%%yz|gA$n5dH>MV*$^2*B0I_As|Cm3fS*b=vfzk!!^>>Y3#p8T_eM85I#ly1% z`3R=x3S^97(fn>8R{lsN#PK1ed(w<|bbn2>9(@#;+|D>SBkj54yRKol;|#THp%{EA z_#UQBWhj4`ZMlLKyp(lUMJk`U0PylYawa^qp{A7(SPm+P^b7pOt!=Cu7&wPhezei5 zx8Ug>uj3xCci4UJPEc~Y&%jrVKf>}^O>zh1;imZD$m(GyOO!&FDQ97pp4(CKB*x02 zQsCU2MFaHLn2@bWPs;I;tZhTdP~Dz&&-d~0YMIRFU}XgTjk+)u%Q(m7B!Dyw>$BIf(>T>sIaiAF!g9{?Ibt#bRhjp5*NenmP zgL*v=rXcKavOV8SyVIY`;bVfAqmVt>)F0=MUXt>>$7<&af3J(~wG!q09xpZuZ7;Wf ztx*b3epI`g*{i0k*oG*6rc`3N!dh2q+P5gtzP*0+dexcZJzK~69-BOPh;C{>|L>uD zNJY2(H`~YGJKs#Z3wNq1E9Z1&hW4?A2T0}l_2>n@pEJ#*xnTuo=X@a5&iIRzVJIWI z$8)fB&YzzgWt*NW9Qmkrx3muRu+nsh;&1X=q`4 z&~vv?*je}_6y`VXEE;oFQ-XMV7m?zBd{ZCDklZCGgTZUD_Ra)QzQIcR{lgfPz07Z~ zEc;4F=09)mJF!T1RH8|>4O4Smi*3xugVL-S>{O~qDQ8h5+Xz$2U!7+-gNKHGy?xB? zxhv^}PG~c7)UryOlg#<8%1vr)>gjFf_drN4ES$ImlUk9_-*65?t`Ip+UBg1W5VJvu z#S1AzdJ~(BN-|apObaspx^(RyFHOHOye9g2hFaxUVg94jb)gT>{tq2=_h@d){=p9q z;V1ujrz3iqcvhk5wM|p=Tub4Yi-*7mgJU|C1EhqrsGeCVI@QCu&!GnBs)XcQ?1HKlhNdUH#iQOW&hz5Akk4+|a{1<>9 zd`%CT0*0Rf*kLF6V!{;^OZd!ekiki^Ly^=`CWj5I?+?~fz@c}Qs}sugg0&aVORrdr zaK6i}7Tjzfhv5IHwwRh5ZFRKF9RB-s2p$FD6TDbXIYE-U)F`~Fhd}Npn<=vk=8#gR&V(VuDJxmAt!|Vm=ItMrKmqxPkV2f|k9*7ILJS;v8$y3_9hk zHku9#xUeH-91Yzseuy#W$ic~gO-a(hQG0KDwhRC;K*U^;bmI{WQzQ4#J{s)pNgW2v z&*o{@#wNI>eH<;9hp0T>GRvBHdUBdDd1=wDxZrn(-3yM7t|w`CgJ9W-aB`(ymz(^t zyM^wAK@oJu-`Z^sp|g_O(r8-~<+`rx%=T49x~##u)aH&hx%QL|y13T%POiOZ8Xxvo zBs$~o8Mxj|Rc)^`yTcn5QHL2!j6Q2Uo6gIOd~vz0nDo~|3=-o*``X6EzU63 zPT(Tj*pLq)TP>qceU$Q4M2O#|!fLA7~Buf>d$#h`IP3!-A} z_Xn)c+Uzry7~>s6MDB=uajw=@Gfa+@7TY!f#^XsmCTE&bw!&d>w&hXPL~WwH*8D2S ziQOe5ay-xTB(2rD`O%jNb+6jvn6NIH$;kw{U>Zjxwsth*eKGb0fX+BO1h!*j%L|OkSRU1&&Ibvm(oj1oG?!%WPnAV@I83c1hk9oScij z@^9sVaTR$cZ_0~z1R_IV`to?py`2-)zp6Yk_HL-V*&SL3$HMusyP@&JD+R?@FIw5- z9Jq;7jS4y5AR|m=yjQ&5Rz{oIS9)Z`+JN&QS=69$>MT8{W&WG>4P*GoZsS@%c^J1& zTZ*GrSM0ARDYpp-MgU=a&g)x9Fwe82@s3jmxwqjq>95Cm@f%VR5GG=w4=6LGWiBNo z6P{8vSLBUfO$#Enprz@G_I3<_1T82rRih^f3`jpFwH-g49K9pi1b|dQ7@lQnFyRwB zEa$pO^4;CT)n(lW!ZyDrkusj2;Y-n`5y?s02itBBnH?J%a%=gcZM~y3N{JmCD?&h9qsThaIM)R!#rBa3}=&?ZGa`^?ygW5Va$uA zf9!U1S*$be;OnL^7#&%q&N$62iI%$UZ59s*q2C*J2vSchguY^3Jfqk4~S2&gA#EQor46oNK*RQre4D26?vDF*}3zW z5IK)uc>Ec))md({mE4PuU7vib419^C&0*&R9i<6uFW$uWAKa+eKk;V%1l5z${gbZ) zwJ#QSH@tWk3Kj0#x<^U4@Rpz?4Klxa!O1mG;C(@&*r!JlCHz^|%%>e{`g9*73bGEY zQ%`8k-Dj}2F@A)kIjai|YyIRO*w*lR@_Ka{UK?F?u%1}16BrRNE@gIZB{H6?qV==G zN(Z^O;I`?n#d-4^tOx{h09Hcl8)=1h1@P+tw`x0UwvAs)4I($ACFu%92L_;?O-M>r z>qr8F(cO)$Q72MjcO;weyY$U6HW+bko_VE*B;6ydlmg3OY4`E&H%DrVoqhzY3PRh5 z`7L~9uKm5tPy=Lk3~|%t*C^NC69y2azz`f)Fs$!aoqN)sE@_yloROM5i&f|lewiyg|%(` zK5)oukvNU5Y^SAl1heJ0%$zEGU_273==`qoPf~e&F~!=`=Hp~tNpzEwEQ-z!3}UAt zLZa2^0mkrl>oUQ79pNym;;iyq_7a-KCRiZ>aT6z14iDLq-rmwfIy2T+684qgv_H%) z=>|tR-~k2x-dd)D(8wia_!Q0WHX8G#FxYhn;Col=?=`3nWvI{L8vh*EWFK7~HYhuE zd=(dB(&nByX$tMB>94*6SMlK$6_@AAQ@Hs{<;Tk^`&EA=1Z3CGrQN5_g+YhA`#8xv z_oGmZ+6OPcHP65Fn4F|sTbE5e*RY-2rWi#*fiTR&ZWP|z$ESo=#&Gw{lG(ClOu%Ji zm$_It%IZ>ZPx*|Z_UAv>Q$#Q)UUE;dX{Uhv@e+S$_}kW$o6!x zP0@K-rW4}iw$opGYjNIYq1w3u-CLHEpTf-#FFaXR?EvFzzy}m=?LM|tbGK$vRcEK% zENI*0Arl?|ew|Ad?9>k2qj10jDE#+osY35?(WHZ&;IQct#;gQy1ydMZWp)E!{V4$J z(DL~DdoBTGM~jH%T68vbY~m@Dw4p`mfYEjxGdNSHgE*%`X<_LS4(l_Ee5H$c@@gL2 z@(n5zE-EUb0V?ZTnp@MTGB=QaDV3wZs9F9|#@|r**A*LW;*sRh%whb5#BVdQ)@K{T zs}dw5qo$S>#|2Q*8%HHjduG5+~sj#?}E} zax$YkW*b?O9SQY^TeTsEj^@__F9}VU!b8ZQxQX&?7k)zyj_!o;sJ|10)%yc~zvygJ zecD{Wp*q+vX#h+>v%hy>BAgQZgvv(Yyv`DFvu&JF8yi31@bjD zkycpl(~T0wCh(D!8MKd@-((6>!8ohDTEqzr*1DuX7RlF6SptmVX_YUTS;~ASn?o1ImTm45TbLloD69H-}HY z8IwaD7#KlC`^@XkJjT5t^@haZWpX1E@4}E`@^cMZBhKAceVlM-W1YT3@g2X9IA=iu znbpR$9Ay7Uzd(Xe3{%)oTtLs&n~B8NnFIGiC113>w6)xYjg-z?=bmLn1mB#TCBF-M3+KdPpe$dQ z`jy=ltjG7I`rU`%A8GM>1))C#*M>T%g~4KYLjY_4kfINV;13JlFaEyzaseIqSct_K zHA(@bnye3>%0MeZHtno9T@6$_nD_cqA6M*bAZ<%|ZR`9?EQie5+E6OMu~^|k7bQ(| z>aOc|TY?+qdLwh>G)Z%pSsS+T=Fw;D*2FReWs+<-x#=&r`_N{+)VVECd0k)IXOVy| zh@OVx*OPCcz^wX3Xc9P=n#ONu(Ol^KJyiu0Y5soq6}NLTtm4@tz1>O%eta8a#47%M zy!~>M*`KLm0OrfGU3VHw3YU#uX?`MC`K{tp^OX^`baSKwbfm=yr{I{##1DAq%nA{b zv)SAWShX40;$SlJTZ~lYQ06_*j?F(_Q3v8(|?79e5r9=SZk8=HV#hy<$L$~y&&jIcNPl+hWz}QvV?z&PC)ER`_DA* z7N|i_zVwGnrejqCz$>rKuZ+Xf=3NFC_$<2G7NkRTESlRxj)aYK%H#O9_ny;fEfpo= z*H=JgTi3FMF@gWpZ>C9d?18RUsoPX<3K&VilWhEWiPmh7`1xF|{ZeHB{hD&p$4Wg1 z;=gGgE1m#J2^{#k)&-v5Ja%tXEV!-(__(|_Z$uDE8{+>M19JNJ6CR8`eq!e*54xs= z#`^wWMF(l#Az^^0!?Kr5w6A{Qfz2x8gCe9C_Wbc}8Es&^EL!2%q;VhsH?~Nx8!V+b zB@ByfBro{d%N2F{`B4%Fe{yB+lug^6g};Tl6ad}AaB0@>n?~^^JcH`kM#!jUOO`$h zzvj!Kx;4CC?}r{gdCpj|Tni&W4zmFwxFqf~e#|%{Wv-NP`Xfj<42l1vFUgm*&K| zIwudHK?Bdnk}EvQ6P<`o?kpV2!jn@!r{LQsJ?DxEOOUYe%EC16`#t%yl{{^IseV*g zM&@2_dhPLFe(l)%>{GXSha5a_l)x-BH@8kZ&Sh=Y4(Rw(cS5R0tJGnreW`v0S8%=s zm8A^l?i?&wA6;71Z2tLS>R0-8p2;h7{8?%ot8`-emNzq@42G9GuW;D7M{OhkEFKv|uQx{8s2dS4OnNMP_t1yM= zHl1!*I|up!PCmpVA;;4XEUnIs)|PQf02N>ZDjWb=YOKdcfwkp6(jD^GKvhWN)^8lB zTP#1(?FcLi)npmrZsBfsl2&z1z{|QfRzN}qZr6ZT8a~;e2Wf?*9y~B%-1gA&8BLcj z4P9gH_iCXN2s$1@Vz>qe@s3$uaSmxWDu;!wy(9x8yQ$3ktJNQOld*8k?Fz;;GfrI2@rMI;Jheg+BG?AHodowri zxuy;9T|}TL1L$@}&++8}bT~Rmty`K&IdUwk4m_23GrZ}g?ywXX(rWC&cgc3Dg?Qq= zr&C$`O1z^#&fwv0lE4?yXE}(CRY66D@jcr=T%qTnF)GRi_@gps7FMd8qYi8#hb=_l z`X^`$OHLxAQZ!aWseemmOJt?UfCE3jsX70idt4sy`5aNZRM&_f8f$Xrygu1_TDk9O zr*fFnDy8+1H(QcLLYP8h-2PBEX#SC6a)$uVRxuPBc5--tbW7zvPWzz4rB?jpNbBuy zsXTvFo^EdBp+7@#a{v*h-mphJ_`rbgUsG(f7Kx!9FSXQMIP_dYOk7fW)XAl^H8THS zJJ!C2_>3q7>VLK@lL(i=IW(#r3gV}1XnjI&$}#S(u3Qv2hijdZn&fY#*|ppZ0=gdf zXoGjP$>C>qpvH(mez zE&*-jd&b4Ndj-X$ry$>VOTbI`HFZQ-FS{vm*`7tg1}mCv&DkRDyLCnD*{dZ)WxWHu z>R^AiH`gtxfc6hCIS80F{6rn36Hh-OfPu*-A+qUFjL?#)Y#kb`XG(&DFPoCYq1L0e zP>3D;9()3czC0E|rn}X|K!~0zosm>WZxf_C+%*R^w1>i~NAc5aLFzy==U7UtWTGAt zH>~LR{1zghlv(UTJZuV%AcyuilAMYL>I$PlCU&dgE*NG5!j1|i;m>@SQ3Jz zc*#||--M)<$X~5;wP9>J4NpE;L|_oszG=L)hdMCLx-gf-p)>~jM4JXf5aL(S>=;%X zWXJftb_4p9Z9Kym$liYz*t$#gH2Cg>D+dfkd*-K29#a1a9G3YD z=eGgUO`bFu@uK53>WJgO!E?8cu+>gO4BPnNxR_7%-PeZ7m!Z1{6hBV`_~5`x@2(3z zs776f&4WvF%i_xk7=a=QzmGtT3cHg4UaKOv&7_d@-N6%fIfF(+3vPA&Dhb1mQh!mN zwq-wcZg;c)pY~NQ$maXn}--g~yZS$jT}pX0j%uXVnPNn3W*zm@=Ln;j=#J z+yD?4ZTXCzpXcRA1G(@wL?fc(Zz)JY9sBYKjav9JB7+^yD^lhl2iX&6#>TX1G+T4t zPbndk^=WNW|F>ii04EU36(l{YRY_zPi(xLdrQiaxL)-}M4WzaYnZD@7jf$ z&fJGJ`)>lXT1OrVvFemhUBqv|&K^x^{s%H-MYbFKTJ7xlLxo27tk#8)(c(oZSC{0w zAohm?mB5uJG=DSolBDXRpEbCRzz==7-R9>1(yCrfI<8-be`IzT1E32R38eabV|f^&Q3@oOfpY4)FkDXRK*ta2NKF4P(mHc3d+ml%1GRa`Wy;uYm)JNSyYRr zHG2?dFQ>lcV^RlT;wWeIO4^ZQr8OqqJJ6%T*-Z;HQ6QJ*?|?`gpj_I%43bQoj<)zj zsvwifA2qA=jp(HD%e>ai^+8*yU{Mx6DJgn%yy4)a9ql=u>ksy>OkEi4G3F4kA?s4nQrOOx z76R@5?W{WteklaJwDf|}nzn4xJ~|)51)sEa*GBDo2d@c~Z6uGpRj_P9)SroRd`W-y%D^yM`S z&<9#5GrgAS=<0Ih5^zH8-oO>JL1Ux{6(U81D zCEr6`!G}RaHj_;opPoaPOnjZnn4b}iVS=;8KOMn9HiwT6jXNE>XjwpxwQ2%47yBP& z2G?RkCsMJmZ_1BXt4Yv(KbwX;g@SpL4W-TNDGldF!|j2g)L%5{Sd&myG4Yiqh1tQY zR&obM(1Qscf$KMGPo31DBVP)KBi*3=XYj#iyVdXZqUn_d?t6nT)>m(ApV->IZ5p`; zb+b%3QPG0Pk-eB}UE{V!Znf*{Cr8y|-;)UPY4azBx zEt73cGRn6?{HR;EVi_oOs{(xn>-pwG2{!ndTJ=6#g4tO*<=E%9gXMGa_B;^h?|Qc& z4eVD?)X>b_DbTFK6?cLT5GZ$ea|8WKpx0VC_h0DO&{bK zLU&z|gX7Wzt>FWFnVP|#(JW(LxoCxpnuhT-d%z2i8f4>M??CgxD3`{$onr+7oJ-Q( z3@_BcHr+6I^DPWKgABmW0vOxC(KkPdibL)1hq`B%VHUT<{WvIB`weHYYUFe?F zB>e%~dBy2RfC4kLrxGjA!yk1ewI}6-NhgV>*QSbWapz^pa`Q^bNPs^_;PL#mW`InXPcUFghg#3@pwo?yn6CE0zBpUTC&L}$6Pys zH6`OWwg$;p2|$B|Jn?W&!3&#Jb176p)>F8CXP=0d2lEasy0kKLVrGoj+?J>v&E3G~ z_iNDy|F~)KE$t0>^*X=OaOL%1$*$@e8t#B*zjRx_c9*>;SmDgW*x>TE?IYK=Nc1>JfpQ*-<8llEOuBG%ptz(`HN~w2$}?o4V;uss^4p*7mhOK`2TRwR zI9hThBX^eV39UsRHkg7u)bl*UIe$tJ$^(F|0sBODOJYw|y>OmJ@`c=yPKs`VNcFN+qsNwIKoadbD1f~epMvG0?Om8Bs5-j!^LG26A}T5tGXof z(!7JKJB&OZ#pl%mX80ZoM^NmjXfw+8!90Fb?LsYUVgDYX9nh1s%5@^=NNhVqsSa6X zREi^>-2OkoSakiZI+c#~1^k%Ti9U4IV_~+2vi?khN#z)uGBR_?6DrAa&*~Vj9EMc6 z(rtWT4|_Yns*Xebl^U!}!u%da6C|0ifb=-eBOJ)Ko|LZ#LtxL&lU;%ZqeQ*n(n`7wRaQV!f{k_Rux#S2i=`*=Fk(NnF8&+6TMfaoWM(=9&SRRX{ zgzHHB$u^92@@TMswr9%?{F>_ieQX+(ZWRK1*{5E1Wel~H%dlxJI+zxi38cqm9^qJU zq!Xt*IO?eWN=wRYfN$Xfus!i%s;l9yj(3` zKnPG0uLS_P`kw{oh=zzImB}=ctas-?uoT^BK%mYAc2iel4@;Veq3!MNPFI1XJW8$i z9VJebkrd9VOZ^|Qb!|7TX;En?+HcU9Z_N<24P2hCjkJ-wyxKnVy*v_V8m?P%i z7(1PJWD%dOC-Vr6s1J-OTPUq;)G4^vb7yvBN|YU!#F|ffe1syqvs8{17@Ym#$NBjSrZonLBHa}Yi;ai1D~=8>z>xP`=+zF~@# zs|Y%p32=00x?wrv=aBcZb$|@iO}G;WkU`~MXrf>`1*6nO4F}IYWoET;UwMEZroblz zBv|OLW+Lk|jjPel&+5Rx|J%pZryJelUyVz$oXQU5VxQ@WBPvkzI`b4l z!ef|CG*~gquYE|9^L4Hc*dp zsmki^|N2!A*TLAV9{USxafA+6-%N<^k)~+)!3*xgMsV`RDekQhVmuZI5BqUk1BQCc z<%7mzr0OrHr-pAzE(t#;em@_%IO^IqeESu1Gl?|7JFN$B;Lu-dLgU8UYs+o0sNP?+Ax_bf*I;{);5Hh$Pt5o5E+QW(i>5G^qkW9H1>vPrv*9 zH$uO6UMtBY%vPY7nzp!Qs^|$gkLdHeWdH&TWT?&qo02L6-f)5GfUK=|x2Z$y)x5+w zck>Xca~V}TgV?&5sVnoHe9?Mi3A&eokftm2g4u%yQ<0Mo5)|K+_w>-A6Vw;pqQ3N*hpy zSNWZp)v*WK{RN{az}3OPO8>gK*2?0q_8@8Cy2rbB4YeOWFN#rx+Iq8`NhtJ;%Ic?p z*k_MDg!(r?S#->k-I9x~b5I74?=|e7?wx6jW7jl)c4(@GJC~C@!XU%X8|Rc+K_P4q zJTqN5_nv>Xc`6-AM|Lt&z^^o>KVTqXG?mYY;SU+eP(lq^Qr6b%*7fkWdyS8)%tL!q zSe$FpA5MbH+u-Fxl<@4E%X#HfOKU=zkQr6tRAoFmp4A{7N z7D)^zd7H`6Q+dr{5fe!sN3XNSZk0sexhZBhlcoeBgP!=ZrMc6{!1q~`13Ck;b~65* z?6Cq)u7a8h*{{q%cNe1yf<(wK!A@Bu9z`%KO$r=27V};ed7_D>TB^xPTmz;jq;~T& z9SoorWGHcL)L>r|+P-fbIaahQe7YmKStOD#>dfTu|SUA%iy{CS>d+stKI9jm}RCsD2}o*H``V z0|Y2DUN99-Wk#bhTtJ@Lj$C>H_}s*zoMOAqhX&&#)JCzy!17xR6yR%UWu^7g&${+; zOI6nQKOeAt6a_=iyVy}^KST(z&W#h=MH=N(6GdZ!*ZMX7)i_(CClVK%)Ep#vn5zi{ z%^DuN_u6Bu9>3h$hcc~GBh|h{mMY%PPAa*JOSRjWeo*yv!1$IG2pb{32+tmtpg_sk=j{e|4b`VObi#ms0*{n|3 z(~qR4;xYe|Ak5EO~HsP*|4JtO0Eu5(O zA$ER3F{-&ExN$g@X9WJi=|du@!P2v$^3X)R(*~}$X%nOK@vci&T+3hTH_c=5Gw=ys z%4jPc5D5KgSlw!CIMN#`OwP3v7VBj!Y0!H$kH_v_PO&H7%L6MnBmgw0$g z2g5D#PFqGnh?SVbmZCNvtPhD}6xcPv#7w{UGNKx_)=X*S5D)6QflYcSk&zo%&* z#jJf7`pvY!Jjjlw^l(<7k08d`t46U?Y)W7LP}f`;{@!0CZl$=hIKMH@J^#c_XQP7` zSEwd0%6XeHkXxN4Kz3W+fF|QbI%{sBv@=GAq$Zr8E>kA!aQ!sO3ZnEOeJ|e}8-(s5 z2#_2CnCKE2UM0NOASnz-QRpWFINvSgP1<_)epZ~b0Di^bAanaR@&uA_@ao!ovus@n zPpgpK(kW!wi$KOZWS$j)Y2D*GssvwzpSmonW#-IwSpofKm?e+#s4fDu%e#*5X&>%O zcF0e5VKL;9ejT<9M099WMO-y+n}4`aKkzxPC`L8YBtzUL?<_LfVc{6k^(3i#pKvR` zt45DqzEGGmj;xQM<(AGX#xVlXCP{9?+%Q~-yMSyy!SC9^3Su6yiSgRMuA688ox(as zlT2WS0?GjoX|aQ&X+$aIZ|4t?gC%*paoVDB zx_|E?K7pTECKHiETrxrCG_}bNhBGmgvT4Vn!^7TeYVztHgm)}e5f@GIa=mHxAaftg zyrtHo$jFac%Y*hz=i4R`^MMcZ=F>&AubjJ19D_74M_?X?^37Ucwm zeo7d4cJ03DSeK&H3S_%Qeph;dvBU+doZK7U+<<9?xO9rXpNxy)4jFQ(3M)4A^LaBX z^+Ro?rlUaX@C;-8;JrYlW4jqxN~qZG-6-|1TL~Q7y`K~>rEnUE@6B8M!JO;+c)U<^ z-&1K2x}C{+ZkJ$HCC0GZ&kyJV>ER5>e*!OTd;+d>Dgv#7VRheY%y4^n4?1STW$ERK zb$?r$kyKg(u5xnhR-LPyX-!NP){XC}uA1Pv>Opl51B+hLOJ+>VUFtW>VL?o)3g7S@ zEr_F=6bIAtJUdDOWDpX@_O0*aqU&6=jZ2+QNwXutj85%cHdD+;Ert3p4|nWxD}0i< zQK@$3-i6XF;4KahKCWRdV$xJ0=F-hA&kk}vj-TObj4Y;f_BgP_$C0EX&b@+P#J5CS zk?3GPCsS&w~^3B2ow9CucxSUJpAw`mpq&nENR>*DpmT=y1e=glJh@ zUHjN}8#G>t>m+6j&VNlAWU>3gq5Intvt0cZ($1xsrP`|>D?!X$Ky)`QAMYD7F_ay} zvIb3<;g`PL0$DV|M?g*QoT?@w*Ko5Qb{VRmH8x}p2!#LbwPsSs{&Qc?HSg*G6A>J2 z@}KyJJ1p72vF##vUYAML2Xe;eDS}*V(=ip3NcPlC?le};bb~&J17D%8FXwrq^q!H%wN-)2BM8OTekNgl4P+^d$MLZC5B^m;UoIrMS*Xa z2oQn6YKn}7-lL`f9fwf_Si!gvFC4J4c8(8|K2r?w`Ezem0!me2w5gT{BkqWIQVb=w zQZL&Fi}EAuBa>tHF4BF9-jfjR4V2f~_IRPpyc=5J3;9Q*s|Yr*3y0U32wyS3P969G z=wL+&!4zbRpSLTc110QZOUlNw{CaELm;?pcyuu=d1VHV;#KS4;aAL;Da8FsYR&N5g z+^xdisV1Rs3EtMMMwGPJITEx}^fueVff0972qn6kVw-998QH}9P4>5(yts|B5u+oJQiw~U=5W?^;^UTzL9-MQ^l3z#ufNm7GbYU?(FR}Y*7a;%U9XNzEf9>SSH7` zUqB{cP|EyBQ`4%6sOW{yMKbB8W60PRo-rv9ODNcbl&{Q=CSQNskp*Q+sJ_C*Ih zF-w-_9!Ca#(3%@Eav*0X6Fb13C}ucS)Z}0I&0Oy9W~Hm(Ah;5t?FhcVpw|^JkYgAP zkHNFe9kjd*(iIh)UYe5a)!#;;`)gvlX)8YQi{7or$Fo?GY_$?5K;S{ zC(!U=U-KU-aTq@vyJUIp@&2O@+Oo#zIaw5KY&1TMBVrihkb;ZPPR=eS7v(8iyF8fN zQcP{hn(-+LK2HrzO!deo;?~Y5`ve`u9@(HL@ z4Red76l}L6G};AWd+#kh5}nmUyHLIyg|TT=_+HnRGGIs4 zeq(#?wd3Rg9-*OV>wmVjzO>jN?o?$`+`>qZGtAD_N!D~6gffcoGWR9SLL_@RD(O-J zi~B1oFs~%i`Rb~bUs=T=1kP_BL-3cHtu*#^O?3ms0rv_XiwM2=?`t8POol}2!V*qu18sL(iaoholLge& zM;IpL`P#PuE^6GKOs>%ci7`lg8~*J~7b78kRFJn|HD#Pc1@1;EqpMJOvJgSaQ>gdC z;9tpmBfj6OAVrdQEDM{&Nq!O_--3B8p4JQ_#?Q+!&gR480U5AEWtsCf2a?Sz-pM5o zvR4E1wI({Mb3hP<4@?V8eh0Qs1K}B5)S2)3xBPW*6zZ`F{im+$X)G~K#&s!W)>0}s zkcS_{BCl3hyU>ffkruw16 z>eStST(*BUm#NZIr=?Bytu=oERx#<0GXJ`9J=YG&7tuycJu*w4y`$0Ms2z`9zY&~Q zVE44&4Bu0`+EpsDaYNv2;2ytvas(6g_AiTpPl1g6|v2DxR*}afBH@3El5Iwqv%isicc*fsK@kZ{|Y;PoyaK76(zxp$3(L4VZ4Tv=YgHF;Oiv)6`YKgDcE!c zdAar8LOZ2bRy$FLn-LbpJTBOpd?>MyF0$FE$}h~U%xAnh`n{0NW=!Zp|Ty22Qs!{HXJlA|Wr20+K%LdBXj(meIn4dlsC4wVo zyN|uTmcx5*OWYcTIg4gK+)!X#6Y{#)f z?OL-1+)_Udd!_kPbScKWuUToW?21+^xL{&k)Z2Q%Dl5^-#kL^Aj@Y%)*R?{N3;eBP z)ouqkdU0rq^2BEzzh2v42YsD33>3`)xx2W+j*=(1l_2fV`d%@)UJW`)l1gdQ9{`@P zOQdoRg6}H#00%g^@1lX`m(CB}+UKiV(JV6w>19x0J@i`fs)4~Xw`NyPT`$D*`pm4I zWrK{xaqQO~#n8yROF8G$GgsI#j3kE;yl^f>7zRX0iVzn&sD%89uEp7ZcZzKQfYp9EwMCRNsn8XK0W%Z45UZNi5D?n2k7g)>Q>UiL&!ZZXz># zb2D7g8=*5WXIC!So4I}o)|HRd+il=xCwRQG)g%lnz;!nZ8MAhMU(sw^S?78;x*7v` z1rjK6kn*DM%~&Wm3A&m(Q;r$cvA^0!_-I0S0TB%pZ1Fera>Elt=&C4P<+f)F5syIC z@CaR?^ve^q<1-X`1N=0@Bfg;?H8gOJ5X+fJ8)!C6rvdV?TYyzD$LB9T2Gf4J!AfX9 zXWJ4q_d@sH0R<8iLtmFCj`*sG8zng*pa?jHCTz-#wAI=)i7|m$Qe2g4Cc5k<7ytI7 zwQvjViEbPjTtr=kgrn=_To&$*I63~Ke`~TJIStWW$nF4^D(-lGV{E4JWQZnnnB)hU zL*odFzaLGV;@9{2!>*oq$Q&PDDNJ3q!0*2K}=aG=-@_~^V) zvkgM>My|`AY)IZj$*Mo*&$_xf&m|GBj5sIJbU%Vn0)!0e&yf#}B2KX209O>%{UT1( zg!cmdq;X?uLKavVlwP)~r$6#CV#_;M(C|SEju-c<@`fNr(G*7^hp}NjIa)DK*{NeJ zw36#WyNdzzwo?N)G|VfM60y>g@mv5~@Wgj zWVq{44eq@&(nw>V`caL04eh&?&t)6Kf0)a^!04(LBwIi_&A0{lB9zymlq$CEhE_AG znQxU0Z5K6DJ>(+dNOuiFn)=+1)QY>_R}uWB?RLf8yNt3po~m8)d?H8ntgK$+;!`>J zbYd()vT|gARjF~Yk+moH0TMGRgqRSG{;=r14Hh`EE0g*Vb1AGu3CBF%-IOvVpuZGA z^l8Jho^rg6EbusVcochjo}{BrQJ`FW*?Ki+6SZekAYbPQWGDF|k-7ewe`TfN@phUJ zFg|vW3+W5Uv!Td_Qg*S0?|Mox$6y)*Y4+kAL63`fQ>~*lO%@~qy##xv&xhJm+QV!% zSNNP|lzJ%T9a6K*cZ<#1jraoRit)L4+eIy+WFX5&GXmnj>-4hxpE`bHBZ2v-bdjok zEkcOd3Hh~VXsqz_f%jJvIizXhdp`C{M1*gA6Ty24ac_h0n|b4cMl0}_ON6{IzE$@1 zVB*mYEgCiur;Nw@7>-xN3sn+W#;(sY*;}VC1Il#kv;yXzqd3!2l*P~9d#7fg4w6Pq zSYEKlWkQHIr(k*yN`~IGXXS}|J|TxNOCn$vFA>V4hW)HkxflCTB3INby18jDKYXmz zt~OhgvZTFo#Y&!*=7Rb2p3lw}j_|bWDtgx|7EOu4{H_&kvWcC_cB0gZ!PD!MbV6s= zrzM1!U+O0tqsVpi=f}c%89oF!v6RGSqZLh;mRP(Ld7dr7M5PlbQ6MKd6HFKSdW< zngVgjHjEg2g*@Ftu1v0MF6^wl@>@Vgiwq8qaEH1R`EFg^j8D{Ydi=*=8x4$=gd6(< zf*c6Q3L#8_Qc}RS1Jy=v{;cMyjs4XrK|ulhkVN=;Z$E~(v%u=hSkm9{&>s|;L>kmb zmyX@A^CdSl0&G>Br+8pDK%*9gD*f;=O%vQ7!wK>R z$n9dIT5VEFM@74oBg$u$i`qjhgJ|+(zSiOjxOt#UJE0gGbBbAl$B}CiUU^PtAX}$fzS`D<9nIc&ZpxF?Bc6X_0j{0iKudjwfnR<4>-(jWf=`B#c4q|ZRo zq+uF-1Kh11aD;lbuwukT1dCgx^W}8<#dtRBpvP2cp2;H?Mo(=i!B5MH%y_o&?{5yD zO_YhAG6a+ioD#rYBOLjVp${dVyj+GD(*a?#!3UNkqs|B_F+LH+9hs0qiwY&-^KYh8 zp-jt*@=MIA#vk|}TRjQ_oZu-S>-yV{xjYk<_n88x=Lj?#h0|hn0lG!QIzF~Q6|Ts+ zOM&lLP6x!yvsB=-l;3ca$3&bHi!?1pbjs~2h)+@Wq&c&c+^k~$pR=Qzb!(! z#1MYF_ZlDX>YrtvdtC%rxqDY|jB7?k>O5Zgz(6{st3V{%EU)rq)OoA3zcT;Ilg~?Z z+m?Cb#enZTXs0ReN83{#qPi{dou9tlfas$jVP?Fu3>7T(i&1^R4CL=RhSh{0|1SIW z)a-|t{r0_w8wuGqvApglQ2uf3xnG#dCo_{PBmS}YD=Qu$<~2BC9NT(|U7%NiL3K(M z@?tspT1L&`t{_1cVME2DbfLGE46-#vMil1nR4nk8yc9m!;P$=c&-b(9I=kVXpP}H7 z^;v#`NM)4vRe*2=|2i|gln$YoEI3ob$j^hTaf8M52=iI2xYU5Bk4%iWmS7J{{d`m(FaZU7IKl}x z{yp|}7nlVHU4rj*9A)pup8rKw#W|LEW%vB7tp(KEWiil0=F5e7bx03()BT3@xNgczUex zS+dx3>d1K40SG2S2SnU8r4PIM&P|>Br@Upin;Y9#nSsH9PhpO~ette7q_`AdIaAI(r0+??3T>>f{@ zJzG%GmG)mnljjRoF$ZRK|twW?jmflGu7_v%>ByqMMbi0cfo#^ z($(v`GFXEeI{{d0F{;{B#m&8gXRiXrtI)0%!=epzk?KR95!!vWfC+v^t^6LYRPwj0 zamyUQtQbf|``UpW1hS)`Bsr9aK_QEJ*w}vn_qo!D&t`hE}L#lB8*f!vAIMb}`yb%!_b47~$MmxEL(xw-_tKhZrlM z#W8g4Aq+0?BK}z#m^h}jtei@r$~8m+Fd##-ud>0$2V?Bd1`@s$7=!IO_UV4s8=Mq_ ze<2_-Q?rNA`q8hJAP#w;0(P{e`VR8ac`*ZlH4lT_3tu5CTPnU^d3v2*D7M)Se(+@D zTq2PxZYLKsBEbB<>MAjP;r*t+7?Y0+D`VHITyCCwdb!gOjEmjaaMd5Xhp?}@Xg~0m zc0OVZ&FFZa6kw`7vFwgl&9QO+#fYi)&iqBc@boF$9&=K_bOVTDUwbcrtT+yzI@{JY z0#!l&L`c2R?e)br#(LtvBIJ?Tz8(T?^vm7CQZBJvrUu!_z0{^hwB9Yku;GD?0m5W* zbat&>6Sh%;8-u40;9M)-9xYfj!;)&!m{$b6D0P#dX=0O+zeDDo)a|2>urQWvk zH^Me7DDKRLhxD$H5i|hCN&}ch58H6Wc_5jEY&p;d){7-Coh4)^@`Kwj-FSiSs1jEp zj9@`6=r_SD2SMhPZfST-R`IiKK4|_!v7)G=B2wln9JUP>eo)|;X)i+aD)81pV!S*l z@<7R7e^GGaO%De-bn4Q-S-#pcaGv?`Z=iAQ7So-3EG4DH6di!X5h8}2VFl`v-U_2; z{EXUB@)rYI5t}b#%FAQdM-m4wx>6mY*AR%kGZ%PwNDe&w?;SLpU>|D}G%&4cISmjk zmQY(atnKU-!W;u(2C_{%|M%?lwE%fx<;%INsemvIp6LkuD{W#v40t^TOFx>1+y#O4 zyW4zOma}jhnG_f3TbG8&fBe&o#9a0o!mK~Ju!K=J2(g9~k9^cHCt1cFs7ft`TG=mR zeC#HsoG={P!Cj3d6wf>?)r1;I;rf!M)@xr9_E~ifBMNZ&Z8^bbhbb_9zzlA~4C4i6 zk?Q=Z|J(k5IR)!O7pte2WX67F9)nZ~tjzfSj}uZ( zx$;@^(0JK8x$sG1Is2k^3FZbAr&MT84<;vU&h;w1kms1}%!4k)05-ur_dk<54-Wlx z#Z|#RsQ~0I$f8mv6Lxs9$FF2**A6tg#b7w|7hg~8&hMpXD3|J}=Um-&KoTpzUj*RL z%>;GQ9#bK}FEOqZR}hYcm1!8V=pPK_EsWM@!A-@i_3V&Fk1*mw=a=}+&xo`*y?iRH z8@hXl92!)xuDV5+-i;*dE-<#3>s{uf5xeY(rlzL}_d)?Oy!3;+;DNdoUcK%T^r2Bc zx?Dc}@lQVA3ISqnWriLLGm2cLv1YRO-zOaI`m@^NKUn;>C$#X!RMlzgKG{ZOBdMPQ zdKdiF7=4(*|2^lE`gbX}NysZT{Z>6$$zo%+DDz~#RxA~%j^L|b5ZRkpy%#k%U|~y2 zN=iV%X$Ll59vwFEkhjmQ<_dh3vW+F{S6?86QXVd{I$(I*qP~)ORn80bCTT@msoc%1dP`WlZ z4R0-vC62f7>6Wam<2%UgT){%Ilf%dgl1{B<3Zae0vGS@ySmIcjlEa@EAdbEcNPrmm ze*^T8AnslyNd1bbhf~=fi0{zDJ;Rk^sS4c0dhO+6Q5LSau7>1zdq*SMgN~iU|M=$| zd~Xbp0?}vZz%xj29(X5#FY}qLbRLeI^uIgo<(aGWw!D)m03uoJ`XR27LlIasWm}H5 zXY!~~%aIw)6$nJa+hS~S#s`NdFuK#Q%}rJKVL4H`U)R6WoJbvrIo(`^Cw}n9+-a1| z_ge}>Y8mA06cYzo(KE2ZLsR6?;p;QNoC4UQELecjY{{b`p_fekj2c&9$He&4D}Qn6 zvY(e(c2K7U=~EBH=H`+b=KxK0Paz~bQ84Ayvq=fp5dwQ5j8MYcto+E$9Z=--2*C{@ zc!*Tzr_ZTbJ!?|(OmaXU+F6l^lueELq5J6NOjwSix-}AJ2PJD!ru3+LI_=fVrBcno z)M!5-LIJ+OH}|DF-EbYPZNh0Q-W^tl9x=Lam#pj!5d@wf+2%yKVXo<}Ec zhRz)igls=7Mt+|B)yc4%mUS_PGI_hmh&@YwdX*a%6?P(|#|8P5ABzpmS$R>x$hXmF z5XHTGwzJduv&B|6C?^pS!Z5}Jmc38Y6{8Rd&I}SW8!ukyf{ek@S5?rGloGO@+Uqk3 z=3Lr_xEaw~`%CG37TjMPOQf@XS?B^Dw6XtYW)WuHrdp6A46Rwx=(IK5&UqT66{?Hl?i&Eqy>z*ooVz5CEwX3V0y zhm^}!jMY4KWtJs|S25-MV#Xuhsz11Er8<~6$py{%2YcF_=xX(7Ch}yL?AV|a0=X?= z!98FTif_eS=xknCWjC#{jsIYJf{%`f%Z7E*0vH@fCm#1=*$yc4|LZ7O|7i8LX*3l7!U4hRM&1%kF<^1jIq83PVZg%iZW&%vNPop;*%yOX#SxgdiF)Z zG;pwb1?9*OG(K-{&Y=zMQ=D4)C_7#E6mHLk$gdMfhVU%+pl)fl6Qo2H0Q10+<|<Le?mK$*sewwEUgnlBFiaY3^f@e*yMv3 zJKgcx1ceZZSeTiXVmLU-kU2axesBVtpiImN9Y#b*h#l5TOr2@$&(rJbS9v$4+R))R z@Oy9~j(>X25kd;*2(BPlKRlQrf+a1Hz>EZF1IOCRQ$kK*Gc+Z9s<6#Rh-u#wx^-z= z_K)oS{N9ZAdD6U*EO4o1A9=TGT@6!J$X@%&2c$L#sOjiGYy&X)XB_!UMvaduwO<1t zlo!Zi^sb#X@D7cx)4!wkJ#J-k+X{bVC**O)v1`Xrfs?7w5k&R++i=jQkU;_zO17`G zYa*`#Vw_?#DfJySO;JU$c{*C>5OyI5_rL*MbX%Zx2g)S*2k;Ao2%xdY*l^wMC-v`r z@g@b2Sx_X|q>wuetowk;$=hk#Bs(?`5jb2et`NBI8Ov-?vNcpE3)WLD;A-|!S2}o1 z;5kg=ae^L<0xzM!NJthizWMRa?6$HW*^#--IBDf%N_T*w97V`sX{^9ifI)ie9J76; zftsj-XTRGjZ)M`4uDmLx*!O4jo`Kl;z}^HOlG8vYI8=#KNWnWI6d8o1s=+plwgmmq zie|>NENHS~P{^JJ*1aI+=Iu0Wk`3F54H|wp<0x<^8B^^i(+HGP`6_aQw0h{3h0xlP zv4e+96S%+)gKVd(E$J4)TohVfk5CoG(rwp#Y?`Iwa?H;UEJbbnXf$G2oCrXe;|~`g zK4~HAnF1lF4Atm=1aw#-Cb%z4o#)cJ6tBWEi6K=#R8o-&AVWOgl81m+FmI;f1;hfo zN!WeIwiGo*eb5$SJe~lFo7?KtQ;5jcpK{R$%bM9Z5)9cfBr5bTrk=e{2h3q-jnn>UHW;2}qj zIE_k-q*@vW&y%nIwqVM@+XJ`Gq<|+Py11r1nSwO)$!+5knL-Gn_0l*9+XfhqUWq9# z+JdA3QtTdM4;o1#1wavFF?--nP_jxRo~y|zazEy5!8wkzne+;t1Zy6I;P^U;u zr4_9l?^Uh%o@rIeSTv10k^)`^UNfkfMI|*G_BfUH7&N{jp3V5k7K{?N zaH)n8j@;9y*&|U(?b4&9j5dR~0Wk zVr+e5eC!0TM;f4(@+AEvJx?!*gWrV>fW{y;fK#Fk4)u`V$0#Hop#{4-#tKn;5%hrq zyhJ&aU_%Wd)Uxl0(V5U1->4h`rX0?PsQ4!Uba?z-cYQJ$VQw-Lo=4m3eP;;;rA<(g z++icvGLK;3xAT}+C%tS6fokAx_`|d)6A?1W6U6`*&LQKt!TuG$G}LD-gsZ(1)I-Re znO+%O!6sKOHsTC=uu0EN3n*Z=E`{Q5TtI0Q??l)+TV1!U7H59WG*kbnSb60gr?%Yr zMwGCwZO3RyoE5SKJ(nT4#}0`a5?`uRv(Y{*t?0oO&RE)g$t=j<&Qbf>HpIo2s;cyI z8l>E!I=#owWE-m37TZlT+JF~}^b+it2{FH>%RqMpasN>_EH9Qzrasb2i{|df!4L~% zk5Ufqs3he1lOt*1Vd)chI}!?_x8#O=YR7I{R<~#FpKyvd{#+~D0r4jEo2!x7+t@9P zlrBX8&R>8iUvluw_5iN+%K86Obn$isoOYEcn!rJB2?xw0jGQ%G`lB+fvH$!4N(i5t zdu!A#=vnduHYK2_EaHG?r@wKEyuOdrdFm@Z&W9Q8=;o$gUXe)h`W6viuEscv&q3~y zr9Ff)Q|7oGl(9dtPs4$R(`_yS*M zC@V%z{Cv(%3lye}LC1VIxFf(uLP*fvKGZ-^mOBMU_S)cZRf9uw3WHx|!H9qev;4*^ zgkh4LzB|d z{Bgif*RU8S;m{(XY2Jyiu>xgI(?fRK;zjT$F3u%#EKiU(#kfTvB)gCotZSOL?m6GF*hltD^Q7T)DSM`os}U9+&pc#YN^u!>IR6>ee)je`A(Cdo&Kxu_KMG z+3IEZ?e}j6`4f`!*0^Mk@^zU>)A5Rg)yN7K&Hhi0L5&bKga|Oy&;b4ru)JW|`mX>a zST;QE=ca%h*%kt0cKIrnWD&oWW`&*1&t2hZXbWIR$ChVUb}1fPcUIZsdGxw&D`^tBP^STNsx_V;nGYw%9n^QQYVNg6=dmGJOJ^&4;8 zWk0n1B|<{9gB8_=6_8+bX^C8AsKPpt7;n%RTV-gL!@@Rp8Mi#-J4$Am2V%KWc0oZq z4`E5`6K{L$(mkt~rGir$Oq`C_J^dU)N$em2GWb9Pcc^84@Il&mp_qp&nk77Sy2JSY zn~W(0AV3?6F(Uk4`f6SClA=kY1Yw6mK3FR)d7WYgY}MXX>|))KCVufWCT<|=VSLlw z4aYEtbHasS+Ro78i?y{+0EIN*dVXessIEo{t|#K4yKu@@Kn~+|NK?`!kyXHF=gCHO zj+A^sOekyH>slT2H?E;FWZ}GxCSpw<5Lx<0DujpimFYpu~wG$$0 zw1l%)_!cLX*fosyyx2JAodsm9L76r~_c9v~TMrl>SE2UC`sMF82ch#r2gQ%_G?~US z!d%@x?0n7Za7!|RqJ5-#J`9Ytg?dsnfg*}l(ZjgGw6X-!e2c+8$K4Gfe@D4!Vi!0h zE$T4!GQxX{6n9k`qjD2tF{$cOlFNv^sFt@H5X_e$^~Sh@`NJV{Kdn0-$qtkCF@fMT z3%OYHE%B!`$hJ)+y*shhM{P-}@rjF~r#amCY#tPINbn^(e5U(Gr$BrlbQWnn;Nhm0 zc`4zhTh#yH`@($}RK~+eDd45->WlO2%5^0kHvWN-XD_a~JN39K9@QyXI zdgt}?W*|l@oaS==9-nM$H~u=MSEIFk*oL=lM>(St1Ks6iQFC=?vly%e zVt$;r@`xuyPF>J#h020wMZBMSDDHsCbq||G1dwL`#q5*ORYnjI+0Q+St%pO(lICau#(yBpfmM!kVP3?JxY>F z0MEcyu#o;={9z@gb0eI5#gOaxLbo#%>l7gD^*9qQdpgs7QKxtLvTw&MvpFU?-rp-W zIWhDb$y9as&EHxEAUqBc{x+?uRwM95gm1U}jTjrZk1#DF<#pDrjC4*rHm11@-|yPc zOdUmVRoXm7Uo9|Z{b1_tGQJh+9DL3V;oBLV=XQ&BO=1kYeEg6}JBf0({>F2qX6|71 zeKOB!#C}x7%AzvzQ}VCuc=}O>^iP5kx7t3mva2#W$?>cDMU11Y+ZsW*Wqre-SPP}> zY(o0}-~B-N8S;=Ym8;=tV@U0_W8=4sg( zD2X~LB?k2zz>@EOJIf*ej&J#m9f-tow%rb5Pzw?vJr@4r>J;%0vKQ6_j`PoYHmQm7 zgN{@Z3|k9@p8c%FPfvRwtP04fXiI-_Db#Uyk!b^PdfRp}sBEw;%zR3@X%G({?Ecc+ z-|^W6Ks2uM0zoeSmDTgtU!UYhr|_6y{Ii1>Eb$9R`#M~a5<_|(;NMpZZ{T8#50Ddk z05kCDTou1LaMl(2NoOo0gMo8?N_?fh5QGu>Q-Q7vxLE zmX#*|(&jEW=B{H5yud?KFgEfLV`6;!@An;z4_}Da-=0C_MZgt4+CrBB=lxOk(|5$w z#jxhz1L(s+}bq9f8~I~QaF(g2-~)8Ny|E&Yr`^U1|D&?r{Bsi3DWvX5OeOC|M>IJ3{Qh+*`Z1w0un- zW_#)2g?DLN@i_$;(c`YWgk?HIZ-OF3j(AGjV>m*c7KzD}>;@wZyv`rAfkeuJqh8xh zo9n6_0?qmdggR#p{w|Yc{(!Ayd5WCtzV^PCa!Fz++r7X=8>i=y4NM7|6Fx{Unb(q zHPo4+ANs`-l4-hQPEtmzG5Q10QR`b)!Yv7w0ES)K<50=`OtU;SrZ63Wru|tu3^A5g zX<&6uLRsV`us;Vru^}O0GW-D%70}80`WHMHBCht4k4C1|ObyTO`IRDG&<6HPwPf=2hY6oG&e07@YWO%us@OZM#Ope}j<0IB2 z1OyER-IlId#IkoXk^Stk0!Frq8tbfAg3!=8&%k7-5&SdZu7X|+GZNer%p@}fF2xL{ z`-;>IGslx`KO?(^E&Qq3{h4VGF^OS8UwoJB1Tzv%r^eJq-Ua&$5aW5!Lo)RC3p6`6 zIz$XWM|SpE5~IZq;n(zh(Kw<_^e}ISpbK|i@xNh8InCL!SVqFrKdsU%w{qYuae2~Nyn9&-N_O@yr4RNG+s zrw70*3I6WScpQb?{CL!^LQljJGe4@m*2IvOONc3Yq>zz|<6XShLNGbG85c*w?eczX z%YQxa5LQw~!!*sIo$Gx$27vVf&3QtWFtf-#L)B;~AYg_x&b_w2xfx>!p8+i!+*T!Z zAd=PzQDK|9U+tA<;Ux3Z&2neOr<*k>`+lshD0)M1AI^M^0;>*3&?{l6SG@3`4c16* z^?364{FYDYX!9m6aher_t^!vZBuwz53&t+M(#CwJ0|9nW>@ox(9H73Bn zL}OYkxS@V0))=s}Cq8B!$N=w+j!`+eEdO3K9`6<&d2KR^tPXU4r~RLhJtLI=Kr4&* z+~#9e} zB(Uvp4CXTIuzW5Of$v5zYvoqC(Wy>RkBLP!{G(Csz~Fzs3dHfL4Om3wm6(oR1Q}kn z6H*<@5)({3U=*o;3J-hCFb-iIY6sdVLnFDzK)^c2VY6sSL}6@oa)Lf)bY$8_BNvFO((C9HG=TKvUy2D@&1e_Abj}HE17Dw zySELZWxR=JWs}3@*7x+BxggPzSm!o&{b7?H_%j=Y;jX4auXWOj6bNk&$mg!tRgc#c zrUtWHG@{;n-{|?xVJoB(0vwSqW03?B%o_LX2Bgv>1)=q4rGja_Nu13xata}ncH0D= z+8>JYHDgDc$iMK+X`Cfw;M_>HWdTktvfA}vQ_S)C^B;^hshn_D3UMD;sHMDJl*zzS z_Y~R8TEjRMY8z?KZsg2jDpieXgkbIRyqeW8pBXN$2M%jHW)?f+X zPAE7jj`DFJbCTGFmTS996$`bmf{z~93i9c#AiDC3ldU};>4e2=%Nm5DuK!CwuRi<^ z(5*Tboow3Sr3X}j_CVTWO5DAj76`CJAiPUk+tuTRKbMK+O3r=~-sK}FM{;0`1}SSVz%FT6#4A5nf(Y={ps*y1r=RMI+4GvaX)@Hp08s6LEN4} z-83>5oh!V~U1z=wapp}83|(?{RsQt%=4A%Cr5H=h-p09q^v&HdG!hiHuqvS5b_0tgxnuX|?n z;_@*bCua_Bm@6CZOs4!9iQ3ZoOkg@e{paDMn1`M5DqhEmJ%A4s5C|{A6{8lWXov*u@qXo^qm2LE9{uvyCt!s}WZ7J76Jg{7+KkS?;T9;ye{Os2&cdYrhKF z>wE!s=mO}#(oj;8V1mIdY04~1+IJ^)0nyT;G^CnL9Tdx_226%pwjS}Lq4{3zn>og_ zK^@%*4pWCgdQ!)z4cgs2_8vz)Mv&4LYo4gyEw_c38b6246#b9taZv0z`8T!Hr?25y5+9W zDvXzWkwK4}NyLO|I?Mn_%FqNDc1Uq%^kCr3&KzSw%2R!2yU6)icR;Kuv;$kZRfwF` znC$BWkTiQQA$@6i4KmWODJ&IYqq3`oR>ik{K=F2;UZ6dHv-x{B_9Glq*b!dX!gF5X zMTO%f;IHFay-=zXW#hGWGp47n=k&Go*ED^>{lSu4y!VQo)Jsr#I79|%wWALdFiwsW zqX*wPi_^Y2_sY7F$P^Ns{hb%dnJ?yH(LP+U4?}(l9W6Ui z7?&G|cZmF5`RHGTslE<8Cw0#kmK#Z`g-tBGt4fOA|Eh;6L;fDv`S+#}G>8cMto>V;c{x}!r*CpV? zIsP^XZXqyNZUSPLcU_-!VO%75aQFfSKl{E#=$Xj_z=!JZBtuy~TYAs0P|&tuR`wIF zH-vHjGuu6a2jwvG zg?DmcGb3Iybvtd?5jCnA!zeLqY#AW3_fuMI-P>H9J>b(A40u@PZ$1#b(?SjnoQv2m z#%|T&jnc~TSXnq>$VNC_BN2*z(~ZISlAE5^I03yf9k`H#usz`y(x!u2_+vPQFpZBJ z%OEu_HWMZ`E-@f<60D9Lyi6ECNpKl*`2tpv3YzPHQb3bImaUrLsNp(;XXcrn-0<0f zv8;q}(yczHC7<^Kzwd%QS3eQg$EMW}z5=$p3m~;RmDsK`6<}2xZrd6E)cu&A%FbLe z*hoGlKU}&`@CODM$F_-7WW~g;LS!xG+revYnL`U|qfv^HY?yw`)=f9zDG{pUq zP!OTSr%^aN6^c2PU)2TLMhF>D4SyGS81!Xn2-pU5bfI(@VvV1MFi?P3pn?)$;#RB! zA8JXgYG|J7q3S#^IcScz53^ajbB^D50of4+R00io!3Cem8Y&_2A>`T|w}A_gxLn{A zAwUum$n2K0w%Lv2GDO1_-QVNBj(Yh#;&1W-7!lAeDbOtzQOmNG`Xx!FHjH znAbb(yh&oS)hy5ZNVki}$C)#Azs(p>GHR9$m0T&nqW#4^7Ipdn!FvL*lG@CJ~WMqa7#%)ZQHf`ZuR*q>Zg=kNOZx*y< zk{n?#G)WxDUsxftkT5>+pCC0$wT>DA)l0FkAHkMCGbrk}y%A|{Cjt&$A$Pt^WsjXV zJ|bhh&oJdQC5%s2#E6j9uI%8=Q5z-`5o|2=v(&nQ{9j5)B^I8IE2c%lO3V%k}D;|z&kK{ zHFU>rSv#RP@!Gl^G=xhFMGVXcqPuWU>*}t&4(s#==_0?XVrv*^fO=T45i+y^I#_`7vFOcAgYV{YEgqOMTbXj#O~m8+0G*36H${ku1uDZJ44 z49uOk#C;+jNcZzGdu|#nH}N-Uq=%$03db_|E~-(5$)-y3uF{9K@mq9K!|dFde&b2v z#JW{kHYkL=4e7}i-M9+b`X#~O@*X5i{lmg9k!XOAtrYGl%?vrwr~CK6G5)DbbZEcH zr7JgQX^{uhF4fy)3r)|wi#?=5jXEkZY;xCa(}Y_TB`G^5290q+FtW=TaupXFXpY4UMh!wkHlE{kK4=&MWL5CgsuILn0OtpE)=|I(kmW-r zRm=gs(~M@hnU%$_-1)F-hz_#G&FC-K?Gc3-YfPm@q;f8b+jtSNSS0QfyzH$1R*(oyc~AnN|fLw^kK^?owh=Q7+f75Iyt} z^_JZICeUm55?Ev@%G~#tdzKH?LDHbZndEU z?!jRN8&gJ)Xv|~$isLv#C#I>RzTO3R87|Z<-oh4rJPMI57Evh#XUEG2OUpuXXd6w~ z$AwU7KYFy9klZMm+Ra5IW3iJN7xWXF78A{lRanT4pfohoEIFMtB#!;uIKeL^vQTc} z9p64K$lAV3kv8QcyT8XpZLyzF2VE&3oXeC&#B(1=yYz>$2GfKCoB%YwJJU#>14`Yz z33cnMAexE%S%jVU_-YgICpz(ln|Q4SvLlyQiBF>EqE?2754RDa4A_K}7c2eBcVKJ8 znGt;NTQ*K~g;h=!GL8SS>X5F&(J5zJU)7M9+Xer*L|y=VKA^|P3;an5&<&Ul2|1~* zN*D4%CeNqX@bqYyfr0PT1)SEpXPBSA zoFGydHydHofxNwNmu*vQ0GaTq=`>7!7wD1r!TQ96qzM;gGs9EJ9x7zD6nV7?OHeb74MM*U=<_Y>hW}|E_HaVr zdv)`Z994tE^G2_ae{~T=Tj8Dv?=($j1&x3pd0gjkTFbxs2+yIYD7fw+f%_DYYR!*D zqK zYrDM5o+o@N7461_9_*HA2_k3{0MIT$zV5TKbVl*{zlhrrt-~!WL|hN(_JMe@@&20W zAW!iBtfKpAWJ-ffP3ToScyr5!tDtWw(=scngbk9%(S_3}$*ob_Y8%*+soc=g3dKOn z4IQ#SQPn7?Q&R)-zv5TmFtFcQG#i9$@MbW7GY8!|j!Ab@;42v*J(ae>$&RpQ(Mv zF|Nm`8gx27F{55T1FUV3CqepjmtHH1tH>k&O{CgSRQFLJ)T(dh1NkjLH`67WP~Q^v zV?wxu}nQM$`O;AsijkZ)Fg1W$(1Hs9=KLdRNNT+t+vTfJmm1PCSa$>F| z%*I<)-=g)3A|)}I?+f_3E9a8m8xl7~^p}x)A*0brF$|gi(h!$0$s$Utk+9v0gcu?S0M}>( z1da3*SXSh&Sra^IK*plv`lVh$q8Yy2WMD6-%LC75K zKlJptQAhj&3Egh3Qxhc>;4wB#$GKBLnN@Ju4roDuS8%Iai-)Cnsr+fsThVO)g+En# zD_Sun@@oxpHfqMN4^#P>huwrM&g;D93lfn7u<3$-(&&jN@D$fTQx@Sg z;w??`q4l=$%N}egvI|Ma_snR!Dv(G8o_3GGs{l?uRF6*=;Y8q!_r$DFR*+wvZTxjM zI>fv8l4qQz35rIc`vqJy1!Nfok0t|J0H6%U536ym#IKhxKlW7gmOXqcdh1VZKi=+< z&HKCzH^Fwq4Y%cF*S3K4?UEG@s$rTgG!!HJhH6=Wn7qdLDgDF=ycrTpR^Aidnyo2^ zLAOX(CsWa3H6xC1JWl-(=_R(qDwj2%#qJ1M{0r;vX$q_M%61I0U*3sG4c(0imXYWs zPefR@`N_u}5ryg?)MIBfxo;By)YN9$<8sSE;psiirB@e%_Uq6h@ zELJhzIuh&iM1*CzzlAcbtA}luG8w9TI~R@xUQ95^&GZ#Z@jed%x(|_G2v-&8g7=+E=}NcQaD37Wfb5= z9_UD|=z)sfK^cut;o>IESztWQ?{S>UXhkcOQg)NE(H`78xSF4NWQfb$s6}p$ic5*) z9oUrtojxF(rWs@ijSy!F%;Z^-kIaBE`5-|wRCEI}*{6bRqBjj@yD7`uQ?=QqTA9xEh5#5VJC04s+sfBQZ(pY z5Avz+5JDu~BpZ*EH%JybLr*If1ps73FCS$ zSIHMqyVdM1d#(BrjhfM`2{kGvnYtXm)R)Za0ySPbV~a0Xcpv#&>#8pmJ(6=r=H}W> zP!eD#KM)sBt^a7?sl;4{xlG2RjCDT76benmJu{n=q&AA?uIsGcViKYSCqsz);la4H z%}_up6{tzk@#qLwMgnZLV;E&6M!3VNCQFR(=ABw#eScqRLV3m#R$%bm`n6x&v}gerLiI;K*^5dKQIWO`4r% zKCFtmLn!|ld;9#YE*N2?k(`T|5#a8&MVGxwR6cfj8X;d3!%P7s^-Ip=`=DqvNY_T7 z8_wL5o7H3>6J0Z{iRqJ>I*n4@UJ1dJT3>1FgU8TduyFyx!nyoB)E();Kw1SEj3KYos8^oDY+TRPgYpH$UFo5D zhY`rxTMxSHd`YMelO{M0RKjie{H(Ec4a5ICO0$LqT#D zqEVn+3z;O{3)KgzgBZKjxY1{_QF&3LkXbX2g&Ht(Z;0H<=vXILr16;W-hf)FK@s-A z-Vp3HUhF6=?gY5{IYMy_sD?58)Xl#?awE;MMTF^WMyp7{8oum(|92lmOsv;e*&@yt z9=f||^w*kdT0*(mXb+9Q-?awXaOqv;3E-Px)ah)XdN`0YEh7ZIZNbMCr2uS2@taPUM%WqzedN_!7m1hr`r|#Dbht zfv%Qf><4q;09jbV^C?s(nf*qtHxV<=s3taVPM6Ul01onD>Dlo^LjM7jwB6?iCS-UwK17BMti@B z%Vpk|i>?)Z6HZRLt9{UhXFj_(pcsT@Dv#YLCYHy48lpTofp5X&=mK_)pDfWcD&pgg z74Ql7jATU{oD3azBcjrYz$*AF!R~{Aq^&+~P}sQu4a~dVp9?iWf*OtmJk!b8^mqcD zlkjVL69i1<-fJu)CS=^Sf->iIAXpVayCunqVVAP)&WKB3JOyju)uSMj-B-4aa+x>s zWg9u3Q-NTgOIM7)OJg5wgrPX#N;#9T(+;@-6(9W3r6NUJyyl#cFkLChO{a`A4@*47o35WdvpeTk1O$u4qJ0mxw`?PBecZve;Q|m#aj4-yUEKnvIT@^S`l#MtO9hc=+ZyZ zmw#GJDj>^`s8R}TwrN9J;YcALf4C1Xy1o}z?5iFdD_6)-z^az~vrK$lA;h@Dfm9wy z{uTSx`W5(ES5GqR97&w#o$%^`KnAy4)zVpvqO3l|p7L2WU{EXt%>&7JbsQFNhHAqi z(9enl3oIglbq-vjf}8&Wo~kD&}~Dxnz27G?dW5^Y)C3}o!+#5v;&&J%U${M%RIAlLBfgCYjn z`TYm64{X-Tz3kN_UQAFcGKu?gVxKkSSq zw->W~3RQWImgCuci=J)Qp_x*2Z(X<^Yi=t8hOpHXro287VVhRVtkEG^Y<~f_D!{$_ z0y+Rhbm>4+J)D!~TOEgG?fUOU6PZ~wt)iq&DqrN$DaU58NrnyoYaR**SXj8jSC^_X z&_Lme1HACqT1Pa&P;^49W%{$Fng8Ciyyf%)An!S8&hY&F<2C5C1G{I#51;$98>^@H zpyxup-Fv9d|H6Om#l;buG=^c^1wZa&qd7riS!l_P5$Mr7Bu8mMTCK{GL_ zDMrL7kT1(Qpjfg+-uYryBT%ln*rRO=-3U#f=vxvb(}^!alN0@-aq=EWR$Us%$qGyN zen=MEp7t2KH-J0Wvw`gXmzn#(otX$7q9cT9v8LuRb0^4P5fQBWvNFx)-Tukqw2cyXn=ip;1UlbTVkP89RmE-0eaYb-|g@aqX6|p1&oheTJ$1hh< zR9$}$Hsv5ta=!2SgOmrHroljKX_(fqG7DU3%N*#z^U%wi#V-6o|B&)mI2pL^&w>J) zb=exhsCA5ohoCOElM3@$K7lGXWkOv) z^{(maRmAo7j;Hg$wtV&J81g9ZL0U`dFD#ZP!0ohDd|2NTr~DmEF^=93(W;vRSF{@k zcJAD~bllin4QBp)CAS_Vvr8?wv~lbi5f()3IXTHGdjJ*);GWSa{eq37Gqx$~v!_`v zZhh5m^~U<&SMaJvDT7Asby~oPF?7$md7VMq3uY3(a>%5D?`J%2OuzyXm|--ut1x_h9Z(YB5=Y|AWO@|k`>8I!5<^*Bf}LaE+yJDT zNsTn1r}dbBp>b@(nfS8b$5Z9DMKJ$(vs1%(WU7~+u)nUJDSWZjK~n~DQ5uk~LaB*p zdVvj*U&zZ41INOWlN8cXazXi8y|cYF_vCSP+9miPCtJBowo9Xjw7%VJR0@DU($hL1 zo;<%q?!`k!r$AwDrT6(Gdt#tvj;K9UFbtIH9nLv^kg8=xOqR(5x{1c$g`J^h=OUJV zCcf`R(3`Fsh)$oElE& zUqXKwtwg+cVph%gGHr%Fn>U)`%PnY>C-9FpGn;c!va*y;zL&WC`=L&~$SqE8%JPrv zr05po-2U*tT|0gG(yMc(oXfT8oS0=goQ{wlkzOCV2QM+4YLrtg%gj@G{OoJzaw$HM zoG~Z!Rw_ePN$w1soUIN@{avGAhm0UoLvkS&VWVvDs2i_LHGsoe{6h8Gt%K%>zJ&)X zAJB1goiSl0z&7?rCRMJtav|O{*JxUX^yYmitQGSF4=XdF)1?XaW1Zd?y>XhERUHfk zduvBPfT~W&iZDHY)$*|_yGOp|=KS=pd(JLk5v{aO&hTL!vgKV)N{?|+`+^a=sNOM4 z|JlHCd3fNxJGR%4bWf%x$6ATtHR@^;G}uo%N^Z~iJe;>bUQaa8_bG_p05;7_jY^+e z&YSfiJi8pIDot)ET!^8RZHE>-9%i$tyEhJ5<91&Av)3t;`PqxE>?jxGtz$5W_X)!{ z=bCuF3BA%%vPE>TMp&DIWt}%yhS4R4OKB4%1s~i!O2tAR>R*yd!{*=0Tf;3s-bj-Vb zG3K@+#c6}9+c3umE@SQ7Jt6T6!)5lS1J+xXReUm%WM^>dc5thhY}(%SgHaa0oCak1 zOtXTeShV-X6@3(>|^%+yvd*>+;B(NU${8I}FR#wH3w{y9w!#4m8 zyu@W69Q&?r1&6~@^^Cv6yIU#Oe%{iTc_pt`E?n#{2p%PkZ*;iKG`*b`uc3Z}sqrif z7VO7>2x7peo&Ws`L3Wv}u@Sv>Y7_)dFBM!kBVjzoWP-a%;hREQ;SPAbPr@{kDukGH zdhK-$vnQM@)JV&zn0|80H4Sq`jB6R5)>Z$G{GSGke<&wz)K}v}Ws8m&S2S#VFmZ%e zL5rG!&;v2;;A#j~D@G8Q+vCOsY}QjD3k}Gwv6!g<(;NF*G|V%ERN*yti!?Fi5KyC_ zd2lNkv`xs6{YInT_>4O0;nlX6$r7t2CD%d0{Oaq?MIItT8)X|xaOT&z=^LxXio98e z*NS7S&iLKrBi4fnJD7dX!F2>kow~ssz-A-G(kE&LSDW^lS()9rJ~V!k0^IErEc8!z zAra`3Jt0l3COykQxa4x);~Z~@=U}uC&(v|I5n)qeh{MYt5tdDT)o$px2>Zi*vQa-h zSTIm|?|Q;#o#ZG#C)iIkU%NsTl&ln}RTe+#%v1OFZZY)a21>p#b?lNSRAD5h#<`SM zKAEu?Asn-T2k?@Op_ao!2x)2Sl3lteNrVEVN0~}$lO6Txj@<#p*|N$Yj+kEjhv1<3 z5}mMR(?|Asv=?9>Pl$KMEKsbO_*4Qm3n-EGrq~=e@0d5?SSLC6D1LD7O6UqPyH+pt z{j`H4bWKL@^4GI-zoG_Dpj%Q{9UEVNS{*EUtRET9S^_+stxZtF3b);Wx2vN~ybbJ> zc=De^f*B#284VK@J9@@g~wEP+G^#@ltoo@F_ETR-Xbx z$Lbn(rm?BR%*yhfy9265E0+$>(Bq$1*PJJY5pmp-;RKV0Y-FzHYlYAAHXF4bavS&q zlUBJWnm@(RTzst3dN~&W@}Y7h%oDl(1RLwt3q%uMR^|1`Z={DBVqsz70>e}~(xKNxEhf@w7x>#74neGXnx zv`L0;_f*B%-%5xVX9+EOJgBpIq-L5B( z7zqM>=1L=T6*)UEbhtkEjM!x4Ks~cd78vFG8m_s*M`AHx5kmn;h=Mt$v0kT6at z&GDItJ|8O^h>3;xZV$4t4GLP(iwi+G-34oGl(eO^hxPpT2{C;IjAw&NMA+e`GC1M1 zW~Kv+4$bI_-@b@`*e4No^_PO_ydVlZy_>}CAmSidbzCT*i&c+CkbBRi8fG`8T+P&6 zNcuY1MTCzikL*FjmUD^i-&BHta{*cTq{)A#;4TL{rl(!`XVR8``PT*eaOQT#hJn5L zsfxrH_xfhN>ZwAeT4=ud(ZBOgc#!`+F~bB zbo$B9%sBd^fO|Yn|5L1?AHQ-id9wI7f8pxU&Jlm}?e1~_9q>qCjXq~TOQ(VaLNfd?Djsw`^BU2TM zJaZXlPQjdFH#ll#6d~^fZT!G?nv=G@cs3g}jv2if09;-cKD`oal|ZZ#j*bMpqr;y0 zWMo=PMWS4k0k?#syiXv3fFs#53WU_GX&l6q!znD+FlxuDvOFbu?bcTGh%m7lGa81j zYM6HvbuQz$ma}Ig6q&CBsWhDbL~}a?{tUz=Dz=EzEZTK53jX9|7lzz9doH!pSbPjT zGnts^)1cYAbo4_+klgd<%P7=ci@bX9`2nu7$+)+1$B0YSjo;H9XZ-`ymHJo$L!w7hTtR5*R%pVB1ki6wq%${ zW=DooS+l;sCI}H{g1^);dDN-CHGMOY3 zTHh`{tFG7C%@Y%|9TnKhDds?(%SRhZ*?Ac0)H$k$TT_#!w}VI})=Vjb*M8+~EKKRrSTn3swSPkgX#i^;ep!p*8c#vNhYMx?+3r*q$jWv&Lr7Us0n=iEjr=+n5Fa@MD!U*2%h&W9Z2=l%Px}`kFGhl_or6z^?e+O(AOPnsJ zLJ!K2IOK9!9E5Vgn)yHotC!V{^g7Qg`b2+o0@t^}-eWbMa9vye*i$I(#rlH-{S61h zQBAp!g>O6OOvB&h-JiH>p_V>I6u1ck(KkT`lk=-s<4HsU0-`lDT8h!G5eb#$z#h- zRg6WX>Q}l0Q;5~dk8nGodm{9AEfh?zC$KDGH6x6o;!AmleJ^0n7xNFQof6*vm8B;k z_;lx|;#gi%gT!NY$&)R6qTJRh6-|mnF2hI4Z@4DRp)PE-P;@gKa_5;BKhriZX&7?+ zf|cWf!qHm2wkIl6_O)U)8mF87+$oeSMR04`G9*0z&#qPP0_iU%Ap%>03N^{4<7Sky zV_@6GqRkAmTduHq)6qy&BKmwKoV!*BK^*X2QQ6T(1aWb~p@Qc?DJ`-Ur(NWL*@ucm zqZAPFtA^E|UYbCFlO2{zS(8KnaX##2&&q8O2mrr>Mr=264YAFNTFKF`h78i%!s{Ig1q)hJhco{Y836cQ@snxls`STF}IyB6cv4YLLJJ0y^1d>T$>T zx%4mjJHM^h3Y3O*tLyJ=k}rxgFh~f1oCw-)jDP?LCKubLC~K;n2&<5_$`|&2^85D2 zQXxUvIKS@c1_{13$$O!GteJ&}v}t})0M0*wU#XX|Q5pX4-AkUnFU`{kcPy#aFMVZE zoZk_0+q7ScQ&wbuW;G%GJ4Nr9!qBSZO0&jEOv}0A*AM z3<8iyz`4JlKq3L;`|wNU9&@o(7S4-=JQ4F{eaYEC=0FxsjQ{B0j7iV9gFiROm7A*s8w zrWSshS!jg13vVQ%srY|7B5FLb7F#M1x&y$;`sws*50?cRVj(w7>*^q)R~J8Vmb7@P zQSTO~Zhgjn^zXcY=)!i?WNA@k6iT9O6XRmc&?`j308A8SqJu8|y^A&hHg8&#mDI6? z3S?*X#zuVR+GT4umifFWJ{M1>Gf%v#sOrF+&c=SmtNzVI-0YvKj(-ED}GArs%J#%mQG0>re>)YWpCVy9MW>!bO*5Q6{Ho4c-KvazN8%# zrSsQ4nGKh`9SSe+?8(ldX$>uo8IOoXX=^q3C^KF2wnWd={4I*$htr#D*w&a#8wfoD zL6bmn_UaQrtpV-F>{|xD?&_W0Vw6wUU;l6J(Xn=8qF{T09Oy1YZN_{;m6Drh*zcmr z)ESJh(fzu-tA4BwIYE{#O2mUal4Opw0knGaC|7&FttDi&nDbHKC4_-ZY+w(EcU_dH zaNnnrUtt?@@v2xd|8oyY_xNsG59uU6d}oFd6D<+G(c=Yv_B4BCv}H##;x;9cY3H>vePx+*=`qPp=O zgg2V25FrnPH3|49f6OB}0D|8-@7T_xFa_96PY0$)WSp;$wHs4;f!v}TOOtH}rz?j{ z6=JOU^r+IN;=V*CkxByA$ddW7s4t1snk_bnE^Z|8qURc4+&pb3zlx&ANjlvc+TA(5#z+}AVrpRMOs>Bo6D znslh?tZ>`6L<<{1+hR#qneyg(%gjkZ3<&Be>;1P2%09gra5F;rlkdKF}vO=J+sB|GU*%a&=4` z86TNsn0&O|SL&F`&1RNCNaR=qmK{!I`?AELht~t1jx`#8Np;fBMx;5Lx4uhkZAeD? zmi~3n5&;8&9aHf@A64Q&Cba=xnuhQyL%lfB{}-#(Mjnw6v(9l!ggp%~=rx zu}>?uG_u`-`AONn5}Q_Fw_xcGWfNIb+a5=^bKmO9Ql?a@Amd{jbL`hFQ^8Ebrlmh$ zAmx9gl6@KW3eZ1M^Y$!pro2ouJi>0Os7&Xj?-5H|5|E{%rWRTOIPcK^96r&jDsyQ2 zPVUNbYPGI1o@L^$=@zZ-f3aDhuGKoMmuCJdh<-L)c3m4uZtLsFYHGe zbGXe{dGPQ`!8Kg;+By1hXzL@{@6Z&MIu!d&$@+rZ5qQOyl#1XhJ5e<&WZ7Amr`KHk z{&^T|Co4rZf9Y%Z*XfaGo99F=R2rvplPQZ|g7KNvI`g4jmRfZZswB$ru}@ z<(ZGngS*kI-?%=MaLPS|t<>kDBa*&2{Q6P(PqI*M_AdxTiHgDhS1? zZ6eh=gBR8&y5`jF=P=wDH-dh=ax4X3G&LKJ&y4}UTBA*}OvpEE%Ove#1v~MN203J(_+Y>7mPmAQWVQv~Jgj`HA zpIJvYw#g=v((ZymlXtc{8p6i;M0@)TkRfW?Dce2?t6PDNqh-@F1{r!cL zudceNwMbL?l|3U@T?QLS)_<^u75u{dUw?n}P)#VHq_aeLvhDW_wG^drvPd~0itpcg z?bO2L#5g6xuD$Zf4aXghv7}d9;GAX7!&~W)FDKWVI9eWI-`MGW#5Y6mI(pL^oSuAT zX5k7sJlKWHw)JYkIsDBN`zJ}#hg_DqiBF(;QgFyF>7{H$6Iq=k%ohnIMQhrMTAmJL zc&`Cth}F`^1|Oy8tw<56*DLr>G%pT!NYc`PCFmo53(Z%^HOLdJp9$TTmzyW;D>!Ty zfF}#8R%O^!WO)%1m~jRT%U_ucW~l!?CdR8l6gFeuv2wAJt5DjGP=7xFDC<|;!g_T0 zb{PtWCFe?n2fK8T+bq{%-1`i!=K#p(5zbXcv2WZo?;e{0^0|lIa(3GK+`^SFXo-BTm_fQu+D!Gl0;3f%m0a= zkyuuMv>n)u~wQXi9j)e%}N{oDYas4Gmp*&{Bfa z*2I93F*2-cLB$ZCzwn{2GaS}@f}?TQHOw=d#xTHHA>A|{apOT2w-x2OZi67M5DK1q z2X-XWq42k^tN;51ep2)w%Q17PM=IKWv2*sq%M^~ni1wSuwm*o*LY6YktBgVdCgOzR zONS$aG^@q$zy`vsCj6#R-&41p1(ux;dMET--pWB@i@#nAW>?-$(-u7+esbT}i`CJ@ zfRQz_Tv#h6(v|*##RXP3HzRfyjrTizlx_M}2Ykvu_)_L2;tzyh(lxR*CB-CUVsG3$ zhp)#J!H+G2fGFkw)b*R40o5Uqv4Z1W8_%o)WlXp4SZ1p%1UM0yo4$zVkR|5?VV)Xsm4H;vhO_)fu|&uUY^|%6d7IPB zZR$5S_!%@JCh_WvYD@qh7}5lg9N7_Rq3?Mrs+oW9xSp%!vPI-3b6qtGg^=9V9ftoUSPJ~!Y438Su6$8_yuimruKhPB1yi2VGGWF=V!yPghH27V$3)bHBh%fH})xQ~CsZ60?VB(wZjTKkXv z?-Ip#-4~s6+^C@31~fo63|KOX-SV^Anat~^SX||}4nwy%>Q3H#7WsuA8Ya8g&xz`% zq72b{#zGosp*m+?dUm|BC!eK{dx*>-SPQam3Pg7R;k;kAtW@d8#0VS3oMymck-z?C z;$5(GZQho&km@_|%{I@DG9k`>#ObqFYg5Pmb`7!ud>GhaP8;C0bBH3cp&K9zR)2wT zR*zl50iORa-a)`nE)1iWas)8tI}1LmCsVUoc^k_6OQxirVj!&Z`>E@{-8lX}f5S;L zlray-h1yZTX@O?_TyQ4FwIF+*KoA+30draYgJ?WxDba$$D8#ppllu-wFA^4i!+XBM z!`kuzqpngn9r@;6hejt31YpBL7C&9{r&r%fQx^4(9AeOEB%#tftALILaEgrD*#?)( zj8TD*Ktxw1G+F4>JBGZSE94RHDh%m_=lo<-8G5q|Jixn8p_>Qpxaf>5NHPXf0hRU?=TGqoCIL|8 z0x=;$#b*D#u7fU|^g-n<|JQ|Dzs0jz3eu>M?<5ao% zq{2Q)A>Gx-9~`_p!Ds%V$Y>^xP^EXCm4n7k270IJH1C;`+!LcEhKQ~saNla`p@BUnJd>J&@;+6{PbOLCQ!4F z!ed@L%%V;{w4jN$W3zfKy>y>DBO}&WeHV({v-X7fdNuh_xnR%wp9Fhb(BeE!d3__X z?|esjr0%qct++xKo|ubf1;R&~MR#%fSql_OmKY{>+maYJ8lA@e>-Bs#us6_U!ZTzjJn zaMO|})oDVBuQ*sjrWuUL&S}-%qQ-Iu$aT}e+4-{%VwWB#vU-;L%K8sti%alX`+8AT z-d_8tz)n^;%2*TyZvh8c*Trmd$MjJ@>{CIjI(|6l2n7G9HSZFumqd~8Xbzl0C6q=s zh=yP8O-R55{$M`}&$NUK0^`R@ZD~lf=pmzE)5o4<%hC<&+9Q4WuVtdF}e!1QkiSmkm6@FbK3tNEg87jGFi6-i>>7;?XNP6$1J>t{r5rj72}D0pm0 ztvC4`P(%ZgkQYd~p;D#I-xW%0FJtmNS9LhLdDo&%<;o`QUE2?YQf($k%WmK* zKbe|m@&HO(kxiH$gdZNkg<^IBLrlVXgghI7shTE3H$k&+Y*Pgcew+4IN5x@^__S|L z$19lw*R+frgZEHphE=DBGAE^rV3*A7It4My$NYTi?oPQ;y0LxV-fq5~`#&fYvt4f^;~+v_w3p2%k?b0XsyK8n(&Id)HJsl)`x|<3Thp#DMfRm z0PIt*i6tWi-D>S)+QhrTasHMYK>_oAT5G+6NLS<*Bp&;G%5^_`Z~{lb{}>x2K4>c&%U(gyD-Hc0gNnOUyr@1YG^m` z2qY6)KC|(r>0)`~P+%0&en~9wXT7j=H>m5y@Y(o*7WpdJT$na70^v+!od(c5K%x*&NvBy7!?*C0lnOWVO zd1PUnjvDz3tA;H~30wL%sgl?;+Q}8MW5{Ecg@r7Ppe*_E()#BfIj(py)gLhoFN#lR z-c;1mTfmaK$`M^idS=s_je?pxcG*nnaiE4p4hvCu#!%PNL(`L+<{k1#3gSh~p;Btc zXs56*2O3(nfs<;qF#{(V)@)bnfy4=;nd~(?@N6XcumH3>ye(IOYUNAol>2 zQmf-kT=RY`dlAgBkX`$Nc1i14x4zKO?^iT@Sy_Y8n*>ykShi}K7HR0{l>(e{Z%aph z2!^AJJ5q&+enEF&5`uU;&so^e^Wl}gru@j~V5;WpSCf>MXK zf5_Jmo;WQ$;>ihEkTg^*E`C?a7L8@fKN_MH!ouMsGQ4yg1?<-ja-%X$DDvlro%6FH zz`T2m6u$0Kf*QS3fvIVDuxUrgwcAwY8}p3EXfm;);*w=;Y9YH1;8VLVy7w}L+4zgn z!|{r?w!QWp5om*ot6CgK{z(1_p47@pNg$U16jG~W3Qqa{&P$;CUTL+jXpOXqd8bd2 zW3@LKK--Fmda$lJMTVhx2Mg5RAu{L_6FKv$oHwJR$hhf78K2(lw#k20ADXFPl0?xZ>!(Nt@5TcqcCZf?k)`R%K?ubNsa}3j|E4HFY6(L+m9$jc5 zRQ!vE0^U70jYZUXGvI;hrtu>N^O5M0PqO{+Xn%3YH^}@s)XF8N?}$ppX5oHKmjca$ z0zOLoT_5S1v5}V0$PGuwr*Zgwyb|lYwUgSp7x0P>!Ysa}7 zAE5Stl?Yj~*C6RlR_{UjiiO?Gbo>eUD>I2s$d=T(=cXEnz4M6r&l7+Ktxx@{+Y7LG z07%$eTIbAh1cNsLKlNbGi(?<0S^F{7Pd9UUpwu0WQ276U$em^^1`A3OLi3mNXR>n! zv+DPN^fmu9SY(?>LLzaA%YI(rs-X_$qp+mq0dpYmz=sJHFob*on>MUZNv%jqBuF_) zbj_FqEl3O_CCWmIFg-bWQHa-#4O8K5CxC`A>?`HeJ-Vo>k_p^|&Yp|$YjNxY7R?>s zQ=MG2QkIi6xrjV{TLa1Ke_f?w@JW2uu~t@9ui|Jid$B<7xn;~_Bn^9jab~`ay8oDM z-NEJ>#E=*U+OieS^oT&hp8|M?g^>1T6tUtm)K42M(yHci1m>8jF$eILUC_ zp-l6!wItwL8*M`&=G8T==FQn%5H2}P+j9BR-gYLxctZ~0k#IU2JQqm$()WLY`^F#= z^k%(A6S@zG1cilUr!cerJaS+&(hxwxaeu6-I0EJ>AZvDi0ecgXg1ynelP*>RcpL(c zGB7WG@nRt2%Y#_e8y)mSSa6tERg$M^#|MEB@C8JU=Tc+8$#m6alTRB_<&3hAs09c&B4OO+8{> zBaW}?Fu&}j)NG-ep>zS5CE@fh2uzUFLPeiT*q9nF5O}CSip(V0|Jw5b%UgO$@FYbt zh!?8xvD~atLa5-+`VH&#IpHRGkc%^b$^NI$&5=zManT*^^47@912 zsYY{OVLH`ZGnKU2O{(mqV`eQ%6RJ-VbAu^g3dFGWbNBfL{T5Y)I8c~fyfFjzouE`5 z8VyC`z1qlSebTu9G8u+8gv#A{jliXaO3381I+=$7p2@CiyVMDR-iulYTwjm{!rk*} zNr`#^Jzf8-Bc~Fapt&xI=eYb(zT$Agq8VP|nuAcsVDiidUgjdca`tpQ7wHt_;U2uB zYR;{c1V(hEOJxlXa`wb+>R~*4q!Sj~uFOfrifO&Ampdg`|JRw#8GD9FgNTv0VEd{z z?vqn5mlyys^HKTInx!m~3sCJA0!@0?os9wKQIjSW`g7hw5rj8=k4sQEwIuAgEc<0v zk*{Sl3;yT8zL)s5KJN&<0}o^0V6ep@mNn1sDqAegUJ3gz}I zbq)NwpeK$ulDszL57D?6M9z*GGrp6|Uqvn|A!}N>W_F(x(xMK@fUJIGwWBjtHz$ z=|BF^kyrMFzy2*s1|z5CIBgvy?!x0Lu}ynNNbs3e!3CB#gW>W0>0~$3Ir*~Gj5lZB zhhjf8mhlp!H2Y4Fz@3F_fw84j8X(hpPQW>8c*P6?BQvIw5$TueznmIsMMX2vJ%B}-Zfw#VN7_5Kb3^60ho=}B@$!vn*Bdik?OZ33(yUbN& zS?4i&Al>H0JWjI>LUWjJ2SROwB^#}(?N7}2#gYV9sfCzm=vW^WcET0)Ll@wXdqES^l@z$j)mWiWu;7KG;S z&rmG?vj}KWg;R{@)%HYB0~oErvw&o1Xb{J=!ubf#S$GZw#@ekdvBb;FeZ z4l!3j?!5Q1!E~fXC$HQrnX1x6zME>^@?rZn{s)~@@0nfeU)s+{TSWU~-(*t~=?jo_ z@{FdxsY;}rrIl%e6=lMy1xI9oY^%*!hbQqq&LPx~M=E>)+|Hxl)1tw3e% z5aO}q2Sc6CJt?SXF_}swQ-BfDnKUFK3PtbT5%42O0Ypx97fD1f`7hw1x9p4JUQyxP zPh_)I+QkSnn0A(@OJtWZN^~*_=EQ)uh{dO*Pw|-P2eGL(@hLefx(-Ku4>;(uG=sS$ifbcf)FmSaWS6DK!>dY-6kkMm=jPhd!R z+)wOc3BLo=2{4HOMFGDlSeIcO1QOttLj;A9YOnY=1H|~OtAM~^TN}6_aIQ*mu%6=N zhGP?C;a+=SsBfgp(X;gCfSgxzG)v-&(B8LlPn9zY&)oh?z6>#IpW30ThR*UFxX$3A z?msVRensv~B{FubL>in8PKkPB z9tn?)SHE%9@g*H|AdLa4A{t9Y-TG6mp3hyh8!%2lPqRgG*gsBOCVO}E_#m{hJ!iQDK-LmF05&)xup zD4)6kaBz%$-koT-Zp_Y!48mDp7Ft^J3}=RuaAb--m?8I9DqbW_p#AV5OQIRqk}MaJ zw|_4bSIfQF`1ClCH$&xCwRR2K@P_R$`(sC(%LUEjhbxjX)_tLyn|a_>Ld&`$rv^vU z7cP#BNn6m6Od>zfh(%@QPAY+L5_yhs!QZk^+f#suk_lpw8xXR z^5}7lg-lrEIQUO>W{8mPeRP1F>>}Arh_bEHrWsCdeyN!H#lfFihi{BA){zxDZuVsT zZvHxVRCtlTve6d4hf+HoSA7VA8W6s5dKW=0XQqX~9pcl^Pdaj^vD_)5oWEm9wzH%$ zM?iDI{e5p*zIWfAZ7gZMW}26!ojLUbx|hZtygr)@;c`02{`FgjPu>*}+h>8P)?dZb zWQY+_u3_$vyg(C#xB@Wzu7B#;^t1qI!ArOhp9eiwW!)~+IhulZ$W^fPK^;)mgYGS* z2!UN1)}*P%tSSvpkU}2uX6DwHL7MD%-gDn5x@teBO*NOeLe-I&5NzvlZknD195wLc zkgp1ZLb)MlxW>0lNE-`IBAr3Mgugg^CVfbcm4ae(C=&!FeQ`%ZXZZ^kRIIar`AcQ%8&Rj5Ah)=r`|l40a2 z$BO5PQGVHeY>Q%boJqu5GFU6BB)D6bih*r&vH7}fqvI*^D~{7wQq*F}ZDq$r{dF8c z861!z;67yERqr?o^{p?i2VNTZ-n-<p}Tuh7i3+g=?hBvi`TQkeGD)@81j z&QSTcR(SX9xskK1x+}vUfgh9(-*rCXi5m2e=Rmw?0(p?)UGY>s#|Fy5*m{>(qrQ=Y8}MJt?AJ{rL{BKmgfvU^NH#4tOgeg#}-|@WZ*_SB6B7 zP(5<~gPK9B+0L&@zWEy@+FHH^d6qHSnMAb7zP9EzRsQY5WJgfq4!N?66X+L@wM-v$ z*_d>3jy!SO)o3tFrNR|A&%xgDQ6~D$XnJP>IxZy1&y6LRcI)g!*6Sx7#%sF5yIt^t z=R_J@qvx~_v=b&!5G05J#Nro-M-IS768IoDj`lP?NS9;f=c3*_D^SvlTnGw2pjRfx z53%LP7w}mKITVs_We)xjU1Jip%Nn3(_9*g@7&cs{Q*jEwD&TLV`wz69W})D)3XX_1 zW-UUvD@r^%&$xjNgg|oLju=UVJCoeu-Mjp#tIbr{(ny+7WT4Z2(wNE6&(ri#z36<^ zDg&+mZWLBkHNb0OTXyNy7&5<*<&tP>5ojKf>WhYsKJx0?HeC7#YqPdzbMnRnA>P`|g}%r=yLl888yoGI`Jy36lTF?UKLU6@E~J4`1?hosZcUlIyRH zMVQuldA#WLRX*NHZ3;W9fLVp2Ve|IqB)Rs|x}Ljk6|RX0Y<`9?4n<@-6`t3BVU<9w z_!%gc@~YnWc?%Sj^$N``*r_D>#K9@%sf1HuXHoj+0H7#&PkBJC+j)=s=O^D6>)i_H zON3w;g0J!mUpWH?4nPt(aMR<{-*ZD`F$`#Z>JURMuO&V!7i|5*_cERj(?w^r`K;^~ zgRM3${To~0>oVd0Fj*>Sig?%CUX3A&%6K7z1pB8?h`%@b#i@U==J1b0|D4qzIXNa6 z&>WH<*a4+la}m=K!- z>vBmYH{`Gs!92l-KjkC*qp`)zRfma<8_#H%b2#a)6xLZ|`XsQk>#E%XCIlsrhSTTrlD%`l%)d$<+nJBA|P+K?BfAYou3eldwV_!@lnSKmA7~wImH~4^7`CZ zdLmbGdY>2>FK(D_x8GpM@vj#vO91GM8oGl^f+PgL%gIcI@n=rzV~gP76UmHuFPwW) z`$SSCdo!Weyb{9rj9DpQ*tWvcCXa$<<92NvM7WpKbz}MI2d+}%snQlPnG9m+rn{X} z13GcHuPl5f&wOTv0>+?4s$uGDF}3Z;gT@%3+mgBUc1WjB&F;k2;u~LI44?+WkWJyO zSQ(?z-`eC+h%(#v|avkrhUD`l85ITQ)ZL<;%IC7G&hKI<@0_ZL=F@&A-E92J!qF&wi5aO^}0FanIZ<3L$Y9 z_H2UGaNlt!PGj^m#$Ys=Wno#qsDS;)eg?yYf#^D9B!cKNU;?0=I^1>i>8cPbs=r`g zyoH;?l|LZtJ{u#ZMF4`!qsvu=T{v#;c76buB)w`H$Ni(`$bjCXX?v53;9S?BR!E=3 z&R6s15omWD!)jH(?9aMF@?>6J!!_}xGVvTMT>lU5ST))(@B7~sQooW9uP~PX&%^Ew zS9}<1WdF2(@_HeT#3)52&&1*$LmrdoCRvu7PdfY#K1|tml^nN+E3cgZp65^~xK$)( zEg5c(vS!(V--KK_RHNk6pQtyh-PBcEnZ3Q`UZhO)EC?SrCn~Sqm-rHIVW7aq;KVJw zP&bOGY4_YU^*YfW7~HQi-0Lm2jzkhI}G_?BL~uOv^*U=>!^o*E*VE>on(#{MyXw_(RHtK0`bT% zdjAKIQyzLzQwYa+I-EM8(~XQE8QJZ!)KQBid()`pYAT7wHjJl@nWj)-dBiSJr<}Lk zwLQoMEMOEKM51b0Y{6lsD>bvtEG_-`$=Hh;s?cu2-gjEnXuaab=p0$z0UoRnO*F#+ zHX2eP;xH>1DW+)`I3kRE zDB6*>BEI~<+03OoUpH5pD23M>uqC_Mx0|r4Q34Eln#tGSYDayEnbTuG;SV=2(gkrP z#&a^tvru=*wT`atKk)}R7ErQRzO3KQV`3!|7v;~(w?_P^!Arc{wh(~xJB zFzB4he<7tF!1`v4ND0L;sHVL#YV+446&SoTk_*xpxsDSuX5kkOyj&Jiv zX9TuUDcf22`P$Am&j^x3&{U-z#sC%nbtlSV{a<*6GLb_@w z_Q)~WuDa@9iV4;KxAEojMpTU9tp1<_z6!xM@T4{hgT2#7(;HtQnC&F}gBV_Li47bM z`%Mn3N!u_Idx0R*xp*d0E)|mmVB(Muu%zarY>4LU#XCtq61SdB{JkceLk`PPpe~`p zxeo^YTS(clYV_4m6bF9JkvY7I!Q|r``WC5osuXb+k!NR?Pnk*`qr3z_d4MCJeCez# z??q_&3EFNkt(m3Fb0ui|&!eyBtQ?+b6N$S2W? zf$~Y`&s9Qyd#aZv8_K!g%aJF!3vej@0$b>{Xt!`h9X$`!%9{k?AbaK1a)0N2pYCuG zuULvwIaE=Kdg_b+3l#avalqzMswR$Vl-vxiHeRZVyjv*Ti`{+x%GI)QuCmPBCPIuR z$*fM@tk#VhgL;W7+{s2651=-tVDfDiWAz}#z56OGAGKex%+vqTby`5|hKVyDNI}hz zi*rC-(x=-*uEw#n8?@KI|10*)S>WA)Y2a-g$7!dw>(}rHQK%<-sDtCj@*k zv4S^1TMih6@~GcY&Ca3Q<_(eg#z_4{uM>UQc<|%UTy9;KnhMN5eM8~)4m#ghs}-Fb zrELv(jt}DyKJ>Le;)whq`pvJL&A>vL4OX|-|2nH!nW+BhL+g(dv62_ftR~I#n4eq$ z@{P>y0`@C@vPH|_{ONvOMhkrNAovo`Cl5gRctDQH62iITLJbuMZh)gNXAid6UTQgr zYy!<5(J==!Z3W|No{)?IYl?Ev|H)4Dhjp4NCU5#(7V{qKIZEYg--4)X$7K_rv*I#z z2pC*4ZsHw2EX$MGkj!!t;a(SOy`sRnKYrx~p@k6>*L#4!68z_@6smV(Z&W+>52#v( zhtPC(an1wxCs;s~_v5fz3hVRmu)jfW%iEB@(qlHFKABiWYk^+SUYQ~k@`pLX%WTbwOFDc$0hrx^>3};-X*;I)=*}GxW9pk>Uf>s^nZaPa>N;LZkEd^DgsYtIJO*e{L;m!co=R=w0qecJSNco)8qMhA4;tdG9gxMfCE{NRZ1G^__&!DBq^dSv#w8 zavW}F34`@X(Wx5bIu4D|OY5F)bspI8HDjy`n<_+3V^s&2=;#5u>Z)Y%Zm09-{^rs} zqsFnUwO6n;Eq4k8Y%mlDr>$$)j_tX#0I1Zm}ZrVogRrt_aLSrRGkB66i7 z=PZ{YK74hUiH|^1jUuO}^&K0=x(W~{hh8rA@TQ?Se|!J5xQprvRhrH72!(Xsh1@VI z{=}u}HTL5yvtugQ#;Uoe%*cLT6nH|}$kyC_4#-MUl=o}^Tkbd65p8< zz>$AgsYC3T_9OwK0l4W!>w53Ha9Bt~n8MQLNhB`oi+UDAxvMf7#0AzBgFHF%@?W7p zg&Prz$YEYHw)1BB$=Jn*0^!;D+$f$i3|epcb5AS_ovGzDy~z!S6H%11_TELAhZ|&! z(lQWG_&hwq8%3}k3fJIii`@Zw<~NZy*53vTv9}O2iq-x+p^qU9HQ(_Ilr-*8o@F9p z5&ldO^qG+i4aVPj#H}5$`j9C+y^t4I&Y4Et+Z6Ejj#Grb>d?7Fblo=>WNyP{q-7z6 zF5>g&nE~F2CbpHSv~xIhM`Ss|d{Haq!CCJ5$v@Dz-#hL}m#xJBQ$Vc0ata$Rkm+A; z7J#dLu7t-@Gf$yTT<@6y9C&0{U8h?+<2izj2j0zyA_n?IC+qI*9f??^S2q+o;vcNH zY6me23`^g@>cgViNSGk~7&LHD-5AP)qj*|~<($uDzc6xS>IDodP4Us+h> zR43A~P9316xwEA3fDC{1-HLlkL3z^5{-6(s1yIr%pi^% zobQCc`eDMI7Hs$md2iu z-fjZRHi37n!#)8r1+Lu6r8M&FOjc%4E%_fI9mqt;UG)BpJ35~m>>hkJ4Z^lFy3X%P z+ce)>+I>hvXd&9W5{BFkSvB^i*s#>*F4O6^^TQZJx!2D%;ijafS+^Af4JIGi7P-r8Bt`R21n#s;(Aq0W z*>Z-EnWeWW-bSE-itKcVq{w<~#N~53tTvH8sLHRVau0NkPb1+~#2&@C2Vvay7-)7Q z5aRE0q{UNJ`(|<7ilO4T2(U514}Xidca}xwws1=@cl?6H${Ka-AoUzfYQ5m{CrJdo zZp;AVWlf0U(wl)b;yB0HdUoq{$KnzlzlgBGxS%!Cy*Ba=q!RaFo}^J$SnnEX`8oim zaNNXa$UI-;p*!U5-H<~13Cw+XW6JiH|3z3Ui`1`1F!}OJt!g2@PN_`S1x^G08FR-{)XA?-J-Gf89fVatz;gd~ zw`NNghH`X^$g$~OqG%I>GRmE5Zd~>}X;F^0*)3z(`DO(pj$~1vS{G!K5^tMjmIG}@ zL^EZ)W;%DK6)An7+y&EL{ly`gI&3aSC4jD|kS(*F+mJb@lj zrFD$H*_H@Da-rd1bLlg|H%W%AqKaWsb_jZ~r=9Af=HS&F($MObrqpX4tA1-~Y zG{Fsy$${vBb)4)U;f_zdo5}@ekHm0C5u{c-x&sCP$&JJbwro$R$scWg{0QQ=m}%D- zXa&-pW9en-pjR0f_BzH+lYc2f5WaMs6Zm}w)qkB^^t3+eTG@CxG_Al6$%)6*&%Vou zCIiZZ?19AUF-Mlqg;@yX z+jpXr%KGR+1RqAXEU5cLrBulmsr+{(hU0;Y)lj**uWUR^5(hlX;2QO`wi41wV=@$H zBf%%HllIZ9H>eWk4q+b^Z3`$Oo6spH`Goq$$AX|HNhZP?Eht3wNF=`_S~C8~H=!$; zCy1;CLqwr-oS#j{MT)o%{KBA-ltI8uEf!ef^UzwA^`TSIn|x{#%B!(W=cb(TGNptS zAI-y#T8nkuY@1Qy0xHqa@D&US_4GX2x7BkSTU_b%S+`GDCiqPf@fvw!@zpc z8Z*l;y{eET^FGi4Pi~mNTP1>_H5c_-sB&C|*tQxoe84hh&(4bAu(eM;4(XgL;$>%5 zZdXTQm(ZKC>v((r#O7Oer;)7C5`5ABnhbT>SY#jedjU}5bL<>qk~YFMBRt=;6lLv0 zN4pojql1#rAmVW0mB_giWgOlna*tK$oUNGa1DUaOZdMe(v|KNV%y{_-Tq$c_Bk<83 zk1vE&ST-klZSQoumbwi3ZZqz7x;ifZgyIs&vbehrNHU<3$BG-8YwmV0*^tf<{tzS# zU&x5E6~E6qi$Q>ERR^BXlq;<)57_k)Q!~RMztzwoWFci_2YvR}fEqVOWe6O?f&9!e ztbYn$^iJ^?REwh%gt%48ZbJg;j%D;37dLHFDzC?0c02YPA8W@~`XT^2!PEWB=~L!W z+I^{HOhiCS6+X_a<#Hvoj0>@&kOA|-tU2isCAU;836}j#HhbUejSR%?9SgMQ=kPM< zjzq?zd;i}cV)uJ{2(!F9#6$-Jd;B9UJDM$@=8-Qc0v3wZ*Nd^Js!l#6BBPu8wM0l? z05cFZaf8-pM!takL=evv5OJOBH{AnM&B@MTz-jpnlEXlR_aP285$kH27YKpruW z`WG|H`XhZ__D?~*4{Xzu>&NZ1hm;grfm>*y(%rLWXg~Ne#BO`;-fw!LomVGSZAW>G zor=ZR0|le}@H87_63snE>A{{|FO3NkS@k`RLDC{#HYFhMx1ip(B(C6HnMUFo#G>K5 zWm_Q}{ssNP zaa%&-07;{(&>L*nAV-PWQ^8UXVy#FdJo74s{ZK>P)(q+*5qXxI8Ej7%;d<}gPBX;? z$FM84;UP8EQM6S8cc9dWDh+y za@pQa$MQ=pM|T`NsKfd+3M~igv{Pg{MTX;?qj`_&!@M3(FxAih?L-si$&yd<0W%B? z3lZ0Mu^JdHnl+GCWIcRGp1X*Z3#$%e^+bT~WEh8A=8W5jX1^6Hb-VgC{@0rt3xxOP zdH>vIU}+QgO!Fl~MDO|4W$sxg2!>mhupX}{&yJ-({1W(XdwA5g6m{ks<7)~A=pZ2k z7+CMW&eu>bc=ID6N+|~&1*aZme%OXH$-`n0#aUs0-hf|w2 zqPysuAWbx|Y+S~N8%_v-lO+8c3?HCyzL5;c8X79PC8b0_s#O~h)18NLHHONwJmah!Yqy|lI5!uwAC=(h?)+k3i zYkoY_lG6zW+v$N&hTKR>T8?szAWC?^XfCc?7kfRHYB@1+I~S|Qi*4U{r?spR5W!+r z$pJNu3i2;?j|_pLYZ(q0=U*;K(61$z4>>j!7?%E})BL`GPQP&HP_rZO<-FUa5!vg3 zm_dgv28rhUaJ2kjrMMloWkC3apIqoUX8qs$P!hu=>N`Z?IyszM?>2X$IsFK~t5n-0 z?3|@B7@{nCzRQ$=p{aju9awKmVRP4!#qg$Qp`9t`sA%TH325dWN4hz6mnROwZ5_Oz zJ(6(A4q&bB-nmrFTm+Jk{1Vj%Uj}5u$dTfPhquKUE`KTafei8MkTeDby9(y4O&Ko#r;XL7j2G=h(t_NZes1rle+naoK#hVS)?$U@TC;NfAxl~$Hr2yETEd?NL8yrl-VTmb0(~d#IGpt=BG`Xh|&a9I3H8{-BFgb5c-9+8Zz5CirSJca>(2 zI04?Jy;Gh`Sc6~DCKTs(1ERFbX-VWN@Pww`u}NpWJvW7QGntrjY;#|+cM$c%*^+^o zjf1Mg28PizOy!8?1B^mbUG;+4TqbMY!S4qYJ{2XN@6v~hvNYn>r?*Kvh{``|PHXcZ z%TIGWGTlH0>G%z-U;!h;Ok7_YMq;ik>8T)wCxRrZV;C#;U#?+Un|k3I>IwZqxrpP#I`HTP~yS-C@qHoZfc?7B_1%rO&BT}zu@-vgQrQ%*r` z_E5v=ZQ+SJx$9JC*d;V(QqgTUR?RT65ubrBmEWM>or=+mXN{r&PtF=l{}Qb749J^R z7SC0xxsR7Z(iDO#Fn=Tx6x_!BB!vEf@;FZefLAdsak4_Iq%Mo-!(JdeJ6)>0K&eL~ zc*}oUZ+fzZ#3zxgCoABIXpYaZ1ic(k{IZXNp*y=d2>J4kan+dE#^D8VZ}5%SlGK)p ze#gZ*86&(H<>N)45d^@&y^1@$A=l912hISdFK`LScGQM+rR%&pvO+k7Jr;!~f$?|b z!|eh5w@%kV$m)tj9S{SGJU{*p%C(>iuQL1*VeA=ek}L0gVFxB2X=Ru;uq>a;hZMS{4g6(KngV%7>6Av&+JPW9NP|H0VF)n-B(_ zu({^coj_j^2;@vCVTn&a;s)}8Nk2^GU?gQeAQ4mMlaC~&ktti;C8-obM=jgTMok(_ zBIrn3t|4w3*>6K+82BFndb_?)>HR*(+kLD}H!!y$@Ze25u=NMdtP9x>KJy9PtoRQZr1mo z5urHcEBWgR2jBSM+CXD{LF5g9?j0*7eAIGvt-8>hKg@n;bxZaO*HrEM-+;hv$ECk2 zYLgI&(qP?z=K_|eKT9r;RbpkGmUvD8?yVygX}G}o)yO1ZwIx9_4>T%JuK0^^>Oe zkOrl#16WZ^@GU0%y8xt7oB>rtC~k%Vz%7#{^Hop>zC~a>c3-!CIZgD0+X9nYrk|N5 zER-9m8c2x)PA>3-k`hWsjPxCwg5pX+L)RW+7)P7Xh1Va<-sOd5i|q5-i<8&uy=vO_ zE+hBewJn)kKWUdUs`8a$X4|8?=PIqmRaNuOH^6h-J@;-)QLcXVMr7eY9fWl|otp}B zZ-lnY@Tod`I^(j8Nov{d{MC;|w9in0+vkGSSCj7x;MS*P!&*Kf&?FAFVAfGni+7{n zOTie!2urDFg2cl~U~yUh1sh}M96(#SAShGC*^cgh$QsRj`6GyqM;z&YKdX1~N_7(X z;~iOBeI%HO$HWZ|p6i>^=>*XDHpEcwZ`a~+{B&H_=!w^%L> zIeSu@KZhXnTolt9cO3fc!(fhUeReHdtpWCWOD}mdZ2Q+Xm$8AZRvHo`-)Pt204Q$B zc3ifruaa+t<8DJB)LX_|61ip3X_qW#G+o>YS^kBYY_3x0etMuCj}IN>nEJ&ZCHqrV z)a~A%oCnizVr`K8M_^tSt7G-tATh@hko<<$6W_xT^JCPjioRcHK9(X;yu^glz8@Ad zs3}njwRZy%W*dkdiPS@cU6>Gv`^0q)p6#AVOk@h5Jsf_y&(>wHXzrZj8^N*1pV>En zscO8qC-15V821Es4qL``sw7+Up~HDxzv<2s_)xqrisT~IT?%0Qo!ir=FjOSEzGG6g z%wv%BK;vVnIm_<98`ggxo0fT2pf>ELv(elWW59t-(Nhrm|1FsAlrHNBs4J`=`Ku(? z9f>=kWvlJ`fot#7F3nmP4@E4LYqf|noS%M^1Qgof*Y?CeV`TRGh3ybK_-w3`fT zr<4YkJ%+8DRS(Zvb%BU4PpW=!l<`a>BT`!mq84kgjmSv5c2xGoLg1-eQ)cgQ?n6~e zk=d7hZI1nc7&^GR#hM52o)d~Ij z-jc1j_^z?k1Q722~(tr3g@bTfxpHcy@|N9;d`W1yK``Nf95d8z1>#AL% z|Cf9jH0jqB9o6_9crO;&UV@It7#yrTBt6J@$+PV*a(pDw5xd#31rE`~ejT>jl1&V} zl&{l}FrDFR0FF1TEA|d&ZOUFN8>+3R*u+}utn*WB;1HIT4Fhjb*I6t{dlmqGJYsI? zNMvhY8_7>X>oSuUSn6cT>r=0eq)gOP!ecbsOZfshe$IBfsxU0Kny{+Xr!RG8=vOQA z-nAD1tCdPrml`tcMne`3uIQt4RMKj$%3Adbj|j zpx(MH$(1YWWF=Omh&{ksu|%l1o3xh}TzCxS#g}a*wfQ;nt5@z4)cD zswd@QyaC*!CMF|FVQn3{L^DL&*}fG;_BNO)Z;MO`N9!`Pw=fi2Uuiwhe2^?3@d_43 zM45(-4f}Y~FE_FcEOlNPO_`~eL`EBDmXR}MdfKrjSYY42H25nXJI+~|1hnB~$$w~d zlHo*$0${iON-0B~*&`nPYw9X<7*nm@0LuR3e&x6+iYjrrAY^j#)W02*t!mhkb2cix9Y;& z1yugcRO1x3l1qtl;|i7ET*}^wEj~XP(=JsXt^JNapYOI=!)hL6?W7|I*d`AnT|$Sd z)u(5mjwyk0#llk!?O|cKX2IQ(MW!@T93^&l|NfH**V)TbWrgJC|8!wZe)ajXw;7nS ze`vh@I^Pbq4?KGS!nQM+&g~LxTAtDGndJu!%88fL_4h9s8%AB8|Ls>LQH!u}QtqEt z&*slce_E+&ZUJ{z$1s=JUDas%_|&mC1jpa!ns9G<+oaos?Lt(D9@*0?oFxom$>%0r zJ||>Y2xIhZ9An3Od0Yv*0NG3=MPx#c)Q%mLK>;bT!T#p#FB1eOIH~p0MtqI7Uc{Tz z$ids+e3Gp*^_qcz? z{jQ_n%_J|>IPk~;#P4m7j5=zT6Ij8=8 z^}hxI&&Oa!)x=Ce{Upu95^9L`5Ztrck;awTTxL4OeCZzx#%XFIdrVfRO0s#&-u{ z$`+(|#OM$W$dJ;qUS-ng+{<7Yyh%1vP@7;pjr9H_M@}Wlh-MB_pAGnPFAMTV#_h|# zTfw*f+z;aXV157kVv+4NYq>`DEABj1OLlMGW4&ta!4AKua0p%)KEJr2G?X4;Vn1(Q zodAR!+YU4K@_|r3nmRpo@=YQ9hOxx(E9xf2#_oU%RznMx2BljsULVL4X+pU2I3LRc z;xA3J_!<0jfd7P2X0XQH1TN%vHfQ~)dn`okY&x8pcEr}!*no&Ti0X{#M0V9{q!ofq5rhok`fb!^BA8H&WN1|d zeh~#2kNJ)D`r975bHRpCi7MlEj6af8tw|Ad576{=J6-J{u>Bf6jyQJn4mn-XZPMs# zK0qJ9jJmy+Z0DKbK-w72IIuACptSi*<9~c{4mt(!A5h8|cFUgw`Tz8}jfy7e5idVP zUI`On`EYJlSBMf^?Ym6_{^2+Ya%mk>rT&Y`Ttz-U{;Z2DsYrwlCJwq2JU6~CN5;xQ z2i`P4-M{>?A_>S#6UPISafZ=p0J(I>eE|^G+c61;p|};@B-$qGOH4 z_+&g{d7?@G-7;tc9D5X54!g#POfEW(Zre@Nm!X@@q2#@g>s(t; z9v(PvxURC&tj_O@Wg~FYAsThXQUwCF9i-jB?T?U^e(=8nK6-RrwOp7?+()kWA0e-@ z*LUd)xlBGS`B@_gT^I!_IQ1<9b6I>ED_m#44h*;RQ_A`%S$6fiYG9NG!fEgfsN zah4g@jT-zd+dwm&*^YGG$aU>3w3oVy0fG_yK z!_}r6sFmwHO+=LF^w&V!oWH~G@qM~!_8ZlTQ^^Wq!$ ze)h-q03C$!j9U4FSC(L9XPacL#^;5-LG1tW*tH=DJAM$iOkkfvw>0>9WYKVrb@F-z z8MEIsP_FeIA#Zy*_U?=?Dj7MznB7B09enChO#bAq^(P_wD%jJXOgpHF0C;svyFcdC zCqoqrC8J${8B}2GhhO<=YQb3NlO3A18n-fg@r8lPa}=O;#`}=7^bfUv$8o)pYp*vQ zhqmpkTS8E2Ed{nZskC!!mmd=-tyj4Rw8ydjAffHrEMXf)`MlxuC~{oJQTveDn+P5r zu`Fzia<*2Ut@>w%V<=|l0^=D)u8?*o5tk@eJ?o*YI<8RTj;*Qr9F9U%D^G%pw20q~ z3PdeN!<%6=m6$-+oK~Q%8*!&-ei4t4qLiTBkG0N^Y=ieWn~_ks)~>=GE%-!)i1^3Q zhS%0}MVL(mDxF@!L;BII0`?bT1@o@dN|%E#v4m5p31s_v2HN-f(4@q~6liUFER}A(Vo` zgWb821kH4sd8ml0jN0RG#)2PGgBIU@w+RQTynF)Au}hc1$+LPsOJA+z%N;Y9g)9e- zZ=h_XOD=q@{(K~5a#$JE9N!3w0ihm%6&2M`DR7EBCZmY3Z4DH(`#KgR7ut4lz(?#B zihL0x+&%&WnShFYFjtzc!DW_A3r3K&WVX+GdnuoB-cE%lPA%;Q7tOoDg|$q}Hxe4o zo~s6DMucyU*YW((*l^Hn@VrRapS4vpC$kN=d~tsg@IQ~6i#%-tp+%A4ueyZh#H!{$ z`{_tbeGou!ApjqA@F6uxy3Htqb*%g84qIJCt9v)cVVet6Dyg~%cAs}UF6x=8cCnOI z^2LO84BNNgn{Z_6Q|-Tg^;uZyHmRd6v>Ni==2DAUk?)tLkq?nrF7=J4vED8GRZdf) z8OBu}o1Q>C)69kJF|>cWc0Bfwx|etmf9<{-*Mf1pldj^emB%>o`TC+TW~iVy5j^`N zC#ypZEC*8X!=sVvE-TchdNrM>o0_-BA<&hT9E0&JK!} zNhz^*I-Hp9#gX)2* zzXR8x%VcivN#hd|I-6Bpw5i9o0OPgvIfR|_wsGuJi^?H_&>+HMxFrMg@)KE#9PX=^> z7YY1c7&f2xlsw3DimmQ_AlC0%3lbxI8+PLkLfSK8xe5=*YW9n)XH6ZgeW?Ef8f(zHTz?BF&@edfW2dD-FK15~UmID5*qid|2FN*Z$#5tG? zt(k6}%G{QFw^boFmQ{uOGR`_&aIU0^<~tzVy|5q}fTLQIYAjYWz)?6hy99L6R?PMR zopIQ_Lt*iA+j2ePsa8#t168eeC|r#0II`g1Lu4~_F5F*sm~dp4xRVF5*ue8b+<118 z@ZSl4xd}wJbQMg&x}eTD$Ga2lDhE0}arO%@TCmxz^0owG5oA>;G?sJm0|X^`EBKUYlMW9Ac9Lja&I}#t+9@jT@Q0DsF5BF0#`;d*JFy!|Fy<8Cgkkg$;Tk(^RSDV+`ECrfkqm0H3J= z>RXFme}3=zAPmI*63Je|T}gLg69pEr(m_{~4k5nwI$K-m!UrB)eWO>qCc3c_-J}#9 zA+nsZB)g}*KRUy^r$>@q{~^Q}el#!L%{J24MyS`M{>!d5=$_pfl==3Z<`!A8x=*gK)#^b-R0fW(||ri7p@gb5OFtM7VNdD zb$ZmL(z3tT`Sj`Wot2$Z5p5usm6A}XG*#Udj4OYESg^NlT=V+1(~Gb+poOc6kkKiH zNnP)JG=3mV`tqN+u3ucs4Yv}j&w)i#H})Tp1Jxp9+V9)xRlji~0Mu__*%&jaJ?z z2k953H?3mf3qF8Bh(#jsi2`|g+! zG#horw3PgN#Tia>Oq@SFtWb8cVLNru*`Zr32zCr{!@W#pra!{n+xSXo*=`OpAAS@3 z-?j$m3J4VNJ`Y|9Q9zXL^#C4bz;Np+38k{3B5&7ESCb;XMIk@<4az&-8{FJ z8EK!s@*KEp#}ug^WCJ^u?>-X&5d<`_r)&iemm{lBk%(jo4<<`PuJ-kq%L(-%1znaw zP}b8W|AEj`x(A`G(16tNaEA~6I7U6)P_PYmQNPW;?+f%GH%u{tao!%GD633V0N|S) zF4Gp8R{A@0oW@3dtUK6;Y-i)<<`P*Wjk1ZLlw);9N)T(DMrzt?$@NEwD21%Qk<1Gb zser*P-^3*~7w$gxYSiTP;zz4c(qi9rDqqTy^9jg_!L9sBtx0<+irBfI6I6kwC+@R- zN^@bcwLP!6h~vY~YnVqMje?I&6Do2)o^Er^tG7<`?y1RyWma$`_7VjcZO-UiQo`KF zU~8Ncyu7Vg2>C`c%EUq|Lp&#A+odG1rki&lH;x<K}KFrp`K$h)6#thssGH#i9;@f_!6zej-)tk=m#@(L$&?I9TK_Cm^&=pj)Ol zzC`#7$p5!)x>saID`)v5UaeV<3PQ@lNeup)GArC-L zW6Zy?MX~ea3v6X+dT(#KLw<|6fGl@{jFH&4dUUv!nq2_kqJn%c4$q$A(p5h z>)g+pFeWyz7^sVk0HX)JMk3Ln;LOx#w#4Q_>yk{>lEogcA5(mp{Xs-}Mv2+q@$2C;&jgu8No5#Bq>22aF~;*FQC+J(ZiH}> zKQ=h_gqVUihinl4E0Fr`uJ}3K7sif^_nB?NbSu~?KyLe~6MnX6RrUJdE0$>`j zzQgjzB;HvtT{a1c_kz&yufg`2pt(c0VV*h|3y({V&ekznQcH0G+Gwfbb61{h01muaf_GZw z2sVtY0y-E0FK0}qBm`L@b!W$M5tl{CkCzZ|QTIp}S{l(@z&VEe#zk4wXV$+QjKm&O z7>EcPF#71ru9ffKT}DO3^I;2-UsqjKCQkrq+$1E*8Q+xHmTNeeGE2_JgXlJ(bMy&Ek|N4!#yM9MBRjK8H33<1-VRVz>Z8899?g zi$PlDnWw#5dwwK*7Houaf3)NK_g5vX-1-niOifSdGJN(7-sY&86fl(3RDpR95=)GR z67l&GLV<_1$wFk{9x|wiNjHzx{6$~jQljq^iJ~UYsLKNbS^H9$br|mPg>8?GFD*e> zSS!DxVUyzNGdu{E?{!o@dB&&7yXbUYFXjfPsoKECv$=O1((6U`dc(PRW6j5_n*&!c z|A^#a zESO4OUr>DtQmO52Gv7~)nj!jQr%a>rV0%Q9#84uE#27zwdPFvCOSs_^== zxl>}jA4fqkwGEs<(%0cis`qhHPo%;%twrX_6Bst=+463_oCeB)soy)j12+KMU)O%z z2of=ZBkXV&iFq($(gB@%K>>UPJ6ejOJwi8a8=N_t?vBIaZw5aL_dw0i-<#jQJ`#O2 z?P39s*bpIw@Z7Ae)52_qPZhR?$rp4{NO1|J2)#ooK#B{v9?@NyV~bE6LCO((nF0S* zO;D&vj*WHX`oW#us<6Ksk#*ZuJH>#G4(<$>APSAfQtcAAW3mqn#+(^@SELc+fZm(_ z%TPzjJYA^QX6qvoHLx?$3V+$>%kw5`k%(CXaP5w3n7o_3n3I+pe&&A&UwRgFM0dmW7tLP=)L16U|69$KTXf{=tSjC#(tz-oEfOA z+HD_F53JC11iJuhAMm4m+;hXo2cMbgO@Y$X9{ zyE}C*k&4-7!18-H3^&6edgu9QQD>ID>sngn>+tUBDa3>qI)%f(@P6ozGCn2JPKGWJ zvsQ!`o7HAYPzB9{;0dit*O$w=s0>A4Nl?wvb5E8}`&q@klL#e&Re9kOs-H{hlBgka zx@maazE)LKK1T2#1`_%%r}8nEMm*jK!5yoU@`zfiY7H$6@LE(E%Oo3CYA}hO{hn+n zN%Lm1QWA(@vHhdu$+HMc`3SG%5|OzQ>12_mp2dDW^}`O9rnkYe(CsC7CxlIb!qInt z3~&)h*xM{py%I>;`SwaZrz?i!!TF@;zC%_xwQqv<^4JbG~v^epn9vUgTl$ zrhoOwQ$C2D;bkGkX+JbFEB2S#zC!4OVR%771Ef~m618Giz~05e3hfl{o|FwKY)k94 zD;VoLm!E5wiXUe|n7_c0DnMN%zY(!Esv5&+i(IvKIH@VfF{R8FwfbeZxNikhQXGC^ zu|rogiP5TR(-^QT7N-hSrv%^^r_}(g0h0iqR{%So)>t|scf7kgUNZ~3gvkR>(yo2# z6n;H@^$tMV91j6DFBjl=7FRPySou51bX^`PuM~2r zhzwipCFt{kDiFS~9G8WyIy^S&(wu`8g*tPI+Iu|t_48pNXU-y++5^py&xmte#MZxS>fbCyE2J)--HsA)rq~dtLRF(t=&c_qKKV^WZmzR`V|d>3o%q$U2UQ~2mZyQ7bs`t5VmHf1+*>o zM@7uHV7Guw%W+1Fm}AxdV<%z&eFFS-fYKl)2qL**s;lRC8_E9&M~=0-bF*QKTWO29 z4lm3e0wHxI6+EpcE1Sh)HcBFHrqmtT;#Z&uDaYtbReO>HeAtFDVf(_kfHg-AB9GlA zkKY+>)Ed~YP;EISu!|>bv$e1zHqS&Tkb#xRAlG;^%Zbdf;l~*tdM;wiKeJ>I_p_p| z7w_hDT~g3v=?Wxbi!XinbH1%wUX#-NoK8@7GL{!sd^SLlnP1L=`g>4vv$>otD zhLIkl?SU2M_!c(m1F*(b|6BH~CX7`9Yj6M;-fO2Wgya|`(#gqYK9A@g%Tv0}pv8$h z)z^Yg7tmoB`CWNK>bs~%%j@}k8fYFP!uG2arkRct%IhOODl&UH5yDX**_|i*PJK>o z%C)4ccfsXvj5D)X2+s?$dtvMgjA*RH;Ag(;;ovdO#V7ZOvD>tuw%hxN>8S*deVw4> zY#QY@I)_I*rL8@Nuh2UT@UdwzfCda!M^59o^SQ~;>saa)N<)eLB_s|HsiK5T5t%pI zLr}%dF+Uy~0fFxVn5B9S>!&zwodO5|A*SVJ%xMdFGT@W_7!j-ZJ3}(u=2Tnq@?Os2kyZg3uSgfu zoycX_!IFtOvj^KF{r5u5e5(NH7|7k|xHP_-CcU!Kui8#rASF*OA6}DAaZje60WT#1p>3}Svws^D(@rDUX$qvSG9tKd-^<$3cF>S=57-t+>3fxWJFejW|7n>h%nnOfW)@Lq)b*4xiz zEq9yw44xHwbb!5zE-pNOdL#>^Cyn|c3mARo#dxB#qX&;YAvw}cZM?$K63CfnT*nc; zP-w2#@|%d@;|A5`(bhhcs$bSHZCi-vdhv?*?zJuW>CZLcgCC1RZTTuPYOb}Na~Xu8 zSyzd!J#a?>PL7T1VD4=r=_QOx4-VuE6O%5HBE}>SJ}{7e*>;3K+tE6a@XIH)-ZY2H z8%zpmDY0f?c$7;$pw&{)XWYN5dlfJ|lT1saSr?l|$V=!`>m^}tdu1qoD0{e-=I)*b<9Zkf!$ZoVtkEgNxn6 zcaymU@y`Yn-Ziz;3bBsn>Hd$Vb>P!paCEk15%2ij&OV!$5A?3z3&b7YUi*sJXI5Rf z=f>cLhaDbgemc&B!4s!_)}Wr(6AQ_cIs2yGW^r9lRkli{%zdB&c8!Tj-7t(%L+37B zJNO>Pdf}#RPh#1P&BEmcS&0hbh6s#Gz|XQJ&zJUQK@3ZsHOLhzh*9a=9y=cu8DJb; zl;^fL+5_1}OW`V3tf7zMK@PZRBxfdw<$xg_#%9B5XlLg*Gu0;_v8Q4R>VpOnWcrHb z;Ntv7J^E8akC!uz}xeSp!4wzZ)RsZu>+<6)!Ha!D(YT0-K&s>dV;i)wN@?sT_QBBWI z$&f@?w@n%d{i2Zf71*3B$VX6BPqO+s3YHE;>exQRnJ;6eaS z5k`_Ke`D=w+v%;TFuR`;ZC{m;|A2k{Hb5l!g15lJ)Mx#oNug49)tC}xMx_)uxqhNA zAbS|ryT)O~G|3`!zngg!za3jHLK3P~6a6lA`oKTz*0>VW<=jIRxvRo|}Q!9q<*6tSspwjUFpK5f0 zTDwmqEis46X+brDX~M2bRGpB*_3ZN6W(F9ggN1(z6e5%ML>tBVcd5xD=obf|lG~^O z&gjv~da;lb&OkX(rzFvnT`UOnR0b^eaB}Ltd-0LzT!sfEJ1Z&?@*)!jz}88`l}N}= z8^fRdvkD*?v*BmnJJ@b{#BTz3y=?_m@<(ge#)DgYS5jzpSKh|_?!pwWrarj?K(;TR z1y)NawJd>pua`UA8-oq{hm5XDso;}pgmr^}&nDi?*oPf9V zH)1=e$2j(j*aeiJtu4Ioz&}1`QMO7UX=kPX% z6#fGD!~Q4qizy@F%nVw2(Mip z3>(~fk5IiZkL(UM**)_2Wuf7@I}DQS#;ebWnB#n}BoOcGS_#t^REQyh9RI3=O%%vv zrrXDXcrpi{^R*M`M3CvC&64EIO{b>KF)E`$q^ZQXlG(1gH`!n$gfWDK2_t;plAA8U z&HIHSpC{f$^jZ{7$Fc)i8mWWjgM~ug0j@ux#7V>I3~(&domx`fGQ?0}QuQBBj9uZe zVKhKIVfgPHAq;L5L+5M_l#BUHh|v}pW(eOKW)~dPO{rKv?5M;OGk?H&iR`a(V$S}{jxYGk;;}HFUxhYMKnSYlW-dP%tEM_#h_rn_|h8|K-*+2`1(6A zoOm)R^I%9>f!GN1el5y`tLcD&d`uxot-xG^BL-C*&Hd}^=bN;RidvBU;EN5)U^ItH33QTE6B zJ<*aZ^LAvUjI{LAOCH&I)0GU`hQ?5r`0oDsp8-XTMdbjrU6lrPO=`(TmweOlA z_>+o{^ZzM)yL}g2)hvGUaIDrsiIP7y;E7SJw00vsbxdjw+69oen~fb~kL1%V2c58| zu5tUz9#S|#`t;|*w+N=P;%m9d8msG+aNiP61jn?jB91h(5Kl(m^DJc3yuSb`36Zt0 zS=`2vkT(wSm2?s0THlH*eY(Zb7NolBCMOel&ZaP0>@R{!uG3V(qa)(CJK3nP?mes` zdTm{*6}RiKpete67SNP&F`mB^63XH9Zb0lGOZ>(7ub1RvUWIDodYDhbD*g$vm`43~ zjz@#MkEnm0#xROA+Wk~c&#Ml#_Frx)9Fl9v-hU2{S;8>lD{1hAVV-yMmgiVs2CMZ? z9w3#4w=25RXWoHyqphSseDcs=gwacNb9Jn)YXGUBf9kmf6SH0=P_!5j86e9~liA;j zJm(~{HxH!ghAm_4*Z+kk-21E$!nvv-A}vTy!$QrYeZJa;9_3t^ch?ZKm=>DEQFKfO zW#+##i${%+NCAY5c`>6$J!bj4Wuq71&drWD>n74I2yP2Y{=(X8`7C^h1$>2oxwK__ zbFKNtAiBEn>{oywh0?j*Bw=Ed5USSYhl6e2Jv$vRx4V@IjSRF9LA{1TrOBR?f-VYi zp`&8JrOI>x4e@=dTa{uq3M)!w9CMS|w}$Aa_WVp9b*f2XpdxrSR7W1XtY)`TUY>)k zN!vK_;!dJ!e*sfX77~@})N9C4_%wZu`>VULP5QWExe*t3Is^wJjT{_`uYm~$zaQ{3 zPMa`19WcWI{RSjCzQposB^!m!yg4Jb^@;JX9VVlB+_+lb(%8_Z>O9q>YK(sop*SkQ z@_%thl(ncb?kw9HcT@ui)GY5Jwr}$g`T{-(1&Ops* zde^itqqnpF?~yj0gUg8N638aXo^a&-`el7z5Q9!Q03kl0-6=xIonFSPXSTyh5go&&{ z79j#}y=U64egn^-EjE?81?acYvZ1XAWfbXw;*=Uf3EfwrIgQz%e%&CkBncWr!2J;- zKi9;7W)g1kr^bxYz~IKlL4n-oc zvw4TjxDzSP*FV3Otk_jR6pJTf0HNl*qcJu${&hG4FWrFT24JbX=k75F@s$dD_=52U z*&R))r05i_Uz~VT?V6y$Hh+YN$fEc>@$Rq0XmDMA2u*wlS_ zGru9|A_xzH*>=ecfV|m`^I{+sBVIyu8fV}#FX1+HnG!nfR`^x6`gxIEva8w=H038d zC_w%@?7Nqka2k*d6P)I*%(RcvLlfe`%`F7=AgYea3KH_-~~vW))Wvu016{1|)G{v|Xs<3b9$q>C|!} zAa=v>wzyGC3J}hm>;1rHk?s^f9(Z5-wG-M>eyJ&iODc~o`8qx zpCpBHpet3BAyN7_q1BI#K=QW>SIYtrH)iBI2cPTsbp z#+@57nmqZ(RBI_KhkaFVY{#bRrFsA!+0yYh-8%_CjBxGs$OR=z!mS0JFbswe; zc>)fPBQtTz9y2?j)b9t|(r;-t*=Dwx&~XVRok={W9v+^kcS}?1U*^S>CI@jdL?9Nt zrT%Z;nvs6;&s6k}I45vb|FU26w#|c6=^OMNP+iB^&ro!9DCbMi@qEE?9B_u~NPuO)8 zBvuo3E#X)8U!#X7&$bt{f#ARACKaZApNO4Ckf^6`9i*)2=gTXqs_&dpJz)y_*jC-x zhpH~=nG3on)H7azkPh+o(Az4Ft7yUUn_`|wfL@1UCS%zAtqMp+Bw%WTWRb@(19k4A zp7VsB>q3@9g${p=kGMrJ zw%u_0tDJlGLOdAbzF~$`3S);n1|yjuI(jW?SDX2WDsd_>LtmGp2w#Ef;YXcc;CZL% zT+s%u0hI_55kM;edgu>p0n1m}ga7@JpnH?)j5e-z5Bv+IJPR#UASiqe9Q5UB5DHlA zZrp(z!u%uT6~C_og*C$N?!fzMQihlIMzZcA5;BpW2-fod z{-g`vwZ3N792nvL6taBYZNV_yPl5fbUXf0>~6i zH@ED;$mKUOK^gg|9sj)W_jO47TVvVZ|DB~gW(GvBB=o`&+jY37ubg#?#>2Kf<9TFk z#Qx9>GYg-s-eAY;rUzF&C2`*?f^LzYQefXUnQ6!%a4(%aU0qAX;qcqF2mH#uet!aFbY zQ4qf~1s%0ogG_x643|KB_T*oIa0BM7;aiKQ=Y!K4l<*kx@)3O%Xy7hGk_i?Y+4Zw= zy5AiQdxuaSvLmAL9aOK9trOxuSxuCA1Pt!}N5xF9DL|~ji^m6lDS4ic zAo};7vsXGcx159=XXIYhrmJjQf;kn@0G#pneDN00VW$yW5Hkg_gh%?`z*7l}Iw7#F z&0Z|zin^8JoJndm`Tc3%^uSDV|KlMAj!^ZVY~L7T;!NSDv;jkqTv zA4xH)0#I!=yzch>CV;%@7#4S#hCv< zNb`kLgAup`T)nvsV#x!(DsbWoFr~h!94<`m`q9?W#*WIHS^9z#i--)~Plxk`XE5P} z@U%>TqXqwJPyW_Y8zrSF3`SK|_RJrKPH*djTxN8P3#IfAvAUYS|K^ZP_-a*csA1d$ z7-!PqgcHUn1kok(zpOxLUX0Ga_Ge3hrY6gZlJ!BkC>Q8>+z$$5@0)%_ zbd(m)wV;}7`e1vL#j>VmE*TEo}D@}Ggoe54ZoPic8(7M zDx%W?Yt1gk3I8~>=LMOi68FVWf5nD|=aNPLb8TO7SG$Bf;^dZL(U#%bANNsmvi?Ob zX|}5B3zwo`fHO1da^}|Oyl^d-Sh5V5kkxd~eJ!FnJN>D{YupM*!it@zO5nZ)LAETfpv+l3fMlL}bX z>qv|z?;a%#8B~4o*4Btf=$Zc7>+Fm|d1Nod9M*O0j*WJoEkX3mXxb!Mzqdv`bKiq8 zr}SKk>Pw#_)B{@Ht9*dFj`;YfXx%FoEFuWJjka?bnF{DOgtFSDU;KTKotH5FSA6UI zSX4P5zK9A18l2cHi8F>zB^O{nR&#Liw?hY%$6tbZWu`K!mpM5ohk*it>UM~60>ya( zmUJDD*g?bc4!|n~(YmXLG*PUZJfa253=8e}VAB`pu|D}V*t2-kyc+2ekByPiYSZuK zj>5vJJA~MuA=cIo?8;{Y!DyGDL0cYeZtLy2oo&a(+suMAH^}gPgT% z#8Wp_?Y<5XPFuGJQP8|`R`>VceGkui*`JIHiv<7XaAxk4WLkL|S?FyZ+Ds8!`?d3L zNO}<(Yb=py%K00yKHKKcHAHY&a@qTkfmf-zOQ|#{fDMH9u-AR8atEC)6JcmI7Ij1G zrqkac>|)?gp3($+d0S&9`%pjF%+vcO`hDAhJv>Fzb7H20>+s`X$U$*`oS_YwRLV;0 zG>&C|Ftgg((H_(IrU_mTL@e>QV-cE-6vru-F;jW2k`!8c4q4#M?$~zGrC)zT-{+vF z#yW|i>>G&q@vC`UsGOe@T#-&7tD&7HSjyb^{FRRo>r%G2abtQV;XsppL z?JAax3)B9s-Z>(Gwl5%Tf8sfW330O&111>8PeFm6uAMC{YWH71XIWowSr)cP>Y(LA zQip5w1p$p$5=L2vQmD^%YxG_yI-N&|0|Ay@NUZ5*UEPJ}(u5_r&ho5$HqE4g)v9YI zpId!FWW)##SExvk<$uv%^4EZG*lvk@blx$FGvgt_-(YJzHcLDtB!O`W)aXQcV8;5? zJe%YzX*Ys{ap+e;<4+}j-QNa&{pf1$UfzY&k5&vwiS3WT#(4>&^dl(PTiu*lfm%Ez z_yW;SKtrt{L}Se_I1@*8(cStQ!oj4OfYnw_)dF>Gmh(r37VNCYiCm%VG7;Wz;hgVO zest|lCXRHt%HM|}1Idzk{Zvcy$9&m3lxh5Yje>>RPp3&iV@DleOILj!ubQY}S#I@^ zuEY2)smHwEmGkq>>YQ6uTH-c5LpOv#u^1(wi6TP*qtbC0=J_L^CpQ($<(Yf6jMJ)W z5MjBV0{<$YJ5cO}POfK|l?+|wG~&}}GpUVx^J_B(>A)m1lvv<5zrlySv6DXym>s%S zji{VX71*>SgFsRO!qr#H`Kjy56_30k+eC`35VND%Oz#Tp&+tOF)h5daa!>l7yD-?_x^Cs(EwTY z{rVjQFNSr|Rj>Hv@jjkyLg_8wNPKk1|8o5O{hhxDHCEJB+r`@q`bR{BpW&gODSm|$ zVWXgZGAYNOqsI|49wn7pQ)+@80VFznZ9mY9-3R?oW5GlROpDJ*Y;&%IejLnVsP}*m z_;}U7vbysZZ0S6jcjari@#riV{HYYg>eeNBn68=l-0zjs+v%VP_c3x_eyuoOt=H3G znG+`^{FwZHy%XtB$TXI31?$0#92w)x%N#mwA@G%nsa21!^V%N`zbX;)=WyA&cs?0>EmTX6p)jn1jIGK*N}vHR(E=GbP=XJoR9#-0+CRfa z6Pn0@LE&U|krzp=*?buoJaN{rUyg*X1WNH1=Ytiqi_W_LhlBU~qQ_u!7ixSTP;(yl z0o?}bPa*JMTi12#T53{*Y+pcLQN-WYxSSy75Zl_z69luSD#ba zjpxG1`#Pr(9~7=NzSh73r#qE0*(Dat3KVdN!nxkfiXfJD-E$3mZq~dm0IAj~?D>uD zl=D7b9ma$CWD^@Qa~A(bjkXNq!v7ZLrH?gVN-AKt$)9?5LOuW2><9TeN+(}~#CB4oDO)u3l7iP1=y zmQiv{MnsR9@jVxK-MQT~`%fm-P4%^+RdoOu6@LS!$5$xuxucXOgy$rWG}-kl@Z$&5 z6@>oCSAmF|@#$&l;VLKYjDK}v@MYaNZGcSPF0AjS`7g-K&E8@dLv0VM>`Jyw*8snW zu)6M6PZ%0Yi&%QbA`&A9wTg5iw%gLRcLtDb2j^ynMkC=U_*Xl^aOzgJF_+Gh%XvPM zb(%_sxQqa(o@X!-WjKG-V5-k+Uva>!G4cYK79u*1JHL}_UPesW=J{ATVg_;kr;^PM z8>`Pgxz6LOFY>ub!8+Nq<~!LHNyH%P3f`hv14_4kJj}S{k5u5 zwPI}duTkbp9@A&$d*sHM+T7by%SF^XCbM^4BscbNLrSnMH84IGWQx<*6&8p&$j`WV5RZea+!) za|Kst8bD`&mKTF&iDJQmrK_H5e9UK8ttba)x=4UQvE-&d0{?lZm%6xz$cX9VU>S05@>SH@B^ z)Rx4WS+`?yuP3PSHMc0oAVL~J^D4)_=i(&QExGuZ?i07Jfn{tHQx_M`_+qxX?`N98 z_xg1Y`>r!27O?bRuXjR}e;ds&vP9gXP?@dMLo;yZfAhv=b7$2jq=AQR_?6!p*HK`_ zfJ19-?g4ewx;*=gq{mq=(M7FNa0^DMPCN4Tsz+)Z3|?(9TPD}fqU(L zu!%XHiWKjt>B1`LE$kw=K`C9~E`9M(hqR!VEl^*`Fl#sdz9al?8UMb?-;55GSnDst z<^0b*=D+saFK;^mYVOxg*5tV9sf0xpcgV-a7n)7jhToq#F`gEZS8+k_%11~Wm~Q7t zX^w#Sysz^C4dGNial8op!%|L4A?XtQ6C2Y3cUE|#_A7oc)7(L?;t#$Tm`+`ld;j|Z zCs}@?FFzg{q}MyC|$-61zMnR?6!^HD%h48nbn z`u<}LGqYa_1h*L!N5F@N(t4GzskdVwTQ7#r&U4L7MAle%b8pmgm34dO!dF&C+$fkn zInSq4VQOJ+Q2EtZz%lQ9@@biN=9zJ6M!$z2 zfsv~PL8!wo^h$)7eU!>5TEbGPPaC#iPC`d!bNTV`sr zFRdBTbW)&-Y$5$87`(*^mfy2x_>L*y$TwrtkNIa)Psr4>*jWQE#f$i0M2Ll73KRI7 zVtRY_oK&R@nvnzk2EkHmJ0ZNJ`_k<1>r`d5;?K?N)R=_u&j#XN*B)*w-2~4b7gMU| zc{}7fjt@o{M1jls_un$9cK}+*1mJ=Jh$KM901!&?bRedtvRI})e8b69Vy~xVRR`Vn zCrd6=EyZa>ykfvS8A`HxXW&%R*x>ElWI5PGuHMG33q&LL?qMCoh6*i{<$>elrHT9` zB}Y^UG4}W>3syJ1Sn?{&s#ea&C5cgh9Hqjr*V(jJXbB~2_hNC=60UQ-m>Q@6@w#3p z-PB;2m{bY$oW|4|mN}l5iFGxu>M2>hl3!yswR)Zw$4}ANMC<6K*0lEdgwm5 z9JR=doWo=JiS#%ntH4POt4wy?h~nX#wpDuE$-8%AnUlF0X|A$IGof??ElvM9Uc`ff z@uk_~k|Wnn1h}7!2QhTFC8hDH*s8-(zc&Sv#?V7=?k%y>op5M(b6#zplyEc1mGH#$ z`AL|UU$-u4FyOJo#euZ11`=fCWmepZrPj%0ahI{Byv9Y4y^Bf1%T;Q821dKatmqVed^*{GeUT!pA6`7LeF z+=4?$Shl|2l{9vnsEt+wz!GDFMSr8S)(>(8ItNgl@cmoG%r;RoT1i@tmS`n~@sGYl zA<{Ku%ZIkhoPzCnOX8S)^wt){rVd3LF_0<`#_FC->!s16XEGV#QTPcN=AP~tq$Wmr z&0P!|N**8>s=xpK#}i>jzAgvxxJ^QF9B>cZWjyEX!hV(Xk>Enu;bWL#?hQPMz?Zc# z^L@5i_0J%+KUu0;Je=1sdJ4?C;9-)VeHfu82J`l^T@l^!SG*i*&cY@3{>O~3iMPTd z3cNyrefMt7X&#rMd)08stRjOsyrPOD@#`9f4lgxP8*}c3cq-{GhNz`1ioVMq*NK{C z!~`DiB^PqBYi=`XqZ@xP8cQrTR3ArY49Q#I92{=+7LGal_kVzKl&*0u>#VZGNc57eer#HJ`xLam?b`f2lfy=0Q>($ zs{gW7f^R;*G2`2=T75dff5JhhIKnJaUMkfW@X9_dloU$ z_ip{{IFz@XVz054bjK=8(>pBgf&EkbfCQ|UdH5yF0qGX9$F+1AKnmlT z7_DALV;TD-Lo^iQE(28Pjkd9;@VlG#B?$p_3La&M-13U#8 zi&LXzdAz_7Z3(yN!s@KwU$%r9qAQ#$kTeFvO%JFB#rub|9H8!Mwp?1L;i zCR3HQ>tqq;rG_~5!AORH-eqi@>a!_2WK!H}Sn~r&)+(DFByXoHp&9V+Ewrn?> z*!P-6ck8eRFHGglIHN`~&$~sN3LHwX>ildbl}(>cQexDq8Bv`cyiiqj?c#}JW8cY% zAP!^+j^MGIyy@W*?ywwAk9xGET1N1sm?M^6&`Mp@4#Ud`sL@`e0y9s`c#0K>mEsnn z$RO0`e*wHVugP+2f`?ZNp{ht+sa|6ugwoOwg&laN?}CPThY|`6UtUFx8_5m2>blmN zWtE#zp-3Z3KG{HN3U4=mtv?I-{F=+YM-tMdSSH9`x1`b*FjQEE-D;O6yTLq|N0{B4 zZ+AtcC`s+WJl=oV5t>b+WXDj6yAaRo&Z_>`zyaz3Ah(LrxU=;>(`#5WKTECas1H0$Et1RM3(kdIb31qfgEgRo~>+ z4;hk48KxYJtg`HP|hgMizAH+)HHcb}3OsIO!*#wIhqFT$_r` zGpz;SXcj+ba|>*6^yxdFSM?DK2FmQ`e>b!Pd;VK+8*n(cQ6!?wQshmtHDJu`#dG7Z zDn=aPOwdtFSf)hvL0o=o;t%X_?N+gztV7VN3E^U_@U-96G+qYB3NC`(s6`7+byWX* zJ-EpC6>k8>mqN<%X>e!)kl^lj(ZMMRCZLWs`+_p}2rZk^H?rP+U)Xi*ux z$<*a|!C-<(=6ITQ0b1e;XWn7uGU9105OB!}*)HI^TTo~l=BZw#=~frU|8zV~ z={8?6B_m^(-0uAXGV7^zqld$4QEN+V|k)db4s!Y?IK zOqZIooyp18LO~h&em)qUDSkkfpKB(JL@_FIoIZ;&{ ze4rR1$R;H3f!1+m79yzyyt5%Z+wnkG8Oh&{J@Es@uST@;KcQLxLRE?fg9A`H2su$K zgQ%0YtTQ+p?20_^Eg3(Q!0L|nepam93G%%Y&CX`9d}?=!a^>@n->Ugk2WjJatS|J# za$E6*an`I9rQhVTzfd-+r7opvaVby(iU>=}K+UAhXCZPlcw|9PboBW*arK+NeDnvx z-RGEWSp`M4Vo^cdQBq2CBu3pnc#fz_brD(<)P-b@rCHCEdra{(ZcME6Hh@~A% z-8y8q_Ffjh1~GmGVF|w??^E4x6k4Y`iz>-^KA6(nVV(fk^3ZfJfyP)szat+gFIp)( zkpPU8rSs#VKnxAPZ5-;rtd~wWVzdz61&!P!SON)|sgB$8-_H%vBh)%7C@3%<)|`Ly zBi+&Q!Ql}Fn+vxnmQ#L34a6T)fD~#kznZ1bHlMLN>F~8VhtKL zlJ$BYP~3Fl1c^ojZ3A;QG=$p|6C|p}vY2shvUMydC?=2$mn3Gd>b2k88*U8Gsagn{G(4@Z(}$n`!U zA@A06tzcd_LDvSSk>ONt+b~Z$-2ukc(nONMA7vxX07Zb8Jw;?S55OG z>15TIlR}og10KtK_)@@!e)ZCrldOQx zPFda%Oik0#L=xs#FWBfS{%R|D0o{5KlGt6ESa>Yam9(dUGX+c{9|LFRcch!_TZi)e z83lcQ1n)niOgi2Mg zb@U?&19qk!YOh56qhP37CSYRgOpw8ZO!ByIW@Z$BX3Flz12)B5f*v1Yb|64(BoF}& zCQ8Vga*dcD8%R{mR+k0C!DdJqX(u>vA3Mq1MV$B(_@4Bm(X|6&{8o6(Yn|;bfnzid zLhMowTd>I1GREhoDt`3Xt2^3Q$82BQBA3S^AusuGpfdlWFQL=WPp;#Njc_H{Bn2=@ zyE`Dh*wxXx#lP4ce>k1;jqdMAeE*7GzdHNXiIq|Rk6!AkgMQbt-Zka44m$?K7pHYz zxvnMow6SoVpcBU|Y{AD&#LB`&RLI)c%Jn0Le>58sxm%+yzVnG^UWc~z* zLl3x&Rv?^A^U-6-o(@@k6{u}-Q>b&z@NpWqR|T7j)~G3BY1A6{H7BtwMP zyA=!l^SgIkfX9l*hSI|Xn_-Su_B}OOJpH_XE%U1S7d~>bIagj2CNzQ5NWg12QBfMs zPcEN5I`^d#{`pw~GrKpwFI$#6?ChmuZsGJUyPtd+!!&MuBLvH}1t~4>tt^L0s9=WMXHL5Vw(;UsN^NVl24_3S*1} zREonu4S=ZieQzJE&XP-#nbNF5>}ol&qSK|LY8KZTy+|0xUwAM!9W`4}6p^*dHLq4b zOJuGdVSmASL%eFO=ZrnW1TC z-(4RSuZjp=9936+rwl*>1FNYBhr1I1By^tndOs@tT#JLb2CGN#nB58tbaw$e8ynNy zbk+W(T&I(mY_(Lyg>qhlD-aMMtY^E*3Mz1GrZKrEvS)F)Zi;#~<1w%e3;nCpwQe)a zb2oan8Mm4bFcDnsi0naQF#A#-S9I>0c_?TrdX=+A`69`rESuCz+)%hgj;O9Y81n?byf8dGpb( z3Z~_h;q}b(Ll+UIgPM$D7jVlVK_p>0EBJgXW#q*cI{tzfU0A2QLdKB4r%~8A49zN? ziqjPc80*%}F&oHz?%V$k8p3_bJMa@2P9WSo6=KFUvJOqme|wO@6Y8kxa|AL{N*ntDSidZV2T6P4j>+ls8YAkC~PCV@qHh;7#u{Hc=!^ zoRP7cBWXmWh(iCm^9hyk;g%7E`xA}5`mpQAVLe2Sk$=8pH*roOn)*Dtz+9G%g##{v zQmeW-eqgYzKt_RsWO8Mjm48jba-6cl>Azwh{($_iLe$I z6yT&L!Zst>rIhT1J-&h|JfSyLSfF$1z4gyzGR6%MIr|t!M{(=9Db9^fZklXjGBK-; zu>@omt8bLEZe0kqp=xNHm}xFj)*%Ax0`wJ)wX_ejFM0xtIG_49+zlQFsBH2ix?I7J ze!j7OsPmEa>Wj0l#%@>RkNz!~Hm)C8G_A%tift2?b1ZO}$ccUq z!wq|63+BponiLSeB2K!iungVTNyf39y3m$dR%mJ6`jr8 zW<&c>>o8ewE}VZWGd@@`FH3Ua{39Ywhxo*K|H7miml&W3t^jsD#tQx}-3Hm=sc7&y z2N^L#o6_J5wZ)0#yU54EuJ4I`B1gN%{z`ZHqWHcT9C)Ntiylx%#jeND`mSfH{$Yky z#3|i>L!h7r#QRrc7046Xe&$>dx3ND#;oK6z5W;E|1Bz+XK_tQYI@Kud9^cw{2}Pht zUKBw5AYS-y!A{eh6_P#bZ3H`yCW-)kdhxeQ-%b1EEl?be+CdDuL_?{VqT<$-QN34KB_fjQQl_6k%E48IhyZ z8&%kn?ay1LfF#NM%q4+_P@+h=!@rTTv+myne&ZbIvwA=tgn`@GknDQM7x$Ye9=Wom z3U6h^^RC+6>X!W1q?mDRr>6>%Yu;naEd+O`(NflW{UeF{KE)`+ zL?K|>n2K@We9lpI8Vdg@X7Vfu)6!|*NzrWb?KD2AZaO)6GWrGL8J_7Gd4?c_#wrFw znqIwp%}^H-n}qoWj#7cYQnn_!ERuG}q#R$CZX#q&+Eu+S*Fb5Oq%+9$06U}=vy4-i zv`&Y!asT(#7&M&a%4*3seoCW0Q$P;a)@_qFALjKK{^}0x~86!N9LCWYB8 zZK=YWInkoCi6r9}1JHx&_}=AZyWzsbv3H={mrVdw@b;Ew3Q=5>tiQJ9paPUgYEm>5 zNr_E(w0prRXEzoEVZVW+Rp2k#_IL8HcR>TP53GHZk|s;+b}!#LiMgfd?SD+ZbFUOT z)0-PC9Jy57$c;4CrmNvQw|!y||5B0rK@y6)~JAD~)3i764VT=EcHU7WKLNW9Y6nqGy?GpT9e>p?!;}5W8 zI`$`;=-1r5kA)WX8UXU2fVHh;&hw;-(&hnQmfR=dE}UDnehchBK|L!QlEyq!&pj1c zaIp#R6je`}ea143FbQDbf1#8#q$d-zSRn!pcedl3ap2jHpTb}-kv5q_yB5tmc5+0L zT6w5GD2&B&T7!l;e*gLFyfER`4D+nJosQzPM8FtvF0leKfM~XvnTPuGJyikKy8kpP zzrMCVY39bniqcWa=Ik>hH zeO{EJ52vVunBb+=|9Yifivh+9v&1|8;?WrOS`*$bt6Z^!_$fKiLM|Ir%~eTgq!iXA z$L%SO)B-R+wpm7{BeqM@%V1-$?tsI5V{VAJ_n*|aZgR%CEqBJ#qcBEPspUZ(E5NOG z@(KTNYUn8*v)Nu@oIa&NTK_>ReUGP0E1l(Q67C~#62xp@f;q1U(FD6_zbfXY{*2ex zg1rG^A9)FucE~z|x?-Ct=S7wTo=4%Q5cLR3?X>4Bk&^uok42I=YUu7H1uVRAFte?T z36uBdIG`iAx=oUTqt>*s08mJyDHk1>IeMFFJh4F{67hruR9IyhJk4HnYh1!t{fJF6 zlZsV#$_|=&?DK8h<%v243qJ;b0=`#6oobE-cYsF;M2LKrznzBa|d-ps2!Js`j$*9VWouA6Cu`_Z zpoLUcAt^Z|h)84~gOTUjlneZ*3#Pt9D!HSEpX}QWMpVH#?6&UXIYrQl9b6Y^XP{=L z<27zso*?Es7k@D|vfJ;_jW8!ee$~`IH>*w_ho_0ePk?%|Oe=)`S08x7${Ha`jymd# zj}%eawd5C?*lwnXK=7pv$X}v1yte!bY>e&xMpEWzs6ozz8cu8q(=G|5i9jvIbjyg`n+>jTd%jY%@}}Vo*!lxnw@|QoB7~9?ynlj+Y7Riuf=; z>BOX}t*75}50CKD*P6k0xI?kD`w5zrW$|;gr8Tew9Dg{#IMawWV{MA#y6=Kw$k9(y zGgwL$moa92zONKXL@3eQdcr@t>32?zPRFM~0fNAG>faz?q`iy_3Y>Jo67c=J2M;nn z)=%|0)^_skM`ri)UeQOvr?IWq2v_!1J`A0T*eLUP9{q`FVZHWV!S#f$WAa4Y8Nfu8 zR|paOUFWeN){SqD7SZWZZI~bZqu`j<%_#E*En8^yxn#-II7_FZn>Z7e^uT3Z(3o-ZzqC4y0 zp`-Oyxg$Qt1cTw0ccN9u>?fk(NF%Jaz$SnKxQ*Z)OnL%O?O@^Noj=|^yN7d%Zi@N8 zwZ$)#F})I9h%}8Fbe^9Bjts%zZsfwy=}em1~(CE9(Za$IJPr3 zp5Gan7%|&`T!K4bA7s;9!o6m)AH5o+xr+_4;lUA+BMMoc7eRj2h0mHm?ozPf# zg5sPWy+qr1+L)xB)-P#POrh*Y5t>v6$BJr3?q*h6{-F0bSE(muCs)(zKOwc zv`e1b7Phv;75K)RwW_}c(5&8YMjILDtQVn4z3{Win!o-UrucA0FPSr?^h|;o&2Wu3 zIJXIToDSh577Wm3Kp0E@Rq%nj4>_%2H&R@9(ufE7odvJWLryi%b^g5FD*}yV`)4U}s8GSw=)JX`CTF^KKOqy-_izF!6M#pL>6vlO`$SB1{ z8Q>Qu^c1Q(l3TC|F88ONmH2bizV`#Jv+cci$qwdz@x(6+ku&R<63`fcFaGg}>%J$h zvOwhZqUj2-4_=qB#FF&JJ1hE>S`w$_gD_74!nBppTN6vom32Ld2$%XpeCu3{dutEy z?{#bZfQD)}|7~xrJVgFnur!+u=_icdaAVuMK`wI=oou1Gu?o6ahTVxH$xd7dY@ z7nr-86R;rgr2n&g@|Tx0*xsv5b};7)Cw^Is+*zjAKfN{u@WnrEIPZJxEb~jN>f7N- z#p$hgR}5*be6giKOWm%%J?&miyg*Eqh=~O&??gnh#Jtf$d!a-F zytZ?V80I;mRcOjh74X9Y!O)e@^0?$(A?}``KbNHqc%>2N0FfZqfIR;Zw;;8U+?#5z#ZoCnoy()|B~*tt@ZHM?oSRxahC=8^DVjcb{Tq{^7#> zaI=`~*S5jvKK5EEqdA6l*;A9&i$J89T|YWJ+jPRUNTZjo6K`I_4VB}$@UX$+zuNY@P2q))EAN6v0|o@TIJ$GBPcQfrjrmU~Gx zfMkQkI)B|d`b=kql91)!>`e)jzspy6hkMdT^uu$k&+o(B;q-x99zK+Wt%0(?fpf`L zMHMg49YzM~m?b}GWkBu@Cc2MpDP=TTsBG9C*M1Ha0_zyLJ4YsFUt(_rs?3MGU%5I2 z>zQk({Ep>a3ufoDzz34lFFwm}16XGjPI9c}Kc3G|yMSjTo{F|H10glphC{|np4m(t zV9cZp6M>-GfMUjD^InG4rX1^-+l#zBrD7e94(wl~jZ-Qy%BPakc6wx8`qB#6y@~pE zmadton5*(EJ2KHI+R;ESa+&qv3_`DSwcd+uXUe4&pGM0H@L%LPvoxvbzdRSboo2ON z&z`;oXczC`dL>V6zr=+KywxRZa@xfWkDa|I5Qzd!s8MYqn()P>Nn%t(|`HAR4&Vvl?AuXGo zOTRn5sTP?;1eUfX-#+Q_A>3xIjK5A!9hfnYnRtUZ&|Vnx1*VPO`s>d#@_A!NhsZxq z8>K!oyhC0+@|V3ypo*?0FQ25?GU(Ab4SO!ZJ!{zwurZzIRzuF~fAbsL2qL%!;f(l< zLN~qEToC7)Ar@7vPt~QwxyYVAd_LPgF2Z4ZB@yW=@;!%DF_>{`;|(T|%(JEtSm=#v zLVUY(xCN^$xB4f{bFF-{^*tU0P60taiE77uSsPRjpI_`@k%SV;Yh}8Wm{xvI(@gXm z=b)*OH39%B-H*dAr>8)M%OZXEgZ;@&GW`tk@I*rn>0x@fq3a4A@z>odJFalE3S?9s zVK4Q8@M-z>24M&JCo2PpQlq~EBSHP`B!`I``K@JGf0Mj&(8fg+g#FyuSo|mPwW+8L zS0h4Jl520Y60?TcFr#4OT{(ihZ=&<`Y@PI+JwFk9l%W=yZ@X`NTJFpA%JzqHI@)zI zCOOQugfHVOo1e({46O5z1u(@*WI*!<3e;Csp_}8-VUeXP8v3eA|2I@e zpDkci$cJZho`4yxF=|;-vJ?DxNAjOd^NTJIzLqKNptp|TP?v#w5D~D>Ip}&0u)qxQ zOQ#0Ap%!?d)B2(vQ1;E{dAvgn%^f%&lqvO!+vzAuw}ZxtlPdmhw6A7%)*%*c1W_&e zPm5RW)9row9jgYv*CYRLr5xO!cz8TU~-HoY;qGX#dDujdLqcNYJYTDsejM z82?OvIkrTeZuqLPvJNUlRGmG<$L3=F8>zs*+pVp0sE2k5*!Z5UlD*@?Y0xgGFGy*Z z9fJ-{_^;t3mLY4Dg@rIAgO>Z-YUIJ!3+t9e-YMCia63Z(ppQyoH(gz}B+ZgUwLk7@ z;@O`ECM@Ja7P9`V)zkHOyVM`@jru%cWQ-aWR1)T=jpIZDJX-%JVe~8LG|XxTwRM|t zPa$U4+DOpf$f1P>V&EZ?%R*0b?(U#1qGT8Q&81Cp6iw=bR4^Ee_tO4#tcoqEuB{w} zhA9var4?PpIDp~*UcvxFqSndG{`DzEMS;@X7}}98fbP~guCF+_cuJa3P=MNfkC}ew zZp0U-+4h&US0SbH=qRom!*R4UblMSiwzjU4HQ zjL~KSU6h*r+e)-FrhbJ|#&5VQD+PXBIHdN*sy$=Z6k=jYKzPF0AN!( z;nPhs%Aj8q92pIGBFPv`2+qiNs!iMs@iEE@=q$#ZO0O24(X7W-$y_X9@%&`aVnfW9 z=#Kxg2Yfk1`$X);AN?c&URDhb{pV|(Tw3`WBChW8@JAdo7y~Y$UaC9WZ~<5m0Hl4p zc^>alZF2{>vMjYr6tZ(CI4}m!1Y`S8=E4EZEqVbaeGC&(K*sr^foQf0H_Rz(bE;3K z^-BLV1kR*08#uAGUTP{c zGuUH0xNdw!Zrtf&qNn@BYd1xH9D?X6Lp0`H1pWEV|16=|s>4AK9aM4b)m@CPFisuT zPzeaK0f5zJZ2Kpw>aETF30g?2$dQuYxc!XB+Yb z4pi*L{33kdqDim^a?r_RxC9v}uS)Mqud$@>KvMKuhtY;D8Li~bzY~Znz%v)%j-L$9 z0oBWUrvaH8u$Bm`oGc>XXRC12!jd7Y1r3a6h6ubhP=-q{E4%hq$>N=X*+O2BPK*y`3paD?Mf{AP;Dg;c33zOR0h7Q ztQDl=5c<|JTM&ZibTeD5T=Ji0n5%x;8^5SfKxlqdS?ogI6M&lT!W>etb|MDG$Q;I- zk}-}v*(}hIhJE>?@yQE*COSo->f9Y{X>E+|C1! z5{U*D`)Jr>W^rkUeUPIKo3K-Za+^veZVt`l6610;kclvZ#;U^}qLFS<1c$B5h2V#P z<^EtaZ|4QJuJkej&x+KUaQJQqE#oKT9y22f^q27evp)E3D$woDJ$D3Q)dnY&3y`XN z@ZMt+v&~7swao`;(7=PFD}^9xYWTjiOCJW0gtHF9 z%}Flm~xXV=^G`6QGFz z95Evv3EG1Sqf(2*jWJ@_a^7ckDVEZ>mPQEHtV(HP2D4%{j0n(vz6}dY&kVX0j8<}C z-o1}RuC6lSW|D!>m1o<$(u&sRfd5i3ypMuUAzX|Z`t4wDdx{IkHCl`Un;t-I*?{qW z<)yJ8{3KepIYlQZf}YnoZBWJ&rIB-4s322N7{u5uCb}h&EL;BLFk>ash!DF*^m(zW z@|}nbU~_Nh-KLPi&Yf{L(gzsE-ho@QBmyKqq!!X02r&^pUY$)Z+xD_=i&mzyKJDbK zEl5c7&aYWDAtg2)43369iDazg#42OZ76XL|J??5(C+sZCI*Ec=Th6ov!nEMbbk3^U z%TBl#Fih$}`nqfgco1lA;awb2oH*(ea_bt@5iQ^# zY0dx0)0SDe#tBCJV?%rc)JE@>&|ny4#D_4ftM&cC!^&R_p_L9HZac=KHmb!I*jbOr_Omc8|J6 z6(W3agdg3qrj1&Z85GdxSWTkOk~G7Dm8b= zSf=f#r}wW5rbT4KEvu+nWe14eZ$@;_iuI6>lX-#fzBTFbc^G{_Ak^r7Hr48|?)gjK zYMBN*EHS17tdHXy2mOnKVV}6>J(64TP*4R5-_QTY(Xv>|GD-GIfh#h?RpcN!9(sTM z#9z?!aUdc+BE*i$d2Fyf-?y$K)phlM)vd`|f;>miA?``o>20gCH|O>SOrMMekMKU9 zTGBaJRe#vOzu?)dKDeQF`-*F*sr-dKes_l^nx6~X68#2wrx@PHxWzPmUs7wjNXvEn z=HBP;DU7zJsNW_Lb_6k}4vgx`qxDdRaDA9=1iO&}`b+b6f*-2vz9H{v&(=&?8JkJI z+@6@6SjdGnro!6CeX7{bcv{7-$!88^+V9C%Yo1$t49=Fq3X_ivkLQ$UXZJlTc!uf0 zqhe!SEgP!Y@?2Wm|J}?jWd|B=P2~M~rcRc_5b!mEa#w+cF3*O=xbkkPUFjmT=s}H! zP4O_2zC|rRMd8*xDB*Q`Nb&&@1=K-ck3Lrbkdj0}ec@X$oK$@QydaZiR*w>Ap$6AJ z{;vPQ;cQQpN7>8S<(KFNJUl zCl2>Ghkb(fW4N-RE(M}jVqs}gQD9uRHdOoi4|qU_L9`p}HslpbyW|vEra~w^30cp;C)337aEsBCd9+B9s!TPT4Czwv$>}T|VRPYC& zv}}0|@*bdK2^rVHAv)MHg-22SCi8joCCr;ycN|;c>^$|UTavnWt5dmV^Wadn=X`$C z;5Y`UP47`7XAoF*WpxQgJq5I1w1>0{j-NY-dBxSYHUPiBVOgGVT5&)Um<0VbpRk@sCq_naqvnxOJqK@Wz>Hhx#;QnTq!aX752?nDBR#*f54 z&vC7A!P)!>)UK_sLeUZ&?EcRB&JWyFGJq#Tc@!l?Wp~%}oXwZ@9nNavX6pH%&(1%3 z+j9Vlg{@HIy?B`;j$W`)PowI=pT<3jT&`bCegX=`_iYDnHe!7z3|GEI=Y%*RdR^{W zL1JuJz5K#F2t0k-*K#ed+`76MkhRiEIv>GF*H$EYIu1wn6ts?v$<@QX)^fJw1i$N- z_@tn@c^SMTz2jcf@Lbhb_hae^^Zpwi&ac-QD1QAt1pBA2^4J{J>MPvZREBw7tS0x; z(mGSu$LHs-g3SvFCMDpLXK{=q>6+1#G*WuX^Uh`hy72UA|8a=x4l!OT8RvqjPzpFl z5j{YXub*+we)ICp89KU~fYjE{zes2aZ-`xWD^1#|brM1e0&OUJb1n zOjK1WipF{OX3+>g>RNl})Q3e$B`%OaBVbVH`>DadzA4SlP2*J*VwGrBkt&SiDhC3w zSQRTd`if-r>sbJApLU+blT25|!ds6@zrYTS4UJQNJT{%aiv8ocH;2fiI>P)x-6Vc} z^W;GiIQXlQucB1~tN#WItJHMjO6wD2cnw^SeIm4gjJGlv?mms`UUQv-58W6Dl4o(`4Bja_p`H5{}7y4F6H+;L>oCQQRE{R#a$O?6sgg> z_7aShm=T2%yy3JQ{u*oX^_O$vO89_Xv=*e zvC1aed@MfEa$|gIJgrAJFObP)KhsE+bOHIbBEGRNf2foC=E^3sZIH~wHx-GRyMW{> zRzjzde3G41`gKOjV#YqBjLV&SyNkLTZ=Fyao;kCY*rGh`WV;S6HT={TE-yr)CUM*1 zG-Rt{ZGdtDh8gWY!`ihoAo?~UcCC%P4{Fs81vDEA-wp!=coa}!j_ojEu6Vh=7{hP8 z-kD~G3^LrIdhxJ$mx#*KYLE>`!^2E|jE~zsv(U1TA@8>c5(-S_|=xdS}zYkNC ztPflQ0{&tQ)i(SByj+2QUS-BH2clu^2xBqkC8F@Y>c=D3-Kv;)> z+Chq!;Oz9#9CR)wQFuk;(A^nHhHw{nN6-UvIE?5`8r}p zsbhs}b#;j%uTKI)Sy&o^!?WbPP|BYL=x!k7h!oLjj$1^X*+gwiv`VvQQL#}wpDiV` zNG*NjxvLHad7pU}sq%Zg3u(KVH!bLMI@HJwggZI9Zdpe@fmRjfhc={w(0aM?HL|bU ztK9Q!7?BGawv8Ee+EvgH8lr_+&ji5_Fz^pUob~seNjhPf&x({F4j^oE!uK4@GNs&Ra-sy>;ld00ilQ_lr2De{%vYnmHF!4r$IZh-*|NaPQ~I-{MjdZvZDN_L z^JQ_ii=)Q`cjM1qECU zNKxhcX9Iih+h$}blP<0cOC}w59`@DFjG7fQ)TWI5^DL{{?9Y1BtX%zi;fEWB z=prqNutk68-+!3ZjToaIIM&tSaF1MLL~Y1WZLGglg+6>OlWIxJhOj}>iuMCUd)~XW zwP0KftE!C3A>ht<;M^S77qZ+@^-R`&GtGJ9U8m>2w(+WyF48g*hG%b@^L*)HPxgV^ zU$E^mHMqJpml*A4fA@`*pBdyvZ5~UAZ~#VSKgVT=M=QYJ0zt0w*9^2ZcYi-wm(xwy z^piT)Bv0Nykbcc}jQ_QB>}1j}pU^(k^)O%2)p3Ix$pQucJ5RZp_hq)h4VihFeGUVeJWx$QK&fwh7GQhGxe}JsJJXCqS8 z42!sxHzBAoq%2}y9StO1#H{ka0Vqxyr6QBYo(b~`g8!d!#6bJ8`#KFZYhde$6{W0_ zE_#OTA!&Jm^aw1J>kyW>SL`|G9Yu))9kQOG_`#%DNtpZbg!nnA)vuf(f(TIxWV;}d zrNfm6RLNl{e_p85c+tY)c2FD6z0TW=5Y&EnIQIyP+o6xcVD6+qzhKMK$TY=#5~=4` zkZF=Zq=fz>ECSN3LRX4TKXg5O*EXIq(6%0pb=7lXN$@(}d&E)P-SM|i$P8VxKdItl zi50P%D?UJl=v$g89TW_Wg1Bf4F|0U{>wCq-7t~A*T6sIq^-A@I*aGv)<{W-0s_}Np znDPGK&vb=!j_)Ou*mdU>#IY}_t>}0eWK7(fsLB*E z+dmBLnhRURP!@jPpE$EBiDXk~TkJ^2#pPDiy^gGb>sp-_I!h8hLFcs}7B7M_!XafIe zn{NQk_ofSld5Y?M3jKb>4CP1Y<+PU9W$jpGJ7(x|x|LtJaXdTb)=(-nzYe$y zP~*XD0shRNc78LFl7;|f_=J19i-MdIfOx?$Pn~+l{ZvQ7T;)fNzjBE5B9cdg_@4QZ z^!o>sS91|lY)Un4_R1)j=n;Eq{sZo4Qil)_gYm>Pc8Vg4+bUh&Vu09l)h&}7p?p}&vkFmeMN{ug@Py|B#hPNQ90@78`>Vmyw<=r4X2S=X#|NGhuQimnH zMps=$4W9#E_Eldu;&%&H|9l{2$Ldz)-K3cboY?!XvFPpWVO;%h8b@T!k<1`2I15lk zWi2GbE1s|y`PEYw44W&{XMa^pl8_h5z-MI&uAW$hD!4E0#y!F@1>YgG{hHHu$dg>i zKlJwqBi#b3G#LFD_}C7xWLkgMr&d*UhKGc=FU*}s$yB+`@~W3W=59K+pOx~zH+xnq zme8RI^~N+5)P7;veGbadSbM}f`0cJ*Pu1%~at?Mm4#(L$^(Kova$M(e&>bOnyo6$2 zm7|9rU1?volv!uQbu?%Yqw~!@^kFe;E3umBSjAGelBGchAbkLl>UsCPdThEeL$Sv{ z;%!z|pJ|)5WRy(~C(vuZW#Q+E9pnNB6^~h3i`RI42b_!}6_*qxH|hyH7w zyt!9UQ!MUS?&=%|gbV{>t@D37>=PhzirJFj)0A;ScJl;|D6d|G;X-D6cvJ;iaP_Gu zN;Sg+yS(?7O}&*kNuMq|~W76C2>w@U0i3p}dsb!_J* zFlpbT74w4Absv^go)+HILJc0JDPkAQ?CU7TgYuiQU+4$puJyV{BHy}*-|U?ajS_FgF)sD&GmM`u;3yOQcZh>Y z$CIy>v@|ASNsVe%%_)a|bIXUk#eNoRtBf{1Qb#VZtScuQ{Cr?UpE`))10ZCJ!1(`v zdazVFoOqxL<;*%wb^eX@@7K0$l2ahI0tGF8axL-~jcNCxDAfV}gG0HVDp<-45y`}X zq#e!r(u%s+g~BHQ1LJml=n)739hW2>x)>w(M)bFMr78V_9ZBM@R=M9x}wOK7`k|B-7ohm%<)rm0=6GSfy|H0 zVZHhQhIYk=bv?Ozv&6C6V4_T{(mdM>H8O2DR~Lqr7drWD>gqU?3^TWA*PCKSS3=WI zY&?I`8CBX{!stEKfs84nmmL-|cBs-Y=cidCf!=fy18aGf(C6uR+^dZ->% z!dQ8E`|R0Bn;5I}uYIqTX__<3<}9HdY$KIS6VydQud(*+*7~gs1;n&}oqzUiU*X+J z!p7qQ`nhdB^CRhv`}?=qD_l!x$XA-sG7(s3PTAAtpS^J4^9^VB z-vs2IF!nDz#|)O74iCcDJ!+e9Dqk*<&>>aIJwo$A8s+z8&^tnkmcw-V$~#OmkjUmoRO5x$!ZB3-}IKnMf2y64yK>a4D>ax$TQuix~3( z*!cjlpD4@@DCcARG@p1Y))R*ZptKv03G)Fj|NJvGQ2h)s@YL7u2_%d z8am|8$}Ebo3j@&ur+`+_j(UQ+?vC_^{Xa0onzGV|5l;cRXD=UAgJpVVw=4a9X`pyTnr)PQD)ETBOD*BfuF)NyMQNQSMH(msRSXewv zp&$ay=p^3;Y{f#*e?HRAld3)s)$tGAb7-Jq)x2z-3rl$;Za?miyV9toto^ZPRAFrb zc{Nwf5nJ=+1^x5xkehkS{2WVO$8gDE_1b%!h!iwM0hLy!jOH!g5Y9jTo)Fbu55b&W zW?D}I1aK3Pv!TWRa~1H4;| z|IMP{BdJEAbMWL|)vgdux2n|_VDekPq^eTgg<$)(yaq*6@L&c1XJ9=5Mt(3LDl_N{ z^Eq-EAqU~45BAPnPgP-$njts>*q(+^?ajQrfb%B-`s(AV_Lip$>plRS4%!zrtUOcK z$l3o1TrA+`c^NHr`a#$m?xv3Gmv=qgv{^}kIp!`*^w&=y?kc6m(pP8b%UDIt@%}iY zdEScaQL6Xpu++5pPo;I+r3yltz)3`TPb^w`=nuCY2zP#zVhQl>L&&z96kbuOuackq zkACBZeK{{%_e3-#cooWcYPG^XdeL}_K)Xc|B$fKSIunwMqB3lFh@gg-97x+qyFt0wiUU(tkn z8zBg*S|uA&);;XHI@it^%Gtt^XYO@TZ?KTaj6csW2`*idcuppa8$#A3Ko_h6r@h_} zDCEj7%WZ$7CUP2p{BP2veiS2OxJGT+DKKo#;Pj9dJF_$EmpFt%zT{A{mTMu?DGd%r zT==W5pyWo^|HszA%2N*rR!#NSb(`$5-KWN!)eV3sMc#gbvTs&p@7_uzem; z9~aJS3HS4k9Q!q7u4dS)>8NR+u`rRSP)++JI1<&{6*veMp$w$N1&-x9oBRFfO~Pvq zK_>9W0lVb%2`p&?w)}QiqbLB`jeH0*)U z?VEziLuBP;8wLLPvXPA$5TQ@DI$TS+l5ZFC9YMSu(BSD#Qcq13G&6S40Sf8vNM9yd z5)hZ#e|(rrLLaw&y>JkjZ`zTF;&)S)ReS8^y6(!{v;un_k+d`mSD#b^E)nD;m#^o< zvv?R*3poslU?RUX|Bp~WHHWo9msa`4c=v22aDn?HY z6`24KYl$tNIy+!`;u6GVn{jV7rj<1|>popp?8L*&qCbg}EK1fGK1o#p+3_g;A5vLN zy#xjUU|nWNh`prV`Hk8s&okLaRBl_*Z#1fWaHrSXNxY_emU2B(X7tb9BxOm zgixb~A65e*2I!=a%~c8^eF29rQy{bXv&?%EMvV^B%03IZ8+~1BMO3nwK{1I-Q;K4F zRfN?##E29fJx;ywq7; z#vz}5aT5bw<9;2$=D&5YIp207G4*d|%vU^`8;<+9e9C|W`eX%t`^~#0d+Gh(Yaluh zcByi}OSS6(KlbfTVA#J&3W9oEmI)C&&Gmc93sYR4AZ(RRi zaTHx++UiolVKd!d|8y*1ecD6qJ_xK`6t{8mqOOTZds>9cUuq(Y{oXfWN*l^v{#SE zlg^%JJTy%%*5Pikl2J0j)HOkpHj&|TN})nxvkpHgjcqua?~`sI`Zgxw?WR~WY+sz) zz+!8h4g|20fAs_Gm}$v7E#A;PT2j(l3It!EFvfR12CxwmUg{P$yjybE8*m2Coe(Qt znsyOMbQdx>4?wgLcNrnw(AG+_o)@Y~ZL0mUXn!V-vbf^bZiMLvh_A7$kq&IkJW6fY zhOZ{u{#|KCQD_6Woju#sp)0HGwc&g%4AEq!rmE|lo-a5O>}UlgK}a5gI;4R6BQ~J_ z)8?*hI60}ny9Mw8B%L6VpBbzp490_uR@8qe?pGEKyiNW4*Kwt3rbVq$`~`3PeN$Cd ztZlFTl{ggG3l}1F6wy16^V7ro`N^7NHulN*h^1@LBd@}yl^3b54Z$%^wWO#~f<7<+)Q-Jk^pvA~xZv*^KuM$2yZ)lDeJ7f`zjgHV2&pKklfU%!)S!~@u(~M+|YVr$n-_DDP z@LK%qRgZu80snchzgig9u?jS@5USgeyIn+{b{+in%7$8O2RR!OHSnGO(%UH_O4A&A zC%S-c4T^)ChHV=ZV<8Blsq6Vonk{2?1#7vvpHQRK0BXN}Tn~i}mdy;Kkfi!h9G-HG z$HqrdGP;PTi!l9wN5aR^_X8ma^K3ajiux7LqE6s%;>~?upO4%fnqa!YILcfDQsI1HGCFd9aW=)jsrdXS1Nk zb?VWBBkNU%&Vy!Q#}RS-JO%C16mC(A3zKmPjxTEk1}00+1EE=i4Wha`xZx`8jk{H|RjLzG3*23GjbMISFWy#8?-oV6#S zN2|yTMc?@uHf*3{vG^ZgC{W`4pWJu}W|m8o5CV&9%yY|YeIzthkhi=)-pJ3PJiQ%+ zV3~>o%u{Bn|KJ0u=}1d?*uYu1*#za+NFF0O7bX!>VYBy+HT>8_1$zQhAtvO z2Vh446hqWOF_0XC^aNzGX*CiqL8=)EGIgJ<&H>;fHDr%&W_|XP0`orMOjdN%5XCYb zE(LdSti@xavTM|pia8q!_x+@--+DWzRQNZ=(DTyV$;lcFiQsMbEoyJyOQt!ieu=_s2Q@4WxJ ztwcmVW1$!^m|~A4l3#`|Ys%FKAlx+2JWdE$=%)%4&MgwM*JfAy9}!ut<|#OAi+Q}n z<~O(Qbg%sTq9To;^_JU-Fgt8WP9|ntW_13$(9QMYtO&y+6rfVwVnaLqtolPK3!)ma zK6M+kG~8X-<_kVg3%l_w3#g?6)gF#BzMzV~Q%L_g8-4yVHa|H4>;!PVu+f)Pxmzrf z5YE$|!ZgNS@4s-U^BPT3J9FA+4;WdUfd&EwT32p{hyIzH9$1v@@4)V<ZBP{q&QgVEXu%F}Mj^AOv`6Q%_6!wrsf3zxNk*^=FD5#+%hB+^r%u^kTD z8TI5aI2hy(HS7nB!m4s#0}`ekj?jvP9jXaJ2J#TFlvwE zRe*pICQk*0XI8=J7m8HjAeeKM6@+xs6gP{Xx+#}qy?SERV%(keLD#dEg^iVg`7xy5 zFzC7rC*@BCy#)1O6Qp1}=46g~UZM8LsOcH@PS2SH4{oYLan@{`UJ9c34gC}?{mc!OW1Z?0xX1GsX8eUPFl+N8B(hFmA&SOKJDWc_%e8{+ z2sp6lEGQO38T4iteL*O@!2+M0>jW0*VJ$jVmC zU+5PXfW8nnav`l%;!aAox=>HPz(HK6?@#OmUo1Rwz}C`(@?dY;CC$4dcsLY18&kK2 z?l6eMVfKDAKtoJ0`$G+Uk+1Souz9`};5|1>{-U`K(stA30rs;NB#iL&U!=UEjaDS= zs+ADFFr!>Q_%a=^a;2f{PF*HM&^^Cb&G61FapTN9LBs9bnM+1-?2Rj=T&}rXK{t7| zLB>Iw46w6}JbkYUSzl0HD{^zDMzQX+l+fnuiRVKQ-#MSh&{N=bPU0h;OwdeZkq==x zyZSU!wY}FP>6tt{TRC4IPH1&tdZ5nO*)tAx0LK0}=XebiE&xUgJcyy;53NjrQ@o36r}RA>9`p?z1~ zMGN*B@4FK3Q_4uFkg7FVj_%aFxhLVt_`iSJMfvzdKE^6=J1NxRrA1#hkhzj@vX!T7 zJ)xyQC9Sbds~eHA#6z}T7O>`NH#A?)K1ONj7X?(H0ZGMg;pTMzE3biG0!coEW5M#$ z86kgnS#{RegID1Tbi5Lpo4Y8gAd0J}%(koK64(yvitgCsw&_dPXH+im`Ijw95w74J<4`J7M?-5Auz`APD1HUE$X48d5QT*0?{2HDq^|EOe8)+^0ALl2 zr-0NG^b)X@bWjEAonQsXis)~C21U~AiMpl7ZPFDI`@k7vE2&~Vs;ubLr?VSFMiYE6 z{2f1ki*$rimJt&Au3a~Bmid8nA47tNZ1`;Q)>JX1k?epT7bIsPanwc>I)(~Wa40dq zG?Ax}O8xMDxSg6pPnX3IrImu1MPXY*k$4u(Fdf>eY<%M$l@i%A*m%@EfC4HffD|e5 z_@aI3ByQ>ZJ{BaUqHe|e{7xb}JI<)6W@%D&9}8kF2vOn7UIO6e8e9@NtqJY|*ndue ztbE`~blCbXUlERPoPiY&ONO<1stN}VP86qFZ*s1f*1QSoS`@q%aho^~7ZYBNjhgn5cx8+lzC7+iH~CLYJm@+)sl+{mxi)lgvd-zmNQO{!u!5Q zF1mOsH-}M@<)Rzawvba|M8X`k zmeQ5!yzqlB4xT+et%-#nB!@&7BFm?l<}JAJXo3bw%Bt5P-DV_|4Ar}j4A#$fIV;lA z%UM%5oiFHh3)*j)HZX-VG$@Lv$1{%jCb*yh0vDp&kjO(kV~4iEYkiiOSl5K13b_#Hay&LKN zil#da(^YHxkw%N0#>_OGHX2wQ-yT+hWXpx!%fbpl9Kbr@4(}>s-B94>K`MKCwp9hA z6JT7H3tYh7u%ebVfLCma9SH(D{nX8JRQ(F;%O~T-XX3@m@PYN)h26z*t3zjH04LX} zF|Usvi|6!kZmV!R81-&U+r?IMjwU!NNZvVJi&vl%;O<6tIG9Nl$DQ{Lb1;@ z9~l~{JDHt=`<+~R62j3t{?Yb{GrO#+UmqXaIMr%;vySUvg7IA*JLmI`(_7=G!v!u~UD-3&>fk^tkGp9KG5_oB*1dSVhyl?Ba0 z!&g*inus^QRKcw1Ln1n(0)D`H@mQzCaH`$D^4{}`j7vF*N*6X zB?Zn^hD$~4H=GYx@u6Wr;K7gGS<;d2BXETLavw^-kd0Pg5v9E-UUV>&rY-h3oCWMs zd*=+3Z%BG%v9Up*%SfBL{JQ@Fb=^Fh%{a^Kegz2dSP%GMTIptP% zidtH8cYbeO*#Gd~78je*CFB@s{Elz1=eHf(4*#eFR#_?+S}4=^KVfSLH9^U~3L%!Y zO?6>!@qweN~OL*vd;f|(EQ-Zq4D~F|QRDglAW685ELpKF`)PTf*AMmVB zi9*`@9FisZAN+`$3lNh(5c14EO(0E2YZMK$JcjA`#?>)V9EL~B5}p>M9TV%2JBxBpnDY?D%{ z4R3+>t25*b3novvH~x}?0=@<&aYniS7~&#Y)z*BlIKI=Z@PT~M=N0k?cVM|cd-#_8 zhB-09;C;ObU-OkPqbrO>abnv}!gJ}**o;i}`}@>~WWsg3y^1do4-tt4-dqaYoN&>F zCXd;64+HyHYhb7?2KM9u;mCfUVqm|^8$*<;!N6|TX6yGi&~pm;yo=CZhe4{W_qn)@ z6`uy|rDBi!bkrr=SC&mkEaa*Rw>X0L>7ur%z*2GmV>!Kl#-m0bq`JU&yXDgorR`yo zbNs)ZJkbt?I@ImnzuU5%(ti|j8xVD{vj&CQf^DneyZw)&&y1ybSp!fg$np|vo^Jy_ zxWGN<^47dXrnjKe=ro+}K8;Ryokpiu{LT$v^f@$b`02C8iV()Mnc%&46Xrv3`qyg& zmKUFG`(KGL4w}1pq#?pp6d`USL(Foln{=^UYNE%dzgN!p9W~VyY9k5V1~I2jIh}g> ze;u0g^sKN?9eh!Pwf_;(qbAkY_Vd!BB9RFyEGrVuW3ky+aNa`pg*u#NMCABp5V<%8 z;UA?VBoVTVpB3-|LtYQSZuFilKw9z8@DF(=Ay$7-Gm6lEq!GcLHfxB?%xVOFsmE=| zI`fg_SJ9Qt4`pZWAmp@zk){vaWP64Ws*t=wDhuxp#|mzKbORh+?=0d`fA{S&c=XLj zK)V6j8Ss!wu1xrYtt6uRGrEwbkg%2#v?~GXZOeat^%k(IGEIR{2ot!E{!FX`%>Sa3 z#4Ug5WwC+8c9*fUA47kD(DT?OyhAbjseN0H+Q!WLSv1Fp3zYae3eONxOb(9@{#bEX zt2cq|U9#~Ei595T)7m1jK;&|_-y~H~%K}mWg59_CA&rcSpH^S56@*kt0${r<<)RuF zWB}W#X1$TwEP6`=w5JJYLWG7;!yLWEAvp=iWda)SNy!Dm~2UTO^;4FEn z6~s^U;{ihvWxJI@s^6H|$0SQzg3+P2mq4$DY!C2XnhzOSO?t4P zE}EMHtEsntem3W0MtrPOORo(Z_u`F0AoL4t+}m0kU3NyhJ$~LH5|-=OvfD6V4dml_ zHQ96xk&0Dk1Z-8&+@!ddusLCHyy``T2`mFEguPh5Zm$K7V z2JSTx?Q>PUWS6NWxeWOJziU&BRa}XQPN5B^EgMF;#jo0$exGD13r8Cr3gT7DiIXF7Ze8(n)OMXWub_BWA1ZZFX>O> z074#E0Re%4)3WX1>_nLsY9`w{1 z_IN~&afE~j&A$BufP8@WBwM3vfPA*a;ljt`iA<|d0{;<1=O7N+ z<@93MAnL}p*IHd;^5!tmLKVgVcwnH*49L9jqKg*bOJ`z^!<9(V-yN3Wf*aOGW4mgN zcnB8AU`_z0%&=_r;labQl*E1JFScj||7QlFCs}CPRF0#_Gn~s6agraCyPNBpJ!}@x z>^q2k`dhSHz{5?LC$l!~04@%;aPAxBIZ03zJRougdHsT1w=gX88xHt?-UoPC+7W=t zBAmzO3^zi<2EU6jY(?PY%St8LmAo|%ELBkKs~A2VD_fs?T{U#r~DN z$Vj{>8Dceobi_XhakUSFqw@mTB$ByBF*=dp1}izdafla3hM%U6V6o20)H>M=0r_-R zK3h0@W^wf82OdC}+rnQ1Guc|t(Vy|n@HVr8_8Q+Fg4@bW54{F`+=`2DqTVP%W8ORe zkq_F=oI%XU2SX-?`R>{S_naoGEmo9#LMK_pu<)@i_MJd6n!Yqpf@6SN3O z2l|31hPGaXsIN2BLIeY=HzTax!Mx1`1W_=aFY5amK?o&%9KAyzE;(+Fi(E)$rhhk7s4{3MD^= zS4yQmGY5M9`t4HsAPe5|%88d)IZ1PA$)}Q%5}um7oWaiNOC?P$2_({a0nf##Y#78! zj@=rA;UP~&?)|CFC*#xO?#cv%JJ0M3w49&*#$k*8x*HkvL;Lza53o*OVC)C^fH4{2 zie>gc?Cv~RzT*d?74FaK-q#PzQuB(pum#C1oT4tE;=!bhl^_kL*H@+lbh?{#)w3p| zC;NWha}E}VLxJ(M1&djv=h#ogTBOZDS-KBa;rv!`%O^K3ws~M2HD@#Nha-2OL>C}s z)U=*5D4wR0&L^nZ$RYj`mS6B5^nAxZLLJ?AUG@Madg)8&6Q9S~BO|>+9TBV3y@nuG8eQ>f6OFE2%t9rsM(sn&rX_m&&|Hnm>su{lLWshpIbtw7)iA&4IE5)4x8b%iUK`d;nBKU@w9oD2}@YC`_NB!sKW$0?r-&6BXqL~if{B^n5DwX zf~oT0c>!o}wH`d4mQl;soY=`r@kI1|)mQ}&N(DXF4~_qJ5&Qp^L}CU$3hYn%lYxH> z<_~U?X;TTWiC-`nuWu!^Sz^3JvyxwimH*D>Y#FMgE;B*@6B=@OMXCsI+yk$GD*_SB zQ6lgtAU8~!40Vs`FL~n-OY*Davc*Jhn_C;eIOS-Sr zzDeIz?_?Uv&K_CpnB4^2t)`OT1tLir8<~)&%Y6&Lr9%>Zb?J+!7u!$a{CWR*X6h=K z$-;ccekM0!Z3eb*X|B-nY8_Tlz(rJcG7l&Hm6xWRWC`e6^C2G9{V{VCrNgly*I*gu_uY0rZ?%6W%y(V+f_Z zl^5RCM#NM?d0`|p(70CofOfmA@!g?_?Mm+T{ikO_cJ^=QKZ@?Jx>pjp)-`_MBWNTB z>_CZ9u=-CCYel*kPmUM%*_mWU2)JnqKlxY{3I1@qGidFI)KI?&V{r{328_ejt|e>_ z@@zCLA_R8X*@w=*AHV-TdHa7Ha>o3z6y?Y7xkdzw5MG!gx}9fB=-2osMzxI`Cnh2< z#uFMzGNbMu;l`qJ=@ z0NUZ^jP+5lU*@+aC^!hN&S}P2W>r>koKFR=dkD?Pxkdpr$eqKq%~jcUEi#(~wMb38 z2tNrn=FjFQOTfWt{I*{%BAKGaD^d>0`>UvT2=S5AFU&R;@(VdeVI&#AC`pxrvp96&2xR z>Cp?4M~;~41_krNG~kaOjSDSC70`EtDHBDLp2gaOgXa%tMZU^*&Snkh1>?~K)30Lm z7tFntH)7BSO9!XQDt5;*phz{(je6Pp(?Y$n*HtZ9ft+pfFnbQ4)}|>eeVs=wJMDgV zaF?^Aw>}N_gTuEt{y6ojzxIt8{MEeNl-Dvd1z&^0oMc{7!f{CykkdsAU!ZVZ7mOG> z$pqT$Vp&=%ueu4fdBB;^(9FTMud4shgeLUd22_Z)J0uw>5AVUw0m z$Z?_tQsIdtMPMwJEDSZvPwuShxxa|*124kz!dnJmvGk7`sfKT#ECZIhj0h}y08>D$ zzi(QwSJpaPBy!$1C9$xO2FdM5eJ#gSe=H1O$zM0D)7gN^pF`!qm7cc zRd^>emG{<>u!%e?D^9CuO5UG`%Ue|)7M5C@i6qK*tHO45Lq6S-$LDaxJIYz!jezQn zVFTY+F|Z<&g+<^X9f^Gpe54T{*BK-Nx*!JRs&~NLx(mCe_CaYZ^FLE59 z7z5d2k~A<2Pp3L^!L;e!X8Ea|Z+jhJ9ISeOC$<*(oCp@uU41FzUtkWYJBBWvT&=E@ zjDEGKMQFNP{{as?PvBphA~Q+StFff-1h4T)zQ>bOus&6zWEFTkmH>v@F z-qeP60Y^zlx49mVvRQKk#|ka;L*f~p7m+b%ilJ4$!W%%4qB3}2w?Vv6MrTL z(~2ImV*@jLAqx-S04SXg9H!(c^m)M7XqyHlJ2>W&^#0Cb>u?{h1Luo8NV*tgL;9r;?m0WfQWH)eaK#)HwJ z-or!K%stnJU?O@taExb@p=r<0)+eBLST#7vg^4R#C-}I;9(yv=OxD5AGflsN&Tv_W#CY^#>X)zUOjaBQG_$25}4Q0*T&SDQJc8mR_1UOH0IuHrQecAOYY)uL)Ze4Ublh*S9g9mt8e}3&ZuQ{L0u?*c%qf(rsfl~dqdfJ^~ zak=7CH`c=z|6*;^SetJo=)=%ZdfQFUZ$N0$uuxBFOl;xi%M zeVJ4^zOSHDpJb&pmpFHhOVb%sdCnIS06u3}4D*e1Xbrj5dQyr1Us`%t7dcfNYqdK1 zo*UvEzwZXI)!ReF0q+Qj3-&>kE{FXLHL~Ba9Jk0a?q^brE*pEA-emk<4HU6>?TQ5tw1%_th zT*=%=EAJ`u^eYx&#fYG|#0CuH)FSpn7dnOA%@fN6YeCQmA~yQ#V=ApL#rK&>%`MIL zG5L4_U`X75Z2%_Y4o@$OH6_#-fkWuh$$UH82J93}juS~AJlEfKghDuS&VKzk@}C@7 zOdQH)Xq{nbC&~7FJ@+qGcBS{}f*4|djVNRVZTrCNw?085r%nuoQrgMhc`6};4F>%BP_lX?IV z7dSb1{!8DKCxE1(fWi`W7LjxUT6zu-VBt-_uVwRdm{Pbvw7p>QLtn2g<1Op3u6q~IkSgSy#x^DLTPGj?XgzL9g7 zxid2~d?X~TElgykG9JIDv3{rcb)x@{#K5?DAi)(PtY1trYdiO;8izD|WtQq4YO`&5#O{Y26282)oZ0w|aoUaSb zLC-KS^^j}M>(DwF84E?YzC+X0)fcgrf(l2}SxWLr=-Nlo&E5+5TlPkJ1C^o+O%rRy z$POT)$d_(}-N8J}XdDQ+I?A>lI+XJG9&QIu*gDYQoCW^^_;NjaUknQ;@_X}JOq9N( zQ_;|WvT=r;5|lRhUCXUJFq9^YcRLb6z z4L@&G0u6k(#}Tq(!*i~dDS#?hppAyZi$=(&!^Xo)>0xzzlpB-z%KSjmXrSxd*y$06 zj1)71a2f!Yhi;~f%Bt^~CD@uv`aM*AGzk4I~hoMMXF z6#xY~)ror0Wm~%qpPbvPW8+CxHBuJh79}mwvmy|qA>+~oJTpmPVtO8w$LjdzFB@G% ztO3IgeAStT#VMRyNlPkt0L*qc-f>YHcud`uXKKzbwvSS}UW>0>3k^rF|hsas&>TP#NFr z0|z1e(k;-#mCVR@7IaG|{aD@yTJW7mH;B4TIKHbj@pN0W1Ygc|4IA@r#^ph zSsJqr8@)+)9fO&Pm2wLUkmpF$>p=%MjJ-IT_lzZ1C(g-zD8;YxI!B_+Qduc^)9jEb zHNy6a%SL)s6#Wqt06h+mY!L~h5yRD)=A&43=1Ffx9l7@`ERyEZj!E7*HyJ$l{4zcC9)}0TGnj=<Cw^ELo2|9LWymkQogY#z(+@Rf`gCugIJQO_^YVF?IS&fM$9f zwnvEn;{6Z_yS2(<4$XgWzbBzF^Y%*VZHI1~FLhrSPnA~>SAlF6^8TNMA;_<(2I*q} z(d0n5i&*!ts^5zra+wX$;lc6dE(o;? z>OAQT8#8Fc9SBJB>LD&jREcDk; zAqD#t)7QU7q$TLF7d2imlLlyf@?RWPv+o#hBSvw4ZIkiTmk58DyJr6xMee)=`OW$J zH%OlaOj~KD!euq5U`C3VX5;8{$ji$-b340?==+2N6XX2v8QD-9#mLEc(+~=It4YWL z{2ZA1jZQ3UWtfN|uVihB%i60Sg;I(GdGjFw!Sv8UF}$}&KrxoPmE0)M00e`ukTvOo)FJr$>~#HjTWn&4#!npa z4z=&*W6dK`hP!Nd>`@EqT z&(z8D2*f_-@cF`J>FQfH%wvRaLIakOBN>vxKJ`#Z%t9=7dYhLI`)Wa)T`OIJlc5jG zJfPTef&fC%b8skfryy@~;+%A@H@6mQqC%FHC^&_!A^#K&S&0{Jz>AXDM2Oj_|abF;~8M}b50>7llkhWkM-S`l+Pp&k&S5V zYo5P=kpvL23Av22p~-hk1%BzBEK+17(K&lrdFKRmk!P(Eh#r&@kx>Jc682dK9>OIG zH%Sl!Y5eo&dW0gN0mF>9&itjJzlZZPi8%!CiJ$MR`b8J%_{E{6a;ZpkpY zI5MH%(OpxO0MCxdv@S4s<02vUuqRrVek@pj);D2Eb>7YT)P@pPVy92`D!&WnT@M{Y zh+p{0fg?!;j2`NgZ`p7nT7)E5e{cnA?=%oq+%69lw7cI%2+(eQF>)+o6tfYrEtARD zP3;ytJttVfuK-VEe<420+$S5dwX=G~yZ3-h;N*M87*C23Wik;bjra)X&5B%`C?MY( z&!1)&L8(tEx>d2*oJDjuueYLKuz;JC0`Oy|DFFkRFfQyH{=5E<(PjECU|IVSwd3hww2zZN{7CQl`h0B+jX_bXM7-t=W<;8ip*Je&i(9|9qs=`9BD(k_ofr3p0sK_Fck>pZKV2K!|AmKzo9iv=vM@ zuI8CaIUh(4*ONE-^%~n}YcfD^Kl-jseIfG<&(fh~dOoL4uMeuF;Gap-p>KU? zT%@0&i`>u+lu+;Q`d6ST?1<)KXCO$tiiWqXzW%RAHc$s30~)|6z;e%ISHN%bfypI- z6;{=tXj9U$pM7fw8nHg*A%Mf*-=*$|4&pu(_QD~yi$e+fMuf~4emTxWhq)%r(U_bC zJWyePmdloP)zdMjo*O5Q#aJ93$$x%ca8OQi8Fw@zOnlLu_){UgPi3~~Mbf|T1MyfeZ1c)Yn`f4rf%dZg;M;zHO&FQ3gJhjP^pym- zGNSe|2|5TUwfB#`z+NqgWBNM=VwBdg!{5_q)zgh-x^eWYNkW=Ir0H?hns<2Q(_E$# zEFz99mFRIQ7^Y+v#MRb*0W(g&SUy*S_V{KrCXVE>*zn|J3W*KYStvmOTl(^pSv-1X za>Iyi7Hcei$J!j5`a1ALg#~Rs@Gai6)YHwsGu&VPc4~cG$XLQbhF0JG1KyMXRPHj1 zOjxG3^t52Frx-`9NDwfeSj%KO^YUvw{f25nKECEd+->A?kbPR7FNU^+9+J>qJ5oWH zxS3H>j78PB$UFrrUH#&GtnbUx-r|Ch@VjfkhAXALf!HH4iLn2-|M*LIAOd6{h|>1W z(m{@V3L-uN>bD0!0iipDi!2}5_8a*r14^(1qsD#hmV6*b)Opl2@pPeEYmQOrB+5N2 zdy}fD?$_%;K!7K`iCFttr?6~Wo}Sh-WGoc9p#J2rw-#iACJf{EG9U!YFVu5dzDV-I zxVDX4Da@!34~@uh%dN=7OFtpUNw6&Jc$X-eA0_w-s4qa-#CLH9NtyuCV^<#SwVrlP zV=CRsXO4xozz%D4UBh!gS2p!=Tim8?WMG?g5aTUzl@cu_cLcWA@>;h=ZCFyadORmv z^PfW7SoS*E9rXiPVzzqJ+UWeB#6Kg`#xfiy_ltZc&*ZX>=o(BjG_ly9A1h9 zmsJp^)mtsuRZ2bMvhC}vq)^OSQ=xURPT7$Z35QaDdttfK6ZLkdsbnjelrr}Wo{*bV zLKSfLxH$6U-H|u=5eh2Z%3lZ3UTC!~8EK;M>Ba64tU7=zyVhhy=73@^8Q5&ed<8HX z@`)`pOvS^_+U;zk4EC{YYjqdxeSM_Exh+8z@@z4!ZiukQi%3|OktwUe$VRpE3(1N# z@AXDgEV21_#YDa?#W%){{?!=cKg{!8A?%U$K2~%9{vyalP<8`>&`?TKxHfXLJt&Wi zA8bkVqU!AM_>iK?wr)$v%g;{d#~R?k+qLHiu~}A@qRKiDdKXAI_1`FNagwkz2{U8# z!`6`OR!*i7I*E3%j7?l9NWIVpG60g4$uznapffA0bA99%!F0@Rly3S%3%iblvpO?x zUtZjDX!eD2^SOE=JL7)>>;sh}%*0=`iT!`VwB{MOi=vJmfg6A9J8@5(p9rWz$hTWo z=il#x=?=Ru&lA^@fT&K74<0)_S1xA@9E3a`C~X*>!{ubP|269WGZ^P)RVO`hAJ9^P z>DXODUv8*?nD1pKOyTVQsk%j~1~3KjhBN7gn3b0h;Uj^J%FN$e5VxJWW1-x50YL7lPG#mto(21#q^yoOLs78_PxN25 z z%ItyIrWY75tNf=vzp@Xzt%Og)#9{mj-)n`paHIbD<|DzC^+h@u({m- ztV#$iWD0a0tDUKrC_ZKjWMaAd4NFVho)5>}Aym}7D3K=-e!?gwzwW1IzDb;+puJS0 zBg@*an2HUGb0nbBOOj|H2)9DGE77&d^iD92q2XB&?FTr*(|SYgImJXoo|*Mef9?6I z4U*TP>iq`0is%^MabkpXl7|qsv%S-SS?NH$d^7gVRIoJl8_wtd-ETx~J(}2IzVBzn zf8;JT*Qkifz>B6py&q4ymk&7mN?{5fDu%xJCCquamB-Uzg92Cyicz;- z?5M;_5pwFTQ>0!8?a{5oD#C!Dw?$ZMvW~?Ihw!9J;$`^y%Nw)4n{(4XHK0c0&uNtY zWPJcu&3`hQBzr4h`1|)Cey9pMx^m`^AaMTn08PjateF2qRfD;{ej(EYLiobesdilq zcolC_z;8bkx>%h&CD_Kv0hiid$9yrAsGVKjXt(76@z$;MVqnHRUl)h3?M~6Z_=Vzc zZ;E;y+U`|2T+D@hJV=EJ2>90(c;s|7Tndn=JB7fz1@aDLPJ@>9fIN42%oen`?-R~nqXbgbE;&LG}o-&85yWg^MCnk@3S!$6kab4tJai4Uj=wJ9;&9@H3z7D z=vSd^?LW@-p0{{GCK@2@GA6%6Lh*kiwOz#Rys!8n#m&15Wnzp!P!f&!)~co^w>KLoe3U{o{t)?);1Pj7|8 z_DKmU`YMXN_Q@2!#abSU9LsW!_N1Fu#^`?&iW_7pU6;q6=e`?oB??S3J342slVzVN zki#O7?i3JCUDHq|Pa=STu)+TT_A&&(TzV)t(ONDO-zUPj`C_shBi?rUlZve?&PWF- z`27h};;Ts#d_2V-M`W)6{ToNp>wZ9a!JEa=*PA{3QUSd^d;7z4S6X|O8Me}A-=lCh z7v9NUED^a{vjA2*7ua|X$=LQ6VP0xjFjeLW!LHq1PIQJW-WO~J5Y`MG~%mqjpMnBZIHXO+WOFqGm8K3Bh`dM1^ zNT-7jpcRlsQKh~veD+&Ddt73YbLyeJxHfna=JKtloDz!+;)3r?T0?*+#q5nwpUio1R3x<2CV8TQzND%kur-nqfSE=<@ehech^bv&CZ)X{vcmEVjw3rQLzAQFg=Su!E_!j*(CF8W& z@ZvTM` zKJOarE1S;*P8=k>PJt~J5Hcu!aV6unPl}M?aNq8$)GfsGIo#MWzdCmUsu!0r2HhEn zQ}v+?yz71ME8mLP`8=bqi!R9{#udD2q*lN8JLEALwpE22G6H`&0;q2%SI{PfI8UE{ zxEw4cx9ad>zGG^7HT_i9>3F|Nz*tHUNN>V=}F<>Hgncq;5KqMq=d3P?Hy|5UF*5z1I~Hcgk?qL?R0zf_w6N)3hvi;F-BZ5)It_*85KpW z&O14xa{9VPF!m(YJQ*U#JgU8GoUJ7$l?xE7$W%DHO)!Ag87(OhlNkC)_-taM@*ErNh*?VKL^| zED9iiRElf99=rhrA6`njEt3+IdKsEm=d=-z=SX9}3iaC)P`P*|W740kl#2vMn1E-M z_2kX0dGOxQRH|Obv4GHJQbcfr0JHM`=~=Q#1-9@CuIg~o1h(?Q=fG~r^iY^K4Wfgj#Tr z5`I zn2+0%xP>cSiMqA4_wz6u@ z-hlW8DJ5M=(N$B`sNCYb5RL9Qxad}~*(}Sh3=QVJ{3=GRiiAhOxl(-oJE@q8lu%xlWf{$YQ?f;(}y9~xUijlMKFYBl|0dOu*S7mj1 zwOfwICIiCu@|G2}BKVK1@t~~^tCpktx{O(RruDVD{Q|?ySdT}2&@^`idgaqqwZT>$ zzRY_0JK-5#>Ws!^QkpVBZs|YAW=kd&*wi~9K0W-mV}Jp&`Yv~TrQNvxnJ~P4FdA06Mofj+7I|jZ8lFnR73f0+j^86e+>6DhEhwni5eJ zn9oeWFcj(W;quJHk%G zM2sXGQS-fKUcQ(kn0}QzXZxXk!Ai!ctE1pj>IGJXd-*SaFYM&=o#i)EvCkx|TyHM% zrLSF9X-t8gy~PQtFpqsfe_T0yw>Xc$dpze|HoQ)uLKu)y`B~@4S3uI)wO1v6y4ppi z5lJ-XL~b&&kA{tp%2=z}qZgy4Fj3j|(ZTYDHMOhS?naH+DlxlDOFQ^1w@z%=on(!> z3T57D)kWibX9*D4CnQNnGq@k)iP3HbStbV_!fkpPSdWf@(#A!VRU8=xbnag_ah~8|mCck96&sK_fY8ppQ2grr zL)250Z_d9jrnxj=I{$6(8R*Ce7kA*yz~A|<`vGP9+U>92p*{0x%j32G?U5+ zG{>^oBsDp&s=8{pO(IP-dtptaE|tqKBVRu;ym!V>WT;o{VWj6HR?w;j@SfFmbJ;LV zob|{Ujrgc!D1Ku8@H$>J8nb7)9GeHihW_2?6A%y&Y8!rIp8I>?XvX*Wx2&gQG&a#I zwlmUm5i@Kc(*iOpJ@<8+SOos2Ybe07+ByeDTxe)_({jQC+gk6puc~9Be-tf2|g>h`QVSg|K9l< z5@J*h)oG=8DU!s&_CbyX?vrydXjici{`&@7G%(8uQO+qOpP{(}J;0vDk9Y0GN4df{ z@~Is^49fzO)Pkd~hN)f;K@!Ykf0D`P#Ji7#^g#_3VNc}gLM;S0SPP6Ok&!SOrCp%^ z8B16|!WHPynA(R}<|yT@U5B#*5g~1u8ylR3Ntni@+{fp!9U&HhsYao|M zpnSK=F>ZjR2I1<13Rsnm9upIm68s6pihEWIeDER|(5u*;>uTjod7{tKR2|G|w!&m8hufVL_HY=a;qxn4#TFKqEC8d-@m}xDH)270Yh|$WK4bcC!#o(?8XbOO{bl^ReW+$_S^qc^pmfmKP{wu6u74w+J$}k@e zs}ULj@@c^Ma+Jo3FFzUz<}aWdE|^hQjnV=O*{HEF2(~c{v(sB!h2Z@alK!TWGvn{D z=#HcIE%r=ypJO1)4d@z%ho5|KY$REsczlQ+2_f@XZkA(VsjZqw>=of}dK|fs=SV(< zJ0LKC*WF>4z~rMx0az_h682W4j5l%1H92CZbH@(>EHFSZPZED(9OC5oUzb1(+)7K! zH>r{0lX0qo?)%fJXqiHhb%-_kzhbd+VS+K(6rjMmz@ab#5I_L8dwZ~YI1Y(H<%3}b z_T^x^2%&Sx)*yED>XaGOBu=fAo^2R1@3m}M>SK_NnIG;=`2T%*JaG}vf8n^MYk9r8--of zvoLnDcx>Kg1@0?$InzphyfGuAZ5+xu9t52FJh8vYkig}zAUpQJ#LH~EL$|wtF1GNd zNpxqMw|)Bdw3T}rp-PFViHu9Tl^|ZbUI?>cu%yIa;N8;~Lmvi-tBycDsMYx*Uoje` z(SS2{xAija{Z?#U>U^qfX}gszf?z&lW3(hy5t1GT!=G={G=by61B&|aKi%1;kChxH zv?^p(neS7!SFkj9Nxjw7s{oq>O*CovrncuzuJgk&7Eb~(Cs;0n#1qKYu&bYdyoLQ> z+zz{m%)x2}NC1u6P7W+RmMQ0)0yQj>U&vkJ5xBf;W!0cLLoGO^1WZe)=lCKD4vDZk zO3p9PV-2(bz2W<>-pXwKF!dVUc={@k}8z0{;$g0=C<2U7<(PG8HST?MTFl*U`|sh`M7f>$>1f$`}F zFerCIuKkG5w8v+?TAi+iWY!0*h0@UGALCWr#v~zwU~Clrd9E10in6&NdItXYp!~F8 zz?vumJ)HJ#r`z}KCP}7PvpJoDOOmVLGIS1@-KU+W53A#yS3yi_qu*+L>~3m#lMwq` z7k%l|h?o7PVc+kxPsnKSJ@)PVcNa#AGPk_jNk8mUc;#5HE5yn{(h&|?U5C7$pR+Dl zchN316KsF#h5CyF_P>Nzg7cbpL~Gc_;cvJEP4-?HJnh=5U367{z(f>lC>dN7NA)8H zeJaIz*YZlX#gdO52hJ^KJg(#_rf-7ZmF`F8BTi1@O^<3aFl_;cHsi&w%sR`2^wOxC z>gEZVz%+Oaaqt9h)k2p28?G@wqI9RF@ghx5WI}jF8kd9-@;iS{C5}~p%-5-^J-zbd zq6Lwfkc0yb@2ae++gxok$BFK2I!;fu-MQ3*fF_S2VeGj82m9_n0n-jrV2%G^0|`QU zU<^C2xELM7!5r$Rfan##a8Q0;FyPlJ<|`qm^PMN#W1QLDTJc$|1dlLF5ez0Z7OY(9 z1Qj;q-S{O@8%4h*_&QZh0&3Ki)Lyr(yXX1^`2u1Q&+KH0#qvIu5}dOoq~Ed(M;KJY z6g5zZ=%pfyQeSIZ_O+D^EQzD~@RJ%cC)Z>H!I6%jcFLVvOj-Hp)E07(Z2X$^`TmWh zU;I5=2z)6**4sS}4*&Z7p!9Yuz4H_~YCHTt6 zc5?}~7Xx-4o_~*(7;_<-G7*YQxVYd7n0eo1359-IOfX4sfQZ1f&cLF>uS^*W!NSU9 z#0(LiZS<*g(+j0GC<#cDL`RdJFAT?gZ%{q_RB{%I$*FH#gxmH|g-!ZAu3 zY-4zU0*+AJj!U@~yvgbI#*kG0LMIf|g7rX=5IG{cd^<)UM(@|28d{Z1vp4BSR8{-W z(~`|{pze#NJw%|n)3E*0&|joG(dh)PS4Wa@RR-eGI}=%v&30{YySyPJ(yE1mTd?kE zJHzNktGG@u(Uu-&Hi3ikh-Klkw0N@!;v_#clMC4Mqm0LM{owu#cQ-E2yW(c4@i!j0xZ|D< zHSNz$uSs)llbLuH9N?sr)D~1s@YA!(X|?iXK=YHH`{2Xe^^VJS{KJz(EXFbU{e+vc z4r7#TsJ(D1%35K?d#`X0CZ>2Safzs78wOFG% zSMx6`sY^LbU4Y;27N1Q!;|elT8-libgU9U)BXQP8#2bYs5|TU^)FRRyZ6CG$PvVDr z8rxRhVIDDn8was6{YswHeSehhMduO@65KlR$H%toZKuZ*J&eef)6{Y>&^53#oLgKM zO^qSKM@|Awin#B7nAWjKF4|6DuPVm31_%;yKZ8x**)da0Z*rSm}8im=K>OINL@>GeS+ zCo}B)&TL2T%xkQ~noYs+I?lj0dsW~hk={EMU{DZ`1I#^^cH47|ms@guRAxj1r z!>1<)+TIXKgH62vtBY*yA!l;p2yXv_(=LfXg5CSRTvbB+Y(G1`Dx{Y2Gn5K5wm3>?Qteo#N3qh3pTuJgzll=d(;U8W2baVzjiAw601rgs%I=SGF%Z3ZA?tA^S6-odVjNFi`2UWw%f1nPRf<+}KYTvxQXcQ%g?d-kdWKhHPWn^_jYh2V3GPp#jm5oh~CJdu<` zOKeco#N1-y;_}7c0J)1yWDrz2$h~9;U%uGJ<(-7^MT&u{UFK8hQ0_-;2+8yH!*+YnP)Rxm1d&<}bO2a`1a z{A1=QiYhon=~t+*WyQe(zX}XxOw9@SFZ7UZoK;>%yEt6m7^>#F%;4N%^-LsG%!waU zN@|ny+0Le_m0k7WH8r4t0x1zki3P_(!&j8z({OS8{oj9p?oImG%P#wWj38hrXb*Yq zBToo6aEJ4I6OnbF2t(A`J}KuOS`cW5q!8R*Wzs4|tReK_OP#A(FEFaA!waM6+fR0a z1cp@Oef~+m?o;V>RZ^H_RTP3E5-`PI=YtyBxSh^iV0XULna^g14%dZRW~%{#O>>)b z<|m4R_QZ`wwC`A=^qp1ndU!=IHnL^?_o_!fwY^Z)F+)Btzpg(yrAT2D9RRiM%0|(! z(lcq%5b+ZJVO52-k{gAB>Fa=fzQt;(p!EN-IGYeYL*}pYo2}>W&WIZzX zsE$|o3;1nn?C|1pj8zobd#{iZ$^TZxcb>8pR%b3Txp;0YF!6AwuX>IrP^E*}rW{Q zwkiXG@NMe(b#dwj<-%Fpq>SVK(qbyq-dwtf1=D;B*`ny18QzR3Bc9}AbR47Ff`}U5 z@zISJVNSV0slop-GJa+7axvLA+U+<7tDQj0HgjdYb{}Cy%Y>ru3iWLL&)51#hU(PE zM%sa~fe_xT5*3Q(e1CDYVB2oMa)(pSRg+)HNDA_A-qv>-F#whcCe8i%%&MH`=ToXh zz5LnxZp%LshX6a&h@z@#8-1TXV=rJ@cY6)r*=Z{NZSOI3wP`jVhqBi8pQg?CYuYD z%S?V~uB}pMEy>L9|>{vtazf9DieqjaP-P zmhwlf-o%t7?h(lHTq@7q1y_{Q7JNCqUU+GQ@`h)?7tBNW?+Cf%9gTJ^8w*G!ls&|; zD82;9~$=6BefjkJ~m8fzUY2%&z{2!}C3xnUrc zyN8mQ6VPEz#L-zV;Id1MVO3!TrL)2H0u({C=^6_L@;H+-@_&#ik-S*LXCsmj>Y7CA zN{zsAVo+B#V*2ro%gfpDrwNy~iPgMP+Ju9nA=t?iheCD_uTXZ$uoxVc#y&iFma)f*9_5_vD2YVB-=I^`@0I# zRq^_DP{fV2AW3Su3Kpo$Fr00HBlfe;H9}<0Q$?o;Nv&KA zK?rP(p^NtqVBn)x6W6SBgHjWDld&tkPwli$7bM=?-|B`hfk5z`dnXW>#3~O?rrW6` ztT;QtX#z2JvJZ%B76RXV7GQd-vzNT)e2Nn+W~TE3K(Ej zCPXlMzw;6k9^PZcH0fIc2fQuAfy3TRtmlh{y#cs~L|gIWP3w=7UFe0^m^k7T0#+0^ z!#(KCTEyl=_dD+m!+$!@#(fz=CbMJbV>BIk%7>-81b!xCtn?;fYr?m474N{q%+Ky| zq5a;2u~QDV+q$tip844f1`c-)M277n63wZd1eL~-Jq zLF4&6#>)Q4kY{du_It=n9kdlMs%4O~TZrst+sfHx2UXQ@uHSN_WBH$-IqxErk4;>x zkp9&6H`R2>{TPZSQPj0cE)(6wsHzb&*|EK}&kqDj#`YXU*&O1M;;HnW zpKLx00cK#E>^n@+V?=#3q)}z>I1kh;f+zD*`b8w7fS*_s6P)+nNnj>HOt(-n?Lne? zL_RDTSHrW30?JMz=E`DZmx5D_mlXlSwm7?+1zBMhcpEVh8;x=dt~wH_h*?3# zSP(^kk~m=Q09c;zL#zgSn_YBhDZ6r#xS}SqJy;m-TV?~~ft=XoZ%XRXq&9A#K3M=F z%U3=JIK~lf>GTLs!J4fNTczp2E6a=8M3kTd{SR6AWY~JF{ z8oZxdZpUJRONKD3uaM>#HGR-4HulRZB6kRjtwVW zBKY}RP)+Q^(%g751M-cgg`wFG zZfY4rp1YEmLmxpia)>;Cc2TCtnvz@aHhoRa_?W}$Wpf1#d!tjsX~V(Icr?rfqp9ft z(gi391icCx>E{hoKK;%4E_;-HHL0NTgYyLv4Zb%5pW}sYVgAB8rmG5e9DH1W82$+@ zYssPhpc2~S8OlXQ^C)UNp;IDf0Pv!%YhdYSkyA|apDecQ3GxE(>- zc=WFP;IYh~4Fyf{-CZE|6uLx_me~mWD6LeAw1r9KvlIef7pq3FV9I~0k}1pp+16W$ zTw}wg$rn?*+!V_nbdD_X`KNW|nAdRYb7B5C+ygqsOrHXAowA zVttfdnHgLCJ)rb{3Lm9L2+jBcdETdAeOtO*3Th1XdiZoM0s*|gDVeVbixX7ymyLDh_p=AHHl6AJd zBzd7?R|xShu>YdRoA!>njY*i}7r`p^y3b)L?yIIi%xD}L{vgI7` zV!y3iEyh#H)GqC$DhI33tk6LjXL2wCcEoc60M{;hFj*xa%4`U*j(@%xvK)XPLOu=T zGRDWV_imA)^d6V1s(7@bmrM@g;1^Kko9;>L_WjLtpbYmG05L$$zoeO6Y){~jRB)SJ z9Ar@BtK#%#pL~V{J^TB=GhF#&QvKXhi2Zto`DU|Pxy8_=?+F_bEW=@o1C!nB(Z=!@ z7m$`@dY5S73D1@|c1Lh|1INVD6K+R@tLivcD?mon%B`h-FK0#(F=4|)l`wvj@wVoC zvyflF{tn&$U-F^op}7op2giBatvvM1&bb1zOG8Nbou~HHSavG^u)CKH>|0Z(C~Q`O z&|^q2oMCeG*R?>|F-L9RoQmaA|Lz{(>pja-g>^0Ca#sO5)kpeBA?e+UAo!#!L0LDNx*Hacrz+gz$mu64$ zPa;* z|L0A{F|8t05u09Zndl=&drQ{}kz8CW8~wU6h47^E`|$H!dx>AgoPiq2!lmkiIpbrJ zM_5ErlqmA<-@h|UKQ6<8d(KoWHDsPvXIjP@Q!`}B$5aEqe!dS!`KW5TSxtf?cF8aQ zaH*_$v6~NBYQYVwoFi^W;4}YPq8M4gTl%d)BW03=y*>*9fyP}?M%*9S9{UMn1Dx9O zXBoiik^&T8|l%0<+=r?fedf+>h3ACnUAOhL% z5edtER$oYLz_UYF9A)jcn-K69I4TlI2=^TK7ejd#5|`34{|+?7%5OnR!Ebdqcgree@d6zfFNMCu{Ok$(t=KL7!>3YJ6E z#1Hn$zwyxDu0+o{Uvm7H!)uP{?_07zaz|e+8`fBMa0c5(N{aE1&S^JEwNrsc+UhJ1 z3SK9Ymjv_yAM+wVdw8`jYbGx#qFXpe(b#I6McYZ z&S-jQUnX~D_W&3v^9bxsy7pr?XgN4~@!~hAk z!Dp_K>FEhXm2(y*+dwFIjW7%w^?M8&rrSx_qGQSsu_yAGbKn7hnnJQ0l#!s4YqD+* zP^wCB`Ek(k9`D`y0U*Qo(N4s@JV zG|wJ7VQn^)UNRS_YI9g=e&&Sb+53y9&sgz-{9<1O_O zsd!;~1e%&f(H?brjUntX;w`YSjgeMA`L&rS3aEpOtJ!3zlI5#C-asn)MyQ#bM&k6g z&FXKZE4kDci>kVXWc;&N%jIcWpvGu%u&}Gd*Dn&>IDiNPX%f&6fJ#2I3ttAdoa`3Y zw6C+6=hhLJBR39me@)|VYlL9lF2i?(r3?<_hzkuLr=`b2B>EG)&|HP$rM>pCX1u_o zMSQib`n{a-DnSuuNf2dZ7#-ab}Od3Ct*U8ihD>RwN?l?U>d-q(kEi3Qo zIwGih#lQnM=MrI?g}pRU?g^-dGwr;S4=&0gCM6)Cx#}q)Uz(GGf@WNH#1TQviw_f%8_s4bwq5?=#8S15CfosbZ?Yw$Z ziIH=5q(NjQ+WD6L#=mkVGzZ0&A&nVsR~b(NH~nNPyhIm+&u5TNMT{XOqEzz(`w>nN z*%j;sWapHWgS~JKUH@HWo3u3-O#8YyV3$lD;~0nszlvPhtq}~{PA76xL*u1(>2I76 z9)anXDm*H^?bth0^vvm3ZpUOrF|94!5md0Z3(Uo3DVFkktlCy|P!3)4ltTj_>_@^V z=-Arn1%E2)y{P46%#pF`RIv*Tmm2la?5*p-8!v$HH7%6yTgB+hpH=&CsTbV!^GRc1 z1p45UQDS7DzDw?^mBbwKOdxHQ{Y~bytdKep6F0eXG9S+P*R(r3#V0e9PAUD5TPimc zt()kD5ckGju@dgQvDhmEnB#44Jc-SvFnSn_FgS>-_nXQ~QUvJhxQGK|7FZEvYJz!E zM{08b(*QbO@oda_(~a&v(4u`gGIm03?s3 zkn>hc5aT9+aob;qKKs$@7{gLfha!lBhm+NvsH^8S<-tds&77%y~AaYfmC&+cvfJkTA-|&mZs2)jL|j%+Ce6##1@7 zlywTce;*K5+3ZdAGiBqX`Hus+ae)AC(;4VW5B7mOw^PVL?F3!F!YCn|q z(-z3&gVQCnjNfA=Z9AC-uiyUpuf)#gj?G3%y=)GvAA@dBK-(t*2ob0684Tsq7Ao>s z0^|OMp4f|)Q?0s_Yx~d70R|-dcyP;*FW-0!b+-2u6>&leP1l^Ap2$$e%fI+jj_jWQ zat^j%=C+k>4tu-1iFOKTb8k;o`4Wvr98g;pcq*`s2tb{yRZy#oLKd}C*VSrbGo;0B zwDA=u0)npHC376#y??N;uqPJ{k31OFD3QSbe+(Mgh_+#~%cV~Za@PkfedKkteba~G z>DTC5^02w(k_AYnNOYXwnrpH|sq@foP`>09<)b3U$do4hW!ukp8SN}`T;}uw4dE_n z+xyF@e0pOW=(bFVN}0U`z-M&Xj-NTm&k_ zx2EW)Ly2JbNgaz#GKUlSbS9TESn&b*U+xz(fIZx`-HnR+b`J)f;zGBZvV_G35&?+(`@YGGpcSJWwHAPR(@EwXWcv-~%^*#&->1Hb1X>(9k*%I^ zUUgn5%E!Nr&hF{EL+Hw@fjpK6Y&-?Ke!-OYGQ`L$xOFmh!M_yn*`w}R#n6TksQ1;r z2zkwN4Eeb;wA54P-H@)x7X;W}2@clYYM=a`&FB^3#GC+OuL0z-*gYc^UsbHbvd+Af zvtg$s!2GPUryWby>hLpH&I%UUXU&|I|IevGbAv z0Vvsl*yCRfPsC*0{d@Y0>3lAChQ?;eZoEe-QMB?onVdk4b#JM!H+_d8-S;aby7 z&6`S>0IVUj>;8@6`v|*o&c9Sgk^k1c_vTJ5%wrgFw7|_W=aGGkQf(ybU_K_Yj6%8P z8_+J8rjA?Sc{$<$4XQ8O;(Er~mxN%j)!T})q+T&!^v^S242%6bdW+enf?GiaUskAa~XIW!0h;H8lj9{U2SylTiMtRl8CGC8;mF1 zXmYr{5FQ_|iIDxiA?K~hy(vJTI7#x@Udg2Qo!!kp^ze}-D6aM~Amz0O&*t956Px$U z$-Zi9IkPPI$Z-5_|OSUp1aXko~b1(NmE@(`NN45U!`*6F(lgQ>siZ#@QU)&W)J zNKwP-M8W!?V}@V39bu%B%iYg*Uf3$}T#;f(Jn)RgLONz!dn~rG9ce5Quk9y6{U08P zsH=Xu5el3gRCJAnye7Kl-BylkCvGEY=AJtKG2u5t#1l3)BVNTg$=;g&5Mwnp(hd~+ z2|4G=u7%Oeq=2a1*O=!oA4ZJ#YjxG1L`rf4S=*QKH*U3(?bi$`O?`N^yrwZlbRC#| z2%D?exihn!MI8awhjv` zi}nb0G~-XrNAIj5%8vPwj6_J#rWRfPtOYT}FItsLkvJX@LdmF{-&crt;1GH7e%$zJ zs7`#qNJu&A{@-Ul6+2S81n6wC0-LC!=_RQVNYU@Le#JM_VI%Tayk{C(5 zudu-1J=&cz6oJFV*X(VXR$3@i5AKFHW!7!NtWL(}Ql&8iDxUco@9>wrO{)ac2dJ!5 ziL7qA1Ni&47fGt**9>v~?Kz4!R zE6BKM9+%PNX(V7J@!BJz&gX>h=99TuX%7%5KBG+(&J)h3j(14@F13-+fe$%^@0{WC->AB~wLvwr9TezBonIM5a@JApJ1d~^FuEY-roOR zTM_Fu1~gRr4BtWctsggz|6hkOE08?Ktw5m=cRcS$_g&n$BI1*h?X>*@KP(!u;nun% zXE!boWlseA6MQ?20~)g56W*QHou?BX0Z$VSF6v}LWmXH$s;m*wpW6B}yV;%9)7(BJLJ{5Wskm zE~jJuS$1?Mj45iJO%G|&Z+|DbR9V+Z_iy}zRatgMs8J7Y6YDZ-Sc1&#MDPbsYn-+i z{aC#I*oY&2br0a-Yqlx-`g+PsST2F4p{ykd+dBG75WIX49$p67DG>t1c19F<0;ZygGp`lWTY(x zcjfmfFXLZ?K<3oZ_n`h?Rs_0uO%_(H2xS)P^QnVWN3?FnDSQ7K}wMUlx zo(xNCpq{VfCh|?eUA&B8eDAuB@TN^lwNS)2v|2>`zLjK+cycaZ@VoV9k-<0TIc?qOCP$LEY$wT0 z!g-StUYU5$CoqGPk3W|R5tuseaBk^{39y+t4#YPIz6(-o`$bqDolPY^61aaD>Nma~ zhQ*17DPjfK!XUm`bNz7Y zmU|F5>sscW{49>>4+Ho(Mv2r#jo~)6Sx0k9Mia~U00Ol7*$(EK*{EB(bAW1d@gdYk zySs6G8zSu-sHELSa%AcItCR7h0EMP0v{>8zBNvJ zqAGe>IaG`?OXP9hM&E5m1p!GW@CRFeDnhQ`E8RdWf<4jT(0huhNGh;p_R~RFZs;T*`Kwe=o$5FC8$(BcN7B{qj!mruS_pIVszVXR<-_nBJQK zk}N-Oh8}8_0LomW!BE8K=VmUykc>R6$PCxBQfGE+jh}a8L8w9==KN{rGJ{<%3#{mj zndkwtXv7?mtSUYfsl?_C=DxMjCG1JFCqJbLFMKMr5Hw!Mw1i=f?^SGJ6Jtmq)v3J- z0yj|~=xa>>x;&o`+)usqfPKhs*w3(PKm=ptWm)I!z-K$GMNtGrfq(ofp_ZK!T7-JVgaR%5gizuxBL?&87oHrh-s^jC7ivu=`;gz zqLeHfM0Fb_!?+01Eqi_u=f?Vw{@)w=Lkd1tP|&PrNUqgv^T~T(Mzqb_m+Ep<(CN<=s6#4G=di&w8zPevhHZRN0@-^z> zRlFucRD^xkc6}4#|B1||30JElH_Yz|Sn6R*iMZ3+b8+|4Uw z{SZ>}=wNI}q7F&cpqf()Y?yW{Rm=OQUk||G87_fkxX)h`Q;T6ZOLR8#%~CE$l@mo2 zmIh#LN4}|!BQbl#M*->hD#3o@T+pv^Ys5^8SP8W98ytvZ?^XO(XB$w1LQxW46=-Ox zX`8%$!7VIbP8#j4s?Au87 zHiE%w*WdSbXZX8q=laYz{dZV%3YVj%a>)7DnorClFvGjFMEikYS@|V^`hrMO#en~Q zRq#*r!49CrlJSmzVmG9Wl%~$N;CV?C20Zk~A5F0^{2gIpR_g$UqyJVU^RpV5NI&8| zBqI2!(HK-H4YOG4oi?KE{{*UPxIn7S7Rv;z9rND@l^f zib6}?z6mxM5iwBp-@3XfTj?m_IG*nLXGNHnz;Nz$Sp7ECZo|0Y)XfNl^?w!X`bqrC z8BvX)Qcel|QV-$9hxDVyAgKz_`G|pJ$XsvW%tnWfK7V~NZ1sp;7aOE`_uMS4 zq~`~{Ab`mkqm+v)E_+HXuRc^YkW?T5kF$&J!NR@GYl-6N(q~OFU&hl=Scz;^XZT6* zaNcZTstjD515<_f8Yc}2vL+!rDFsm));je>bG*}njAZ|6t;VDNk0vMTA5Ylxa?!kY zRs#YW*>MEN_rp)fn9D(0rZYSyRz)A2ROaMmC}Ax;larsWlfdhUOy8>P6m0O%D6B0~ zKp*|txEv?OHbxF3{QttKGi!iX(ZWDh1-QXx=%vUdpE)prUv8B03;gva${#=t>=HPK(X*A0tC9spcTp$#XY%Oe2|BYJMTO#S1-8OHG zlb@L(0oPFKWdwNxm0F|NDNIu9I+wk>d7!WFz$rv;*HnWLu&cJ_ zsTfs(eUsuQ6{{^k+6viPnB8ZCQy~r8elG5dgs&S!U^5zNAhCGD{Mb1taMrz*MH}D! zzNVMd3NTh~VIU5i2g>?g23!qb&qI*^+u(44F6UjQJnA4_$l;4fj-;`^3`N99H94uD z@;u4;zQEmBnP0yy0=hS8YH>)M#K;Dn&d+`AH_N`CO72p)x>5QwVzV}dx{hDS55Pby zrLaYVaxq@*>yzDU#@KhQ$pvUBX~sp`EX!nW_c0?-q=@#)ieONuPg)acRYZh#I|&}0 zPs*a!CkXXEp_6WwbW1oTFCC*!y#6#6F*Rn_sSPj8Vg9d*&C>z@t#HWpR77TZZl9Q> z;T~W5pA#^@WWt_^3Dkyv1L_I;Dqh$O5@eep+=IZ0XMy1jYccETaQOFZTCoZLV(WP)yUbut5(oN|TA;nvC3_ zgwrl~o?CpcqDd@m48?uXy{j{^nbNgcP{b26WYT?vLDzOZIk+>P#K@!N>&)Z1oq-F- zgT7ih>^}DS3*5ZrYK=~7j4*k@)o9A{KydLyz?0nrPlu*gnac3|)%@0wfrwX;C^E*G zP$$6t6ZEKOA;m!6&_VrZiZZ9UP|;}O*xiKEWYLcdFU92#)wNf#fzj>_(R9k9#D;<5 zV-WoS%E7=Vd}fCOQ@4Iwf6o3!8m8XN$qzjjLUPQO_?@LGnka#Y8u=JVns;3lo__0H zE7OyaRBr$&)zNp4`sIE%rPs5xZ}WiB<~^5O$JosA1JlHrC4VLAZCwglw5|?xw=xON z;8kzb`L6RNV{uHJ7M7qSQ#z-VjeK&N#NTuW|K7*ThX(ANgeheeKG+Mt)LipmRDVR! zhu+Uq%&q@F>ri?lq4@&6&f)zHB|4`AIJv+7jFjhQ`!+Q!7ycz6%)@KX#1O}BxJtb{ zj)r>3&u(VJZW74XJly9o+hIB)?<9PbwT)FLDUykmL{`-ZY3N4@3ONZ3N`A`TNG%cp z$@Wle*ps;V!fYSXQ@E0qZ)$#J5M=CS%Ewv%lOmTxv*SnIYA2=bcxF`Y>&^oXtUWaDc>0^;|NCmY_ z;?dpg&GsZrqNdgWgi*?jxgbgWA>8oKi4C!p9NqDdllKX9J`iUQQg(*E()=;kdu#!DMrBLnq}N>89g+9|5)58@Xb zF%#HSGO~~j7)SNDQ zTr`L@eomZquAmKr9mHwju6wz>`BUKIAtC}e&_W0nq=W%qUdX)TRlyUc%;gF8JbHmO zGV_exVu^lSF2~x4H3+MRkjhJ2_tJU8;mRNQR6ZXFGcfvHh`j%nSL}SWY`sCS&8pyE zhLR;q{y$eRm#d{6;`#cgc%da#ItyPFPKy;^Vpa~A{FNms45?0d6)PF zb~Y1NL{Yv0HrcKm!xiTe~pL**cDv)o)AH zHT;=DBTuc{!$e|!P*zBDNi=RT2*V^geLruSC{I(~S(!roSFeNG6feeli+%9Uv7f4* za^4u0Aw|bTRd469p|H8WOvmxz;1Wd!)XXB_5UY^SmZx=hDA{j#qV^4WacQb!c-Lpj z5%2celLY=4VsB;uslLG-Wb%6jp^TY(uKOGLM&kXZ=v=_(+NfYA{0aZpgbPTU_UkjT zpvjQpwrsnH;Hzn*tt3c5UQWOyW@>sMu*tzsG808#>+;*FWHvY9yPi!ulTHnHV$;uJ zt#+(&_>k(a$&8r|#JuW|%IYKb)D1H$*Mvz;W>kPw-}cl5LG4%R8TFOp= zP=@R_FK6?gZXusrt)AuGqm!u?Oc7f&P3&`!k*uacY#>)wOs+>;ra9g{F^T@brKmN_ z20tO!SizBE_a5}Yn}nrah=UQl_cb>( z^uS2y5y7Z1-l~08VC|oSNA@7#Pr&|FO7oqGDVG%z|* z^~1f%Bx9k%tGoVC^e0qxkni4<1mmd+ZA9?y=S!(_{;{>0z_jNb^vs8w#Z7|tufgD8 zAxDQ;Py?)|2^smk!?p(RHW511#&@|dORsL&buZD8IB`Wd=-7PqzH1*L+J4YBfRP3e zq>#(&Z`jz3gxBbNoE04`Go9_88T2Z+pT8oa&CNZKH#2+l#fpd*m-h$aqJq#ICjHha zw)d!_o-62i2l#XMEJ!2Pbyh+;*iPQf6Yz-JnsFF$3?JJqU6b{zJSDCDUvrtXv~>U3 ztHqES6RD^F+rNN*O6bNGu!&vHV1-byCi6wjAtr> zX&E#fN3fAEte?8dV`F29VvgHxZTxb&6NPsy0kBJ}Glp79saA7>9_ny$(IfgYm*e@Y z^IXQtS_N>3Hd)!`O1zc+!DKHpS))rIX2O=sp{UuFiU=ImyaekA=90!YJ5F56=wg-0 zK2UnNC^|9)tF7c_Rv4H69OY_yfQ$BLuL*+OgwvL=XWe;Re)(@eJAvE;3^*Vcf?ELi z1%}m$<2@Y$CJXLn)31#kK!xiGXt@T&t?#uGshIjhz~uMHWhs9tust%}qOQAloJ)^c zH6IB$iCCm;1!}1oZ?d6d(?ziCf~uMgZ~6$i#L(*2@UnoT%d%luT$t!j$}UE#eA)t? zWNkMS@JiRgyQifAbsQD5Q)d^F+iTD5wrJDnTRv>QD&l3$b+J4x5v<*;LAADJgzc1d z=Z91?a=qDl*dEV4q;H2;ytcA|BqB>cm-VK-V>Iz!Si`%jKh&&%1jQE(2K?F#BctsU zv$SxdqGGPjZX0>)A6DL8b0RD6IRLxZWJGE&Eo=Gz_>6duZ zFhNU=UDR-GzCn|0g;)>T^#kq+eAPc?VMW*r`Z{>r(XG-1P78YPma(92RphGx=fB$O zQle3qqp9Gqi)D!MFGK1EFxTP<;8FH^-x+LaogusdtC+}hF~1xXSLe{go9qdS{97%D zr|c2N)KFG8pax#^sL&-PhYa@7kN}Jb2bGlW?Y3ZO< zNEEmz>+PeCp~*L#4SK866R-xv|FLA?r=!KN+VP`C{B8ZP3y4_#tG`F=0?nlg%AB;? zyEVMY9Wy?5qXG!-YCJjc2{ew}_MkWIbRGb3oroD=N>6X$tT0W^rvL{lCnk&u+d64e zufj-Qe*thpx@c@Ds6BZhRQ9rOhQ~Z&rIxDX^!Y+!353!8?1ZD%m*-s9+pC+NOiWrH zdz)&sphkobHZ0GhW%;j*LUbBB?EH43H*KwCKr4QgruyiRuh*?1{n?^bP_R>2f50R`?hfK z*R5-s(Z1-}x_2xz=YPq2`3)-(tQ=Z<0sORMjhFW1Y`Vml2;2=$bfq zjVl7Dkl@u=ILjl4MI_IcMt{OJZry?BqXB1yFIJrQASeb6feCPL!d7nVsNWSL3=htL zT;8%^4g0Gds(4`^KTK9|n@CiS95(t%j=~JPW|G%(jB+u7LCqtAPXatsr!R!wNDynx zEAYOr<)n9@{@e4+ZHLGjL53pr0x7=j%PXqa7!QsN&_!#WW9^yj#7ME<%2I_pS!y@i zQp_sWQMHfrdxZ5#9{Y=Z0S9M*NG!cN-l)1CNeE^0>@9F&$fAvfw6?MOnHy5$F^9*= z{jqfdt{B7Zr-NGOPh>2QuF?MC=SPhmB!$u~(NGL<0gO=6dnSW%*9Vavq5AFcx?|CT z%scn6JMLdtv03}WPk4rFqgxbt|DcEME&XqNYUqJ!i;yGavHx^4*@2U@PpkSIox0FF zXF`JTK&bYZ*E5m~p#7W<3CW%@G~&L@!!u9SmEtE^DdZ%z|w@+3+6roR?LqqneThjEcm8Y7Qqk zCOyNoU-BNU*!n^j=^UZj?7S#4qYnf|7)vMMVeuElf6)YX3?|0W9MKm7ovV#bvKVW< zsnZQHfod#OKXY_N9;2ZEO`L|ge)S?b`!3%=>q0IM(c-1(i%3Eqg!?fM)5?Qb5RW75 zuBSBPQuG$KVcBe$kVq2l^A9o(ZGPqZ2(6pW12Y){x&+q}w1d`L^LftjlvdC&Q47`p zy8&|Mih8Yl(S&Wd=}Y?{OOoWKKteq&&x(^}Zw%}WhAA_?#W4}*KP{#eQq1&9jO9uu zm`Ip;@TJ-u+=-wPEoDMy-$eBKfAf(~wN8J}KG(Cx!ZeAd#Pdl) zo`g_W4=-=wZ+3OSKRe*eo10?;QEMT)O%rw%F;EdTe1{nWLEQhTJN4*R3^RV3)t~$Y zb!Ho``r`g9piC7qYD}LQ)#|NBRf^51a%Q9I-w7&bU`PX8vF6o&g)e70SlYxynJ^Qg z#Jtt|01B4_KK!CL>xODy45KU_-@W5$zkg8ieP1a`dm3?9j1er50nnC2M}ox|ku3*V zyzb;mw$sJQ7rZC7C#WKL-Y{~cBDn-Gazoj5DiHXct3M6f4Al)m#zKxRT!5_i%!H=14&iWd!ftcO0l&1F z_yB(hTeThqSl*5h!PX6#IdBqGBfptgy)mD9KlDEl#4dlm8R%yIaVKK1gX6X^;L4Hs;kYJJ?)xj=N>G!a165av9)w`)A5mQ+~n3=sEL>+evq3`pS@yjjy4z8op3 z-fkWLaj*DA#m65RiUW;rAb?i>#dK!eL7ZmMUH}HwG+LR1O!?#{(i3De=tm`1eqQXRfD2{-v-!W>tP|PC*@iX)_CZ(0~bl(hZ>mCU4G3 z4a{u|9On4*#mLv@5oSM{b0OFEto(EoLbKMON1ErOvyP+DVNwK1p{OeWdj97+^RN`; zg8)xdkP;p=Y%54GLyQoSZ2pmgHl-%i%|zNVAn94FUBiiJzo4^1;_Hjy&FfYC!DX|B zR0oTk{#Sx9?gGM+0SegiY9*1BstJYB&jaD^J$ei!Yk?4c&6|Biwau#_iyQlBswkB> zI{wOshvH0g35}4bC_R zzG1@PAms^N#;h^lE!1?-u?yJ~?#%v`L7O;X!PQUdME{_vG}` ziXj)jz_b`lB4?bx+!!25`O#O&E<>2}L%%5e?Pg|c2TVX{(OUGDNbdlG37Mhmtz6y|g#1iF>I!q`S;prR zIOFuSHplb=FSHpyhz*4B;nhi#a2l_d4OyM%rgzZ)<=Iqn>gxCSJ1dd=ArQl#c!jFz zie{uQzm9@PxB>MABL6`WKl7mO`wgoGr3 zL4Zv9vs*q@+k@NiwkzLVc&I>T2s*!aUaEb5%{SFY+1I?dV@D8-R-$)-u>VO=KA7Wm zneZXhR&FHB%--`6pK8`rm2exn4Kmi@wxU{w%{Z_M$Llmq$UQ7DOVL26P{HqWKV5eN z$3~({m&Lsls3uUZK3r+j50nr;J`sUvG$9}~gRBQ&pdph!f^&}tS1r}hJv1S+R8+-* z^md!sv!|CWR!9h45**}xann;4qX(OJA9L+x%gDe}K1~Qob$#ZG^_&C};nLR%#=HT6 z_h0b}Rl^&pnJKkE8uRWyEC2pY{~%G%vyNYl%t55pEhB-?Xp;#tL*rW2ebfAU}AisvHM(ySYR=?m7i6u2C(w}$l3 zb{IntI#GH`u%DZsA6Y5}@rYf_X$LN*`qdGrN}o-<z=BcvQ|tS zdlS4UlZwI*wQ`~jpUvQx2y~CtOb@Vjv_BPxQSn3EGdmNvfDae&pMWd_m=cx(+;vk*#I z8K~)0uQThJEw%1JPkw2x!5!CNXSi})+Z6gkq4{I}b$tnZQ#{6;efb0kGeo)rUF#N9 zHX{6n%(Rv>5sx?NcJLcGI)Pejof&@(ZIapB`~^-Av;ae6<_k-`UQ8sEN)j1B8t@QC ztOiDj_{F_DV7PkgB9-1vk)i!ULxn}i(87P{iwGg_zXJLQh^d{YgYs5LG{yuG^V2GX^-n|}_&wz3zkORxVD zGZ!5L_+-`L+`7woyfX~GaidNda;IC?j=ZsCH54wA%g)XNp6NWjuanE90f% zvb#E48R7hx+s7_{+Vg}ow2FTMdOf0-s6M+)M^s^S;~oY?JE~ z#*&-`{#>7rr8}dko4gtgsPx>89emD}3E|HK)JsP~^df;PbQ zcU@Jji(!oJFp2sHRrYei?GM_{)>RuthvLwl?k~~ec{g)Q>TDOi6hBFj&eYRNQIu^k zDhvIgpX;>jC>G^ba{8y~O{~-{zh1f@$t23bIaylm!W{E4jQ5kbp^4$`;zU3$9^=og zP^&OO_R{{|HM*ZI`Y#v``JrfBgAAfKKFM!GOG%AG>?6=!I~a0h9(!=`;#1bk$pdQc zSb|z(T$9}=wfC>NoYs<&$@M9+X(Ep@RNG3G?GZHY7)+54@2~%SbToAb9c_@E=1nOQ z)Nc%a;|z-|KZ0S07Fu`#$Uz8;D((}|2ZrC2d7_bu25i&YwW5Xbze66taiV== z^A1jrcXTvaw&^rdXP&w+^9ZKqfh%>lwq>zf3Uc1RcM87f3a4;OD~4_l@x&1z3Lq@- zT{PJcaqoW6dP_eQ4HzP(oEPH&(y0HRYIK#aN$Vc?p$&QlMBF24!m~EfhrS#d@Q+aa zio)mx(R0f^VdMWe7?~VVd3V2y0T0|U;zE383MQ=dyL-=_DNnh|IyX$ODrjk->*6B(!m%WYPy5;TdcL5|~@x z$`OrjU<0%F3J77gQ)j*p80CquDdvj5-jXr3;39;=1t(qDd`xF@E4!g%(ou1#p0{UH zempJ(R|Y0GhY;iZ(L2a-+8JVFAn|pZ_5qu2M=LWO3r*AD>*~%z+RR)i? z@@l-7B!aU<+RAz-v$uN-iOSy!vO^CLO3Rl^v4m7js@1w2_U^++QMLw1;g_NJy5@k) zeCPJ3H~i5S{`N1qhRys{%Cy~o@J`=`^sI4Z1D`^l4?Z(IBjmXJM-`GwN}1GoKIg~I z#`=)pSR@Jk$$=zeqrdYs~LYPFgyYg z-f3N=*9EfKFbO#i^o=K53E9k7j?-|qRsoceJ^rySkb#T;kf5SyDdCU_3_ zAK~FqIdrkSAzSUjhG%HQ#%NqR7i_q>{aDt&&Yfo5(jQ)31A$Gf`b9PmL*HK-c4XLj zlAzb=poy4O3KAhZ3Ytt%$OPBc&8|mI?lTccb{%N`1^C%-HojSz#BNj`cZEFFqNjeA zHU8=#ekZ9r`Q_06dp~9|EMrJ~>HHlgHx{7}V0O+u&3AS+1lpKr)=^}XEATv;k$ILFse9hITpgZI+UHM2N{9z{S1Uc2SzCO$r23D7 zN+I4}xmGJCm1;2W^q&P{-QG29#nJ3({dh;TONW0JT8yrKefR3U`AF+7-(KuQnc94h|$8Zyug*-EwH;Me+bg zQet^+fJe8#Tx2ZsC2u=iFK@$Ot%2(Vp4a?*3XO)ct_(xCY?(TO-$?XT5?zpfs@a*T ztuoKaK*drjl1R1|@xXzZFE9 zU(+?Pu$=YBqzV|5^-J2Gq>1%FJZ=(4iOUnR03 zTbszos&LGxYIQTNaJ&G7;YNNUAACebNTY3I!4g71G=TU-{7MF8Bx8?i`G(UMXMB}EmsIx-3uS*QAQReN z<@4(C<})50!+rMkY}R>n`?Lwu9Gh}^ntfM0Qx_rJ=5>AmZKwkI4*+S;qyEH8t@Psr zUa=4LHXexrcPKFTc`gi^#(~r133Sn&LxhybS&G@Pw>_}_)y9{GAKR{yKKIXAd~Xtq zvZi)z0h*QEPVJ^MkjL5|EFV&1S|gei)4SDRp1=JtvXaW03%6)Oy2m1JZE_;zEWStA{Kc0l?Ru#L z*ii4tB`d<2D0X~;HJrL#4Kkf)RtBJYUIcU(+@}!9z~@{4uj7klqJh@nGO5>u>Bk5+ zAo4CDxlri0qysNSFWWPID%&80gfI{jMiH(%rZ~l%*h-nHEaD^$kQ4(-{?gQw(aWF= z)n2#{m5>*zX7)Hw<6TOst0DzGo`$LWir(x{Zers8>g8yXx1`d66OpF?@FFOJUIdfC zBDR(aoxZhYq-nCx~Xd_3SQLUv`L;TbTbUCw?m@W!wn`5<=Z+0OBE;B@Yv z=ZA^VZ-OsFITi+&=0osBlr`q2Fh88L-%YMQKW1>hN|EEpYZ>^^a?Ce}$-HU7;i1g+ zy(o(*3sg#=oTt$2`^SDpUjkgE)8FXx_Uwb%fqm)5vC2D%fS^s^9*vYs%xA^0=y5{Q?$aHnJ)<_+6rmF7iqmi4KnXU+yEPMaylG ze!(CO@hV{R?s(z|3!;5r=f|wUMnF!Fb7#?u6&_HW{sO`Wt1j<}sJeo~j9P;SQd^t_ z`pjm)3yI#W<+OtEvda4YX2UQ%u_WHC`q*hU%!WbV&^hRi3V0I}I5wPqBZwPb+YSa( z)b9}Lx!Zj`HQnYIHqgip64S!2w#6*OE@qks3EROyU*=`u{hwd!Q>?d`C!kHH`0-NT zOR1`V91o_Er`!pFg7lYDz@Tq@jE|MsEtJ_KTe|%DXvtI9G3Ob6b(H0onnj}w^0HWo zLl2%Ez~x`6c9H7{w|uxRP(NE7Z#QSC--mwM&f>5{Ru_6hYVf&R4}Kg3i#_zGoWhAF zdU1ckJP3_Pde$Mi<3tve(_e#K;+H{~dW<1#w711}ioI3N(3ed;%DEp=&Bovi*)fLS z-DyYOg_~^WC1Yq~V*r>L>~8^q0lXf{^^nQLRa^4n=9Wm|9C*f5S=K&oNMf>cI;)Pu z*+`JLmz?Oo5u4K?b9bV~(V|{q7)W!l%cIRLl6u07yc~=WfTkM5xV*A$1T&S$pU3I~ zr1{$9WP62qNM>5n7!q*(zix~jOV>-W?LfgF+z0{Fg%X<6AZH*BEZ`VpFDjr{tDw$$ z=h&DB>zu;IiagBW6CKiL9#T9F@b^1WTHVs`XHMSi^gNy%`VwxltX-F<&OTmwd=(nrP|IQc{*644c z8zXoYCtUIFiR!N(PJ%EM5}Djv}=0kjN4wzDtk2Uus{rj`Km z%c!}u3Q~JVy|$`U#2mLvR_-2~r3{20l}*236n3Dci*ATvyRpM#=*US0B28Q<)PIQ@ zQqJMHE8l~_TUJk`xZe-xzWxK#5?coCoD2Q&EplIrx1T?0o5)Zw6+`S-SdO(25ryKp z1him#nLKveJ{^I`FXI>n-bA8F?8+I@Cl{C0=F8c@pJEN>d`j6;l6OXzY9lok__QRm z=1Czj4&HnfKF@ivYpw(jzp?WGDmZ7`-K>UE;TIgq$a4wL%XXb^zaU!j@iZsPQV1SA z)a^EA!FL4GsDu$neWSOELh8T+iuY@1<=4ZG6&IBkH0NqiqBEPYY|GaDh9V%v9ZGQI zKk??gJ?2bqE7A*^qsJ8X3{_t0K)5?SM48~v>gF5z^rAkl9p8^E@8>X*; zOhFHBgWr%_ZS2*|f{1|?;4oFvtdEF;AY%t7-^Yrs7=nwBKl6;>?i8SjbIf+SF?zUTsWfHD`L+h=j&U()9phmt zlj#g&>2GaM4va;{v~;W*7rEJOeyFZAbVDzO8hgYP=$H`y9p30~ad3W&;b13PkzbtU z8iO$gL<=Cg4-t^y$jk#?WDe4iw6^N-87NXo0Mah{GUbC$HVl0$P0H$%#Y! zgJ|PWg(BP8hSbrnC-RCUr7-%&Hi5b6Ri?Y25bMUOc|2^28y&`Fu)5gD+r>f-VO@@f zFwEAc2)oK-21FwL#|*qSI&PcG{9s*apuI9(4#q}2KBUReu^?92m=NCo>4j7JSba0d z;I;?oAfOu%okW21z?0XGZFTk%`89YZ|1;o8N_fVnX~0Zef)fk{8@$wzQ00A}smx<>#Sh#I}&8{SY-ly%j3VcP4+?1k{ z7+Z<~@3BKriHDgiMu{=0%&Tccd)?g|p`Msi8NL*wGg?9F0pvk6;pcj#dH zMA7N;5ilpG>hjP=j4YL&_1jM+_W^qU6Wg|azcM01AKm@7H9K6WcH79je1=V;X?Y;Y zb?(ylmuQU>dno*Ht`R@GS~{CEP{F@uQI^n1q@G{}HckV^YOz~ac!{u{3S>0t!e7ci z+Sa(xM7~o!f?v!_4H6bw`{KRU);dM+Os9%AbHiQHvb@kw;2MV9ZvqN{yCK{MzWjx< zjIe8c2huYWZ}jf!)A4F`BN<(%X~G-+w`X0qNEEmO)sZAJG9`;kQ#acE1(7}?LS_#j zSVUIPDZ<+Hu6Ql4u~^N|!IQVxsl0ms3KQYet3S?=$8K&kysxL17%?7ZB3$-rlEzr> z-pY=>(B8F+s*5_WMmxJ)-I2!|oh48*QVQ@tk2YSdXw#p>YB9aQKx}+>d@D3uTyUJ+ z#rnJWxg!P>42S^K1^_o;WMR?ZPfE_D1>;8kwRf9QEq^b+F=Hh4<_!=~;ypj$3I0)7 z>5?T{BLP#e=-&D7zX-wjtM18H;rjhXLQgP0SWjl>2vj3sa&7++BPfK84oD`Oq{{VV z!Op!y1s*?*<)gASn_de`rKHSg=RwnZwU0u(zvC;NXZ1zF>CiwXPaOH>g&_~Kn+DhX z0O6Ewa=h`)oY!4PNM;^Dft|$hlPMWN221HHtbq)(Fc@Q8E>223 z(UujzT6LcygHr9(Y*7ykPuIqoajyjqa544g6)*GE z58lj}EGOi^ap>bGjk#Dx*PoL9&GY`*NrQpF6!e-!H z0#c(#sQ2{sQjm5{Hb^4DX=Opm&xRWv#^Q$XdRSVrwDQXinl5mHvi(K8xS1V0-d?CI048w)rZe#CbFykyN_Vd#gn&Y{YwZ)~ z3QjvMr|bL-$DKasLt_9O5RgUOabULp#ok)t-TLp~FeH|E@%;2%4U>aN42c&H%cjZ; zxj8_a!D%5GJ00G$Nzq-7Kwacjqw41>{(9gSU$Wae;VNTELt|4T6vcO$@!}H7!nqJS zW}4>RGqS-0_nW!oGfzHVSI-}fc@VY?V37g$Cd3CX!kEkND=@(9Zq3vzItZ)D9l=ng zge$cJj~Rh$q-hm3)~0TD;1xkD5sVz)@Pw~%+tSqk$y29IR7mQq%!!$`D!l4(S9J@Z z{nLlF)MtD#sq$closF-g>|;p(2FaN4#(qSw;qyJy%a-O3qP-V#Dtb(P3c*zu!r=&G z@K^8aI%enWe|5hQz()J5rZKol##?*Nc=GeI>t zQT)q?V#-qJEcW8BFSr($L^5$Wq%UWZ^HK{+Ud#eJ;L$ew=bc1@Lf?no7XXabS6Id{ zepE~w5965gUSpjT*sUyBV88=Ve_-whr)5wL=59L4#oS-o?DAe8-DV4_6=2JA2>%iq zbi%YooYZ?a@R8^}oxpAhk`AVFi=(D!#?{QZ-wqAEZ?Cexo?(S6684yrjDc#iP9IMg znrK>qZZ?WABbK*9sl$$yPdBT%(A})sWp39Bn;K@n-VD91L`oeyH;z4<*`2i^!_&c7 z{_YXLCII2iCOhjMu$e_Xg)N0snedVPp?@0JHM6V9RvE;pp{W0QI2f*J_+Yn|dm8A~ zl#>QyiV`SPP(2LkQ^&1#>?q;I6cT%B19~~rMo{f)Nr+I^?#H#Fd+AgqL{d4&^EkC{ z2u57}U_N{Wx7E2Y)+cOKtm_H|_;@I)k8;w_ zLZ`^YS0mU@AvtgC3IKrv$Pg0P2}|u^w5$JsGXz4rv56f%6kvfPqP@jhlbCzdUFL=v zM1Fw76XQ_C#a;DXQyy$Hsw>FSQQ^dv*?dRoa?w1k&#b!EVYEbtzN=3({=zAeGlXGA|u1mBF+ z*q87o#`3@;xBeE?F-J?k>G{5n)PDAD6cGbZ+DBWqTA8&i!%kc9`y6a0HG4R(uyho(#8?e_;^tO>r(h=zI2$2;0ErB>Z2d1!)B(#)hG}$fp){4?2h@?E$`D^0 zp0K(O_9f7HVG70~uo@>!yjBH-w4adY29qkztUT%?ox374kesdAPLbuy_)u32MR`In#am9i)XQ2f52()gLs<*K_+uVe2&+5_m z*f=CjABUBbtUizVq59JB>`GCtjt4_gpZCOQ!DHaXitZJLK*mm1bC4CKD$o}ndE!az z-t?}a|1Yo|uM1yOg`p&el?B9Hkh+Y6QOvZ05&D&l4qjL#A=<32#_oinl0yjag&-aW zEU*5-KH5d})Fh*MV2Y!SJaa0qqMNnG|dc*3T9w36M46Z4u5H*Vd0_? zw}h2u8T9yZ^CU7tuYzjEHWeQ~0=DjA&4*ag^BH_`&DF=SyR+L~IBh#p6TYqth*LTv z$bJFhMI|AoU$pN8@%)SQgZSnCWHy-o&%Vki#J-J6Kno@)TtathY`)CV7`Xl#e3w}QI~ zhAE=WU>*e{9%8v{*Uh%NsObsvOd4ZGyQ^e!dYjAqPYQ5Q<|}@{{{oajYhiN`qRUtb z15Dn<$0bMSSnWYA4G`J;4%5~KDB^M#AH`(n7FVZtPwFmf*rG+i;KmVXifSnr7}5Eh z;d?Rpr@V}v90~KpkvG=@*A>CwRSC`l&a+entB?lvXoeyLSUwqam-T_uk z-E<;xoyRoFS{iDznBSe=-R$9ty{p;jOR0GzkpWk+CvLlXv?#|YJUm~P^4{`7uncft zjtA!}%Khx1&GLlo;&sJL?HokQQ41SERRnZmc5*(B>CUN_rdH-ROk(-MoE)QEX8J<1O(^+EI z$f%Th4X>w}KEQo8e^UmYG%N{mGe5)KljVNT`Ju+*NTWAh4aa<*C8W4!Cv}2r6g}5l zFG@b%3%2ZL3`bbevxCURmFtgVx97FKbJ|vawS7(I7lh8G0`2)S2bTVO2BtT_m3ZDV zfoCEE_*Q9c)TvKFw?a2ev@5HO)rTPfKej_r@z(Eeh4l1^sy}mmaIL7JOV0b6vj;dI zKzVC30*5zMQ32Q`HS14cnco~}R~A(g%ZHm5L0%TkiKy&a@tqt{m9~H-2(t(8>SWaT zFGY?>y)ONyj#scrVo`dfGoL$METzhK_i7Vk^V=)VWic>7MdKPFSh>>DMD$V(LD)8M zW5_=fO!$)C4Dc}Ior(4n{M)EwVFB}r>702)JPN`loa7$bPB|p@AuI)4&Lqy zbXq#cOU<&Q3BAN^FI!MYt4N`blvYBF8_PqW5#XSkRDx^tJ0?-7mdO3nK!hU_F)MD2!7?NF@Z}h7RtNUH?;Pon%>>!mVaf zJ71Z2aP0scnAL#8EPwblzLzn$JBsw~Vm~FW?x&Ri0l8hv zP=i=Md1)kWNDLBxrTznxwQXJti{3_Wx)Q9SlaM)hFu}sU^{(G82>1Ygas6y+9w5&4k7L!O_DAe%xS2WY{0(P{ zucF%7dekB@=pkDbyM&3EJs;uWQX0TEt#>`3n=*5IOwBfa zOOR+JZ2?^XAXNJ#+Lcw^yt^`{tB4WoWl12|;^)@s9s%{V(HT(#*`C z?iq?j8VNj>C_UK4R@^v~3E*P7$V=(?x8@^1A7tHzJ{Tiy(Xx1hG9(nhR{o+Z1pEGp zpAFv*S?S+%N^SYnouC@$SuMuC(T)0y}Eay5jXUo?NCZtXumWUE9PY0>vU&IGikea`wB?%{jIKjC=(eH0aq znw1Xl648D;AprztT`izZ0W!IG&&~gFR4(ch$pw3UKv@GeDv}1Uj6!iVvvEan>i0iy zlQ9xCuT4Mew~shMTl@)kc-W97@|YcwSg^X zU#{*gg4vk-J*7m&s!`9iBDtaOjmF?mi}h}~-B%Xgy!Cb;!d^Zp{#a(7dhxuN;*(U* z=5Z?_lu3G)z3|3?d+^O7ji&9<%xzoK;?2yK-K^!PQ$IZMoN@XSS5~+?zx9C@+u=Li zqYVq=Q{WUid9UD%xxpt6_{raagfyQ@f(_x-dq_P}m?~Y1q~FKmz6ojrG+`)=#Bb-i z{GL#5y_mtE1_v<9VbOnvim~uZJm`O^ID+JZiU0s;BmN!$nK-`n<^6)vSHJ$7wY3cP zAILJx<&s#={C96!BO#M;^0JW0Zvx#}`l)?S3asqf5ZqZ@8sa45zNx3I26)8Q^$(XU zR5u@i!}B1Hp#AS8sHdWqT#anj6V@-{GK~TG@FF%QG)3y6rE3eGYe%ZC1tswW2=t=Cx z{s-Wr;#e1tfDjo^e+oh=xZ#&P*!pVfta!1%Fr>a(pebXCIXuVnn_Kg_U8w#eqmrs# zn*y!AmsYK3G@Fq7R6#2!4#m+4(1plX)J)weI2F^IN+#1lSkAPw40bJN`^v(*F+{$2 zqC|4nm}_a$C?o}r$0HN;{yy`U8j2(J-sDyl-7~XbJo^LdUwlV?_r;Tv_T)Zg4s==b zP66{6LsN7c++xtNkGic;FfAY7gQ+E;CW1$(fBH}hgEW97kA3_tn{WRs@KuT0Lpb*F zr$tYcTQZqCf3Hu}&~}G~yXEvHAF$&>VcAMek^}D%BpO)n-3i+Lf1R;^4-a31eh?yIRX zlxXn2?{R;zJ-{=qmTx-O+LtuyAo8InQ6SpkGZNhn*Q`&T3;)jwh=0T^LGf<#Cz655QUrbLo{1}gr< ze(}}~KfQaQOy};gQmudOYfaxf6x%>o{~K_+L_LC#I@`=pOVh9a_|-(3jDm6Q1Z?-8 zN7nezBaFeTuhU-U?sF~Ktkni(i&BmGi|KRgPW%8p{HM>yqYgrmBoBdMlHw;W)6jKx zw$8jJi__xah?A+qWA$RW0K6i2yy!R*ck(}06_W*y{SQ0LfiRO>`=J1c)K@CSRjUQ; zBW+zXUhWH|<`^JVYAg(;Yd+pU%8d~S>XI63Ni3qFp;#5ax}S75b39pXfKLJR3cSV; z$oH+={??km<-gh3MAB4=a*OajpzCa6%$fuRS%Si$>i7paCtuPLG#Jns|Ir=X+&_qJAnMm1~2I9x|1DbACw)|2ALlbW#MfQ z`U?aQ4!^W$o#;dVYiP87g=ws!uQ}w1%fT}5XlMc=2={~xNbvrdsN3p>*yLo~fywKB zgpWzqR(mj4ukNhFlT*BVR2JwscV2ZwPnmEqwyBgRW~Rv%ixm{CyF-IH0c@cUhic7_ zbVhz@XtoP4LF^0TGV^Pd_10yS z$0gW?IZu4+VkTANIGGMY*4I_{MFX~RH<6?fAMVs8I5)+Zrg5Lto?m9E@$QKlcng1m zr>dX{Y0X|FZWokTCawX+HMitw7;ecRBg*rA_9q# z6o9I6S=^z89fyM%oykfQiLyA8z0j=5cLpa5G5;9WQ=WZBZ;65poO;Y@+jk4kxrrf4|olz&}O9xF*^)o%cbQt#ju^iX;_$j&2i zp~}qPpUZ7J73Wm3{q(q1T>8gr#P(N5Y!gV;go4S>as`mM`VMjrg7_q$&P2bj1>(W? z`$2^lHMSkL9Xp=@C>x?$0Em-^DutGIXyJwWFPtGc(O`G(I+t9|b$U<|xJW&dGv z*Ju8Dz1j1ehzFYUk59zG9dpHn8naLtTe8?bB$O_ai2OT7jQ-wbxguLodDP_65#EyH z3`GNGX!7!~C1m`X?YM2JBr7Wfa#;9*p~>q8NAWhzkZiUpB{XRJY+&w1#xaHIm;`gp z4WZ+^bun4YCZ@9yW4eGhAi2wV5eLXihXs`Vlj<?r|(={jhlwL`}&E~KoKh5qpbEY<7MsIB9~A5cZZCx#_^S(CCcm2 zu06*R*&4H8zm(f>DXz&<^CV@R;?G3O%dOE!X_bW^ zU1iY5P}-r;VWH`Q#9H^J7Q99;gLzB0xLMcM{6onC$zT{M;r`@E5$J>K%G~9O*_Tx9fLi!?HK%fviECSWfi^j-0^tJnWX#A&C(gI;^e}<~ra_ zs*DjZ$^=hU0JK^5mbB{SGO$c@5&SKU2ez~|*(siuDZ?ViL&0zi2<3hV8^u)#t)oP? zIAT62IGMfd$SV|60ZY&@VdCm*doZ@m^UF)c44d zpr|nm_7=n~m+n}oG+tB;Pc0~u0JDMl9_LXm}yBqR=fkjKw zsK#OiKCr$g5UlNRz_{SreblOvB%>APYG^4#On>O%M~?XfNe-Q(`Mk;!A@ zh)dt5s|x)1F{)fv%D9(`JEG3snYWOCf}1NmULm^+YQIYf-tRZK$P+Jj0MMzuK1%u-IX2^>W zEP}fNJ)*q6@9OT=LwWGNue-W&_tLl~AcOX!{c54ul}>?&B|mrk9mo3g10C-3?%)cG zy2oQjxcnTrEz^s39F3%_jCk8_+gQuzHr>lLZaw{qt?ubQ{CKJ$wg4)B^tV5I5l&D1 zs`VBQ_2%6*s1M0(Fho2Fag~Q=E5UMzLs$rw5x~uymVMA&a zR?mHd&K}ou(_&E>Rkl!<~lQ&0vz7Q^nr0a67{%X&L0}c%d zFr(c0p-i8mV_^BMKCwXqM~ZzbM|5c5eKIy-q2amP3NEGQtZ!pxa@YO?9<~(>WadgN zSzEzkuV@HlLesVY9?S!IZdz7GLsz@I4u9cvpWhzbG#wCU`}g?;lb-kAF&ayI-9=A9 zuCIG{0&q(qOZ32TI0kU#CC%EI;nGzC<@WtAiKt?!WO79_l-Nmmn7KVh+=IlIv|)4! z9!H+I;cB!<4~~L}q?r>zshxb;k%p-?%LQz%Q(OM6Fkd|ZkLFyns~ip9?GowSY-+h`BXg9v5FGl^9jRdPwUxEXi~}Kt(`5W3oXS zcC>nSF>eJr1>`2o8d8s--`mgFHYVP}7sNSLGC_4l=-B%-Y`b+~t!KmVrOQN6Y2)jn z#}UG2{qQRw{$*!9*>bQrZId%sf2=CL*}35pc`D+$3`V|JO#rfm0;I=CR(1!9c?F_Ifb9= z3DHb1N!`&tHzs8eeR}f*2!0n4>`?9aV%7#|VpSuo_|vwAYOc3i#2?~&8+aWVQ+sDN z0|kQSiFUFD`vX{{9XseTpLCA~(Kaxp?}V*Gt@E!Bwx`MLhXy*kfxgLUS=eOEOMhC$ z8_coU4@adcF+B7l%E50MU@7E^RQ_pyA_FyzXJ=n;ygWOu$?2VtZEXn?I0vq) z^pQh${oq~w8+#M|YW%x=x3ZbelfLS+i}A+FNR(V zawc&3f4)0((VkAQT0DvUah*e?T>nXgMVnwy=2p1#4zWE#BD;d{_L*ekJ)V#M3Z}BM zd}-o%`yJC$Qa7MH96y)B+@r+Iz+DtjTW4y^*utxL)&b1=BuC6(mM9yP)a&O9;2#9S zava0JrUiFHA(K}uhM3~-K+1|m2%|NyuM`towi9l^J2hImrQ-a>I!pr|*|KJ)Nw4l)#j>vre-ct1??VsuCj2 z&^3w&0=*xEMBwDa(G~uU0#Y>a+nFv6)lPMFSOm5N>cPBC8R{R4jJo6bRdieCrb?>ZiGbnTyj@ z^-0?ee@9GT)HMl?kiL0&qRxv_T40bA44POKZ!kP`iM#%D@ep>K&?2@FId~KeDDnb(5`i2zRRhv+F7x`hzG7Vv z(kO$UGF0&ib8%sn;(N_O3DS*Ip%-;`^}y>%2;;^}@NW!-={4>k5gnoqx2s5WoVA@E zD;imT3))L{Kag13)YoO`#_ZND26C&xIhlT=uIl5fxGe;mfM{Oc2he%I7ZB|th-BGF z$*aRx@mf0w6(b~^%aaBI(TKn@pjX>FL~z&q$o}$5v0N1UcqX3HIW4Tk&YbG)L18AY zkC2c+EFv)8%_A(0OI*M(pfs!?VmMPv`#-}ovfxjHCLz8VR@@IPC!3iH_>8_|i9a9Z z;*n>uA2n}PA|1_cuyDuzdZLyD4rTul2SI4vM~G}-DTPmCY)>Aw zWb8x;dYcPYxy~!MH+c6%C7AYrN4NeM%ZaN9N%0THI|VU>G7(wb!qM*!k&TZQB;RHA za;^FDUDoOeWXu5N`MYxCrzxHi3*-YO97wNOnQsZlFLz+%6AQ^#I^U70wXHb`Cmt5s&N^kBFb&y|g`Hp=hcvY{wEoe0b9CAQudRSSv0Y zdSo7xO=UfG+!(N!v9TlcKFq1PRTWuX^%>A<%!5xW5~RLsc`C+y*!{o1;h?Nz<|LN} z@s(UMa>-EsaL0k9nU)i(joR}5&%#FO#3r$w1`}hYTp)=brA_cTf%?of&bIBCw#C?< zu(8OQJn&k${$LBan|~#)&`C|xw*Lyi8{O3jHOBBZr%5m+v|E7m>#ID_EcuPOO6@>F z6Y+_SR)95pf1@QKoY7*JAjMVSg7{yZo+yZHBJsY<+J)L&*VSpaL^Ry+=Ez-JzS^kE z95M6AP+Z4_n}kP=0yr{vFW&8-H9VZ5WVux!k&wJjV}LA?TaS~t2Zv-~jf_O0=q3Na%hO|onDwyo zE^k>n61E%}B*zk|R4fE%xXj=$S~2GA7HHzsBK&u`9}n*Lmv8E;!@qKj;<>-=U1m2q zuJGCFL`)DoXK=Hxf7higtt=;#>vZlgzXIM+Cb#Q=ytn>8w` z=BIv_<1&Yl)9YI-`f}bfUyW!gEt%MEPT;vb?R1|Eq-a#vO}bC_&FBp`jox+BU(QYK z&7mwuZfhgA+}PlLRD3r*3{HO5Z*?zu1UpbF>B<7AGmevw93UZ=d$147iD#mNnL4E+ zkcKkIc}ofVN6o4HHj9j&S|P-W%4k!O8TUO232XQALoAf7u`az@`CMOFo=ip4{r29S z(`{?H7`F-KUxvT+1YXn)t}Neye*T!x;WG2H?jz{ZP0T?)f{-8cQBml(%}hkq@Xktm zGUX$``Rz)Yhk}IL%tZ70-Tq5Rge5X0Ydm5TvR8Ee*y)poxy5fAbN}tYg( z2mjlk+U_E&F)1LU&I%G=f#UnM7^`9t!6gvggt``32T?PU-&T?F;j(6u!owLta){_mNwsVhaA;$X32w<(xZp zYu3|0{@pr5@DFqjAYH|s<79f4>&|jbaNfv7NnAIF;2N z){V3h6Jt9|9dX-=!-^+GqSQTHQ_MzgsS!wiDBmJe$hsse`dS9{kV$909XBeHn8>{7rVv+NHGdeo9SU3@8lQ5r1#9l zzeJS`9bRQsD$akvEw{NYCP!m`;l>U(lEO1ir5(8=Q7d`{1c!Qs$*QAQArn^C{m>X} zenOM&*c)}i>M3^f`#kCPYZ1)qTcpm+#wFo*?cPN1{hTLltN*Uy(n!o4OG~of(fyTu zCJKU@a}yjIg5X3O*D<}i$0k^68E!^kgR`~o2JdYFmx+f7_P<{joo2nead=hPr5L>( z0$uu_a$fr$2}?W0Z-Yb|&!}O0(BL9b1ZugVnY_YwA!S*Vu;&^pTjcb9=o)qc1_#dC zwdvZ>d|4G2sSUA9BxD$%3lxi#`_^|A8eDA6HQ1{%oj{#N?T9R~|snp}&TJIexH$nqewRWZ+b-nNgy3b(YD zdNa3&x{>wU)d`bsGuEqTUnIZqt2Dpj6L5viYOb}id#R0Fzb#9c znC$ab^~^03-J3Qe8;TJig9~uQ@Rpul8MMw|n^b?xYpp~OXMo+#LiIyiWlgqgmg1ah)vY{F>{qk$Ww=0x3 z(%Q<463X}WkKG+%F>ZJ-JzEKA`%lN7D&Y&cWPJ?*BNY>Cf<+f<^}4%bR5vwKJ#xTO znhx8H(AZ6X^G{p&O6cGe%juFJPgm+9M3TX#0H1Bn9>#{*xt4=~xGk+0=QKv|fIzoZ zPh`xe1x(0u&+s1a?-hyFm}I1&&hpfWI*t9PQKqjFxTG11P?y5GgOB)5_p#Ch7rGHvX4EPnLD}e}*{QSspuSP1F86hy_eGv#yMlff{04f0C9S zja1l{W*V*pFOeQ#1CrmCnTx63$}s0*w_#|)@le4!)9?kaMz&I`xH6)BH=dMpUK}nQ;mR^>uP* zfFPbjiZ5<{F?|?g=0j5KFp}dm_(a&=56BE_rmBv?7gLB%aeQt{jJ}KWD?6w_G`i!; z{=neJKS|LFGceeNZB)il#Hlhy!ss5_f?ybMDwaF2_hqazBTi1)jkh%2aA zHM6-oe4~NbysGZ8e<0j%gO()U1F;j~@D%c!oCIR|{>%*uS0xb!AbpO>zjJ^8WKY{5 z7kgN0e4ZNDJonGu_Yz_ICewP_QIW}x!RH#>tscNSxFZ!I>W*mtvEbui-~I+nIQ1A* zK)QcI_Cyu9^V&^EFBh?oo>$R>c!VF0%$S2FDQSMS>b6G&K~@y>pMhNQ?nX zj~H)Xqc~kZRy^Cq5T@@ULjGEF<3#(6t7Q7YfviPUX>f3?$bY` zbb`h#ni=-}1MF#=^GpsgW%R}e$je~1-4McyNpxqp-L|+MIU7iBl8gg7?`mjXj3bqc zWNA?g2?^jTpTrBz9Pp8ARjUkwkh%IoJ|AFh&vv6 zg39vf=y7)x5SqTs6<^fg9NFT@$F4h#fup)d_bVlL)EMJ1kc7C23J07}E?K+Qesbxi zs}DeVz_u(d3XkOnu>cNKA=;P0vHoP-n}-V#*brTW+$)em(W)UZl05z}k>+^ zbG2SCwAG$M;dgX(jXzgPZ3-{m{3*yV&O6qN8h=A`a{#rUv&LqW;busV+h)@QS5bSQ zt$!}1$Az3#Ekv?+-N;O&->c>GUEqYWYtPWwCv0Q=_)6RS(w=*rkw7{F7s!tOq#(IG zXQo($Jq-lGQj1n+B_9LN`kL-FMl@Fn_vIWlDc39_S!iF_kISY-6{ zt7ig@mg-95ep@f?yOnz~dPXJ+?B-tO0B6CMfWP3z3e|!(wv4{NY*6gmM-r3r`+?<1 z@1B}v;>JS(x5fE+gYxcdnf)aNoz(6muVRTzo~&!{&_qv@-N4>yYC>*=-mL4%xuhwQT9nD6-7pbKEy;aY!)xIzsb1gKxw)uL@_)i&Vc!mfL( zRqHf7V!y9>{m3^JkOD*Ck%4A)fr=XRoYrfz9->7ERuP(kdbr;7;}^+BMIjl-10xKn zK#c)L(}G1vMHTvy2^H}vTf?p(MBlOlm;W9=-40I&(FAgL;^>TmD-KLtl9PpE?t};j zhg5xN1f;fBl$&Y1ee*lFQsN4N3&1*im=nCHUCBl4>)r)y{hhZ3ceL8N+@Eai5pU41 z{oyG;nPxMo{U5;Sd!lLwvvr<1yi%N%!Uw~sH@ATcS7*bnj3l56hJFK!%B3+G$3RLr z=0Nr->VI`KVai5$ToOJ9$7>`w4G)w+qlk+l*uh1|MrntrCfbi}>> zZtw4wHr^pI2q8;mPcbB4nbDGpiLEdoQHL5pfd(spfxTsC>)oV-Lg*q(LNHZ+a=`wQ zAq`AOM~4EqO1%xS3PpoW*^oXH;F8hXA2z`QMQ~?SSEJ~}|8(jpN4pKQ?V#x@g zs;O@unP5m`%2ONdR5hH`2(1A$0C1q*`HR@FvF>$W=WkKhTmNY?x#ZS-EY~=pN1a}d z(>`DQuAY)`KR_dvE<5kkC%TUFFU8gSAUWJba5o^8()1L{HP8RQ6fQdi)^tQ&&bu4n z|4!sx_?nt0eT=c0#K$cH8>TGWrgeypLEIi5aa<9kCVztt*fF8}NTV4Ch`Rx(lxEBn zEUJ(E?$rUNB3s_IAQ6J0$g^vM(n==_UBW+6TpzJyE%vp6Nfx*GMkTE6$dBaz9_NnYq=pq;Fl zB_$DUb(WAqYOVx@B1t3{oPHZVhrg_gF#RZG2D7fa$i6mUMsm0hW^Uoaqykr;Bh$kp zahN$Jn?$U(&xq>GSjEsX0|ZP%v3tIy=0X?xi@bnoNqjV+X?B8W!GWE@3<8Ixd}l$h ziQ|V5$O>j44F?=>a4@ieqbH;bOT?6GT0?7l6+ACh9A4-UkWigT66Zo(?YrbV7quV- z>q!MY=q1?y!7w<_&UqJ?n1dbU(z*ESIQKKGd3}nJQML zUpKo08) z{WUVI5~oTc?K^^gj-X>L>*uZ?u5vdR4jleRs}<+^htwL-HwSZ(2jAxWHFRy^eum)h z#&V?UJ~xFh0i&W7Xj2|v5h$yb%n_t6^uE#hrPNeFlk^>6(kPT^8$Y^W+H-+~)u7Oo znJrlunx-r*18$g#&gH;CA33RP@1O%cyfoaW66h-hKD~G{82j_b5VTeVYJ2|O)$=vAgY}dy+-oEyoJ>&v;gNj>e==+>8_-=K zAa^j6Q~ZJZ-d|pa$!Pkk$e(%StFJl4T-ih3X&uGEP2Hs3?CrS&Z<=kNK%iimh{!sZ z+G-UCVhXm`t<>+3QRn_#r$#Izy1om3H}5A3=OGQgmO%Og5GS&FWl?g^~YDKNjbp zlb^zzn>w4ed9M`T+p4+9O|%Dh)j^(FIXoIA$m0ff{Fgye&i~GlUP_!CjePD|lpQ-f zkZ^U-`v&5JnKnBj315Bzu(Bt?iB8f-SfU*+VZ@%p1aciT*DP&%l3&j3_(p2_J$Gn^ z>{CR^Zkzt#UOj-3M64!!4`1f@_3EW+f`bD0Lg$Yv0-)#MpK{Dy1#J;rOZA`vh7gDr zg0acKI6a3nAsq_z{nG|t?Z5e8;~c-lYqXVSr}9oqKqhwnr6v${$kP#1DR4N?9)`IC z+?T>|qARE^MF8v(>to9u&j8<2X$G0(UsaJGSyL#Vq5M+0(}?gD13CJ~jU|eEU1xsF zosgga8P@2SpFoC#4sQr1As2r}Qu8jVI5baWLY&mn9B|5kTw2W_b2gO_eQ|7ZD5A0# zFaw40G?%)A_#k|)@Q$NP$~qF8UTv(_#?Uj@bM-{(%feIgTShkALUo>3B|# zjMDTuF~Zasky7>ll@8Mypfkp`P#@E9-=JxaV1=GsOFj5a?y&@d?rhh#@$Ot<-#0v~G#Jw$kMqd^QbZj-{o6&dHy=69 zjV(Wb$Ig5NOK^8R{@du3&Q3ka`arVU?<$$a6-B0L9eI}gZV%}nNagetica+fUSS9d zGLv9>{8*lQj>s?*#cFt{8{Fb>r{~MiNZ0uN?aZ8H!he}jD3@gADxm?>weZV{a7<*y zT}ojZ0qE7Jd*Gt`*pdpWREN|nB;{4%OzRVWV|~FSVf((p)JiBS3&vE)Q4hY)S7)eK z7U1{CZm+5`8``lnv3M_@I_)M5K2SN`Ni66YvT{hd837uq&dR!+LNyS&3P41fwDFLU zH>&g6BYgJc!k<{jRwfdrjQlYeZ2vYO;MHwf!qIT|CxbUbB=Jazh!EpR+?mePcR8Fe zC@Dg9Tr!72jM!98pHbT6++0_xGkQ#HfoHzF#0XBRN~I~VdI3-=yQqBJEx z+5FZ2z6qSnGMa2WWQPC`*^ExRpZ;^t5O2AIAmP8{IR{lpwT_aWC7OVv*0&AG>Hfvz z)>lMd-mQYF@>rTYEr#1tm^oX@!{s+Ntj@`b=T@CsjYO0K^*>;LnRJ4@({QPb3!F7u ztghh!gWgOaJEY#b(0U%T$-)RMulbe-vfzFow~YNtqAw#_N<)1gG=q8%9iL_3d%ZR z=0<@#B3OOl9vVFU*>K3_)|RRBtA5*sIbYcfH!z(>twGzK&)=|#;OdEh4>oiWk>mQgLY~Yal&N+EL8CL+xN(AVer_1(>Du*rATq8>*glcaV`)5Jl#%M zmk}*W;u&}gBj^J@j+F2%ft@yjI7AZU)=8W$5zUz`aGT47HR%VG2l<5uT6C9A6z;mB#oUq|R;HUq*@Y1g{MFLLsc6yn zDgt!*cHizCXdB1)IJsm%Z&Uu*I%l0klqbgV}^3M1bKYPU<-eU-v^X)yXjj*&=q_F=$yIIv@^7rfN~FqOm$ z=s*A7>IIBq5fP}J7r5L-Z}=>F^36BPW64LoU)Z_8n8N7^x>DG#6!INW(fh%V+7kRl z4u&fB7`0|65-3Uj8G@>~L0Xc0tvlZLQT`>pW9%|sReZ+JJwUt-sDZszj7d6Coa_4a z64%9{%5(l!!D&Mh+f**uF2o$;j%xPY=ettrxnF~@q@3!t4p-?z5aSIvY46Po?i0)E z!f)pdk+IQ({tzGzXsVcbvjuKzl3+&=6f;Q8ZJQLCKDw#=@3NXtS1--0LNaT zXI>S$T7T)OYpHM&Hch~vcyw6hc=YseQG?crRrs33nG%uk;|QPq3i#my2it%(CpyRH zUE_`%*$%t2dJ3N|+rL20?FqFX$5!JvyuC#Q`y`+f#Koy-!;?tHA4()~aaZP1ZfbN1 z;pqop)pt;A-(g`g6O0>RjC5GVdDZ|aN&wj6(1Wu&DX3JPagxkBx!$(O)wRt$8ZT0w zwegMIl&&xp=u|Q_+z^RLa?7%jOPXf?J0s{@Oa5KItLzNtvM}XUuT{OOBHkX3w3daD zJ-I))S9jKsgoQ;JzsA@*9nqFU%aBKJ?fI{AdUuXX<11;WM)m?>x)CTlHf6CFXM9pyJR zZXY2D3c1jtk9Y}W+UdvtNHUTV+b4Q)L5|9V zg(f_+qkLm8hpRb(y`U(tcl*;^h+a7`MK8>BO9<61>ZTD_Mia0Tioy^!IWS8v&AuZI z6gYl_4J38B_0WHYpZI`Q_D~;9!(mv#vta~>Y%feil@6ngFbQFmiOAc8X~OI+G)QIp z_i)F^KslCnINL!Fd}_^2D@LO~dVHRhm{1n>XAPGKNeU|7dDs;*H;b&9R_&I?LTKP=ajycHgRrxS$-o%-Up7A#kW+ldP^^MS@&^z1`@|Nc7?uq7PV z;xHNz19w{gb&w+J+4q(&M~B*UeLmw-YciKFBHkxKeStXY-a;J2NpaG>MKw;CP}Ks5 z^h5}@+nVrSo>e$U3mm~i+hH$uAu)8Tz59dk)E#ZrSb8b3IZR`R~)AUHp?-7e+*St;9y9}p7AR8V|KBK_x+nZRg>mmRF2ogcU>E8hu+=ki4 z3(Q2g3|np0Des0re;%INjJwFI0zu{|x71bRC%j|T<9pPZy%#jDAXOMlFW)h;2=BR% z8KDH>0EpU0dHfz|>x`7&#Y#b$${I{eXch4x$*y`&Jvb}IOX&zD#qa9sLIT7q09GR4 znO{w+Jvg-W=N6ql@gW~;#xw-aFal3qv#^IB9a?(YmHMe+gGZ=j&dOCEJuv3fS_{US8p6=~zc8`t}H7G;2(DBS_qE|%1(b+~@C z_G;C|Haw?UCUA^Mbs}QI)$Ht{DeKwMnPenJkO5tvq$6EHeN>*cQLEywMu(v~cmy62 zQPdc?(i1@dcwG`JqCc*KIRg{rIJUv(FSFW-z1ais0z)6}M<>I8Yt zvppNA8pwi> z-RBwl;Pl%`lsyE41%ar4f55c;gatW@Jy5-F_7aDYL#I=6j1VaZ_J73G(3bmDts|ZJPjLcAk?puuIjti;M-PKe?yLHAT6SfNB`W&npYy#~JhPn>WOzB$ z62!WpdKF*c9i6Ct7gxTHIl6tOA*#lwdgz_G;H(|u`!cocAW6T$K%GeL~kDK6ZsH-=-+p*N2OwBj%tk$HPKZ65DZ_Rob`f{NnpTxCtVr zy#>V!*JpoQX4$N;o8+a9oLinQrpmx_85C%K(l+B6eih~%8|E}MjTC(r$Fhd7EGO&d zQW29BVURL50ASM|b0^t=5i)Jy#H2w}?K(S}x5>|*STb)IKBvgFfKEbYU|k;{v(y?e zC)QcmY4-{(KqF_>&t3&2Mi$CJ%dI`b)_&w=TP2sLD@nbLC9IGErcqhlX+W+?7z+Y~du`3OPSmafWR#QU{W+e<@YJ zSiOAervJe%N1Qpp>BP8gL}ClVcgTWz+519C5e@%}!O`>E zzu7kYoT+ag%14r}7n7rN^Q-3w*TNZ^JUHtE^w~LBW=`1Dz@ zCvIteM{UfhlWoIg-qB9T8{^-$OSiKsC%UjmOlTcBNhX)yDohs_4>X`#=l0ztWj~+O zne!>B8H^m1sLayjlwQ@oKV%wq<~^`Eb}3{kswbzTJzInUz6)py6t4h(K){kv^W36n zpHtblu+n$RZREY^Gfa`nj63yK_zV9k9V~qPi^Q@6H;cQxe^>658Q`~{_)XhQs)Ze- z|0%w_NI2yFb(QZP;^T2JWy7pL_j^+RE_6Uy@19Be)}-!18piaD_^Szr3X9g_6-BWF zI$Qg^^*f068MUwm$l`EkFo=j-BZY+_qWzaIp5N`~Okvq;w1j3r8B&D@%AcJD4hq#I zOZ5e#Qj*q1f7YF+@Q{o2b#y?guC~)^bO7-Vxi3Ow_s_fchP)nYb2;1IB))Nj;)Qe2 zp9sB3L#;gOfTBZ=xj%*s7ri~*1bT?igA`&9X%udrvnk(nBCMDxrG#QLLI-Dgm$ z`r->oM}=_q3^^Y+op401MWL-%Y7ny*fbjz0i=X^061oC^sO?7G{7h(@C@S5+<$E~w z5>UXLfGPuSZnQM9Bu9c9OUwx6k{k4YnAb7|PQHn!L_+-2xaLG4V;qt@BBJL<*&7o9 z<2E~E{?K2DyXe9NCzZo4o5LoGDsdOE4*?h5z{@X8rEA#xKJPWounR|8%>6@Zg)!_& z407R16V8F`p9rHS`6F(0$}kk!EU_CP{dEI9cYi+g-#OCB0)<8+TnIY%K}Q?X6NSM3 zSr7&1zuEBtcJ*+Zdn_1b8SVcO*uFAh`(S9KeGYbsSxRa&yp6ryb!#kOEQQC+8_VYiy*M#&8mG^uV6v}#v|;F z+OX*Xw@7b3Apw~B!4`5RXLcD7wJdC{nk?~%qmy^1m{)uTXATgBzEMMc14QOnES^$| z5=2;K(E?fjw*TkA3RfG5hAGMX3L-Ao9-uy4#5g`)v43dhQF+nM@jBBJM4&psph{)$ zDXhda_M?{YNHqHKDV7-eY_0fa%9;g?-8a^by&?M;e1B}erdwB2D2q$DkbC(#JG*H$ z9-U1C4aV-|{}cn$1kCwL1H$1==2rp!c-^TR5#yOPiNhRbVJ3?i(rm4YAgJ#PYhonp zK-K`i_!C$FkpVc!2^Iq-+JQLMqqS z30QJ~I(9YZ{NF42jq!6=v#vFRJzVEzjm@92^5RuBmQMJKL);+YOEElmj@(x}m7mVO zpPbLHArvvp&Y7P?KhyQ091nlU*1(BB`Cqz=6vjR&o^&?z4bX<=l;LK6iSBVhBJ7}$ z_4>hHs~hz~PvbCj8L6&dj^P=!#-@GLsOy=nJzgvQB{+&nDh#7KQQVW1n-&DOZ;q!L zZos;;STgneL0a^!W>E>$Hwo0Mkp2~nohG#AkSaiga2|HtCv{c2pp4&IVsQV?40i#r zJg#faLm^ogr(w^f(%q)8yAMWqz987qbMW5T0;aiHn7KNBhrKyu3kNbcBR1&o(g2by z$a5i+e`pT;G~oO{``(3;KJgxnzEJX9KoOyDnw@=OErl)ZBEy&M@B4mmAUWC(d-I;I z6G|qV!v7W>*|)Z1c>?z18GY?Ej3>k%ENnP0jshF0=MR$_vR+QFrzd$*8?a8_3 zRffDNjdg=x^2>*19E20l2;8w19>yKQ6Qv;|lte@tvi+f68}E?_2NVP7s7H)Gg$LTQ zagOdka??dvJ8QOIHLZ5LKe6C^I1oOhQV7Du*uC!A9X?yLn2baxIIhQ5DUP5TOf)J1 zjkBb;~6N^$aR0@bWl(>a`gWQSCl)oTZND~>uCNv-+j=zPczi3!WfRQBNK-qmV^CJ<=DjRC-m8O z>>qvCvukal)ocQpag=`19Wk@?q_+}T#}B8rDwQ&j38yN&wbq$1AoneX$AheDKYhiNv4^f;B9^rmiCsC!BwFdFyOBt)r{pztZ&6?tX&9_bFzOw~Jf#Px0Ml`uSkUt6UT;nH&X;Y!OA8 zuThDQ%(U0in4yK|tR|Q1ciA0OF!a9viv5~6c}AGuhC%vX< zX1t9poGv1d#ZirbvyFPAzx00mvRv!TT{*rzslM13Fl}ogLd%R(@M}=kDAHncbE8(Y~lH~FIQ6T(HtwIpc>v3;QOkY?_MO)S(;|p*P znB^LyqIj1hs;?DUq)MQdbjdR9Hh8_%ylN;cr`MR$YubI8woj3e$~lueHk+GFL}iAR zh~Xq19A%4Or{uIaSySn3ZM-R*mOUoN9Wu4sc*?T~QMYh&EXi7@o-al&{mpT6d-b7c zo03mJ-2Fc0)Ax$yCTFr1khbP0kyfD|I}-VtIK|G=OYm*bD)PT_BwQKotL@1tPxS=6h%3cn& zjhr(bfsW$wlcsKL()k}&0lV{h0~f9KCME%-ZGdwnB!QIscyWApbFf~c1&9)?_@;M} z`1nPp7{)LN-b<6M{iMf`mr&bvE^tQzYxlPcLzW2;Mm~Xs^yy$ilFH!~^&RYfnVz^% zBGp8~2hpE={3fLR1<~CA;)j%(`?gHO zGcsz^1{V{E9VJR>ZJEy@4#7gpP#9kh0)R040&H7B{qt**iH4`B^2E?Ja46)A z00CBdWIq%lROT`D;%NihsnjvS!;pWGP@pY?j~}Jw z0OWg9fpDlA=KURF>`f8su#e zyMOO;orT{V*0lEgR=Ybb@uM~0yfYdecYih?#I&Ya7+7q~MejqyuEtB&uk zHWOcW;4t_5ij4Sn-ph)%Rx(KZ^~7WPk#Q$_tCg6P<*k$bfVZ~}=##2(ChE!Q@Dc)r4&dsdJvR_!dJW+x)^ z!w22pxqM<5Vdk)YDAIB3<)amDgqZpKdrR@fxzf~>^S}8p){-Agky)o|>MN54U-pQ- z*ZSn%iB@?@q(qjx8t%wEIeoNWGi8eN`@0th9R~&dBi`VKJo}R+&cRQ*l{bsyk~MX_ zUVrwmJhgWcmLXzKqaDiL7RtE6-scA=d)Rv`(FI@W<||-%a-t9j)*z(Ie{4VHLteEL z#SA}QCLkS6T8FBTYp2wq9!lef96DN}j9Mijgb~wAmCt zp$Y2M5`6NAH&yce+U5w2)D*VY{ z`iU}?8*YZ2;vB^>@WdF2PE?|kBJ6Z_zQ9$i&#J(5V(_JTL-DSPLfh*YOjJiVtM|1qKaEjbqSzdZh2 z7qxrw9S6vJ>H?0s2F5|`^M5<|rhEqqbVpXeAH9{*Z+jGt!>w;wWO#v&DAJl~`Zfj{&O{x;ivLBF!De)N#KXTcW{r`M&P7j&mT%$#;Vg7RBb-U$A;!qj41R><}Y68Ni z^%FrLFxv*ug-D>Q4HIm=1%g-N?W_aKXhE}-Du)Iy%bP_`E~QqA8vz_T_=4*IP-c4h zkIr5mRDk%UPl!Kt_ptz&2@i>XZh>O63(c^FXa1o^w6OhOBkkMwT=Mmt*lpMEliT6t*B_3-tFH$RKe~VH zfBK*8vyXetfd@}MCL;+qUb`%4=mOy;yzNK6?(zZzsLOQ6pAMS|BIs;EqGG=Dsy&|o z9qctN>8!bjvWfm{S9A@ux%61d;IE;=;SaBAnG=0SEo^9TO&e z*^NeAerQ>s(k(KP|E$~0xEruBV{`hWOdwwrzX|SUgO+;oB&p}DfXCLZ;AP;5wxNBz zuQj~lXxLhW8;;*lt*FHGh%h~P^+D65S^E?@5@Jo6 zNDP5R!4_mLuxEx0!GHG%ekephoRv3^9zNGWVW+#xJkwkof*Wu>yepJ;)Y*2q{n~If zyeItIl-Ro`{X7D*8d+mOWnAp<5|(2>ZXaG-sa>Uw!EH2cjg+QK5sOi~Kr?*4p@%t} zLw4gOW2_c#Mj>K0Pz>@Or#y{yjKVFp46TtJr;t*)f2=(?E&<#3eoAS3cbmv~Ha0ks z-j4hxsLv0cXhvef4QASn0y&141~;KqxiCijALbk~J|UG9#cxR7IX#k^F%~(olu_A1 zj+HJ=Ck6xrE9D%_U}ZPiMy6R>@p^9*yJD*I{PM5hG|m*8>quGkp4QVvCZ^21Sv<$? z^@A(e@xhG+-6)cBS_wF`dj>_q#%OOB6oL^^nm{}_U<{bUi~N(o^Eo^XOGvRm6sAur z&tb&6SI&QyH-;W2h{*LHC+0~dRhvz*qWx=^SJNn3C@V6LY-BS$&bN@YPeNB zkO?Vt2vre}9y7i*?0(jUop-$bEB6G9Wj$=>rN=o3dWF`TX^S=4nAgC{BN72-yqv46qB?ZWR z(0jF$#pAnoIS*r3PwTbB1EzEQxbe|dLP!N{*8#()>{4O!=)DSrQJd^t=30Jw;V0%c zyxH|QLsUNHa45U|85z5FU=xDTRvruQLb9xNkaL{BA^Ho_cjB<7#=2zZ(VytoA(fPa z_$Y&ExX%X@Mxs8C1H5+z9NF~Hpt{dK?9zl zo}nel>kE55-c>KW@q}Jz=}yDLh4h4L8?vnef`)BB0?Fc}Qm7hlP>Gc)l2B(925Dk7W;(!i_z(C)a&Q29+=Am?!9fCKh{S(Z`F)?Jz%{^#oDXow$aq07R2A_PabZ0t+! zN?i_#={Ak-Jm~QMf}Rn0ZS{S-8yO%`vkSuXcc z4Ng}(odT;#bB)h6pLbt(v_5m_F+_{Csf{8~k9rzgV-?L}nP*mI+-{6ZfhrX7@$KSC8j=y`*uU<@(<#;24)0`M>$o zt|Mqqm#xpB+A^LLm79ymLj)R72~YyC*KoivE=AV~Aj%4`S_q$s1g7Z`Hgp9R1eQV$ ziVP?PhXmWudV8&VorbmH=~g~oxQuuS!L{*E;wC2pwPeM9r)V@ymxxk(i5jiwtDCX4AwNVG zGjq~ogx5&U;t6#fC^ZsHQ?}5p0FdN@HU zx{YFB6;%6ob(LI0>=N{Xxr>iNr+FQM3`tTa@o6(W=C zqo2~)ir|M=kqb;ke1Z@fQbtq60_3)#$-aG%$C`)4O0r}4>(VZ@ilPWcQ$SH0d=7NL zkP}3O;jj;W3&j7e(kK1b$zdPbURCV6$6c+gU)88P6>7ebd(jn^$rl9p!NHKRH!kD) z*A;*Bc)i+@K)OG-r61=kSH$hBtMBQr;hhmcYnhz9$mjU=!i$E8iw0Vc(j33!??X`! zIzX7Xv7gOw2ZPdj2%>fe6YuvJi-nT(D?IA@HQvuObvDpeo7s*^9z^nVHAYKGr^51k zu%8zCDJg1#0Ez{Xo_y#DZ1AGIb*rDI#)qUG#tuuoPY6~SsOSAjYJ$OAY9XnD^Y3$? zYtH%M3fLp`;?5-*s8o#NANI7wjME{Oofd^4?AT1PUE=%J`#MT5JW| zY&;FXBqL_{lf0Nb!xXSmQcEEXp6ZEIXu;Ya4EcB)D*37!u(kX$%O-QSE|e755GS0U zc4+ED9%f2Y9k2>!@~qboh*_T)!o>)=f2TvUs6G$)*Lsgt$CmyqPpSk{RcNl%l7q~R?g+3B)aIdhKl z1eNg=eOeKOw__yLAC<0_wO$C%g|`K3EGSmZ`0-b$VYI>CxIp*TIk?o_LznCdA%ARl zi1oz}aU}D;AGi7(#-F1rh9uO-@r`}XdA5XKOAy+A-B=3t4l7PgcW3+~n3}2MJflKV z$n=Lb66zTh=Z{BevrFpUlyT@$+-v6CSy~%gA>_h{7H}FD#&arM;q1*HNGWoAY-7P6 z0p*cJ1UZmMLGCFo^1Cv$xeMUaqXWSrF9}@WJrsc|{~mHIoGM$u6R2R33x-rh#l|to ziQ%SXWH2u!HYWdSX-!-`b?vDsa^3~!TqSh*AA&pN$C)k4EK{ILb@vvNe~U?6qosp& znEO|<30E^CU;5;>|E~o#a0lAFx}f$XUNv(SI3KAv<0S6xF^zD@eEMgisIG!&M%y>~ z&uK_aTX1AWuK77!T9&$fwN@VQD-;me;RUT2Dv@ARm&+N+A}si)-(AU#4rne`LK_@j>? zG2lRxWTBxf`B@ai+qH#ccz>^%hdG^*AxOWuCp-89XV5)$sXZ6(TvMCTNT6wAYG?Sr zspl%Ib3Na0Y-y{%tqG(f<&^K}q#X!vh(7;TJHx_}1@G(TAIgjpC+L}YuL%r7#4)%e@dFQq@NJGLGt5Z|fQ#3)-`o(1s&XdkCLmG~d@t5=su!OlKse)Ojb=X94oK_LwxzKpjG(zm+=Nf2^hxR_=a#xucJ zS&I2*j$^H6#+)AuyTN1Uomr5eIYJ}FL^<{kB3xv!&}MpUq}=9`yvfUdo^znQcZ3Ah zRR~9NU6qn%aDE3DUBAL$JxJ3g{8Rs55AkGJ3KbRhx1|7g_r0bYa=kJ=m$I|0`; zD9alhNgN7b4vIe*Vi-8AzTY#aljK{3u2`eH^{weECDJws=<2PZ?Kca`Fs8uzXlsN9 zV9POCMJMS!EOFwTFh~&N7?2g&DaEjO1Xq)PKE;vx)AA2`1~61`S=chlLC6uz;z%2u zw_^;k!i@f$G6)X%9RSls?E&pZlwaNgmrT?H^T+3SP{89Y$@SXu!KFlU^4|wGfrafJ zwd?`y3e z>)-@wZ*k-%FDd3TE!z^c1)`!iy*~0^lzlerfR1iS%d7?1Bf2J|iOfjdpK;0X#?g!5 z@hyQ9VA)B67+uvBh8;ucrxhJ~x9E=Ss*_YO*EwBJT@Iq9g4QSIP_|*k!>}$91I#Wi zUYE`!!`Pq$L2MkC(%R6*=DoLv50TAb+|iI|R!_Y#*owQ!aS%FN?nFjbWy1XcZo}A!A2&30IG0BjdF0Vv z`1(N4Qyh)Q%GZoX4|I<@X2{2Ak@J9EM|LR-HE_nZSS-f+ITK@cJr~=1bQeNp+V=6s z4!S|4e9>$@-YZL(<>)qYBYAl_ej05h+Q6{WFGcFB>PuIbZ@}A_uLR+7-%-1mYqj-X z{fzx%{W+|+`a9R}H|!BYp6{41Yl@-I@MbYA3}d%;`S>;Vl%qO3(>b#Ls9P`*hAjwQ z8DOP`+}Bcn&rVZKvQE2_dA-kT5C@OeB*DId{>rDZCb^|uVb;&gW(Ok3ZcK*JQ#+n} zP5eKf@686;nv40!oqllCom<*xNew55llo#2zW+@Y$!VsK@kLySoy6i0UJReJyj`Sh z&Fz<4{9<6`bIeG7G(TD~9suvB*RTY$eGL6(boe?~;F7WbXaBg-AWvp?GEX-4EDn~* zH7+4s9KPfeva*vWWaAEm5B<$lDL+X@9WsMzbQx1ZqoJ{$!GRnsgKFX?K;K^lWwipD7oRYrz4g*wkD8TD;lcK}Lw+73JkuxC@xe8H{$Svo>?8^v-sK$06!_Q%MHBNA1xSU+|Cm zqYr+|XEMj+wS^lM*@a=hfwzGu=V=o8iCnMB7*qJA#og!oYo|TLYDXN{1uf5vxmh3^ zRj~Y1wr^>bDX_(n6s^ji=%b;pEit9B;w(Uoy+BT~>taxZ^X2wzRXg$2s}Qb=+DT#i zH#64iT5~a)jO|CJtmQ}k##lrC5DCnVHq~8jttS9C96EfUqaC*n6 zaVE0gT!S$`=hwc19fIwoN1y{TkYFY63GQ7y$qOfF{XY@YW+F{#mJ%o9$dk`*Yy`)h z$aWL%29c53dF2O|^vNj7=4wqO?7e=E-4^f%g_cjRzNni`i#UXfP}C%0s!R=upa#@S zlBZ&zslz+1ZH^F~j+6$i@t;0Y64D*Mz=qtUIi&rnL?kdA&aA2mOa<#gDOj=Yx5yAr!WX!aH|6;m7Aoj3nzjC&Ezohs{C(Dw&tCKI_+7`dVmpGSB4c& zkhAhY%6i~gZ$B3Utn0w!I6z#&;4ixsN7PBmF-h5%SP%&S&cp=Jz!X>=WH6a*pWvHO zpOEfJ0w z^Ni1$S2Ze&?A!{mT?ldgS1%GE(r9?rdM)z&zU-^NRlG4?qJH1uZ>%fAF-gsT)c=Id zQukum+oO!O!3}S8Os4)%w9f=T6y+w8fn-xhEn#XOO&OaDrB%ND+!&ehHz`-4(!bZ_ zw_@q9rxo{a)W)@e{%v2?IK}g7mfYAeMzuJ)TDS~Vnf+D;R1tl!xQGbozw*1mwA&?Kb+WlDl9Fp)qUf-kmTchaCeOvVZ%oC%u7 zyde-xhCH?aw3=o~im+car)0@?#=y^woE!$@3&nNpTSa9_np;9G5JYGN0+&QEP@{ZT z=<;74chqrvU3S*9@!pX#+?5v8Y2HWkUc2bIbJ~7e3&@3nfQE=4IP}tHIFS9zA9OXD z>S`&-%VKGel=?~&4Y2tSYD`7KnWCGO0TD)tf_ozA?BpDEK669elV-_{6t;TIcusZ-HkB0&H-&TaPh2RlF@9pVOH9sP7lz2Myjzb%6WO31;(ukcb z!Q@OlHzFV5do)!dR8l+!0qmrz7?GvjB0arrP zsF|YyyPtsGA?sf)<>?k(ht%(QHu*4m9)~B(AloK+d!$BkKSx~b?AlvKSFqRa%MxBXf z+9lb?K!M0bY-^aW=~sjF8dHVIrT)P7bHYhJ}3Jg8L!?Z5ScR>zZ765^_Oh zryD$dwq?3)9)m+Zf_rf~T7E(!5EyCJ<+ASA*)>l_f$V2o|&`p!sm1A$9a94V*_0BTN;n z8&P;guR*na)O6H_9 zE1)*Po>n6v{FX}RV(Xw=$18CxNuP#uHbrk^x&?WhY17S@9^;R}OTt9gTUU|tnhKNq zI&Xzc5<%ZqB(wCFY$$6`)m1RUPR(xSY-!Mgt-B{Y0^VA9J9v9?b8tYbzq)Q9ON z0K~vpY;fSPE9Vlj%1{h}gpg{=wB&86P^DUJV0ap#Z5x}QJ2lfWhtfjJQfZ}SO>AA) zhMrB_7R@%-j=o*GJrnz+1IUrc3E;GuI&;BrY3xekTIxpS_OW*7UV5d>Q;)##nC}V0 zQ&Z23JePUV%)RuA={4mI%Uc8QE)#VYQROUw_>TI4_({xEFLrJfJXdXWoNDehPi@Xz zL9ltO9do?|7er7Y1rnH%QtZgXL>QksGud=5br)_+l7qBGM|4FGG!wG#o^{V%8O{`7 zFj+wXKsJJ6FqhyG@AwPn8b>>4qL;Iw=iDx7Wg<6A${XlPE{2YV^j{%jCU&-FrZ<&z zo39Z2WlF0=rlczr4C>35#QpFUf0)`PR5VJweQ;0phE=tQRk>#E=B+D^Hnh3yu~tt| zBZ#5C;wYum7S5u&1X3iZXAj7}3O#DiG6fDpgIG87r@KvD9p@sCY1-HPVk6nYOl3Bx zdF)5j`-~FLim_?pBs$LmVWH&NRGcls-eZv|%~pu^i^h6%O+Yv!HU*jl$GYFZdM0-N zXr{KXv%JeCQxL96E5(7s{01}G3EV1yfj;oBbIzbl#+?*aNsuMGG!pl;Km+yT-ZLqk zwg*47aA8~6YC-RQdu_s=Y0@<0qNzvbp*ckOK^?G|fuvJ719XFifjmk~Zex&G zu(__W(Jz#XxuAI_6Mo^aFb~)Vrfzn#9HiR}YoJX*_4d?_Ta4D2{h6fYXoNyhTHZ9B zPA*uhfMeZju8QucxU={=40bV-#3N0zqiu7p)S_gk8Z#n@u}Ul;MBwHK9w&w-ja$O1 z7Fe=1OnVsgf=ScT@?e+1E}CX$D*>T|3AXtSzXnY-{a^SHKBR$T4p7$X= zp}QG^e6CZ{LPcM8W_qPe6v|0+W#C9nfnWL#mH86%V*N6!oc~WKy{yz9$20MxbC74U zH1*4S#?X&F%FCIT&Y5dcF|uf-4XXAM_*sD&m>IIZt2mO?n&O#wr$t*CT2m$;_g4Ip zv_de82bPzBh2Wpx?9|X^Vmwp{3o|%3>O0I-bgT~B*P5}RzCMqakC+d0WVoAO?VV8hmjBy2_hsbDh26g)Lkv$9C)@D8x+Zsb!ajv~_7r zeO)>O&}QhfG(mu^$+z|n=Qg56V?A1@B+y{Pku+cqYz75T z)j00ZI{txv}r-ssjvUL#Srx$dy|R3K58WKW)*a(?s28A3Z`$4oRg|zcKaJ z6V|bimSk~(*TvvEc)`sZCiPjT&UhDY1UX8Oscb>X4~aa6Ch$1Ks=qub^B`YXGZ#Kw zK9^d^vQZcq|IQJb)g<3Uei3n!*7uC->UCGY>RO1PO!H?4*{XF1Jll^U#|$d4rThpt@9klJW5TGvU4+qb z#d`}DP2=DRDlhBm!vfO^YI^Ypcv~-LwDIavueaKbqlN*RmfR%=$MdePvx>NMrObA{ zl~obPVNJ(pDs)V*5m)GnqfA)eTy!pQ|l3(qNsXFvu;Q!8{B>JE+*M&v!M#2n9xp95pU@;Ds*%M3Ml4uWp6w z!u8N{TW#ex*QwVm?oT1+uI0E5i15|0Ep+X51O8)Ln&+tM| zjts>sdjrwv#0}_d3!nTq*%D-u3n&2ewJp4qHqwk2Oxc4+^ZR+Whu827t0$=`{9{_9 zWE=^6b_YBluSv7bugSO2wqBiD0mfBpT&F%g{u0k_HefNWM3`atXRR35hzBw2!l~a) zQDM-us(e0%N3lWd5PyzmHVi$+M#1DDF{1E=_9ygWLSav=kHHm_?WLbVc5h#;r#)$u z8`Ow5*q9gBeiiK^UxW*1W^6dxBtpP+RytUSA4+jm0hXzNp;rw8+S+4jxx- zY^s$myXqny$sU|b6eU`WSaISdz)O@QS&CF?(q+h$C0mYMdGZw~RHQi5eZw+o$}~0( zE*?GsArUbNDH%B+iR?>Cn80l9IV$MQMdHVLlB7tLCPS8NIdbJIP^d^hegoU?qh{t7 z)(|L+NTTWNdrD>Q3z_)sn?)UlV&Y|*4o2R z0D>7-P{-J5oQRY^4Kd<1L!6~F(Q2>O`q7doGbDC2&lbBKakE?9;{lI*R*G~7WjN!U zq9Cw03cJGh8&#|tU`B$7`N6*RGcEgXi#IFqmuF~_12D4;B5EqggBP|ST+YwdP& z5KnIMF#MIQbY&?|g{n}ctlXes8m%Q-p)~@xOJuWF@!1l$Bc~p5v6hsnrEG2WRcf#i z=GttJqt3hFZufi4)AmVozzLPks|6T#_+yL-wtJoph_9(1a#Z9}NEwaHXEO)sW^9Mp zI=+}07WmUwWhFZ~DxlI-R`oY|h77b-KMhDH5x-?Y7>T6C|X0!Pnb_bAgXw7fH!saQYQlyMC@bfjXX8g11X zHiXHr5O#-s;XpX0O=a~P_krBp%Sg5xW{q&DT2E~rCQ_MHP zpcxNg~DYHhd_clyy{7XB4N6 z(M&K(Fu)9EF^739VHqn}tzAY*_OgRr?BM_;sPymhH$1g)SC{B5-&o==|MLH=^oQ3$ zzA`XmGLfYrmp~#p$wgjLDOnlHF#=R(1ggqV7(r^)812-2Ez&Zr(ptfJkSmU`y*|ip z4r?*>Ib+F8o+8D1=);_`02S=Httt~uG2JW+Ew;>B>uj>!4twl(kW;inF6f{~Jm#__ zd%1PXhaGc5mQ!-&D^j9Nh4cPZ84wJtvD;a?%5|Y&09_gaE39LO(=`bsm`GxXM@2HJ zWRoKn_r!W?sAo8%7{f#+Go6{tW-jwt%5qk+hV>jR?PNE5MJ1pyAS^r`eJM)i<=Dfr zAU_p!6QNL!a{i>Z66y@+jnz0UV6eMma5gH|Ve#{?k_(+NW(qukDa;gUig_wiT0M%c z2ydo?@u{#{2lbi2avgD1!#ajN117!GtfOuevk+1piYY&)b;nVihG=*VeNm=*rb<)Q zxP|4l1B7ojw%!n38UBV3#r-nOlV%~Lc~UKX?ly~4UFtfDCZ3g!`oAwOYV@OZ&>EuI zuBjzR2daiBRH>a09(f)}rd;~M(#o238#Zm(cHD37o_z-n z9XWR5)R}V^E?v2H`BTq4_rjHc*RTK9JMVqabQ%6o7r(fV=8Sg4%V?XwkkxJfWThKndiRg{xQQuL7nW9FeNAu# z5{1TKad-l3|M1HcDvi!yve+Chz~c*qBC$j&1LX>(N^PUj+UoRn_6|P#;;V1I`{Acw zNV@&6M=!EI6jU^H{RRvgGHk@CG2N)o znueB+o`I2xnS~3hNqwEVxWtQcg-o_9Q587FW1$Rl%dY7T)vfCvIC;&OZ|%6!DLDf4 zWSq9yO{8-+M}~467nWaLYshH^Lzi#)#gJSVxlc5%J2Z@yk9e07St70HMu@(9p*N!F zhu&z0#;Bg`WG0GmGWdp&Ck&wjsYK&LIDxabe4-VDeBu!_LnRg0C{zi=!Cbie*_hw$ zlQA8qCD3hH0iLJMc4-?UzsY^1WAkuOM;HZrW4YDzD)xQsGA--#NY>+^ ztjvzeX#Rr1MwVb(-d(yhfH+jZ2w+3yB?0{C$$~8&i$h}P+GtFoh7xi}A(n6g*~-HbyTS^%#yYFE))0` z#IdImkuWi+hFhWoMNk*CAihMd%8u-jeiT%r)owEQ5_I4-fxg{-Ypl$Lw_jZ=x|Vk>>ss2iL@b^Oqc#Q< z2)pA&$8a-%aWc&ZD6k1+m;(pQf?cBr)(>U7jJaddgl7|cQ!~O%D{qR+q;e*NWxUZC z8>3@n3}Yc*u^=Ub7y!d?W6LMQ`jC-tzm88L8U^GY6Ex;sGzAz42zr81iY9_}SIE5` zwa^Nq=S@9kaTeAXFZ7$;QuMaW=(vpNnDl7rlzv}Mx_KZV+-v>K5A=cYmCU=2=XK(# zaURh9k#Y>WuP>ros2MY*8+E(4g6p{KtCSt-U(E1;(m}XM@6=T%2z;v@Q)Cm?M*f1#Rb9i#QyHrs?z+dl(>ji zP5MypDJ#gyN{w&Pyh-oWRVU-&U`BsDoUF?otfXQ+fvW%er$1X53pA8u#9a6>KVW5| zC(=-MEtK%dx73yjnSqXX{xUNlV4Br;X}NKi~vXapUAuf z6`loiCcHyOjf8`N82r)Dj*UmfjM_C~V;Dx$q~ zV9Dhpu^h#fjV#2FfpkR>N(TQ}M2Q$KEJo>vjNo6PtM#2We@JlGTHWpI__EdVnbW79 z?BgtEi@$C5mrZ_?=vR2ZNbp{~H{ukCl`qC~(dC(KhanBZ$K-?B-mB$ZuIVk*@P^lG ziC#(YQoI-9JXhT_)jU-a*l*KPqxQlm)#C(n+>*DVUqpgGSX^$^@kt; zNd5yx`5m%CaDp9RVtL0bZyB}-Am~ZoYg&G#M_%fd7dmzc?WA@4lcqIKn16EQ?d9p= z?&hk%Nd8!jFI7`jQC3n^ke8E{k(QE_5El~_K?n;83h?vs@^Eu;a=_WySXr2v z7#Zm4XlbaaC@ILvNJ*CXhgH40?b@cT+M>b939Ie+n{a`7nBMLS1GtUH8F#r2x3`|AFFNUUjYIZVLEen(_hC2z zI9eL6`CHx5>#_Px!vR#p`Dc8z&PzkL=JxP*3ftpf*{jf0FYQ(zPwXT~xJ$AK@5`h> zsEkg<*S5sw!M ziW0;qenJA0ty7(%-(3I91`^9rIJB_g42#_wtt-czs8SVPdH9+FW=AZ9llRvOn!bSz z9N@wh@n`S{390Xg#I80@n!Iii`SOS9y3s$~>|Eesr%ze}eZ$Faq20P^w|&oF1I`VG zmjfCkjyLo_P{Xuyiy`4)=`6rdZujdoZhX0$SmGGVAAf}tta?I_C_~9ICk>K=6kWLJ zhz%kA&xb(j7=%X!p_)NJ_ymnm%g~K>kPar4|s(b2__U`L@Wu5*bzQ)BL3tc0rXbN zsUwwANI9KJ=h2N+rCa(LN~MEzmXQmhmg8(rF(SDUw+ucR;ZOoSQ9i>OAc0<^WK^>*8zZO84y+S{|YW?yE1 zn)^;ExRh7ATe?^tDHqBYDt83OgMnZ)mHoKT*sQC(_Ik(5twvs)}KdGd8tUOA~G zB~`~-&>nh&-m16j44tJ9=_S3T|8Kx(TVv~Or?p9#;11vTKSBoi2X1)O81;xafJ5*i z*_>28G$*k7@A#CP?wa$GSSF&7{XLjb*;uhD*}o@$gBS43v}I3O!Qb{n{uamSuM!fX zyy;7us+<3H)2*A%Hv~VB$$y;M|8(}Z?R?{hOw0JWR;di$wJ8fIbDmCtWdOj}a1*v+ z0mfkrMxh0kFn}z?;JaW8D=1(L=?wrZ2=9b$&;}t$hEn!1+s(GKt*o83vU=vqRm}$<7T(ZYAj?lq@B$eJ9sSXabTa{6={+c_8sg^zq|3 zo&8UyjUDkFv1@FKnK3mgiRvgBxgvYiMok265G{zX8$@HGcSX~qIJ!3Ch0nw1f`|Oi zxM^yC>VL?8iy!>n`_}s}PYf;rD`-FoQlPOG9Gxo zk?N39aw_^6`LG-h;!fOwbNCfpf`L$mQ6VG{1zW*JkPckIS}+*Axw2gOt&*)6D$SMk z<>%#v^0Q^XvUl03>{wEkW|ux+94V@cLGet%AXku!&qd{ea@%s7b3Qrm94gzLRc1e& z)oqVyw`*J9=F$4Lb)w}LufD3UfOnhXgY_@vU#nZIYsrr?`w9JoZbFri5HKMi6bX4k zJwq{G#?Dw76SKA)FKh)<(1p3^$^VI`Q4Ogw6HmwB>*vtfdR{tD11x^v+<)#n=>UtD zEnc*E_Trg~p8nnR`r!3`!HhHGvhlrRH{Kn#20PH<gwL``AC- z-Qz^g&KV9?{UaRV9_BTWf(Ha%%BU8Ims6AjcCv5&>%D*!{m4l6c zbV4Q#VEKN6#q`r)h)HhqTKzd;78g4|8=T!>zr&6?_7Iv|AMMe@I`xswMw0-%Ni;KHuAn-Y}#S5v~wM!V666pMTZ@oM<;TXaFtEjam43J zrzHSiTd}&cI|jWgW}bP7`*Rf>ab0a(G*>KXF`&zYF^kxi=rE+mdZ1bT6Ugu*rq^Vz zUv#d?rA5?yj6ApZ`tV%TFUbSh@b1cXwMG*TO3x*qZe5PU54u*YU&ChhQ+So!U7Be@HvV|_~>E4l~$&bybI-h~f z>=UmPyeFHri|<5!%M%=55YMrjw8w`FHUNfG2V}cnL;v9$H?ijTvv)C8= zIj77<=*m)q5__p_!a%V{EQ<>oTN@{Y10c)+kpw=-cT(Gx?op|OacpKmFWkogqvnB& z4)@2%5WK;fbHVly9u`EUjc-23ne^cRAnBW5ajD(cVUKf08~dlJqWv?A=vddUY zM5}=Y!T5~Wd$lNKtIYE;eZwN&Oyg6Wg_~1=z{esR0IUfrHymou2t&P>k|PK zEAO1<1o|jA|L(qvgZF}G8?EJSoo9{scWsH2gmY&7-o-`3{{kD9eOXy!_D8|J=RFNh zyEt|_uz;(t7S;+d%my%w?<_vKy7Ul-i0M|(ECwsbP4Qe>k6yTjCfhr%HnuKywcb7U zMu6dmNdtyWFB2D!cn;R(L^KC2!##%`$~y}CmXOu;uD-8^x73BI7$0)9r2`U`1e}4I zmV5sh2KrqP7XVHZM;G4H;pRfSs?PuY!4&41yLQlAPOiLmc6qc4u@o*i%)pKFncOva z>%@G=^ol;u*n|0tna!TIwb3v0Wm^cEIg{FAtY*MyAs>WWhze-Dl3ea5w9>|Kw#vpB zM{M&HNIX^q0F1PkLP`>?!D;)NkdN_V5c?)X(Wo+@5f6y)HyP0qAj1ebPWC?u%6(`< z^vVzkavWKXf5FRd_(V`*cynbAZ7o0U-(DLn5$ZP(7I8`7FL^O)HUgF>f6#^5ZKuIkqY@9kMv0aPbJh@0%TJtyH8^C73q#=G+(%J{DcmM z)~_i#7$%AGe_WJN_QmJ%O zLSn`AoykI1yeYqfDl)TFqu`=~h4L!WDI~i{IYG6Ys$}=-8VU~l3ZV~M7{09R8Vb|n zZzGaya;d0ptRT?HEsES2xowQ(+q~HF-M-lPsjvfxBP znVn>y;@a0@7|W652YDd5ab;_&*_8FMLoleK*pG|J8`Z4w>pOC2{(ZH{9vt!(;3tIP z!gxd0xpjPA0O4vH@K{u)r&b8uo#4>*$9MwAMY;wu$B=ILs??%?gbSiyTxQBbT?1sXr^{`s@ zuU`AuBjxjH$EAGZ)mIvHX-MIPV+Xc0Ub$Nq?wG`11jlE6FX0Vx)Bl2rv3oq_EBeB7 zwQXUnl{vW7R2~`pzoWy5=*pNRmrYIu8{lYdd`bbf!^=zR|4LF^3Z1YFg^)`Evnjq7 zxL+XuE9p4i6<(8PUQ);bI2w`=ZyhHtWSS6rKc;MLwD$I1#lQ#OU+|cOMqrX~sq!hz zgPb8XA9T=Id4P1b^b_eezkzjnyJMTRw{&iQ*(`5&`4IxaHGA~-BJkYPAzFmEv8|i` z8-%-^-$Q%!b?GM8t>+FBmg0e7!#$N8I#@;`NrJHbWrumK>bJ6`^uv2}Eqmnc1QN~E zzKmq1VF+nkya*eDD1dD3!DVY)P&B{E2^zd%Xt5AXS_%tBsd8D-NO;X{rE1R`M8&s+ zS~dri)u8W0wZru`!|{C3mS>t*bSuFHG`bl7U|@e*Scd|6|D zSc`p;UbaEjv3BCFHJDmYt3QWM@$Fe*cw5|bH9nV{2K^?xj7zv5w>|yY2Mhev?ZI8_Tv>4(^3q zzw5R)z8#c1<1Us2oHUstw2$Z7MZ5LKFQp>Ihw#O7_-eqgQCy8bjDjVfLxAH#gd&1T#8M?uP(jIz~);NUt z4k=HX&Hmy;l_M|%S{2N;*dQC;2R!HWY*!-9ID!M263#cwXmo5_R7G^3*BEsN*6(8c zUutoClsnp&JxVvP6I*>dl`sN2nDrHo%t)Dp5=ac^ne?^WhCjQl-FyHu184Kr+)zgxbPUiAf9=Y05$0?Zaaz0#lB`f9oVT(IH16^@!*qXRv? z_rMSNv4Ls7*-?I_&k6T%&H4mD;nGvM0w@E*!^j24D_^FaVkY0X7081E&B41_gu!2Ot+D7^f6la`&`{=YP*| z_dNX@MdXi2gBeDeGXES;+cxz`P6_|cRl_{258SR{I`m{(*){bM^tLH3MQ^6?%iovr z!0iA3|NsC0|NsBLr*wqsygNm={$JBm@=8L6jRPhDlfi1BkU~lqv;_uH0W%OqZbpO% zf|)r92r5jJiPDo9aHwj9rX9dA!U#rVT*xSJr~8iv_%w( zftNyw2(eOCN<=8ha7Z2$)DWsIDWrCQ$GxD5MO7$^v zcP}gCYm%8{CYdvDNYNN$0c(i)8$YEANhzfQ+7Lph8{{R)Ofr+q2R7X-af@^CneO9P+m$ zYYrh?V#{6s7{XwP+}%@!+}*uE?!QwaLWxL5M{nVRD0c>rck+JZ+MpAA?LK}DSK{v4 z9-~Y5571&&LQuVj2%X|Pm{ELRC=$>C?BTk*ck~_pFi`jtKK^wGwudDl#1q74XpRN` zo>0q?DX}WQOv67X34R3VymC~HVQe?>c}hfdOfY(^SI`dj50uoE654Wv2Vl{mB4c}2 zfr1r&KBNQ=;Q@FiJ9CuL9kk#D;I_9>84ixE8*&_$j3G{u} zb*C}HFobXy$^pzm&>1z|z^3>)hqS(WMe-}f^6$Aheq#1m<7j4tAST4swgrsUmA)v^ zZoPxyRrx~RBAb%@gX9A?T%v-B7Rm*Bk^SF9%fT4l!xv&U84Uj$fBN}IH=L&%qKjR@ z!fOcmyI-EH(j6RDtEQiIqwkTN(VBrtW_n2fPmZ8!CnfgWy(5xww_g>2ifC= zf}kiUA}S_E1XkV1xIGk92!OWfS&X+r9xq)rqY)~VMk6<>Xd=>9hkyQmKiWR`{XgS~Rt?Eybx5LdGSV_F z6DovA3}CTsat~%xDf)f;z24nN`*Q;m;t7;U)@{lXEjkjGCIF-oWov9tjoNYpFMLS}_3b9cYuz?j0EeU}X zN);(05(uGLDtdPpSFEe7?YS1*(%p@9ZanxMnhPzm6cx6@`6}F!gAn5T&-1$VA28=8 zlkf98UYH^84Gxxu4Ld3&Dk3N74I zs3Nd#*h!dwelGu?d0jh)ck-2zx8UqMXV+xvKBm~f0K;GsRD%ZymV_k4jD#4$Wnj$P zPVY=buU1~WPr9eCKk4=V5BgFExq8Il3~%IF#m(e^Z`jACjZym{pWdg_8&d5&tb0Kka_5C{rO^!ZbDk0Ku9Tt)=~ijp$CG&7(z)S z_E1YY7$i4rW2zyT5=u*AN^7=Zoy)!&N}wbNlBFevAh+>wB08D4xe-dWHbbZehv~}7 zYE&V3i1?A*<>6xX+HUo&bCU zO_Kou|HRxv+wJ{{ND_tQp;1brA|%+9?O{DZQDMOwY;*<$`2X4u#ofTMfi)*K%15D4 zadw3&T2$zeU2Ui1>+t^R>kp6+5&nPw`*%GI!dhp{&yW@5o$7YPyhB3}>(K4cinV%> z#w>nwMN>(@V?xA9z@v(3X4P4>&$I7o&HqOQsXt9kRdJawyb2OAB}5>Gc^vYxxJ8WF z%|gUB1`$OpCPbEq5pg}UIphbPueHp~hMrI%<$#A5fNY|YLz0AwSjZq7dBojye=C1{ z%k}^4kW=B4O;x%fGi$Jht{4{AQSY9fnI3B!u>|%eM2Hf^k`=dSWF>-=X$ZVWLt%LJ=MkQU;0S5QT9%Hm6r>u-5?)DI69c48{p(oc?MS-!wr|BdDXwgfw-G#eUh4NI^@vC$PY2nRhV7RupJ z6%i5XT|}BR5fueHDwdc=sv3=RZRat<{}Vr#TVaNtsnQM&OKx3_ig>o7=!%iLgV$8v z|IANHP}>R{N@Mf~dE}tLop9O~B=;7EVSlevr&ziF=9X=T(7;px9($b#MnDpMfzus$ zn7XyYEGJJ=jDS$Pl>R>a6a?BP35qa*LgFmx=LKjg%~l7(4cMCzXuz12uvnnYxVgW$ zLNNxjRHKTBO}$UvA;@51&E*kN692HDzmm5yc(4f{5aryULHGyhYBHAIv`xOfXU8}| z2dFl=vbo_OWJjga3=?dM$bZ4z#M_n7&|h=CrQ~%sF6tv|0IEjCpgF+%cJH{viV%dU zaGPuHI{i1*|Kwv~a{p9&=JchhFG9jjOe9$r@(OUZ!X@#pz_GKo?3CCchp*1rBI_zKM zoVwj%YS*9oK4G0*2Nq94h!BC8jrO$I^i^xI+h(JhNrLzqrVA@t6Dr~P&-1qR|6kpQ zLYjBpe%_vX{^7UU7!u~z4kiQ%qF^Ry#*o|4W>lakiXcr^FoC2fVnj?J7(m1jTa2NT zsU52v8!yVn2AXQs=f6L|g4>=Q*N=1=7==+-)v$30_5XjB>eu$Z07$(AC0Bs5?1bch zPC%|9Ak~nR|F1QrKTZBM^)#)zSG7#MOpw3}fJ#Jyav~CxfdEwn1ZWwE1oeSPP#*sO zr)AZon(Z1@^DOt6`64MJUw{_yBB@VAl9CVs`kR@M^qEPyjzFneR!=^?^3=oZo@Up! zhkb9iP1-d`>R~+lUiV_N>Q%4%?@cw^ef$gnFY#Z>xXg3pxM(hfP_?`7W4U;E_y~jo z7b^@D(gGJqLbSA|JOdDRIBt=gPJW+W12I&chE$b44d(MYE_>84c2om389Y*KkxK`+nKul$tuDa~`K zy%1mk4cHF3zrMfUEV{1Jl$GoRga)Zg1Mak(7197s!o$|Wr^k>^%`mcEw!Rz_xIUjzeUgJ42ZFwhwfri1F!$G|0-uIXuS-(;i`DAcJfc;so~?*#h2qVVsKOiuPE z$@ZlG{-tH-zRx#Sts0{$Dk>@>s*YpTG570xz5oBFB|Z1?c+@s()EE&_5lckX`S|S- zUi9nc+oQ=zAiyhBs$QR%$N@b&Bed(;rV~Q@@UHEMQP2T8LAbMXc<-(Vz<4`k1t-f8 z(Tx2+NJ~*5P>L=<8fI*l|Iol7*K4X8ex#!@9O3|A)IDZ^#u@jLW~xJE+X(Z>-UJp( z^z7E9s~`{upc_sa`)*<3UF)^!*`aN{@;QNJWc*~URMIs}&KZBU+%oMVxI^)5JBLo^ z-{gMnnqOHeFRVwJY#0E!{o~XC+=g=F*>7H6x*yJcX5N1O#?IGJ{FxC%1pryWX+H85 zu_ON^kpMxZT1MnhPe)3#Xt)+`cXDc?IkPE_EA^nx^1O(LfjVKRWTmraL625N{;jit+)~3?qFbv+*dmnrGs@2@7 zhiqq+s5aehE-*64$uRL!R-Pk9+y42j^Ok^z@2@+mHhS8P!vR2(1H`f zkcBoJ!#Ui;H^L$&l7bM_$Ovv^g)oXk6xD$R9egNZ2Z%Igv58}Z0*XxJgA6vrsK)Q{ zZ-SVnyE!;d?Bt>`*$G-uZ9hzI?TXQyYj=@owd=Y4F?H~k_kw;<)M(MN+#Q{SVX1z(h-d}@Mw%mLiPFKfBDqC*$ zNAuO?{qV%>d@@^Hja>PQB8v+I$0wu0GO|OkgG0i=4?l@@jV!#_IJ=RQQB>FQY;0lYA|@@TtfA-B+_@W%LOB&J0}DI9`!}c2 z8H(qZR%RPo!`sEDWOoc!)U}2;PReXj9Bk31b0{t)tDwBL@44Ls1prihhN4I)F%0Yw z>=7~W2uZlnGSP=%2#ibaVIIQsHUZFYGv>2?xUPC2{oZus<@)6o7$%KK-<{FwCwzX z;)QnT_)DjVCn_nZ?m*Mp;Tm+Z89&Bkp5+m6{`>a2OY zEM2p4z2RfVO`f^Q;=#?g+F`_~@l$5bTfAcJ)?Hj+-OL4Ilt}K(>Mb@%ESbd@$~0ye z8c*d2<>uCoAco8m$TVh8u6t)NmRC~QO?_)1IzBnGQ?R18B`i8FHLFQUWlh^Iq4>1i z;)?o?6W{<3-~a&vkb?_oz>e=F(+iTae}x=LhBwXUn^P=>lB}fupkGk2@yQukxbd(- zVu%c$NUkx$(Ksp_5GySmAsn42QJHkJ6k!F*G-}pekDFws)_a|APLYFLr8}IRT|Gp( z)^K@9B_XAtM_E)tE!2<3&>SQz8YdEJ7H~#L==eZRAS6s8S_F**#U97Fiu>>=zT@xy zv&m#7rJ%k~n>6ndotRVFkZv~KP@m>$oet1%{@tss&>Mb&99FQ0cM#zs!;BFOMA+a< zFcG7NfikjDh$_^gofHo=`3F;dcmAvP%@*Rn{?3j6@Po;pfBQH8lYFBm`YU~24H+j_ z;iBcNs1>W&*Xm9CVe@{z#a@leEg$&z1zRRB-ERESVYsM8C|a>XpaEInG08b1k+2E+ zGM9tASM=!3SLL+L-1r%FQ)fkj@y);?OfdMR;}lNw0|N!v9IR6ywvsMH zS?#PMA&rw`V=hOepNwFb6WyR_IZ3#!CVcQ9v4}1@=+pODGzo$P0wIG0yX(^!@jAqW zM&<$W#XSyIFhp1c)TZZda5W6d47pzVE0>W3M&vF*10{=RVG~)%6riHZn{6_X)ij+T zc|oq3M!t&12Hlpb?r|AHZp?>&sD)*nO)&nv=3A} z16I)&h|>|Qelnb)VzVL=5ni1vJ~2RNK0ureUjsdvTG6W@?IX6ZsNKY1N}n`jC4l?7 zQ{QiLD-#sxhIxZay1HbtR)N-ZglHYpPwl4VX9ZKa3S3aYT?n#EWEQi9r0MLYmB=nO zIK^J4t?AxJ0gzNA2o#V4{}j{eAur2f0G`vc>ipGp1r#hju9Cs>5KNJxnlq)yvmdyyS{gKe!>m>ek1GHlYZQKe;Aw?S_obdZCKx;% zB&;$~*Y8mH^*k{`bw5<&l|kT!x@8%NCJM9+HK@}VIdm{{4Dh=#B?M3tDe5|dIl-E& z6szr)n;_^-!{MyFFW?CStoX<0URN1lmL)&MiJPF$qQ&-atfT{ZsY-m$S zdR@kETFala_VQ(1{GxB-Ji4G=#9*~#1!G`osv_u&DR(2*o#hE08|(moH)2f3AEcD9&k+ljv3B;+Pr?5J8SgNQt?mK@yO6 zLuq1ix97)aCib)ZW0j%)6W$qFNq|~!qy`k)L#4PlCwMX@DVQmg$!dT??T~Q!3{>b% zAY{o#PS_{Bj{@R7+C3$CAYk%5#iUb$_TCE&srJ}^iFTV8$E09DII~P6 zn1dEi;_ERr4A9~CF9l4Hw9u|COt|K`NnQ|}*qjI*nrIpv!6B3m!pt&`Fi7$`-rHvph|jUuW5N&`4#UJ~M+N~bMvkLD4H%pOPkWf04>lc? znn(S~9&f9it_y(d%m&}Ji6KvLS(x4>GdFrA2@UbYyb)nb(pSCtDa+*%cW?a~RO`$b z-%yw|>@+2{6Qau0$7LmFk*^=9{Syjd+Skh*^b}hK?R1>8_n4Tl28wHaRp@*gx9KcY zjamEt3Y-!07tpI}Ll?SI5NICjJfGYy6Ea&+V!je~52Sv+;A&(!gjx;>L>R(>6XLS@ zDrh#@QK1(o%+>z@wrA@;<9I$tw%6L{jqq9Dxp@|%6a(Mu3oF8y%!RWUuC3l1n`g=LMq(dZ{jUMewk%0ZTUc$ z=a^6{Lg0-~x{VhoPt%DObHD^f7FYF1y0{%GMr311!D%#FV*ukTvSP#=TM-H{iTZKT zi@4MxExbW>FQPL{)U~Km!&a@Id{NJ^z}8&AcsY4p1#r|k4p9t;>o9Je0%Iv>zq{UM zJgSzQs=ajDwUEe24ZAkymoe3AHzxUJjRvSX17NjS&5il#PZM>or%uG53#^h&nG3S+R9(aC*5#wj2&5WztvG zPsmuJfAPXPCF(u3Odo1i2@JN4g_0}CoTfdkKTfwiNBQ zJrjG@v@oS|dV|+$<7TVxUdV)?5N!e-3o#t&o1T^uJ4Bca$^SY-C|XG`UXKlQd9N~h z`7ImPcrchYgmx?kxqVpkHZo?O@xVk1J9KBD5YWFY2x65^mz#+@3#y{0Q)FJ>=f}h* z&xRAFbqg`v5X?R1u1PB@;9c)Ug4kB18Zf^;bX_KP_&)*rjpc&8B!EMi_BzfmTR7`*#g zt=3Cf$$`ll0ep;n03gi&rd5di^!5sWQyrz69L4ZQjT8N&jR@{THa=_A+-$q?{V1`5 zMr*}YZ`CqeVxy}fG_^NqwV5g*l}`!g995KhHi4U7PH<*`@!gcuB*yS|$Et2UpJ5bG zY}H1b)bASW@p9<7KglSBCl)q^oSV4uyGDr}(agP#!HLfbi(uvLeV46q(LT4yaKyBi zjYqk5QF4i7Hf60G!evVh6B{)5iUTlo{DXbv1b=3)p@wAMhWqs)FOG6jE@JycsO>8< z8``I4C*~$Wen8TktgkQr0#;-Cdh@hRlyz6D+m^bzP*z$b$^(-=Y&iaM`Qe2#gZhk8 z$|m@#+O@t~yPlVitv0a5Px?OiaY4DU4-Y9SZ#AtmW@AzGsp6$FjxW2JA+Rykrk2jf81}Wbyg_<;S!IRmP&MogeoTx2q!#xgvuW{l5 zvjrf$72H;qFNA>v(4&j7FOy}2HUa#WDiDQNEJm;pSZNcTSD=#g`?>- z4lH)!POk{LZ*6JStN7B{8U(U#^)sug+|mSA^Cg)%7_^$$+-ohwKA&7FEf!^z-Yd;l zf;rPY)n8q|yMOW6SeQ?i!@JKsc1Ef4s|uL^Y2Fd`Kh~e`>-DBovq5c4QD>svloE}o z8#obLPjj(<(}$14`o3HIHz$l%^bH2gA?1+!QS@B87h5i2B^^;x4uk$rQHbA#B{Mh;cyAI# zJDVyiRb{ZIm7oe2H}=~U@+nRDi576*# zT{k!36;Qn(=Q$yaE6xh`H$)hft8b`^&xCPHBeI`O)EB#0D3xYl3^oM2InAIfFAU5F zr&iaKW{(|nJH{v9Puf7J0!33DRejtlM^x=s8Yr{U>!+(>OyLWg*QZWzXpu}Ax~x{G z)WL0KmHUir(JIgEc^YW?{_pW}i@zF5@TsO~0uy|%#TH{K4O;KTZrbp%X2@VW7|e2AWT8!4By61=y71m<`ba;04Fgv zQun8FnJPvYLlNuiO{M?Sq+nC1b^!937iO5N99<5lI=|RppiIr)QD+7>vVG~hhveQK zRy-cP5QzalEyREo`%ZLsUpcUk6^&yu18p_=FWeqHhM|6jH?r}vfIO(<^aPAGyRv(7%pD&mOLA`MgXxa0b&-`4x6et zcYzU)&-g}f^s{w#P_dk1^_`KAx%4_T<^6ginfY;|_hoeyG5QP@#GQ=T|7g7%(?6#` zosdnhH`m^qu>Al|t;tPS!`RXna43R*v3Yf>mhwRa#q!C(vffZ^fMPgrTvxP`1AR}r z$N7s{3&qF`wiq||q#5^u4ZanOA%>8amK_G)SEtT?#Smb^D};62=rR`YfRwBo2aQjhV|e7##7zYM*reCNhMJR?N?B}5 zB4HBLUyP{5WqzE`)lh)`nz3wW{Dj;dG$1GN%&wWut@zo)ha8UKk&hD3Ae6GnV0F0j zYV9FEyJ~&smFKV%Of~jL#Q;O3ZeEH@+wkjE>{#s(L=DPXQpv_z79gzaGG zXMIJT#iCz*=A|vKcg)9Pd4Y^Ds~K;62>2m}zy&&Z)lTK?&Y8`vgxN!U(r&?ONk>3L zxn4+2@`$h@c_T%zk?cU??e530eR0cg)adrRs|i3MHm^ zmThMK?Rq)!e+#lmg>SEkYX`B=kfLIJ%Z+8OiKXNRe!14yKv0Sj4$)G1xxbaSI^^1?Mjtr$+?7hEzncxy@Osns zH9To{*zY%5#_^3?XSc07&LLN7x~+m^eAEQq6j*&zaC=Qn^2ccMysvZ;HuleBL9RZe z544@XAGAP9=*W%KT#ft%P3eidiu(Q3S866mwIwRi;9?$VAAq9+B1t~~HJO9W7x zVd}XXzJD>)*Wg%Ybj{E^iv!_-`)Ac9J7jS zYWj+-C$dE>+l`nU7^*YMH{Vp^T>zzJzGY_8=pI&9sI!#E0n>r{psVIf9BZ|j*Hrgq z9G3c6A#ND}KFN%WsZPTzjKAFWyZ^;B>~) zx?qYf!2)QYO{6&h=Lk`tVwK7`R{$nfWD6;=$vG*4qW#^{h>pt&M|UQHXhchHN(7Vx zBA~DW5~)I9uu3+D(yE0bQ7q?D0cOmGtTkyYI8!etRYfVzws4qGwFtS3^i+M?QV)0X{gDor4DIHG1v~F*w8^;onRTYnGa~jAz==}Ik zKRtVHUghA~w+D?qc+9!xU#E7?ZU8qSV%%XLA9H-X&dMgA*=R4QCTEle@_2`*lM3HD zqZ5PaFu9nTW(PE)w;bhHlNh`Bm#(XwSD6cm`na=pPW6s4Vb$DKkL0)C#J7q4BQd^7 zC%GHYs+aqo7;w6aO=bd~8v<-hzn%y^UK&ptWahT$yR)OFjUfcfVHj|i#O&UC?h zBdCZrLt3iLWKGLK88+_i8&b%p_2I{A0FbBk4PaT3yjKp_7K`!`=lBI3zKCE@5pnlF zQT#RUw}H3-^>NoVd;Pc(p0j0>`O;;TB}tqeIE#SofQV;5 z**MZ_x~}wdCuqWIfviZu%mmRD9vP_az8cks!I$>i7TqYr0hd(wIDjr9 zxYZD(4s)LIQ)K0uqL%&m1Al9OnxJOsp&^X+$`B5`jmRtnFJXf{Ov%rFG=J5jJpClz zdpt{2&2htFR%lFzP%Qr&7i?S*9y4feu*2#at67Sc*0&GWn=>!)b4ni!02ONzuIz)% zXz^BSFUzsjTm<7Mi#{CeG{|nG^Z0M}oH%u_z`#8^1cP_`SzlJeLJC-x0LP`dthU#) zzDz|K5donufwF(th*|`X^&tnS=4~3*w$?A1wHg1pXRcNx;{nf+&XdM&@V5)CVs;(x=#(JK)fBM>T4Sv0{ zfig1HhLK?Gc?=x@Sk`IY8bZS;FYDfpy{u;wh$8@qof{)3PH%gvo|+2P6a?}81b6G5 zkEMS^slv5Dp%ote#bxIFLRU<5`Ee-YBiUUmBFq(xBMc*3JN-j3U>gB!dB_>>wNaxX zM}3D3CUZ!JDV)u`{dR0#yi_~NQ{C*O<_0GoAe9a*bR^)|fBB(_TXSe=n zr6VP|2UxzVz4KmE#}a=Ri7W*A3!RrPF`7;ngD%$hiIij>W!pM&;z7+_9^NMCQB$6*noum0r69izO}PV{XuJtbgbh~G&9IK*PUE?Hr%cEDXNno9~) z5^!gG=|v%o%Zne+Mhor%{Fq`a@6YQy8BEU8>lgXqMlRdTf1D+QkLO}y5ClKqbnXZFOe;|7jcg8NKu=cd3FXpt|)K8_B!F6%=gS117*>i0mR>ML@mQb!U?~ zLQtU42yhBF{7dTuK5}yW*RK-mnmyk6x0$o}^;%*8wxlacGr?XB8&|WS8@Uhkyk8FX z3t&Ad4V=zpwo2s#T3w_DwV2Ng_mY~8bT2fHfPVnd#AGKR`{dp*5@dk*1bZV>dLlEi zWKHbjrE(P<2WqgS7z4M$bq~uq$ zE2>Ei-0O9F50gH)k3JJJnS7HSnVgv`_K&*$k}HR=K#7&t#mdBGdT)83Sz%SIWw!p@ zk7Pb_EZX4RMJ(pjES=eq#TF;#;@BT%nG$tBwH&`$E*P`Q*>JIc4z4*K-~N87i` z&^J1C-1o4HR)=otSc$;C*ndvsc++`&xqfQMKF*hN{xicSa#YN}U*>FPxPihXX$y9n;pRtAgr^uCjSO1v{qj!=I3 z_PmYfXFj3gley&DJ6OQKCVL~ke%SIEoK0rCAdNq!Lf7;l>1rMp?D572vBgNp!U_2{ zGdf6Echa`$va4=;e7+0HrP9wR4IfhY=9z86FHXFDdm^I9=xs?(PsGJ%T#*S0iC@br zp*M=&BKi=0t(XwP3#6CDjGlP=sqpV2T7%Zit?N?7lSBvGiFoeCfu>7R2&T0*dl0t)@QLQE?XHHWc0#y#4q^ z5Ye5K-;?%J_y6PHPViCLU*)M#LdV`xRx+swlqAz9$2Zxi%>73b%B`C_xv#u|#8}hR$gp)`% zrFGBG*88@N>DfOo-}(IFRg%$H51dTOa?KX69uB^GonBou|9H<=dpL3v*ui~n;1d&y z>s5aEro~&VWO+I=#aB&eCRkKw&XxDo*H6=H-(Jnn()}#AzEx#v%{TSGfBVzd-(G)H z_cw#TpZu%lk6HjP+r|^jKZ=X1sU9{(@gzQE|mTQ|~-}8Rt)y=9hF>RbNgY z!;Nvk_=lvsnpk{+REI`lAyo26x6yE^UK&E}l2;l;J(5pSbVq7H_hXm6 z z@2>d2iJ3=p5mVuqR64z2WPa=P^)KFf_-g3z{HEzvIX^tYxzl9eLm`)gw@OX3HSU(?riQ?7G*5s2Sq*SU zi*h$L!pZL_X)(w6L@dfO7(Ce=(DXf1yI(+MKy5_4BVaRqls<=0BPEc#YPWmDuVFJj z+S2Ja;qUQ<1j2g@i%@`qP5jI~6&Q|y`cHlBTtc&cKXW zyediok*c!)We;gVc`Jb!gy&4%{Lj*0$tp4stbp6H%$>#*e0~`xC<^%hlbpX`e;#iO z-5Ic@;o<%B&)8JvCv`KkD7-K^!Rqn9r=TD~M}QhL9{7_*ds-RBAfwE2kaJw)9uN7A zX%)E`#7R8FU!tW##^rP)aa4mc8h*&~)pJDFK8qkQI|T=tuoA4m349>}l7Iws*aR<9 zYXm~9(%OicPLri7gcFr0vz~F<=#)*NSxu)ddw4ryNe9OqsTJ@2BZCMR{mDQ@R*G2a_*?+@+ z%o<$3Po}Nhr{{0QeylGnxdqKuxyCUy?yCHBOKfgMuO+4xTbr-$Z|9cOH20pq;0YX{ zKmpFcf)(ejV>9(>)k&9M$Wwx9+A%+}vshz+VF)x1pl~Eo{}}&r`s?FZC&bh!K`k_n zR@tMNiR&478wsC+9RLZBicMyPLj!SRCh?+_l8#qvUy)SMHg@4rT4idhK)Dl>Eb<0e zCK;NlR|Yujen-N`{ocwhxNP_q>m(4gy1?A*3^Bk=fXxKJo)BcAwhRqKuGg4)Ay@17 zfMtcU9vL(hHI|B+cNId<7Z)Ed=VXWC)AU~uk@>qUc4w(oD9of{;`I_ILT^ii@$Y?W z=04{1qwi59G6?JX*aT4AX%rA|XD7}ldZ~-SHf#fcFLyhpy~UQpas;BRL+I~7h!Cp^ zF;zg1T#UFdc5~-#eh8JTQRB4T^?}Q@-)wVQNy0to2feNk))3T*RF;^A%uG#^<6yi? zwk@#poda!3SW+%s??)SVR%S<3Ic$7(5ZgL3N8%+$rbX<=fzvQ4f5sN>@L*>!vUk{& z0p%S7w^RQc5#dW8ZsJBvdw1>K$r(R&eI{$c0d`bAKQb79 z@%BugLE~W?FoW^q!0uo7jvB3Yq9<>HJ0!R0jSx__F8xvrbdC7nP7m|Zc_G3c`aIc_ zke5`=NyCwh5<@n`y?4Bl|AAg#vDAx}|4!pEhA=^1sXP85>z?H`jf6kLpe>bt?<|Y1 zmI&k5`}WLz%=!Dj+wT!01a-Y^0-Tg{xJBa|tLsc-@8sn2Q0&3Ml8x^*;OoAk^Ou(7yEyp?pU``zVYs0|-)^qVF#(=ovi(kLC zTlJtxhsTs>`Se37>Td(8fI)yOaDoCS;%^5L#WgxNv)ZAQs#rWXV1z(-0Sxdq|A;mG zfY(MxO&3=k10W%YpV|B{+e@~@0-zQ zGsHE;`szR;639=ZEb@sK@5SAD{4Cp3ns~+S6)8}k>~_GEsy}_lFW7pKSGBV^&j>3! zsp39uQbZx51KtAu$1xIy@+?mnw+$d6k|kYn&OAyG5P*8}lKnxbUcLLgf12##4Rbk^ zjVHmLdaKF~>l%*}wumyKcrW(}uJRBI{wXRWSXxosGXP6V>$8oVD!;(MWEq*sSUqjJ z*1N#U5=Ea9uK)Tg8bC}Cnw+(#b!W#emMNnIo$Ovfm@!dMFLhqM#LyF63_;l&0LXok za3UA%J$=|E5;Kttk3EwYjwR)Ab46{65#_xe-$u`HIEcC);p>4EQIZ>8!Kg^<2(Nd_ zh*CS)#hoHH-+kTr!#o4KrXu7wWP^uGnj*TxR}QuNW@a+{@$uoH)A@Sl91@{bdOO$P z;_jYxtM=oC@DInwm##4c==Cbmh~N<*?}{Nw3@K*e*N0m`1J8WwsA$=D+i!YLaNPb zobyYAlw`gInWP~L7?(=2jRG!iH6o`d2DJp2+jb`c14fa7R+*4h;+sJB-ha^$* z%PVv2=jcD6-=}DB`4+yS?1~_iAtxqp$={j(aBmF!O!?&Fv)Op@ckj+=j#PRL+331U zHWGQKc%*f}^Z@(-p$7CLe%=h$b$X;;_@wU`K?|tWCj$!_ySf`u?r+dPvnupCFs4xP z&md-u`#m0G8<6{IZ#e>Da%$)AL5)Y265n& zPv_PxrWBanbZOVrk3(LL6!>nEl<@9|oDXmW;(ncVp{3T|_iRSmb>%L&ZKujNfL@fG zxbP9|=CO|^OXa4$-yQxvAXBfy_22Bd5 zkCNuCpnq$X>gdFoMCtlv%t&NhvAv=Kr51w1$17U!AYZk{cRLuy%(EgMQF&wE=TW(#{i636vq3o~#_{^v}(ujm5N%=4}QV)q?k=Tl37N+3xrg0lwF^_P(F^BxK7?bBAta1eThVZX&dE z34p!w6JZJVq0xjmN|&rMR#{=0TYF7~N*^xG1*h5%63AmQuXSUP$8rfEuqf$yLJ}oE z>1b^E7fnj>BAr0xx2U$#0NGL*KAXwt)SlM89edcwHj=iX{KI~gFv&xg8;eJSzgckE4ih zoiC(ccMenPMkK$&r^HV+(H>VG=5Wm~HZVWvAuk|E$T1wEF&&?6z$&Nk33R2kR#O49 zD@(~La@{oh)4#6V#f$_L^Y-c0^^>#5j=3D;lOLSiKpL*jb}Emj@&qbhUc2D)yUdq@ z{V)1P+6X>cmn+jYYGFy0*589xK7fwFn;YUEa6u`>1E1gmML-~ef`Mw3!of!f3I2>S zq32!w0W;$j7Gs@<-MFrJIlE@Ny5*hJyLl-6m@hgILz#D*9dDFjL^~%YsgHR-^;}}> zNaV*&%b@DGPhs%ygY5zb)tH3?{kq!eW*+u@%=g&hd}-6_Lf56sv**%XVV=*n?$OQf z+hac&x7}Lf4hy|>;QaoD;G8E1{7pIF-}HqU8Zq>ecBMA28J_da=LQ-dayTCuyK4G} z?2tU6C@OD#aYMeT-D3HUr5sYx-`C~C}62hkTt849WM~!)-AEBB|bb!K#owYyW3yJ=5XU&}I zBV)s=dARP-1baY(kt9WaqW010|6q@MkKM9|fCT`gRk^jAN|;ez5UYqGxd)@K!RP&- zV@D`kTz!2|ze%}3nW%Yt+g0Xp=hXV@Z0dV$!U#s_E!Z6QopJY;Y&KkW`kZs{{TP#t zpx^28WEzncuCLVjdeMse&>w3P3D5(FjS`+qM<7=1NX*Z*aY)~PCaT?&W#uhehrJ0l!OjA;8~j#z^HuZfU;XlR8t4@_2Co) z7YRs`3_DPPpK}@u;}e3fL?<^FooBI_&l&TMO_(hMBhVSArTPC} zWfxW_5#2Kz$>6j}fu0x*>?k`Y*qpofgVPWW zpT1l9<^Z-jU(lbVYC*%rGLftT&f4Bu+lnwJyH(r*b47*;jGuPQ?ME;lnqFIrC0!E} zM7Byn%k+;B#@pRGptYg#oQ3zgj+0EQ{}RbYt_;dx0y(iXLJa2#J)*qoMdoC#3knCe zNMC1Whus*@8)QLb;x2LAifj_BFh0N95-N%8>Ypj9s`?C6QeEB z*KfA^8!eT&!ohSZ{a|uE{IXj3#q;kVdIgOTF#en{#zZ;`W370OQm$dnyMVR$V3&0O zSsDxuR@%4vP(d$9w6wLfK>XWMXT&3SV6qX%Sm2=n5gi%MDV$gc)|sH+t{gjZDyocz z4af6xwvyn~g3P2~EVxuJC$dwMSqEzVfVjOJ+w^3UXG1--39+gUAzjMj3?(!~hf#`JZqt}q2LshPB~xK7aGl3(qy zPca6Nwr3u^GzeWPAmSM3I2X(ZM0EXZ`!`j5T0dIR2da5RV3$n`HMMlBTpcY&?AgDq~o^ED`GqQ+(sOsn3;aS_D?+GPMbdsSoz zgR(Xk7(=j{>kX!G|MjV#u(e8`rSD!th}l!b$`a3S^I!yEM&ZA0J84ZD2trxzzT_|wT=GY(0o(N|ccuZ>VG{?Fg9$^f#j9ChV- zxTFIg+~6IQSIv5=5g>r$$<4vL{D$BSORmrgcCK zq^kPwUT@DsmK|w4grI(gW!nZm{}c;KP}C@PGulGqfC-!b4llyu*C#;a0FP$d$Epl5o>ddSnwj1Yzir-77;mJ=uRI7v5pqH=x3bW z9OgV%xXA;a@rE@*_WH6w(Z&!eT*N5QW5yM4LWzP73p08(ms8C;TIptxakjIYgABnT zq4GC2CgdnmPEN;>GY|eErJ~AEi@@NiOcRmZ!p22R(y#(r*(g&7>4`xe)W8(1!5-Yf z7lI)Q5^*BL8!D9dtc7}LhA!wwo67Hnqt3eQhWnmNG@of18qeW&10e+p7glcpBqv*M zE#``LA&E9R7Ii;_&4IwY3T{Exj5HGCNA(8bifBe}MMzWv%SEivTA*kwg=?x*+Y5lC zp$yTSOeH-0L#U&C`1G>yuh4<=_fPoqjO;v4 zeLqWdje5^odksGqYr2N!w!Ba?NJj!wXEq)L(h90Nh8DIiJ}L;P>QgvTP?`pXh87v3 zr8!|)bwi&dXH-_V=@=QCl#x?ZUfbNUCxgH9mrjF0?KkZhvCH6!wOfXc89Qa>z><|~ zw%`8~rp;coa^p5ODasom#Y)CtcaI@5S)kcM=XGfgN9T(bYFlRrPZuh6c5l9;E1WD! zcd2U$1A)5LoS*kvR@2mcEw8Y=x?N;!a%N#gZClT2;0`W;fB+H5K@EDa09w%8Ag(Z= zjS)jZbAq^9?E|{mOuod+8f}dLVnB$f7?`=>JuwuH%G&Be?;T@0M+j=1VFH~m*BCWJ zP^KJ3s`}YUhrTkqFV?X;m~PD+Pv>i`V7ge}B~ry^f4VufLxpaPvqFm)N>CYf&?uS# zKqKn7!&wikn7|k#{y!Ax5s*-^;s6PaghfEbgkEE#WP^R2;4*IEAv}hs@RFpgvX;J~ zsg;ATO3JEe=^ImKfv64{xm|*ljUmyoY1xIP zm908NL?>kyl-4w-+xWEH(u7uNoA&59of)5+Tm9k7@Y~(%#G~bn{gaCq@BV*0zq&W? zay$Wo0x485g&Nkdg)0a!5TL-q5m#hruz9G|%p1O4Hjn77A zE!%SD*6^L})&w%iK@brnAQ`EMB?H+gUbBO^TJVu%1=(zUionCXe&j& z-)Pdz`HKd(*k-4}Ipg7l2Vw~%ga}0;&f+R2alj&Das+atX8~mZhl))=%8Z6R1OhGv zyGqq0lF2~kvX;Hvy_Zqe@+h>h^A#yMRUJcf=dL`;Xq(wM`s7lwUFwEz=3d;!J=(@5 zW#tuAHr9)5n3&TvSlvDlo045p+t#~V*-}tZ<*7uC>V9f|ZRgB0-zC4usIQu z(=vfVBcNjgNSL$cli0-642+EbBrTFwr44CInx?(d{^{^^TsrxT3$D2SX1BZB{T}+5 zCq46puYBV>Klq8yf9*Rz`o-`5_K8Kk)~A2zKPlNhXYER|svE+3N3x0?6+`1>D+Xsr zPUJ>$q$3jz(K>9@_^GpZT(oTUru8?TJb%;GyB<4Z`G$1_84Ubb#&LX(n|K9h&jAyU zfQ*g>0tNvChbfST0}vh!mzau?#-yYsN}R+?(nKfMWR{RoRM+uhX6x%RidqI1E82-MW+GiQf(g_W+>Hh{6?%i@+H zOb#5m@j!kcpgCaR6Oq&L3M4EFHW8331aty2*0IKRU;Cdjf62=Adt>6X`Ab&sFf?w) zf)yKASqvh`HXHUXZl0`fXldu-$*VpJN8^cA*3Kv*gD=zi=3m-*jZWSB)M?s7Fa0Iw z2iu1eb1I`?WPvc$_$D*8Y0YGIB#z1jl~yE{$`vWCoM0kTs5H8}_JwtZ$e0qLaZCGMiYN@L2!K-&){wn%l;v}Q0EpYB$Ag!WlY~vD@)45w@ zpY9VbMJkZkX6$&vv%v1teU=sy>*H}$`sSg zF!OA3&0ks><|Ln?qo>R{T-+p?(%trxt)}MM=&B!eG}cBZy3(Wm#mZEonKt^QvMNfH zs)ogyiL35-;xgnE2mMJu| zcEK}*T6REhbU+vMK%p;6p$F7MAzGtvWGcPchi4YV=9 z8YevB9|@ND95SF`GmkEJ#25SA^2{HOsM2B1Ek8|!9CeYUMfB5H3tjXfR;E%db*+SQ zDvFn)McWU6Z0v+Rus8OH37CteSckoV=LnUyK1E>5G#3A|15Y6M0u^MS1Mg=PmUoq$ zQ_(c*GyH-N7ysf4e#TS0!(W|U**(4fFtv61u(kiX(2h6fxBFiB>_@-&*Su{9&Ru)& zkYN+%t@w|K6g?zsjw#>V<~i??6Q{^7XsjxzzWUdy&h=JQSryfxa#gBw%>rsPIE{>R z%qy+TvYWGfMoO46>s%)tE;{`%V03{qAGDaT!!g%9^UoL)AIN7R(O0k0O|`m_5UG#@ zaz!C1KzosbK7~Z2Vuf4S3$Mcw-isw{;~JkZgeg3N6{3kxtR$BBq)(0$hXkY{pCe_W zku)V5Q3Lg%6Lf~|qcl}$NN4mwle9=>T89XDAO|ye0|E^R%)mA{1QJZ3gca-|2oO*p zvx`_L1EyKdEE}_(46-jVj-SPOJdBU|BYe$&DNYma!cWBFkjTVAzycAXJVCaktF*}p z8OfazlakEjUXrq|SgDkQa#g{~SEXvyNu{YwEz}nksWctZSPQgKhv+~TdZ15eUuSx+ z5iR#aBp~V~+Z0SpC9;U+#Jbd#2GeBPkhY~=+se&iD0gEyk5)qKyUyP#^f-FUed$qR*ghP_)N}ax_l~{sOahb6 zs-BE|F(8>X)N}-HrOt7q}M%qASarG=P)^Ky|?e|_xjVJI(!F}%j0Hq z2glj*=@0)f9*oPM{Iqktiq^490;t8W-bsJdF?WbEPs> zGIiF{Ww0!k-Evt!-SDxf7mN(REGh66u?7HtUw{+qISKMFN-ws92s5L&1^lh+D>ES8 z7r@`Tu2OfwKomILSG(X#;!OaZDQZCB#OjkkX}9@yO~bZ~81PCzLU=Y$dB z1s{-E3y|RPT3q4;pOWkVaH2mafglCI=(zK4ErC{K&HiOkZS)Dk*F=PsrM-_35E16B zG9cPHJuB~`^g_E{bQvH)s;Mj^7WGelNP0~;Fp|3gaGmuyLgl&iMB3`p|c~;5))qfUk%) zN^1TGe@y*(gi8POS7kxwpvI@C7~psu5CwMq%JbceINDgJHdJ+tKZl4jFF|Je;nS~J zIKiHlRw542MHC<@*@6Si%6ytFa6XugxV)eVRIJ{;q4ma9_>F!}b2@gT)!gf(ojbOk zH(TqCG7ET44EoPggtsYd1nAX9NF~n) zTE@8(%Hqz$XV2s=xa&}qfO{h;-E69l)@}|LTC4? zphVLcI3P=c0eC6B5ioMMaEsKf>3}WmCnrBMnT})n0d5pQ>D=QKh+0-E1cOHv*4AmG z;m;g(S;*Q5wW74+iR#=u5Q<}pgj6nyNH*AB7*J8BFb)tw>oC!m#F~j(k!94wI3^2+ z7v)#n$!0l`5V=-MVX3?V+=*lQ1h$%_($H$#MZV-G{2~CY!kYq({5ue`NSM{&Uwvj2 zhC?m=>G7~4Y7_(WJMuChQAuJF5QP)Y?3d&TofIG>y(HVq)`6HP&^5tQy_MS0kibbk*x*^~^FTlO3q4J&6}sa!Li57<@(u`4r*%m7 zfFnUA>g7fRdu-<*MV^+&3I2oxpOI_>N|xZtf!l8TqV^ZgVSxRP3MugT>RJp4`3u7fkl%djy1i>T%+>na;rKlFNn7QtbHIp zNU4@U8&fjhxRqLNHeTyGM0wl3^wNPKRJfTZG{WU^u>TH;b{G+?HiI4*6IO_6JxFms zlKE2m>K`Xy=E=}ik0sUzXT=o`?ecCq59}V+JrC zaX>WimIo-RxMJ4(Z?qG^+YAM4T@pQmph9AlIZ939UnqMmTFrb3S2l3s^f%Z#h^}q+ z^lk>tg-XizZ|rxzB~m+cyT@L=LeaMF3ktX0Q-$``o#fjExE;sz8Lef;DS-g>W;1sK z=$uT|GS{y%V0tUea!NgG&4iww=B>{Eakz5F3o1*Am1%}}DljZnuiPwN`Vym;xV@A< zI}8a1^c9MyyzJ{D9v`3!ZWXPOUVwkLBrXSduf!Y_XqWfCOKXbK8uBB`wVx6IgImqL zLEh@8!9^k!sl&)1PJ*+NY?n#wWMVYan8vKEXV^4|+c=d2voY*ZWas+IuNjX@gXUg; zC@MxpIy3Wx#=I;6-J>M^Xky|e!6JwY5(24<6rdUUVssS!oTr=@hy~7y!6cg~F-Pt( z;-nqv85a&n`9I?uqBVf;36=p!N|?vQ4fGnM2N5Xr1M%JLyRmz;-UN$W5CO{MFSLP{ zf8m8#H>nE;b?OH8$(hgj$bLMckmBNGy4Fg$)_@$ApO&Sf2-EKzs z^YcS`A72dUjt?YJ0hll2C3E-AL)FMkg1n8t$zXbVF##T*4DblEnl&IB-x(@mAC;X$ zP-y)z;-Kjs;phQ{)`snT`x8JvIcKb4_zZ)4a7-T_43L0X zB@eSRjI{uc=!HcTnY6t~!Rkfq1ym`V_yY~TCQ=9J8RT-?+qJ#meOqKGDz<*Qv-AGo zYSKywvd(nx^|Eyyq>_{il6!vL0k04S%jMxwx1d;Q0Esz2g?NE*<0#vTKJ#)$PSJdb zP$%}0k0BQ-7F?V+qtsxhLbT!lkaz*ne;a-tln?h@jIy|dJ`!nwFyjSnu=9(<6_nnN z4p|@csDtt#V5y;7{3gbQQsf5)2+^MzLFT*&2{F5rtl2um^|MX{i-v-BJ>R7g_>l>6 z`@S;0-J98!MwDMhu!s#*b-q%7t1mzT+;bOLUn|P6>L3*GlLH5CAI`@P!>tLasrDVy3Qnv9cd6dctA&IS+O72IG3EyBI{<^(IPGylPs65lPg|i2t^gH@m#Fw?0$7p7MQzpM#oJFg4aN_6{XGh5&g!E5Tbl? z7Q{3wh}Fz%sWGD}!+x9tN+OTGqZuMX%ZUy}Vw9Dw(l_XA)Xni`9EQV(kCt@uDlaPOI+$zPa(NFgS6YkrEb6s+A@sTkwA!?{X4@Xnw8 z+tds*CV!X>X=!PBA2F7@B(Pk;s-({ZVI7vIOlXMDz~iFexplGQQ6GQla2)o2fa5xh zeOp!FzD4`HOYfBkzC5jQfTjGj;bE~vRed15plSpt!=(_279{9|N25kQ6@-CxjR3-Z zq59m3imlpk)zc*rXYMku<8bpSE6~TQ;)hNj2OcPNrT#o`tx7sLZ%1 z&;kdFjHe{dU<@oUxMche8Q_>sEhjQeG(pIjYGp7ADgpGiV?rr0YJHU~lWC8o6=SArILG3-5;2f#cM(MO^oL+C0ohDCiGsTT9T6`BP?B+0Q5YFm2c~4!7|EjX zBr6hZs_K=L-QR6AZ$#WoIQ7I0%Ap8tX=s9;WoOo!P^Op#{Hd>cxG+jWTA8KW?E+3a zK|}l}mg=j}egZNsp`}9EX0-2@0(-ccpb8?O;3HaRo(Rj+1q2lVbEuW16^`07cut@+ z+)*1wbdZci0|fC1+>f?1ue1Y-va%LK33^ zR_5aPeB*D9_8{AF9j&;#Jz|; z0hhE20({hT0VBHuk!oC!kQzH|nLL^49z>E>XAci0j=kY>FI zH=+2l1jJk<`w7a9a+s_WOwT0UJT#|+0S23=PlmJ3=sOpuPE#}m%$J$-Yv1J|Sg6v&w^MHrc#rSA^= zwx5H5`k2O=h=7I?(=OrlIB|02>B^N#4KRVJNimK_-N%NWn^8j=2UlgSm5lQ+i1(AR z9rkA}vt|+N7J+R{n6kows*c^<|L}v+9tanGJPN1Wd88N4BI<`QQ!@-zF^myr^5Ys$ zDW$#;Z?kp1*Q|oYb+hqNK>U#viqk=KR^~|vAX6#aFgzNFOq1dk#qV4A;}Vg$8xDK> zwx^!UhE}@9Ug=6PfTnbwqK+x*4cwd|UiL*Haeksb1la?`URa$!K5P-ig2-W}56}Sz z3$>-iQ2v%nEim5eQ^$@Sieqrf8`C>+OmqT)jR#3mQW>!ZNiNhHl3qdk$gVTm{+CFgE|OZ0m?*5i6|Zz_vs3?cGT2Y zAU_c7B4>H+6`r!3g_h&$2Eu>!*QK5pU`L1oq{Hk zlT3AjDW;a@Lp%l3!~x`GXYive@yYRHTO?GQd%v^c6u=W2@$&fonAzObnP|>s;a=Ug zYy8zD8yk?OXp|QRWs4h&{;QFDDVTS5P(gd{#>zd%|!@Be(9@ zP``ziwed^yO9!of@{!h5EGZR*i>XoacyVH3anF2y49LRi`kCSAkCmum{r4+lIF&7BMvjYY&Lphwxeq+;JOv&7F77))@dXY)q67RD{wy z(dgaC`+8QK9&)A~OByJ+1L&NpUc`Oan{lWST=7Sm7hvkvK*XBhx;S>0`4PVa(9>(! z{LTeZF^AFOH(=#0F0g`R#Q8DY0@N^ev*VxN#TLW|Ie6;Fk4O-pA)YE_ll(o)?2>a= z9S=-{ggGgyaYBGa?PSyodO%3$qc?ME$70M{#{(rn+`g^u(N|-zNFvwqEjf{7euC`w z!-t=zcZ26o1c!HO_MdzZzzD78BbM*H;2tNd9*RfDp4hFmY(4v!yFqneXWLu_Rr50} zfu)UHS%WJnS-0Ln#o$vkBQU#W$!kY+YI}q^of#PUJ6{lh(sgo?nU*rMOWvQLBg_L$ zvV~4NpVdr!#0mF|=3_6#<{HL(F=r}$;h~K1mF)=Rfqkqr0K-`lJ<{frkS0ADp`9i!nu&A9!(pQZ$7A0Iy#s&pweI%uu+S$6EO?nG>3# ze-M?1F$ougrGEUQv1Bmbfl{pBtU(nr${lx($I?Bjmq4ySEvf}|Kno9qrY$#g#P1$L8}zOvE6lv#0;R^}0lE*=1*tke+e-MK;f(5l zL>3|Z`gr4peiZgR9UjQez$Rc}(wju~nrGAzm_3;uzO~le1+5#AL{U2;qpT;8xI&r} z$}PW7hV?|Mi%CS7^@4K;@?iE@Xz|fC#x}rB5LHryCMtNdeoCYU4k0}5L;}j@EKA0L z#j^T&Yv^xaWq$54W9Y4|eH-Gg?|$aBV*9?Pt;D*Dvd1^HrsHiNwQyVA)u#{Kp1Nz_ zXr+;Fir};->UG37 z;7@&<%7dM3L~D1E%y@jIHQeZZGus&R1{h2|JhDVh11)Cd=HPT-mQDk#Q!^7ABr*To z^v1WK`44xyYuftEh?dHgdPxpbgFk6A^b5^doSj`qvxvl(``zGKcOLAu4rd_S8tlljHFS zU6>MLGokfSsxUx@BSK|1mL8fa$pHT%yKJF@LFEG4P~b+Iqr<6fEth#x2_M#nRZYR9<8|P=`g{Q>Z;`snre2WO;DE+VtZI90&WK%c99f`H!Ot3~5aA=D z*_fK4Dxd5yt|7qvyYW}giod(dfXsw}6?hrk3I~N|Xp3Ru3k#8KqCTAaJ9o^u$q7P+ zcrvOB#QR*IVZ}bsYLw|YA8M|`pqk*8P!`neO+$TzvU3RGHN=PnFPO#gWy`^RJG;~n zcDYZd!JoW-22ol7G0&&T*ia9`KD8<~?>p9yTUHTw`-7%*KeV?q_Mg-_<%I?7N9Nj-=t%%P?KRZVT$x?t*!f=v%W0{cj7aUtRZ)WKjalB0+ zTv*ItRBUzyr8ScqS!PT7FA;_#T{dJCxKQb*R_o6F}VgmjD`hcO$*^;?}*V zI!oU5w>L6pxb%_vRL0NC#bj#ORRt#|$@;kwZotym5)GBY?7q zk~EbF(#jekTywglqy#9y%HA9OF}9@Oj92KgJQ3i4ZdnfVv1pC#1}BP=0L#8Vz{brW z3cat1%+uRo+ZTr*kdAOLwq6*=#2RU+267y3t>z@@tP6nFlKqHoK-RVqjsmc_B`~|a z>x^E0u6tP^hzjCZmid%oQ9^Id=^zA@`f1>E^{gbv<_|k8E4f*Cj z-31OR&g_pqYW88fW~E~H-t(XmbB3|UH_S@sPm26H72nVG;l#{^FoBywzz&7T3I77L zj={~Hd zmk?6&dq;*z*g6w)Fuh0f$n&bTu3YNPk&HM>O{XW zg_@e<0{;ETTK(ALM_)Remdey%b~JUccWhy9*L;2gh(>slU_LHd+`s8ez&8tiXhxwK zf@}~Wz9UxkND|U=YX>zxD+pERadF57ZgsgX=DXVaLo*lC^L~tpr;Em9D;#s?kao1# zCZZ{}R=8L`SWU=65zGDVA-2aglDL^_&_^%R0ke0is^a<}ETiyWYp$bh*Q>k|3$oY7u@GvLjWM|^VH=FpK$%_qUv;zyDA z?sf54sDPM`4vZ8u+Omf&dApVKRhA}u8T`3T$?BZ6vOnu&r z2_@6&4%WkkH$pAR>|wz0kMg)=AUpN8y z?uVqcK|5Q9j<^}j@&qd0vk}k_GCvdGBK)i8$fRPPpO0xlk|iMmonNimDR@kCy0y4d zSusliLnoh0?b3rV+d*Qdk!Q^BhaHQ-iD1FVwvcNum52F0#H!MK!onGEEZk()N=$7k z+)D=Z^7FXQiC*EGoqhh5g=xqU$NJwYGX%448P*hN-GQXpHuV4wv&PqYQ-x$i5p=c$jFQxzvzQIr5N*!4b>$Ozd! zHIBA&7!Fq&JxYE-Ie2HxBYa?1Ul&k+!c``ot~niwBs4enT7-+T`Wei2?Pi#04|c9p#D|npj255amGhts`G^3ra7KgYGt} zr%H$z+;QZ9d7~U?BdB3Z82c=6?Ajj2djjG8vB6)O)fMnrZhrSpIDL~FoNS6!0OYybobBGC$JxIvARCE95%9q_zXw@-CKk#@A4#4|`C$xa@F zSOA$}K6T;m*ukwR5JXroo`Yp~t%FwRe(hido7ZxaM1m1il6D&1ai(IGjBfX8_NwS7w$xHx;g@f<_)~numjBM+^L=BmvD{Z01#6 zK^K?L{(Ns&Y=sdLH=wa}8ouHmJjwQvRz5M}sT`JhDaGX+0yBh>mz2~Efj6S4j0RMR zB06AJ6mlXtF9{+X&t~1+WVWM!MyDu^AcW~|5b=h)&*nIoruOdZdA$hGhsOH%V~W`5 z4wjaqrqltTRp{U`{Qz?(`5ihvuY@bo$k+vUlDA(uK#xegoFWpDW`WA2@WHz&=U`HQ zm!2!t$%T%CHW>L8WPPq6Gao^G`@y5nS@2l##!tGwe%N`tXgLJh-U9mw(ZyOnQ)VJb z+FR!3&q^)Jc; ziYkgxHfThXASO7|@?TbGylw%~nh3Mjba5(y;&LI?-jZn9l0G6ar?ASD?_AY-(;@8o zf7s7XM>=VE=y2AQXR!0#w82_Hdg2~HO(umEI~7N~A<0j(NRf|3->(#EzGh)~6;&uO zAtd}bOk%ba8{Be#;C7LTO$V@{A&v%b0k4wl*&W#3;W)xiA$v`+?eQjl%w{Hp_ubA z3q0tK?S!)G?|>-_SzJ!~JdtNl(P2;q2I|EBfO#i>$W&vaq(Zjoz*{fbd9C=N>R;aq z&bRvH^*s!txwFU{-m}9fBcOFqiz38;ArbT8$t1=iPQ(4m?7*$~ZIbwHtRl&fQU>$B zYM_35Z8=8mNg2BktKBH8bi;`JUJssJ`E>oZ9>;Ich#2r5E z@dAk<0LM|-{zi#pKGr`0F&VKa@WlFr0;WWDKDAp6fQ;o+!M*k2^`nI zJ@OkNFUBuE8b+6Vv2nr^**BFmqFyW|G8#SyGD2v;)O)EtoEi!;xa%9|08qmv0)oVI zi`;b9>6^^D85+`w#lT_&AT%lyndd*jT20eId@9z_;IQ0 zr_WYDm`O)Y1dhbgo$K0QngdbsYo?^pTP0Q*&_V6-)r#4_FKW@KaCWg$Lpm|dFCyfc zSM>apoWuB-K)=LP+$^5}gSXy7O{RLP&ps+~7D5smdJ*}}4djOA52|XUuvl;h4L=L0 zEsB;fPKQ(OV2{BCe^h3esq~+`2NMabgEzgWobrg6l-IHV42|lSG0uMHSo)29;R#S@ z?VCfy2_|tK%M@o@TmzAUx%T z;_qq1W(hgCQ6=~;nA;Xu>5 zt^&GwDv+KXh3XgdOHrD}nRTLU>|pCPfqwYLR7Q}AJ9&B6Rt2A!1#ZM|W20?4@M6oI zjI?9(l#e>eJ<9jY8;x}}Vm*XdS=!kx?vhmK^0roX(#rPj+Uq0JV{d!7HGGuUi_(BZ zKE_BG{*Oo2x5V|&4mQJ%gwWsNX299E2G({es--*zbdKXM9mT6(9+qRFSEe$`d1m)< z6#<`+T8%!IK6a`UC}O-Bw96NKupD6Z;Q10!S3bV*U^TFw6QAoGZM|uBsAQkU7jOQv zi?rgtEp?V9g#ep2paa0G^75ZHm3a)!XwfV9+CJzg*#B3t*nT^e`dY(96r$$6xYl`e z!8!zFtn%#_B2k!ZPctRuVYJYJf5;I`%w@qnGByzB^JuFB#U6`6RuSQ1TpYG^gh39> z_c-^3MUkcRSWv{AoSj^x_>pd#qUeDfESyfJC|>@i-vyUym4B(2;lAuhX{wzl6fzJ4HytEaUcXJY=O zpIL%&TTsRpL~Us>R;HKc78a9McO7?#jYFii_8ABX7Cb?5%T>$%>=SZm1s-f@gSpx> z;ZW*GobNCt!vD)4(vR26q3UkpVj$uWfbbgrhf7pEuIF4hdUpaU{ip84#Cl+8D(wW6 z_*K#(N3xYIFe7vh^)s^23AiT=z0VZG==_^Pvr4*4DdEj#G<@q+RysLcZ(N^xL5v<~ zC04C}PTaM!x<6yuU=oQXl-x%ewYz$eC&0O`OU-tnu;VZ?=1VrEvuT6~bO<)wL$QeQ zABM!;fYTAB(TRqt@PCU<6%@*`?#1$7+Yr7GfS0jHS%zM^VR-BM73m9&f`C z7WyVu7|d?{zZ)Sj81CTv!h<+$PUqGw#J=b&_p`=qWSca!1Q%Nffg-DZBRXex`R*@x zCcKQ`n|<2HJjBWc5W{rLyLBCqmM`Cv(=xycVHwrG=M|_WfT*#3Op7xNsqcqo+Q1FA z{9ffS!{F?V7i(_rH%zDh+!Xs)k5Bnssc-$6N%yEA_bYIpedxzKU}>xfD2F;?+c2c# z+6qpuH$1jM8{(&hh#v)LR{b^<>_B&HAxT1dL8y8sU~PqnMU{^}eoFGcKds)Z&CryY z6(Y(GDKeCLb`*m;fnzm?(afMWJ~1{qGM#`;cTC@x{ZSHkA@Wb7SkA|gRD6VK8JuMo z@qZgU77AZVXN{Psh+f#RIY?rof2ce#bZGKqwS?nzIO8qabHt0}r^$$>8C8#=QJ^G0 z3PGmV8lCeM%D^vzTlv=`B?}EY)@_eC;%|Ef5QUe-+5`AhZIB|U&uUy1?0sGW%tqoc zYm$|i5m`I7e=5EdqO|}{!Fw06g-vhTpQTpAnB)1AgsAWR_z?=;2d45=$9i6;nxqw3 z+dtjyeK63C)D;nIbJNpT%^=~%@7F9Mt7$7B)_T*!`@h(H=5b$9s9vYKQUfzO%eQym zx}*F$kml8Ie@5&NKv({_vHl?m!_gGKITdV0%oe|~GPk_2u#yCZ^e7htTF5QK=&xVN z&MPIAEju>`Z)EKj`y%)=Qk^4OMXdzCw2NcMR(R?e74lIbqZR{kf^|rheidvQPdUZ0@(^5TW*`?kpo28=9o9zS0gU z-J)}W1wKwO`2you3!#B=;}!$IXl09ZRw!k#yu6G$V{Pl%cVUp+t}nSvE*OVpu29{ zOQ5<^-!~Rzpbd6?R!qhnI~U*N3v?zK0dh5Is85Ceq3b;!{0CE+X`#k+tXj>9z?%KJ z&!nfG^$9v_B7NVkx9kWJm=4eXWOwIRr!S9CTaaG9 zT>k5Z%4?@6YyV}xCSC2sf_0wR;1maTyPNjRK>DorO7rw*+gq-8t!6BaI9r`Qy((Us zh|wmeTk1w5PHN>WmI>Ly+>^I$mHEi5jqj(TeXhi2aCGbls5Pty9uH)kd$!oMd->P) zfLtzhOy@#=`{AQ6S(+BUlTv?Rb86z{bC&@RZV+j+ry5naa+%^*+;N0Fp{Q|E4w>j@ zF#GzU)`xtHFiSnhaUL=FH(;7N&b3Qcy7P3b(aWsgjCm%sd1dEyL)@3BgFk-zTF^$y5Si@%gd02cRA`P5LMH`Y{9q?rlk>dxv<`zbu`p>-E!9t^|w=L)hKpx^T{ z6Y`B?<)}>O6POaH$yK0z6y#Vm`;Ym8Xh4UUHpCfXlzj^20nKD%uH^t@3Xo@6e}DH= zJeGES| z8(uW?&?3j#@y+Xx<$+cpE?9B)ox^^QIv$0y@+JGU^zU^cZzK~#cDdJUmY*D&7#$xY z=(2R|NBv2VNteD?vzIhWIsEv4FnlT=5OJ9yL=|No#8|G4jp+Xvo2CF-IFf8Qk+5z= z?A@Co4*&O#AG=ROzs{5>1B@&?evr`E$(LtF*&!0gn*5)1QsxdhOM8YInm#@7F!X2?c03dv)t7HRD`gg|v8Mk7(8bTG zzT5`&ljD{Ho!QQa!fTb~u8e+S^*zqy_1LkORsskeUDWI2V2pp9^y8G2Wj&=@XS zy(7!=Ld%L_8*>4jhebw zObwVhE%8ytUe+`gt~@Wq(T{fgM-#nG6H}0VBf@boeO!WIJ|%2GX&Vs5FGDHxDlr~? zY59;cvaa1l$)|T6RqzNGgAv#L1}V5^3Qsz@oRck6UTidrQ<54t`rZ+0>G|%q)BLgY zacR?2pT2!w`2B+=jieO+${)SC;Seq#!SF2_9|WhQ=h;yuK7w3jM;8zGk!ZRRoT<`5 z#5^m=(`UJ& zZa;IpDiDFpw;PT;eOs2bJ8+q*jr8B&(y1tHHM#4GYq?C+XtvhsC_9 zTk2DD-#y3t{-HVg?3?){^O4zILInEXYKPe#)H$8yl5`HU@h%(7O0(p#C!ZNV^?H^# zL|fQ&U+xp&#Pf5vjXuern0oj5ajEDzzu{ZTDq8teAcGZ2_C<)>^b{0j=Q?O_8Sn+r zdND*{6LEvskx)VIeTnG__wP1;Szo$BjPGrb2nw}-t%f6AC$iS@3|AC4kk!=33Be(> zS38SX!_p_ujEho|wKBc#a9g+n1Xzw6B(!th97Vb~?cjg$;*tIZY3z`DS3F`+~84hgNDPp<%j|qb} z*v2!{FQ|@kJkKd=>?rFm0%{*c+b+at!Po=yO;QekgNFRsSk zWmv3Bqdn=kSS1kmRPe|4nv(-2>lfun#s^RtES!6vH5)zHNcEO7Yo0%Qzw8v?OoQQ3 zF4Ekz75rRzTHSmSH&7RZ%UDZ9ALvwDd6yOWgN~WEt%f~da4bq&dPILt&3UICm)y_P z_|;cR_-7_lyG9zS#(W+8r&}1m&MXW@($x9v+{o@TvDViJQyJxej*tLZZYXj&wS48W zYWmx!^gR)x}et`KK4Jdn@2x`441bm z&E&^c?4CyB&MeXoe+iex^ny8l{!lEV}8| zbh#gQ3-q@KSD7$^85TMoiV*Qe;e_IBi&|Da)sk-JG0o^4+GebetM~CFvd&S43TNM9P3?<>xW+%T8=wmtqS?odE-OWmo;0$oT982XWKTj&l(EqXl zhV`wiN?pbQy{G(VR{?uGrn)-SlKH<5iu{diT$(6y% zdkb3LbOm;&;rQhvl@u*$En^gdUE7cWV*rId7{(=d zw&JX>Tjfj~89H8}gAb^FL=TSX24^KT0P1PDa=V+(*oTHO7S!ztxvIt~Td(rCV(NzW z7_fd0oWDu2M^VP6Bng-y3_RnO!%dZdnh7HOASRhPT>{C^0<=>24l5sg!%JGl6ZYG6 zVn`cc&^GBgT`q!s;d;IWSa0d~Lzn~62FJL)7iA8TJL_{%9=FSnE_cS2iaRsp!4sd) zjF}nc@>9>m+V3G^-0SK26hUH)-jT-?{J4W0)ARJ7^i>km_|}v3P6Pv-dNcHqqcxRH z#j0PKPz8T0Vz2Mk#CH%FZd?ObMBrb#Y`+djt`b%L^zV#`b%DqKEv5E24@q<|O_4CH-u|*7pQXX$VXxFk#eiYoa=eq!*$$e6E53RzJkMe5%6i zrirUwd?-m$u*JI>Tc!@DvYP0)f72K9C*OM?aX$f7`Gp&fV|lHSoW^0iMiaC=$kzi2 zV_8I9NCkV5D5b%Cc|%(j>I|9R1}Rsoe;dJ->u%7F4?lsVM<1#;LB#9;h21}3(WhZWx;g8)ZJ^&W@i%J5u%!hY626@F>s6ZsAA4o6hmHVz$P*JG1kvkUcCK7Z{~o96fKMVM%UlA^&pmsGct3n2+` ziwRyj^7*A$5fS6W%L0oWg|@QQ4ZLxO6bZ*)9(L6}H!*h@FzbZ0w$4p6T)yHy<6&=ze<{H zGz~|nUxWvmiTTb7SS+akHmdsWuFBLn$q)W+zbswuKx(&asMb;}J#g{K+f#cbdq^t+ zsIw}2TN+Jx9)09b#G@^mc4cE9=~-;;Wx0IXSulkICtJ4JECqLKiKNLcvPk70(iJYt zzSK?YllhCyO25G=X|##wKh0mTwPD``uVZFb9Z@Iu0}GvR{^W9)I76*>(?YsOU-MIX%xR+fMGeG5(CY`NX{szkjs5 zF=SJLu4Peqd2F)#gZNx-X6eSKV)1!YdF9BI6;cMWlfg0~UJuUD5hdbS3biDXOpG{d zLOd0_c=eMU2q`@i($}cp|jrA{V^K`?7U*eu#9UWMBI+Awu1%9JIRO|#n5s0;ZC-H(WaX^VfYe8km58Cuwn>nOj??brUTMFfl7^jj42#YFNT27`)KdFFl+Wxmclr~2qQFtHC^+5C%U999 z#uNrOU{ZPu1;!3$R%d3zKH&3Bwc(n8B@el_-gTKtv9A_w|NAE|sc|LGSSLUUBl>El zL=#|qIXTZn|IG;RH^H9TW~VxCKBh$Cu_9fZ%SewB_5{QaUe#xUpu2xV`baP!2Eg|8 z&hgu*U#Qy6P7D_l)oWDY@;OC8cXu6Kzg-suz_9)jzuajYFnY@WfEKV<=4)IjU#$ls z{jez9qjO15I$vU4(hy1nl-G!6h4Pn#laF*B!3fu-_JPA0PeEmhl1HSzwdax_O?4N9 z(o&TxvoEfjVL3cGg&Ter&#edKV;`{oN~4fet4W2{&jKQR(Dek0KLMuls@roxwXZn% zr79ud?bi_S+E6}-YATzqCFNb-i{JAq5sxRxpIzMIk8yfe`ldsSO|<0v&@8MrANu7a zW5W)%oS)gf^AzQdZ|%YasyTaR7H-&FH!C)F9)h-pAm_C?L{~t0Tah58!SstA^OAIi zA@}{yGc4*WR91fBhMMoJ+qDZVv8FDsL&<#*`IZwkL!FNEcCAV?_JW*#)xK+z|`4t|HPqBW0=3vRpdo1|LP(bB-kvyfr{Pc~wGyEn) z5w8F<9d#cdx^l}6H9wrppI=*;7Ft3>S?@#hJ&=6=vRB~==Tb{t98zk0czrYlP=^() zyR2?GjUT-(L&0VE*;ABn4u?V+z6E#ZU(IUs%hcH=fg#LC{!iCV9P_`g8`$rfp~3^68-DK1wpLL*RLlqUFACraV0YrI|Ye=;YjS zQsbmHN>%&ODP6*pK+E`xnd#iW$dW*#G~)?8pI`iZ!eb`ILkpS|6^bm06SglNq%K+k zLGRQu@k#=VG93)#i>DA}Nw5l*tNjA#XP2<$F zvrQSwYelohK*!lFtnuv+_@88S*+$;89Bisda$@Zl%|gn0JVi*wppYPj=l|z*AZGaY zs7w2A0w90pf869ECmfx0?P33LLLw%lLG6kE$l>dsA=hK`1p0LMDOIMy{3*TRIi3&& z6(###OXA`{wHZ3A^-7Zi>oH`BWCaKf4n;!$v{IX6+TZK!vzb@w@KBk{B0gn&Gkyik zH70nzWx~#@`?C|`MUh#9)zR|ZA5APj$RON~05hjsuOiT)D($YRWnD4q9)n{|I(q*X z3aa-v#%1MFg(?hAOIK$THbvRvXaxNf`ZlBRV#l6SUu?7|4;j43>P6+O|#29A{I4w|NMl>IU?#VoGk)lO1%XW8a(q zh+DXc_J-;l$BqNP2McGJm^jF}WLNUewwVE@#IIx^inLcw0sA zlv^;6@zQ}mml+}eY}6^Sfe}F8Ms3ch&vue+knm6`Y#`;KMH90EDT_p6MsiONG0e=O zp~1y*Oh3|Im(;$wl4@k8$hV^xz8)8ao&8INz;_ioE*?lZ^I4`a$uAAcjKNuj#Pc)l z^=y8BgaEl675Ob?Dq~H2owo6(IN;FNBEDGAT@LkG51Y!)SK0nNzRQe87}hAn6tL~0 zy_}Dtoz^SR8+P$0x*fHq6CrMpvaw71MTTJk~mi(qajR@QS!#l9nNUu%WS%}Lak8EV# zR~i=a#ctBDQqZA_qK2DZh2tK8w-?`QTO=#C5*=$LJ0^oE%r{dJr!EbcC@Ij~R_&nf zlYP{a=glD^`q6gr;+~Hd3=o%z<*aZIdKNwAtieL*Oh9rUBX)yJT3Uc}sLWaJf5(hH7?EZmjsblKR;4cUQN5=eKvuwB{wxl?sP1>Ic_CES)_Uj${OnTKf7-Bl|>oH}|F2u+A++)eFHZ?I7C z1D44Iosk!fAa>xbNRhHvkzg z3P|58l~V^1VyYZ0T5Kdf)4kO31BIjN?$E8gb0yA_;T@5_o5r0wIi1!?Cli)APA2qk z#A>&~vu+gQLO>h)MT-oDx=pBO_tk6E)V>_SpvhZ2OECd}>VRkZT~=262yJHs<~?ySLvkccUPFY3 z)2A=1Hcc_p>@-j5j*nG%7cmn}#UwaB9`l3udibRlI@}_{ z#2^+ewflS$+@Fjma*)J}=*tBu^hgd1#F22H=cVf6(!;1CX-2H|*(}u*%aaeYXInd$-$3Fn}8iK9Pt)v_tuT%C*U z&9IsLuDeIL36kL!AhLFRe<4ztIBHQ!>QmZ_NN$Un0fVIiu}pF|d!%`!-b9D@j{x4MX|6$;^r{7v zIQH=5Ioq>a-KO4&$dF94`cOi@075L=J=8ydmlHk3COQPzdzd#++7$~C;@Z~B2n*7- zjX?$OnSEw8SpFe(a`|1N7}sZJUwoKI0C~S~;XOou{a4rfZqSGw61v>zsp#%HAk?u9 z+~xF!&1rbBj~MOAP|vAfr!=QCJI~DAX%YMae*~@l4=Ti#<#lVqjS&;>A}4Jaf+##? z1uy>6eRAnzi-d$1t7eO_f=bZ8F?0@U*6vBst^N}kT+6Trk1DMz!^(tGPpXV|1`y%h zD~}@g9iS`EdOTNk&maq&Deif9MNcWf8;+s9o?9rftpVc5H~_^P8yAsXKg?A;UUwQf zs--vlq$VwCTHK{J%k?_27IIr;=_c>{)lZ%+1YK8+lv<%oRoO<>t+p!l#v=w+z#pCB zc|fkC6rw`1DA#vb#6~#hhMraeZWw=j(u^yraaxZnaOAzQ7O}`t?B$m^vc3Pnicy6? z;5h0Z_%agAL(NiWf7;5Wto11^&0Aev520|@?x*!g{g(BU6=R&ZN2z)APZ`s!}=c%>xeh~P|DX09 zRPZQ2qjDFhl*&>CgX@3m|16{$%u1^KsTChHM1i=ucNd1I{mRgzuQZ@^nU9)1<={le zzB3d@Q9(BhKAogfb9v7L{6%HiKrnR}EB|uJ!p*mzfPn8OZh``P0AXnXEH*k9kDKFa zbgD|qGZK7DVwcawiBV+-zkvXEdxF2~&OLy=bJEa;fY@myKv^MsajqJ{HLSAj@<=Gdc$R6aO;d+7@GDoLyw*1E7)xw zJSe3;qnTN%yQE@&+YgOOIz2~w9^x-qmURRVbnJM~a+o2qyL>hmGL9M@s=8us&QU1^ z>*1&`28zw2Ue6-S%2a?5Qht~)oUMRXLe!l4iIunU6oJg6PF{?wHv%CS>n=#EL#Cgg z0$xVKL`j%=g_x~Rc(>;u6a;2_zz*oG-SZK}4MiCiN@9`D#^V4%4SC&{SiE0%#I-XY z`)Mt5`4p}&H8?yNn}-*7jUo>6C7~Ek$3pX9_M46R!WVo>YP`!2`jzG0SK|xIWZ{Tx-(k_>s;4MUJH+&1>wyN|Veey1I7)TGg z`xnn$!Hc%~`H?y(GLM7@JS%q2FCItv%w|*4tDgsfI68ZXJ+ytO-atlqVoZA-K;)&g z2KsyIywpy~7*Y#ziA~aBfJFbn$yZs^HxsC!?eO&26G}!XGx6uJW)mRf@-+6p&Np}Ipj}?%^09DpE z<~L70rQj)(th@?=FX)0VJ|H+j#btgiOE|F;i4YiswsN8WtYlMm6@7pEjEK-f!tEA~ z2da4E!TQ)uKc4>A_>(R-Ay9}{uTzz)!6~%4TaR77(+~n6D5)m;A>s8208CwKQ$%}u zn6-@mWMfOvH)^cEM?myV0v7xSN|gR3fj5a0%twEc3pm9|uUJYPx+*$tqv-a`FJo z*kOwKq<rjFaZ6wzI-*M~(=j7uBMCC?TA^s6-vp$Zd-XVQI1E5*ALC1DxFYexz_gCX@eUJ5_ z;V(mL3_3P>UU=Dy4d)d=O4ZS)Ut)bR1t7woNIQHoa&h}BV!y^#!VF>tEBhQH^;rpU z{aGe1KwxW}yWQTpwWhlI$#Tf=q2~QVtz|QXZQg@K!|i$ryc!W`+jcNSsQEp1TWXFQG0F!*G^fCDz9r?^Dyx)q#&Ym6|IvJ%^6?N2bI09x? z?{nII8Ow|Kx37A8)1XtAJ$N8oaTsOPAkq$#Ow{u@#yOtwiVu7>ay4ueXmBSOJQTRp zGRPF0SzsSWh~tN;AH60NsKh7dCRh!}#+RTNWrjYg^Qa-O3J#vUwNC-m!7yxv1vu=S z%kFvRz3&V$oFYyG*MYlH|7MMgzu$X!q)Opeikn|6G`|qUM?r;c(Y zPZIt&9SMtw))C#<-^Z={ZVwq9DK8zraYXhEcmK);rhaJd!m|l+L3%yS=@XMwT3Ody zaYe1W4v&dXA8Y?!WQ)yX=Plm6@!U<9uG(gwo4tBB_T|xfk3^o#jG+Q@jVnA`Zg%E6 z`lKqlwnZg1)l;ViUg$Kh+EBI%#BVA$*TSqul^@XxP12@YL?rq~KF`k4>EzZbAFT1% zF883Ny`ZR4B^iXbVtEg{cvBsc0XuyVYdP$MzNer2;b0zti!c^1Vt{ZQ(a7*T?|!}GRpBbua_fQ~?) zlS^r~yd(99beF_uCr3w~WPzelhLP=^7^tNcm?y~#w)4N(v&OKPOS!?X_GRRMTRKwU z-cF0nSGTqE*7-^W#rxcixK^nTyRO>9@gjmJB&$O3L;^IfhCcAT&w}J>Cfc9v;pen+ z^9%Wh=^*wMpUzJWN8pxpOp^kjgN6dC>*{ZCG*PQM&13GJCCK0^(PJ^~_azoNy||(XmlyIEK?*fpQ5X$56o4^Src@6SGCKk(3;4Yyt5>OGH+LFbM|m+^ zg^5V7MmdH8*RqZ`Vps{O>IF%pF-=U45Nk%CiT*c)H?;x_9$|dfcbXxFM*Uh)!UAK& z%euF7FFUFg#06A>7pmYLX)lQjCA27iQxfYwmBfXOWQCSLpkl{Qv{=1>7F%x8$}=uZ zz9{{%0*G@P$%gKfINMK)opIEyEKLdcjnVhy0UZ%$TwlNwXNf#rpkO^qW|J(qmY_m5 zGApqfIN(-swPZ?mD^dy0gTWIpl?il21ENP|ERN|4*ogn_+Jz?P~Q-NOn!?&9V8WURhc`RErxjvnpd@L ze?T_fOF07QhUA`LB?5HU zIcmZ)f~&pvimr&j^ z3s9m`Qq^)eQTW2<_0gI0L&)Sb_M4@_a!wRY>W3xAN~G!MuCaE7jvS>}I48#AHJjc` zSw>Jk7VIUtZ;>Bi5A7sDx3IpV4`bcpsRLmacc2U)R1P-$z^f5<5R!nzKaxj-h9GgQ z3rjV&O{39aK= z7eGMAi{J$xz@K-wd7({c#9o&u-q)^+J^y57LkGUS0H0s5jp*>eFg#psY@naUkBUIi z2*b!$PCT4uRrg$CA660}eJZ3YNWW!5;r*@}JH=^OF+68j;V9?6a|IpzUqJO-E~tOW z6zLfJPjW_`G|KaB0sDnc+cwM3lIJ)*C?^Ajb5r=aLsg!0!UUnU>*mY&SKX-k7 zlc~Wp?Z}Vz|AX+M`!w0(6N&}{9h=1uSD#z81phek4#5hf)mVmm@>c3-E5>sXL)U5K zbfk|497>``vOOUyd|9#*)1qUzG(U~s8{V^;Nk!*$+G`Z znE~x(JFWpE`k|GXlQ^sM2VJ*r8Z`X7?dT}3f_VXW&HPLl;I@)uT#VJ}6uE_x~!UjiI776@9U`#sa8|#zy z_ep!z4RjyVMjD8=Z? zHow^i57p+r;lgZ=S{M1#NGUH0V!%2I*Icz3LGcZcEUvHoj4c9O9LfPU+- zpc`I7CUtvAvWX<=Jo%GkBRitZq`@b8#+R3pC!%7!UbE@ltM85IHd+qNkz;$u7Zy{$ zq5)X8;~t4P=s$ZuBt!#-zjpzLcy9zgqH(Y%!U}H-XHyy83T#47IPGA9hKQLKgPD*E zN6yJX1s~IqB=K{0;B*2!0R;>J5%vREknoBaI{&1ypakKL%RTWWBUdg?2t=Ga?Z$w4 zm>l3MAr1~DDL^sfyE*18FyB)5`M^$oDq?8K!O^BN7XL9f_%;hVLdUcSogphBQ!?#q zDL`!0y^rJD0Ty2W??%D?N2l%w;qd?i;jz6Q?Br*(aB~+n9LvF084{)Byifze<9$KT z)WX4inDQvTf}y2nzkNQzCFrG7pbQuAJXO_j2l2xQBuFCR-gibGe?I@;P9Ce}Jo?Sv zNKCMx7(Q+@k;>_^1jGawU<4!V-Y?@fzY&%(JB=c?`5X{+X#=F>ZHeC^izV6nS-!7T zUi$hp5b62)*?H8E<+-?o8i+`Ze`mgI4YI^e;+-wFekZ)UBa%3YYwPIaF~v)UVk8@; zY^Q9$cSbG7d7zG|15VLEZZt;qN-XkFV+%=_O@|v&uP(kWCkM3{XRcqS${rb~N+P0u z@q9Xa-1mh|edsJAJLhef#d}td%*sCV|5}D+HoduEpvC7^j*ECrL+}+GsuOZf zFIQgJ{y5h#{g)*m=(c^|%_9@#V36-7jVCLjOB+c9SI>Cmt1RO<`gYIw=~)DW3=&dk zhmUM;w&h>iZB+!-6odnK=qM0ZWBUp^)PGRV;iYsIACwY7SEwd#T0!ywD$bAruP-Qo z*x@0cx>NNgD~&RA?Td3H#&$F4l|C$oZu3`P%jKP&a^bNJ5FiLV44gAK_7k#PkED2S zV%lsrhQ^Ac<%dcsUD0@XBUqjpY^@i!n9&J}p$1$G!BjQv@YQGj<_ZZAx~z;)X5dJS z&Y9J*OB#1zg!I?D&S730XDNj>Ys6?uUrjOPtcFKqAH6DvZWmRAK+;O3V2K6=e6i-_ zV67zEwZv<>^WJB){~;FOP(eo^t04Bth1h7uwDp#->Bt~nbdkACBlCT!l|(<6x%L2n zo)Z@-ij>t%Zwq-N3&|`$ky_fKjMAq_GdfxOoJQ74u#C3jTNVPHA<$vH5Ju6NX3;TB z(|y*r{5oMFE!)67mrwVbp?|+PC%Sp{n8uf|2bO|HyuiTu5GL^vLdYa3Y|KQFdq_Cj%u-BWSe((_C}I|^sL1am_E5l;x|lBt zKz228r$P=yn+iE;S7QaA8j?Kk0-!(H`Q;izIt?rmD_9aKk>V%T>> z$UExr2F(!;Ed4VEbZTR=CAScyhWQv^{`V^a2$O1`OYYyeXeF^FKIy)`PSv|zA{+3C73q6NPd(ZH-R!a#Tg21Jh z;YR2vxc|j^To2s@k4R2cAZr${l9D=7S^B^1p`IG%pS7QEJxtr1g+Mo)20D%77#7bl zr(i!n0~!xBIdr!v??F~L>3W`l2Fs#PPJjiPlWX9`EY5L=rVi#S$i#|hDmurYCYoh# z7N8&kv~btMyn?AH%tA}W+F*13g6;3UPx%9`jN?wZnmG963L0R(4Nm3`Lbx`rS?5DuA`RCHrhS{H1){Sd_XU0ZMM-3)mgM{j*9a*pD+^(6J>NB zVU_4%mgIm_PB#6BM zl9`NCBXc3&$gCzEPdSoBh3sP)oE`|CeVjH5sr7&O1^^72BOEI9HO4Rk6Yf(vwIw($ zmOMCRCOf&8T9)&uLgWr!naL*}zP*cYJK{7)c-PDSe8T%V-)NGW^=JMs1XRlP&&;H-l-$}(|YhA*uQlI+~uX~%ud*gqZ zd&9hOTGH4DwDvMNQHE-Ft|#;_(YZ|5Krye3%n6oIL4# zQZ7{FOja%hA^&CIau%*M=3;TKHRtjwSEIPvjQzJ;@7#Xt&RDk!lkIM2-ecW4>_Hdq zR_0!Qt{*+V*qa;>zXL__agoh{QKt^U_ z0j;*_-#PE2K4sbb<@;Bd@n2tj>yp_9cP+s3CyLLr(aZj|(^98@*Ax_ixzI(5v5<~0-6PFuIKA+)Ds(+`jR z{Q9=rE57@q7KIG#?G0ZtV!(3Q;-R2n*WoX%r?*?L?lJyfo;vw(cgoC&*;D(5YzWwN zvZ?>ZkDCs*Ox)6Wt9;w>j=6Kcdqeh)-8pO5#@!FxEqk-}t=s>-Pds$h*Xan3!*~3f zkBvRP>%_2=J5PzHozK6F?m2rregoQiVe!R#$uH;sUbvSznVoWd{Y_oRjWg(-{MI|F zj@y^alWDG_ z)q*yG_J3*%K(!w`=PnO?*m>iyf7iITWveW|#>0Nn)=pFeYX8LLQyI@-(n@xuM{LKe z0Mz4Bj~Y&SlSkj;G0(aFIX8Ue#&_M^!0?`1PWR*+JmqV53})HvUC2-CST69?IXv<} zqv!i(HSb;d257=9_bdz?!mruy-#zi{JT*J4IhFrAyQh8s>~4_-*g4xrfBn)fanHQk zU(D$*su90O>R&4hu&WlQ9r=T=hH5Izrcx|J_53Jj|_ouT@RT~YxvGIKUE@Q!PKP%#< ziz=+Dwc1UWc38V$>i(eB`X8=(a^GW(cgJtH9FlFYwT~TdbY48$a>tv!JsgOe?s~a@ zlYKoM+2BBj(ZNQ)9eBfc#POoj2SdkP#yYd;HLOg3L2gr<-dL|XBu7@ z=xT3Qze@f0^4r+~ZuNG1lsn_x?R0PToxSf)zgOx}Z;$@^VD6(MfAkdn`zL4obob|* zzZl@nGv&|47vuwe*XYytqmNXZeC^>|58oFpPX2b`-+%pc&aZFl2mPJCfqo8t;TATVuez)c|Z6fI0*X`5&@FpRrmzr|= zcuqVQo)@3DoKKwZ-wR*9@#RO{r{7PyUw{AN5_dUsxqJC^#h%)i^}8lrXI~Fp?_Ki@ zeeWv|%L8Ef_7x0R@yX)w${VZHS4Dw=nt_9X9~i`g0Tm1iz~G3XEEwX!@TrlmQIpa4 zK}(J2OtehwO$1=lWHMxO#MB?m6u^uJX8(q9za)6U+m(;mP+0_=A)lfVvXZ0ks0ChtOnz)`WHn-4?wKeFsJ) zFg9RZ!?=!VhA9N*N$JIqp(W!zR2OOnb%$~QT?-wD?tos0zQuCFDgo9J>>yy50Q-|o zDZnWPt_*NMgv|emB*;1-TLH4U zkbPDT26FV|h#(gWxp|O#N}ioO0py(_3;^LE;SIt^gg*r+LB75GAjs!Jey;*)C{S0x zgn~l~T@{{Fgo7dq6rER$gJK`W4T>KrF;`Nnv~gqmy(hogZY}(l15OxBZy~o}a>03X0m8h;s5&!i#0C>+t6xFW4k)k*l0Iuz8DYMB^NSr{ePm@N69MH z_@pTK!Mo=PH_qinipJ#u{h2@F`>z-f=di8eAhlC*tJDT~y>?p@*%K|ZeG^u{s!SgM zcShG`H=rX!?|MM|ol6b&^Brq(*iL3eVEn;)7MFdw56^LgyN)t#^{tzOs-S}-YiXc~NMGg+}k5|%Qg5{}eUrnAin=E45GxnaA)z>wA z6fSU?*W?>gAV#l@18}a>5qfBI8(^i0|Hon;J z?r!c~obDz;xU3sL)^O)MOe+s51ovZLVFlRDcCFFP+2#U!uVN0tZ*4_vKPjQzbZz>C z^B?B^%`Au7`%t|}$uIeh%Ge#wSkM~(#t62&Yo&~zj6Xtn!8e&pfEM3-%}-`eBm&eB zrRBU`FAp7l?=w=LJ7?WLtycMhO&uNeXB1S?Gh4*^q9jeS&c$s{n#aR5)jAgzo!JKu z7si~3VF@nZxPNeZLn1`Y@HwYm9hxyaK8*+}d_q-ivVXzEf?#0|PPLB=r`Q)-@Q5T_ zpBMTbm@sAIGE-C$SYW{=@m&#PFA+Y#dMS=`@fp&=OGJr`BEV#rKLQU?@&DDSu#XB8 zII1gQ2}??4!~ybx@C@{T1S)=jbmE1f?_74Wn9GSL&flD6-taM-0T5%@o`|9KDXx~> z6fJg)+t>Iw!;G=A_r3B$n^LnIgY_}a)ZoLreBw2DF?()Ca$bH}ZAExMRA-5_y~!eeLhmfEe^RfR$p%i?5#+S#m_MsF(j z)5dl8$=i6t%`_8TO-Yxux5VwzyAJni!9S!KzJ>N8Bz%{m_>{yKT1vF91x@>^$UYV0 zW+7CZ2FiC48g+(8mf0|wLrAr>2Gn5T?0)uC!NX!2Xw2fsa25seHGxiCFQYkv_-aqB zo>FM6f)0b8lfYHdfr+3^?6* zgKTQ^?lMjAly57Ao}i`K%i-~XwoGS22syzy`k&hW!y!)lmgR{UJTjdbk9Qv5!t_Ot zg%e?|S2y_3!ZCUOUJrxQ0%I`Bv5E?`p6r#SZPF93?*m zk((8g0eGiv?h}k|>h+Sfd%&oG-dD%oCX_&$dpr`DB3UOwd!MnZ=4gXI+!FPdc8i=oA<8f%s*pSR^^c3PSJp63a(=6}%*z>=QR7w|7*uaZs#w@qQf zgY_f+Jy%690lG9l{L0V|?~H^caf8P)x{0+e>i98yZEx%9IgRH#3C@YhaXBYg#@^*= zHFnd6X&*550ZAXepR@o#=$}F-M_b2dSTQvs9-m*zxdp~@IHCYf?vPjYOdD3<2>4=p zoKo*0wD^iZFpsgD2+#aXv^DJo78kpnoF5v?zV8LoaeU{j*wU6zICbqGz=OB!$a>g3 zi6nRFu(k)IV;Xa6HYef8KFH~ygbt^LaO2cE`=y-wY@NBcR6-CEO@)VrWJ{CG#~90Y zNYj4jyFzDqPxvgpu&t5aIrI0zP-D$@^qcLik+~$MQDr4UDvc$4r`yPHqmr9@cebSD zPE7lui4~wrrQ{_`XLB`r`<`%XN_7w>HFLeWYRn_SDLJGMGqQ}CY+v2j(xj!JnoHdfw| z`-w6xVgV?;A*i^a7;Xyj{(+ghLEpP;M^l+f6P<$e8{(3?J$tLQjyKfykurs)O)(P4l3I2+f!xVhCln$M+QtrIXqCch^;W zop_;0fQPd><_Ntvjj9pc5xehh#dUQfzHNdN|3o28MgA{QYfU|-|ARmIX}gbG1w2>_ zI(+a>ccE57KoNjd-Jy6Cc=`kZs2)A-Zb*2D0wr$lt;dB0K_2`?F6<(lgsJgm)4QnS zCOqYTnkjOmWb_BjjQ*kVhn~loiS|!Wo%q1k)7`^fM0CNk)+Yb%H21woSL$hZDLhv!p!$b=Xq^;f5QgKshJuW)Aa-`;v z=`_~FDMO?5W!IIS3wYESbk+2N^b7BGOPlH>V!{K9R)@X|r@bSO9O|$v;b+qj<4~)Q zkmHpd1mrDcL=CMJ)@HnEE_n3SUh^s5A^vpWRrh7yg#VEXxZRs~#>dddPnS{))qv&{=6vdA26+CN-8hW1ymeGz5iaA>#u#Oq#<3@PA2 zLv6fG;!0qI3RO3iQDZJYMlKCRcS5JdkITilj_b1*!Q>iT^M-{Z@K z?h^kuPH4HrBh>wLY+vDbO1-^rU>p^RAH{}Z=d9;}2Z=uGeKP*i_3<1g^nG3Ao8UhR zgIxqI!n4sIIR0bPFF{;dq{mDH()w0s{QNGj!a zbGOVUWt;gBj7`P8c^nPV?f(1xOEQUr6@+F|*p-Bke-`bNHS|DJ^&krAk3^&jmJ^N; z+pY-hdm!(8wSn+cEyznJQZFM{dmQe;aVSCv^8M&jTjp}i)Z%O?otV5qFsYu_^vcZ= zpRQ^lByescY!b*6zCd976sumWuW_u_$fWTrJY20ZnyaH}nMqh!4cNzFzaeBMa0(HY zA{ypFj!yhHYQpPo1@Lb9{t@QzE$ z@iZ#O&(J|FA^Z??_-q&sz%B&Jt|d;Ajytqg5TAY7VGPy*;ou(!Yk|hxGq{p zSWpTt*AnsEIm=Ak^Pm7XK*+zq8IkusC8CGKsmDrBoIvD~D`7QNp%*}&SfCx@vyDw> z_{>YhYGh^u#24KH-?SVkI;ybF)^S#iwZ{%`cRfM|33)qtm#|1)Qiue@CQJT_S0}cm z1Ru)X7WG}M=YC%ZFqMj@GOTxq3)eFZq@!ROn#+(#^#Q_zmgf2TY`{sAJ7lK71tP%` zR4oF1eP`+91VU1VQ=pG2YL0-@9S_3^ZX5Squ#~n`S~Owvu|l`A1}nVn2tDY9y|I{K ziRQkfMKiHTVXH&5J4(udo`Nhq0Vri6s<+V)rOUp*_=*=T!qH#~38V-7keR~ql&vBp z{oyW1g?|inkhB41)Q-@mchvEzu7wqN119tG@bw4V@`Gz`h3Au#yk66Onbm*f8Rqe?;Kb}Zi#q5pLl8=wExWSOJUWKN8D0vH ziH@d;^X8G^R;U~qBiwZqQCzMBFRI!p&0ob(7>ai%DaQ>g{0L~LT!JoX9M!wvnTm8q zp-1O;;U4V5;Wkr(pXZ#T*$Eam#+ z#wl6~EI{WoSso2&!S{1&w!N@F7Jf!UD;RG+GoI``e;!-O#nK$T*3gpylD6a+YP6+5 zy=@?pCQjSq1bKP7@WUv!D}JtL1e`S^^H40phE;a}c0iLP-!n$f>k8S=e11UckKzOx zJ9aifxx#ka@{P=R=%cG0a>Y8ftbW8e0&9zkUb1F3!spcY0<|W3E-fSWb@Cn@UIz+6 zfAiQU^F2%7o3A2i)z_f^C{UKE}V21PR?(%e5 zOQls4>`nG4h3JL$LYPJ*I1-HY3z`(&j3v0q$vxKA3AeN<%%!ZP)UVVRd1t!Oh13AO zH(WOU_~Tw099KX@2tP}EPGr8QL7;oEc-p>mLh-$%IPp4=OoD^5MtRqQZB?Md9sDp& z%My_0)EPh?Sk^V5KwGwhO-oO3)-m;s!)F|YZH-2@j8N3dj(|kD?y;H)kmXOz81Y%- z?0b>g`6cZBuAO1Y%u3(F_dKKf@`~8)V9-M05OK)k$kDGaDS~%qUF0cc@^7$+#WLd7 zcI`t?mY{oY#fnqgTflZlRyRh&Ez#x!NaBDm6VXL@6#)z3@gU1@$nx)l%=0Ss>CM^U zsSJZwEqleQXAGgmhsp6=|5AE;rF?+Dl>{V2!#M}_yk_&IPC|>FqM5|N*q%v)!3YY5 zxcx224;D}tLpb8?+&>iz>6Iiw3rh8fzzwtRHB`$(d(IzxLz5ijL>q0ohaKSWQ~UE6 zMbiv~!!L>+GF;7IFd7b={sSvaBi8V{L@4<)!6GpJ9spa99GoH&Y}iwRLxMi)WF)ad zumfQPN;cZyYv=78U(V!EITdkbUtD*_z z|0N3*obnJ#D+DCWBTDUXDcWbNsh~GeBNt`2%1kq%9doX&$K%nUh6JDgtL3Hr=J%f1 zSI23?Ax77W?~486b{^bI@$#I9K3D)!qNJYZv5qa-5b5o{qCR&KqwDwg4iRLwO7nR2 z`ZZ3;({G~b6Nz-7{RMh5<@9;0IL+eme-GwSTIFPA)U&^C zKWALohwfSmdA*rdeXwLzk&pa{ug2=GL#u%} zU75H)vYZ4hXi00IT9|OEu76U3CQ3uMJ6?rfJ79uK|9jO*6y`8HAGbn<@C=`n{^;$% z%}~9eT{h-~fhoE5@WkY4RceYokt$23{jOE>`$75_b);xvy4LA0`0df;7+pm;hF+ZY zRfG|A1DMb&`?HSf^Y7R{*hZnJvCoS{&Lf%>x)F zQd}(4KcgMu!n9{5Tq4{Vo~YqnJW91wZSmu}p_g#$2tQ()nXdif?3XJoi3`RbW1|Ky z8@0Edhm@e9)G{KUZ$r_dGuQ=#zn|zf?Xa1S8eDH1kY}^_-tYd+BlyekYSNKkrpm=>hYG%EvwJYaNOQcKFrD$!2si-?c&Bn(;A9|jg|;2D3*c~tHn#<_}SR> zs>kr}n)ns9}cD5Y>Npa`8kELLd*#mfI zes3Q!SPQaOgo@r6!>?nlGDn*7+SppsO8Cveioii#Kk5ABGjonhmrtC%NO|FotfNmjGjAZ|ADyu!EFPD#wast?G^V?Y_VBhwwH(hXc~6>*Z1l- zR$1h=`LT{!Am*t`BaO16x*y#J#sn;kOm@STluyQ?MHaCM&q9dyOTJJiCwwz zy+2?-huKhL*9VsOSSBm(=kDjp{LUEO^6BXNF5>mameTu{l`}ib|M-g*s>J*KE3Pr+ zf3WgD_@8fo^DVxlp->)nglYN{gKH{X(?+qW#-eTQ{^bmbX08;4{p6PVbLO02kAjkV zw<2Dn4TUs`lBP7QSjMYX-yoL$X8&S^T(J+At+21S_hGMD6Buf^^WVlNta8=%etA+$qqE(-8!88v2kAC2k1=QsFr{t7$GC^23!UA**U zzn?YyN4>9P=O>h)vOJ!fcW=n3A@UyeeyHkAstLXs9Is>B$45NpCl|3E=Z8QCvcK&J#&@Q@>5d}w$;61g=wjk z^X0Q2_FTXs0e%{KIebLeT_N~mjpckg*JU6=Ymt6Q}s?U&I z41hxhVtXL@f*6e<9-6F$sp zrkQy`XOddtu-FEDpNxRpRHKY3!kK)*SsVuSR9KB3C~OVKzj|^ma2%V4CZ1@wZKsZg zSXzs5aBeO!(-Lfa)CC}LadGQ{DdAMGMH#er;RS@8cJoiVYkD1Kh_i22Z_K>{lPP+b z#C7~U``>Up=96uJc3z!X3xNpkxIiF}^Au5nAWkJ$NCaG?SX{Itoj8i)pha0oO!x=2Dr?#agv|gwR+U^aQtN=gklkzp}GncXT^$Jg@2@4aOV>235B3b zz?uS9DNvFiE>Smt1~6zUo)V1aO1V3>R->D!(PfI~Dgz~GW7n;IKmniK=J5s&7#BV6 zbidBMtbI0x1zL>`{Q;GX6P3S%jqk0&iRQo-gFD?}<=Gig%)E2qSOLe=zdZT+-X<jYKefxmzlQ$%{&!0!@tBW>?MS znU-k#PhSkMk%S>RLBNCNV(sTlEowKAEVSuGBG3D%Z2MR@Z zC2hn(O5M+5BDE9zNl^}nSlI2mj~P#vS-&*SW_>J7HW_b%-HL&-bV6XfMbV+^7!ik6 zWSjGMGqaKl;-X4y*J{Tb)uU`Jq%f5BuIFcV5TKoW9NcfYZel2Oa}x45WNGI?+sFw7 z;8qtl7lGtj;~Za_bBbBJCvag2i(19NIcw9?_c61NxMK)l+wVO7+F|9#NjeNih9$l1 z+tOv4Dki~c-5UwZRh_*`KE~Hyu;|Y>-`gNiurovsO@Lb2(2+Xff z-7%ZR$051PD%Vl`6HT2p;|S6$j40S&^HbIpP-z|9dQ7f-x9*z?cSH=yjexnq!h$q6 z!%>a3)W*++mKi{92fVw=c>iJ}hQ%OC9fcNJhq1GgNCs^@;h5Kc#w$n`=euip883*? za%slUU~(}gW*Q$NXO=o)8HBc<1#g~VoI?3vl)_*JECb`)uKu`rdS6TDnX)X+G?Htj zRYv@-n_;0A(^+J{j9Q<+dv}c{;EtbR7k0n!IR|=Na~CE5z$NJd4u?BbOCsPF)mjaS z9A4x@>ix`u_NDU5{{W0CESvlYf znDZ~^e(>g;(6sPqHr(Ut8}1KhUk#OVg;(nW?Gi)wpdy&h&D51GCIx!j{8%C>Jb0e#3&ch9aqr*_i-ErL zxygFQM7hdW2$TbEa_-wNLaim%Vl}%Iffu_^2NbH2IWV)(B-Kl$9bp`%2@4_jPxQ1C zy53V7*@@@jZH3>KO^?mRKd(W1zyuOZ+y9{IKp&(T6pUtRpR znH&TfXk;-7&S?WFqC$1>!ZU+mJHT5B^xbF$m4~xw$qYxJr}t=L6YEj`YU<9n!~i?wxAR+u<}c!h?A|AFHWl znC!?+#;n2k57K?vqyUWy{rSYpk1(oj__NlV^OJstR%Lx|2!y+m>oPz{MihiEY~HD)d`VGYLvog?*azLw zQmu-Df<*Iu0shi2?@cdPpI`_b;f!C_2n)&*PwIZjTMO?Tj6^hHGA+o+#ty?W80?aZHphhlX31$}SY zUe%Glx;PUGCm&RhLA}X=rcgr%*o#4k12Q0@r)fDu95&jX;_q}wG zX#2|@YJ9*y78K*fowonln+}fLarr|%96|KvU%{vvvHm8p@v%%m8btyJFSa5f8``1L zA>8AO)6t!{XFYbQ%>9h{^a{at24gbHWvpYsJ{0r=QU*yWV=_at_bG$UT-9X6-$*uS z4it815`73FwpUlq-~0N|WLwC&aaf#K!^C3UIm3svrnTNQ|9bBX^c}2=Br{FOHRXEj z{dsM30*HgbJX4I9c*#A9H-O4m`V z2bW;u)>WT8=OqPr1oVhT-PFY{64Ok=)gH=I`xP_Fuu;)Oo_o=_-)R0Mu) zHHF!jhcsxq*)%l|ku7O5o&x5PVH*R@5Ve7Nb6l+(y*^1c@?6ug6`i99hHX7 z_eaEUBjcWx!JPr?hl&n<8}Wzx(&!$Fz~2o2q|)EGPSu%y1KsC4Q3M&NkTBQfegnT< zPUhynJIiEo{o_rg7nG}asXFKlhE%^Wr7lSfMHntlZ=_JVSwt~t7(#r%&HCvLp;;BV zpyVW`G%l+`yd1~nc)2^<4H_3T2_(&~OOQgn(@C77(#^MNzqtd$RvTK<7yf+hY4_io zWtHt4n|GK#8SXdt+lr1tQp7Mx}&#+XB`1zhn>N_o~fj^x0333)0Qg zxZU#0CY#;ufxa!@BVUG$feq-dSN(PvWJLUt1k8~Z_O_|J$mmB7^y6v+9PXpp|`5#mN zr3adX(5dGewp}0cee9V}>?3wP@^Ry&)enUG519BOwB)0=hgKTlDwf>P6>=?e+nlQ zWRv^y@S9I->)NXDBRm+NuR;uyKP+OG>|0e7gb6L|7S{*n_p$<|D@|&)wV^C*Gd+@W`pp ze>-)Ts_I~)A++B?XOQYYP&rV8{1EEXV0WtTx=2+&vhVWo<3k(Js|0n*MvY4YuG>%A zD*_W<`6zwIM(g=U@SKBI@t{Ud6gF#)3wnU=8+MZR6gEawT;}c{Qz+a0?d3!GAMhLo zDF=@4e4Iii6QLyG0>8@b+m204pkn}ECbI+IQL&}2PnA6;T$jc4{6t+Ilrwa`DwIkW zdo$&pY5q$`ai4y-A4Lp6rHCjzLQERY&sd9ehS5A)e!};vDTJPU?0#Ua4Vrv)-dq0# z+hD?ax02oiqJ=V;J+2vOrpDq&J#O)TO7y~O&paW=ci z2|^Kmo}PXJv1PQ}8VYfed0F`FG zR;CRZREaq*ulbfGPwisz#mriM?=LQ#Jk+YT$gBg}WN~c0gQF+9-^7-sB_j(8i zMnuFU?}kfPjoi8R9N~q)xM+1wD^8c`MGHXWNYls^4Pmmr?(XmO3c8#RV@u4Bxc@(P$Q4Q zV9YvWvHYeMX-Z0l6$CwLwZbuhbyY)~v0k8)`B>7Mnq6W1#YVOdXi+45qQCQ(e*f{@ z@E3!1-i15s%u0T>Wh2Uq{$DEZ%O15BD2rcEjn;1iV`oTDDU0N@<`XuL(~Ae>a(Jq;gd})TXGv_9u(D}|T;I(4eF2s} zIPgGLOM4UClV)ng@L9*bJ|qmSd_XY{i9u9mYd9WSuT|->X%5B6{l4Ap)+dr&DIOG`gXE|mvX0`m7W{61*P%6;o{t~N&ims$ zayvMP0~`T`Wh)rD#R;zI8qF(`>~6%8K5bLB;K_G~E*5%zm271~ZpCppbG}3mBL2&d zo%P~z%opI(g4PnBQcb=`SmQ+VcJXUAFNqk zax@=>T+z$O`*+G8!G;%^m={55A8k^I?rYYwi?Z<~swYL!t+F(f&L}o=DQ8saWO`V% zTS!7Bpr0_kvQ}1Di-h5S&o?colsyzeim?%ihd#Zh&H(9gkca?+9YEg*$c;d9UrW{; zMwpO{SBw;p%On9}aTU!>BkM^J2E+-!OT z<4Xp52jtR*OetCV9GoS;BWdKJCsZ(bdZsh|6ZpKkb}Gb0=w;P zWz4--DDtVhn#om2wTutaU>(HJPjyf-(u~k5!)4%D66B&Vf2{K~n-+{n-nMHQqbiUs z#i%N#qhYQL`jVRO1Y03?ti`vg5G8zXH!J0h<#JUX2y)p%WKoQ+LWk*S>IuFn(LY#; zEAElQ)JLnZBO}ks6tkJqU-v;uIwxVI63LMa{Wn!dU2qq?9UP>wbXAKBqV?FF4~) z^@a=R!t~y&VWSOp`;&hI6T;w%xl2Mfh#R`}46d>;jetg`dJG?Z0PRLnr{4m$lSfyBBb`M-m@MaK!H5P#k^R zbR^xqz_bKRt{K6Bw0L`;+xS^xh~m$ZCmhF5!h?De zyoKa~7)@80h1!X@702)vbI0Le`tcfiCUZr90eP49on#h*q7Xc%5R7gN(l`-fkT1pF zkPeADa zP_LSTFpi?RDN`+NbWHO2IrM<_r`p8&vT7v>8-F&8{c{6~=(b6cpg|Vze<8ue>6a00ot~A`KnFj5U7ls-AP1SI^MAZ1gP> zTS|RodGN84K|Z+{jKG1{;;vT6BoYgk*$kKI;M-W`!VEAY;sK30=`n&YS$ zhkzdyFOSzxgDe)bAY_BA1Vk_pd18s{V%22#igh!2l7B2>zg3}Rta3R?t)^vozE`Ja zwCih@Ay-X)y)nFJ0&b7_MGjpJQ9sM65A98BUjkZV54&w*pl|(P!R6Cu?zz3aC2ZO1 z%8Ftbn3FST>NoZeBjWg^%rXk>B96af7Gm&>4lHdCEn*z^M31OA{!AG=d#(%MW%@lO z%rPcEFAch_w_GOOYH+A(^^PqEYsH|vH!ZoF}HE@4Ujz&M=>35+AGB&GZZUsnSwbCV!nPQf;5`J67dT-0**pdeY zlSM7DZgmL|I4Py7z6$P2GaROz^WeNkA8Q37;E%BdG7hHJo}lHZsi*ksK*e7Lz>T{~ z;C-L|a^TRVK26%{(B;e&hA?Mk;J{!(<=z#7&({YQvc;+ORU#$C+^f>c-2DzjY#%qc zjJWTcmtV{kV(^55=CuYEF>80mnN`f${U6b8<{IxO(3dCMNa!3faok z>Y_5}$F|R4$2H)%@>^@HnA`6S))Z~2GAhZnx>+eg=-hMJnZqIQLynPNDfAG!^5yIp zuZq0Y_*ksy@C+s-^@akrBDJBU9)?(Y)q2^8)P;IvVBeaU8W5k|+$VycaE)x1!e=u! zTkX#Avw2>49B|sX#H_jjlaseJh?3#H?9Fy8Is%JUZ(ou>c0QOqifd&j9&D*SoRw=c z$(Nz2#@+}>I3GLizPCvZG^p6bt@qmvDmP7&i8?Smo0^eAX0zhz^a8&5(`jhH%vV>& ztXolfr~rjr(;k`rs5pezD#RUngEPsZ(Pn4qv@%*Q=d>LfsTLOawwjdf=ww0yzv=kH z)U!<%q=4hDlI(V4jC50i^tKqO%GC4>rbLBN;cyjdy`b4^*paM&;9?@;pV{aN39Kx}}(?hJsHRiU@v zR$o)9e)bxjMXY&W%SIc!Y#9Z_6A!#k@bBBaUSlSKC;UMeGH7K6i=*$G6R_StV+ydh zjaU|2^~cqmPlXbV8y5TsHnA8VQkOa*A~or`@sVl38v2WP$z`s&kXc zyBP#|07vE?W5)&iEp8k)EKSRDGNYKe=fbfHmNUNq;8pAYubU z-_}uKKSd*tH51R@O;j86SYRE<8r&Du60h~$$5BKu4n63KCr6lee2asHVd8pXwN&pY;v0RRPh z!)t%RF6T>G_izT$tH%}QbrpO`u?d(5RXQ-Z#~XBcga;mH2|2zCV5s*{9XfJVkkz~+ zdXMcVsVV>8nF#>4&s{HKE!PGInO3Ny5JxU}1Gmx?jJ!iwXPc>rFVex>zc_so>*)q& zLok&%#P{J;3y9>DoLK}HpMnXSb1D+l#B%CIQZ3!&Dy=0L+MZ0C8j6NPv5PaP$&D=l zz`?X=TL85dP>Y-MaHsou?71*NjS&-2%Bb$ERGl*BOFoCcaKJ z7P1GvI;UpU*sy$#*X#I}5AhaaMo*k+Y5l{U5M>m$E;Y3pL-b*ESj1LZ+MmUpCDgWLv0+peC8Lt6**`$e6?ix{O&IG!xr=A5O7I$az|dBjEfG zxH4*5J0ziNR%}}7>cF!sn3nk4v++B+fWL2gmx=uJYlI_9+d&SdN`^ftwkQ|Q7UsB# z8@n=lNIH=A1NgnJ1Mz&$OWe7*y`R%G_J+ox-E;t<~5dtL9?yJ1$fej-<7EhuYY=nB^Pf9C2KWZ&8r1r#{xH~P}PqnQ* zM-GvOo`6*5IJ8RiU(>+#AweJJXkZ)%+9mn>zH0i{i7o9;+N7sg@AN4wnHNGBFt-4D z%sYy@Q&LkA0+Wz2NS`k(ax&w$oC5@nfMI&JSD{+^;07ka4@V|@+34|Lw!OG)Sjnql zbzs4R>`%^)9#)na{rOa-+6yB~GMQTsAJ%iNQya2tOl&*B8p*dXMg+$MIi^TXIHWEC z#vj1^;~hm!7dJvnj4TQ#nyBvpM)uft2wj|4tkWw8W>Kk!1FuV1oF~fq#jOFE0^w;OF_|XKWLuUk%dkSy= zQ2Ar|_|&AFio+RfOIo&d0o;^W8j*wcT}qdeS}kLiUs8OuERZPs_$E2)^oep+BF)kI z7pV^f2lDw)F*bvfm4i|>OfRoZK^)zg_V)Q0Q=56` z61b!jy?I<=2g3FL=qqx7xnHA((SIKTB@2)89wLznPdTU+^ztwVan>3pIJh>yb4X(D zN40JJAGVDvbaTm5Q|?x2m?pCxqspH7CU-`wm8#_QsY8%hb5YxEA7|6{b^TH?SErG@ zpW;NHpb-}C^Z{V(PehK256YaFJ)P5ij3NwI!aO|b;L4Gm{=23Fd<%e9M$wMl;Vx{R ziqWV8b+x{oG-h7(0qrNo%%1-q=3TZqvz{TjJFzcyyl;fEN(*UN;v9=RxZ{vW{E)ddyw zH>lGmt?G_JHn-8Pw!_Nm(p`vEng^}=GxDB9q$!+qP^*hvI$>!Q8ofhn+t&b_A z;;-LT)R%oU&I8U8<-C;+X2k`f?c0a!X!I*{Y*jRln_8HZOmxA$&re;+kJ7jw12O*b zWp^s0*%t3A>Iu2r8EtU>4z%|k!cpTZ^SxoxQS^I1x{dj1J>%!|9A^ag*p1>uJbza_ zzx#>zJ04R;r5W%QRc9rKZW^E#F!x>Lm41(FKFOfhn&cg?8{8W}Bg(sXza8&h?{~s$ z7@C)b(=~orE{UQ^d--X#w^V8zH3?}7+5H=kd=y6K{Jk4}(wF(w>6JBid(C@HYg=7x zZAY@dnQ5rC`B+35268$(q^OXqsTRk8l(OP-2Yuj(xzl%i-X1X*fKbiGgrFf-5tPI@ zug^(r5UuTLWWNJvT95a06QPC``keI(3KCJj<&2FqBGHkJ5ROFYP>xQqsnjXMP46=# zI{)3@Z{C3ZLQ$9C5d+e8U zxhO@_QrNinYdEEt_w|Ai-T+T1KR8i61GnsMPdKc;Gb0hABzaKUOGDG9?;Lu zbhO|fX@epuqD(HL_XP6U{7zcr7@wbmS* z=9(R)>0Ore?rDz!hvjdOfBtNKcd*W9$OMXIEz*mDD0|*hKvh}s%e{gv;G^kFV|Y@4 zdDA$eWj*h&jKXmx(iM77_!XRH0TIKhj-(~@8C*B=%P4I30d`6sWIn^@1C&%l3ue1+ zMNjK;XU{Fevr?(!nsWl`nkx&k zxXYwXq(gkD(!LeVY5>X*gKi5;6U)^o5`NHyxEZ%83+BEg4FuUOO3n`RYE-G47O-y* zYA!8)ErJr>_e%v+rY?!?`%cHI*;<`}_%yRtURXGW&gpV%u)?q8WJAh0ah=b8NI2(( zVONbeQ@YmP+x|HX0N@}}E{$|tf_9+h9;&3?!k*+fcu^J$`!*47$$UN}0z%x7v1^<) zrE7Q;3B#Vq3k#Cpt!6K_et0oSJDUVcP61a(op_nKBihm9q`^Vr#OrLB1F&UMSQ4-^-UD$D(*1SjG>gRv)*3ur_JGmoaXasTj{ zH`z8t7`_cHk0&MZy}$6rD_8Ot03qDm;0u`sxPVG;mp5n$KChw=qXIQ|)-o7icf8v` zc?JUtP-`<;^6+McCc<;k82CGi-K(_gP15+V&CY_FAtkTYwi)Z)*bF^th`5;*2Dz-UQmP3< zbLb}QHpiUhvnP@xy?F5wMRMANQfH}I&OCxS^QqQ6aUJ+FBhTcB`SmS<@DQYexjXt% z)fD;HxktWu7`xqGOT>d?$nCY;nghejk!t9GR(2^rU&mEUR8k9rv{(t@T73CwJ*~rU z_uW+GW?{UUreyEm7?-^PH}0&5QOv1j32qGQsPd|_p{c5ldC>QD07jCcDDj5}q1qq6|oibWpDj6Rh@s0)maDLXu zgEixl5_b%Jt0i{4Os#e+Sl?<-Dc)J;Q2yp3B-cy4k*t zDfp5a6W|_Q#A=N3&}~&LnI+A6USk@Rx>>ZdM(-U&6k%vfE5Y^7CEwp!KN-HNr(xsY z&U_DMj7%}-iYz*oWM&uFP!Wy>C8cjImq$VxHVc;>-(lY{+c{_Ht0p-boQ#z(KFPRd zgq4X^J($QHAK(`9uP$n`Ll_W4=E3cQ>5@5YYVT-=2h2Jz=I0(U&!7-3&6GvF*PPib zhQK;S8JT9BfwU==GDIs)w7pf-gM`5yayp8|H;*aWJ@6Z^zb7wrmYIrj?u9AWr{8aY zh1sxqvfYry+=9C2Zt73(-EG`I^7C5|)4Kt+?-MdS{L9-EDbD*Gd(?xMCg?Qd z2HU^7kz!~8@{2x%(NC-lP+e@OtC3SpkNN+Ag)DvBR4tE%`qaw3btv?@1%gzVloCH|67(e91R@sr)%G$I$TI8a;o4&g?HFL{Gtw)aC%5qXV=B8MXSQ&?7c34avWH zjU+Pkj_jz`xm6{H+6u0=F8=P$hKZsCrnMWYV~b3NXpdtNv)I zv~890Xt;cN?2ehJ+h%!`)2XTki1!FcVmz`VYFg9)Fp}p(Di~X8)vjg>l+kX5eJ=mR zbk9gI^E)eFn~TTi(!l!Jf25degPVNVEbeTFFev)z7A+bN7L7h^oJCY2gB)ndZ0#t^ z6On&nrV(c$ZHhzc@Gv%eTT?eOW^Ak=;WOEFe}YTy1fv*X1`3wFjm!oiN=Y-SR?O?~PmjxLm)YfjP7!jx;lMZtJXWu%lhcR!FKP9qC$_s_@>P@a!bm!Yymd zt{MnSX4b|FkCayQiC!OYqUF6N@;J6P3{>=)jj9 zr=R71ZnY2#gs}&5zV0<@N0PVLt4z*WbE|^s0U#CB+Xies!?0f+EbuJZP5CcpXz!8rS z=}u;%QL1r}BatS+VbjM?S%cmR7OBlm=>>f4$5Su`?XNHWw0=eDp+XdT&0j`V70+CO z@2~lA3&yPyt;F#XT_9Z(3Jo2GwvYL?bf7Vf7EQFBq}Xr1v!rpw^-Ati4jwL zTl@^ZV-j$%T)=kOj=4qlW>A%89FR_<=dkDraQ9OykuSLrZQf^Ruxu8o-jDavhJ-p^ zQ3i7wn=pmP2!X;%QIlB_M3cNSaTmGCv&d^-+t=_%M&((oSs!C&&1>v!=Tm5v@9Cf@!>;{(^sc znm!RnWbn{(u)X;YZL>^UYRC?}Zzi`B}&DM1-r~c54IJmm+FpbVA&aa(Dzp(MTJju9R zc)0d+Ep_<@n5StzoL&H>xrf>x)Ztnx6gu=!@;JE?^@Z$VAO5+- z+lEk{&Z-_%XkdD2)e*#QdWrQr<1BU&aU!-+5|{Y;Ot5^#yzSd&AOWOsxYqz(lGH@v z)rPgH-nUW7`J{RVMkQ4cRTxmPvSqO^Z$7xRNm zVM_+l2OR@WLy9Q$6R?ZaWdrlvT>ypPMnnxutdFOXPw=kvVdXq=hTAS{TmH z_*J7#ERkrF6T#Jqd%Vd)oBNpZ*euQ1!QvND9C~=*I4ZBl#!-w+dlnlboP!aOLYQ1D@-jxqLXdQqnWra*?~IJ7K2mp;^fpXc5mYc7hA_0OB`Z?HaFpq)0d zBPN|0=Ox3wxIc1nTi93to#iz;NODd;N_?#4b8jFVwjgL`2M>?7xMwYtFO+h zh=sEjoCbH;mL9G4;vgOhK5-JCux3JeoYC~kFrC-XQ4&tRL2ULLOkO`e@YO_13?xT1 z8)$15&(+QAQZ3$a+M82&t+Z5yece@N-pKV(!a9b1GA$AhiiQx7#O_~eT=4z1 z=f6tDxj|I`zQo+*wTPaWYDhoR0OYJ6ru2?!KmGfp@AIaIhAsJjs%C(_=AeI&W~QHw zcz((QG$J9~gfaD!;qOoDX%&|B!8P8OU5*LBO{iBXWhDeBgi*;2=#52sxvWh!X+_}> zMjNmTFQqNEi0@!^913Ry!*hSA9LpB)B07U(AcRhD$W#TwF_Sq|Hh7*lkBn?##Ce_c zH`3YeU}!ApT;@BRPV`JigY)nL0{c|(CD|rmUZ#yacc_@{1kxN5sM|Bk$+5cHKY0&7 znDlr1>q`3uai47(=aRfsG!bNQq^1S(fp2$gC#WZPoBFJYTBi!XJ_ApsfvY62z$*dd zY%Wj-!s*eI3Ajm3*hCbPNyc+^ML{aFp(%7cfrZ7-W?@2l#!lwz*6Cl}IRfybHbtMSF%C3gC$SVp@d+5Hk)}QCz?S{x-R(jp`*8^mJ~Mb{G!GF zvucSI22apPAdbRB0W3x8EHGdtDEoji0ixaGNhw}~G-THkcIiKqi1?O2aHv3AzRq!y zuyhDvJ&$td_6d}uczUzVHkeF`rF>{|5yDsoD?bg4nP?PxCL234G}iUm(vidXW; zK^<)2;-Bo}(6jizuX@L=^CX(ua4`5#(aJ>qOvp5W2}Cx^ikk7igWy2 zEy0Ji<=bTl3Sfhwa2Tcy)b;o{yykLaj@aLWrusaI?#40HrTK8Q2i6;INsIhdMtVLG zIIg1??$zB_gtJn(T?$_Q>fvM+f{Wy8FhdMs)31))7;C>YbkMp5EOfL=GaiZS8TR5m zx0op6lZesNhkRltQ)fM~k44v70w2;N#vseN2Z1Qh^Ehh7q2Ny?k;ipYAnS!77+EXB zKno6PPh8K=*G%@VTQ`B~y7yU?;RI*Z=~`}sfW`IB!-t{^-I`u^cBEpFuWHHJga)S7gWHmUGv#>&vneVZt7sfP7V@a;-3$2

6n9PHO(X+ITqtXPo>@sZ|UmqNr_=F4?FN3)Ar^GePHN+K7+OU#xeDSbe6nzG*}?| ztoIDQ_l72?MD6zC;mY$4YCXo(i7yvtjN@8KeWE~*Q0UHO;6n^0D6Z=1&zR5#9UYo&dW`~T#p}|8{vp(5sUcT=Mhcl=q6Ge{Ttt>4@9}J_F zZr-jM`%ND}sA9m?Du(9zodma`(6YHu8atTdQigl>zp!J1G3?3wbYl|_-Gk`*1Vo(p z!vX2A00WDAL6a(0LAGyT=|JgPvvG7*Y+_neVofP(eR4{v%X)B(CarS;rK z*a07>j-WmCH~^RJI)H5GWws+@hP3ylUe?vgQcziM-CPnqV)X{QBe2}N!brb=*MmpMQokJGR^v)Pu4X3h~qmJpk~;P7Et$7kjN;rXJMozZ@satL6T z)Xrb_Zf967#dAnJu9pZrx4<3j;blFx(|&VCqO3|=_R3vg-U`(qU(E5`To&5LUK}mK zVY`TXCCqyukLWvNbyD7*w%b27&SqU;j`S_xbh<7cPqN&9=M6+53KNigm(WHci`x75 z%_2gsR3g<{wgl(==LW9?afpfq7s5M+;g+kp^|fqGo&II=I)>Dp|@S9a7`;yUtoBL!GknC2}XMu<%-9bm# zTar3KE8Uz>c_lif#wa(yf~v|$#O|}CPtfEvyGt`(`h->KOR?#-CWR3e?x>8oBe}uH z>0;lqgu{w!;DRs%k^)zr>S%H79SyHrTEs~ctfe$&Sy<)Ut8~FX?UPYLgg)jhKYi#s zy6zn;lh^x}b5eAHdw9?a%d5(EB8I%6?}ok|({M^7t{`$KC&33FDQJJW2xzN;eFE6U z(`eOwS#_8ksteI5`e6EHS&|({)D;iytq}FzKRHG)@BNn}C1yo`qIw?X_H8pLM#1#9 z;o-rPq(F+Z6NN}pQT`EaE&8e8?pTS_FM~3BShzxBbny4~9}ueziT&6ACRa#&5PDWS zH$pOba+*+w`({akOWsnNi0z(D(@jG$ZoZhfoz|l45MN}CSVnMtNGd}4H%GR(n{3mb z2^3a$t->1FDs+i{>fnt7hLRl%t&aWjr({ere`d>DNV>_R8kHvcjf1Q>3>3Nj9(kD=c(kYELnWanLp0n^eb{|G0GjJrI}Z$U_jTKE!JxejQr9_WbO( z6(l6<4SrCq-hZ-Sk$0@phm510V(v=jxsdu-=tbb_lT+``yr$0o;J<*|4ET|cH?_G% zf1XjVs}#pu^KOD>I1-&v9JM$ooeQll@sFZ!%#CNdp%pD1R%hnsmBm(|(6a$DBD5Ct zBr_XCE|mE0y6+bIGV2e z63S1^FDr{JMf*>0mlLq5peI?`P%Y}O_8g{K$pk79CgE-z|lS zss)-2$fenHASwq?4y=hdM~63pqeYM^NT9-3+T!yY@kk@>yjBhNVRk;JC|Er#=iNVC zv)5<`OOEHeW!|wnjTj#LYj6qial&YCDe>e0M0kz-nSPh~#7jdK_Ztho8l~#P=q8P6 z!*QiIVn85uQ05g%kr&C9T($%B^N0taoxg0AEf5r^@DFANTXC`?Oc2c3Xo8ka)Rb>PQF*rqVCVmZcr>BpAe&0!8p~6ivggT*Snp^2- zWb_>&rV+z^JIod^;|7@pcNbG@d^61nQg7BL^nZJdGyf@=ug4rJyg4+ZuD9QbY8Hi` zgw3M>*!>iz%=!<~4VXJ;-|ag?2>SdbE>7@bWuBH1IBsN}rSU1#{J^+TUr*s4^67>7 z5zvr>3?__jshA7{*#Z*o?*`bunB@=4^h+9;y*ts{%+z{@mh|e5HWgdNRg5R<^G@lc zmx$k(u;ZhH5f>3I!UGf$kImg*{H=1!Sx<1GrIXT^TP~qXJbatMRFM)^3QF1JW35Ao zsgE60+no+&bl8^S!pb3~e%Hv2SnqmT_K+W3za;r7U;SaAeNjX)Zv%f)mkA;lcgO5w zY>6W>lx~6s9pA^N7Tv2#gA&~EE0gbn0CY(31SZ$S?$2R(PPTv?kMsfgT=YuFWBt;j zY@;XKeQxOWj*^vxDcbg3Q_Fp*6UT!q=i&^G#h9AXx% ziTj|cx_e_KyAHx=E)L|r8XYa1lCZ>6lSxp36e*Pd^)*Jj9>ySY&P2u^v53Slw=;9Mq9s4MRP@Z5Ui z{V>XoqJ=^0wcq7xX$qd&Uqc9RPU224YooRZ#5tPEv)oa1-DxxYS|z`Z?XA77cyl^y z>6Ko<7cV~-CQfUyGBG{7?0BiH*D)yDnqwrMowH?-LpM0kufJI+A1R>7sO{8yYvc8m zC4R?VV+boGITS{RA4v;0@Y7_Af99*0CKU?1>?HNm>7xoSJkCj{ zb!umBASxuQot1S30i0VQwJ>z70=J}by1k)buS5Xp^b>)ZrZaTE@~=r7^M`K7lJ%3O z(UCwAEJMBZ`fG_HG|;ZtV{U2fvf5`L(x8dVHOjS2VQ9;#Jth^gAw&}s2eNGAB`O{L zgX3H@gFev?7Bmo=(-_b|78rQd@*#dfa<7zgYi-`?V_skp+nK#e)Chyjas!Hh$3%#a zj}BzOl(6T5b=!+~)(k1d_4aeoUd&Ys`1RGD;);s=M_2w|u>I<-vlbC2d~rL;bEEiI?y}u`L3Xt3om{9+Bt?&n>KQV z;v4lQ%`%Jp&bPk^^L!m(==Ua$m9!UdcaF0-A??Pz$;bUY!;_r)uLL1I4fZWSU%1@T z*wb-VJVYb)f?fmYFC58vzK&Rlx^#Ri zwH<#_GDU3dQ1`xc6-dZ~Esee-L=DzL!ed#||1sRGe^1rsjiC!HIGAi<$@wh}3LY|? z@xC9oxQe(_aKB1t%MLgr&fXo-s$rMDKP5j(9=dXg9 zp~BM<7Q_Uu?=P5OlCAa+@-vH2R*x1B$P0FWw*6NeDCF%19jU%qp(>$7!{58?K5zh| zD^7D?g%AP27(ASZu@0Pk#R5KP+o0;bL}+fv^b`jD^-aZ|cT8U^ z0ct-tHtAw|I!QY+rIiA2pQ<}h*~_f0|*1%Q19vC(3M zDGTA40a!}eLn)W$0*Hc%z+dejmsld#DNw8~t!z0eR>IgogpJ*!!3G%^$SwmKlfo2j zxWIgelzorAlYgVG=B38;9Yd+gMO5xYqWGyLocaOG5P^cmgHHu#3pCK{OtMI&b6;Cq zQB!*<+->*DsQ;xs{jgiDFB>5A@7#JzuhaJ?%5TE3)O74>s*0N;Cs!5?{ z1`L=6@rgwb+78)?EkpnkuS*P-F3kt@bs3vWBKCVm0iGKpRQcZ2TX|4nkT zSjf+0qIkyUduKHsN|!gbubo2*!huQEJ3=hiT_)urMdxC$FMYy7Lhs(W?kQ%k5{L|X zf}7_TPazd|%9I??Igl62M0T-vYDaPvR9!dx>Js#IGO8d*1oNKJJ3zcC3{z5Lpy089 z`&5|Odgg1jQ&!>{Fs=~VjnA#67nQ(3isK{O`f9=UePi%g zzZa!Oa=?$;KPMntLukKf%TFGQf;9d$lWkYL4o#qeZA`Xi@pG_6dge3~yLBNHXo;{g zDij2U)f^e8(Xl{Nh`ly={WCY;Aa?pfdoMa@ni{G0C0HtTFYA$W)w`*@Y!y|z z$KG6pBu((^E>b4g@Hi6ZOOq(LAkLIv#z?4Fy=z6?X9La@)pHc;jM z#uKtZGq7d!1_TUOTmg3(T#15tb%pzU1P2 zv3meWos9@N=>*qsTXbH&EsrEeQ!2_dkzNJ$hXh13F>S#nxUfq1m{=E^L%Bs=AsX-u z>xFRdLhNZBB0Rq&8Hg<*DY%5CQ>fDr;w>H`rVordjs;^ooe2eO;DPBN6Fc(g@iYmRw+m4Xd%J70BtRYmY&BdxFo}CgYWi#etM%* zOe>5e6E={BwJpz|JV1z#)}FbG?>vH!#sq^Erq!fhFk@ja`P5Sb)=U#+7yAs@?buY=xLObDwv71&Z+*nX%-1xWDWQEhuHE}T`5 z<{Ye3X{aG30?=JAtio20kv=L957&oLC`foF2r-YEhT_J0EU1*YmU>9Bj9TeIA5y(| zM2gGy@wfC;Xoit$<}`I+QHj^$mEt^r`QvnM4gBHhLqe)Q#Ad#!a-!a812@!k785;S z|0Of26^AXR`zidYorK3y-sKPQppjI>32Cu&6^C)cYAAwqB0}CGuB8y(7-gD}+7lGM z#vkGYU&6~|z6j>POyS-tWWsJymAwPywAr?-IhvDMP=pI5q>nRXBLS&cmOI~3=6-Vv z7?WNI-qd$XgwsgpDlpg@Z?*+weWUpLh=p64_t!_oNeYyPAfdNS1F8LpmM zi6HDyQV%YSF+-@H0tx;ZFb+CIhF1ywBZDNGs>uJ{LCkamxstNEJjR66mcru|s7OBe zB{>5~aJcjvyIvtyB1{$1bcp;`e*|E-P3BnW|$mtBbfvEm}{r+5~5)96`B5PGe?SGs1BaILDg4%QmR-UFAeB2`soCSe%o7Ws zB!4gRK!@%&!Dkh#)w%xZkD*}l`rzEyGYWPyGj<9g*Iu3RZXoC8cxb$d`l36;K0Yqt z<46$@;V#u*_?hrQ2YOB1l{Lct1e5d@A6$ypm;;NC2Ga3dm#&C1Q37ntbTSPd!BAM8 zY$8Q+f!+WF9>yO&=h#I)RGwIc@{ zW9$^BchfH2CR^sYPyQVl+U`vw&@O{P&@jmLmLnlYk?<~YfQR%ewld0gOTYXUa0IMu z?f~rc^Dt4wyARDfn<2lLDYO1g+iAw6DNLVoMxiQ+_|((w8XLPlY<(-)z@15>1j{d$ zKX2?@ajm*3Pv8j%RaRwVTTxVGhbUs<3^CE638s_0hdV3C+Y8vgK;Ei|}>% zw=OG7vAkxT$**;;4H>`wZvV8VpT&dr=?s|u9;ml( z#dM7-3{zMs~XDLzL zxqWH>;EB=f1QxYuK)3(*(HRhhAaFRW=v`D*8FB@8>!SQOWKe1|k_ULu&wP@ZEo1+6 zxYxG+4iFFuRBZNNHm7S%QWJ%@A?|{PNwxbDhOgutp04Xkih?URKm%KL;UpXOUa48- z_*-JTl?{Pc3b41v(3#xUx=vd|LnY3e4pt}P=9eJ8f8!GK|& z6muzMT|zV%kzo|7rBapB=eb(g$tV!8{k*pP>bXeGV%mr@Txj0WgOZWON7h))vr7!e ze9c({M%Ez9H%o)IE{n5_i5{YF;xG@RJa(IPBIvOzLjpz$0wt5|+s|wsYEkt zbk!hLZem8$P=kWC?;ysPDj&uD6hNwN zH&UPrh_c%RQTy?8hWEjO+7B#+ithO0s>jiX*s!B5-aE;*S#O`lP3gtd6W2pSdLFh4fa?OG>)z?N<|! z_D#Xv4|*+Mo~qm&y7c!cI2-+|OEA5_(h#c?xez0k^3V1KWr+^7=Nf~TB$3Mq82c2+ z<0MSFdIumS@bEJz1*B!3Lo!XFGAVzJm_W3WC$&`Fc|lx(-L4Y!#^_H&9fmFHz@_+V z^B+HbNl#=7jCHA7{|2QmEHzb?oKT8h_-dq+Y8CvZmU9kGhFD5g4q{uNU+phgAT7@S~?iA+^A;}QC zNjiz}78q3fo~2O9&@X2Xl{ihG-MMyQ@$uo~>de_-bltCyS2Y_SB@r=A=*Hc5Gtk1xqfqwfe}H_6ZxVtwnhLx+Nw>G{WC-N z+*z$1Iel46V_6odoOB_R%Rgc&HqW5VU%0gHu#yvkZhr}8R7rUJ*t@g=W_$|fr{=*y z@J#;G+B1D;73^VRo3X=c$O$+iK-ItRQa-gUY>pCy2Po!cKfpn+YLJroVj+a&NtteQ zfbfH&S5QgS6X;xea+Pc!$eHk;=U1h~22&S6p9*lIXRk>}egJoJBsh?GP;Bq~bOMUa z%>w)sW(iUf@5nqJ80esHC`%5*rc@F7 zq`!+Ba4F!3wj&SO8FB)hz>su{J=@w?8=DSy$`UDJnLjY`Vdv^3We%7F5e0dHyA$Lj zlDY<^ba)Gc>j`C8KbsI%q_sdS(2)zCG?L-!p z6B7}Y=VZdZDpW~x0WOYcQ1Gzf5C~k66(M&LxcgSzt)xSe`z)D#Waq$=B1tMPcoup; z1F?sS4kjad4B#4Mtv+IBF+Ad?Kj`2c!e~^Kwtx%iNBcs1z*$I~Xz*pa4mK(cZ1-8X zHTkfn2^guL0_c$8>s|-gsc`!RdcIST7=uK%f^LVph7mA;vT_?@Dd}3uaudakszE+X zfI-B*g!~jV?)7{q68?h>Ld1Cc>WD?0TW+S-#?SfRf(y?B4_)ySUv+$OsZlju)e$JTA^|b6`}LuEY{YhvE#^! zz$_mH^#fyo``5h>)~ycIs%+d4I2*XfFYfhXvD*1vrS~(6hIUE^%|zXd67z4GR3EU= z-LDbZHVV5-M*7u|8PmDcf7+jozU}sfvE5kW`5cpeQ~3ZDBe;l;hPT*%#M6LhHaTW-H zVHxUfCKngqM`*8bXSK;HycuCI=5f}(WI~F?bdZf&S$<&_WoFm%&}bzEUXLsm`}@a` zY}IcoWXr3^$QqGs8~+J6+30%Vi9yb&w!<$sQRsu7u09pw{if(;1LPcmjX@WAkWZzR z;K;d~$6nvcfkQX)`Rx3D1q=Y2fVT?q5MmuAveo`fI(eC}q5jkYoJ=L^F>07AyL}vY z2XB{+3ks`1qAwBz>=EQuBSXwQI?$+KPX+rC0XXCu71Rn?>$A!r`Yxt`izw-9M0cAZ zAlDylMF8UBROi~EP~JGSt5iLV;OOYY{6?T)Y^^6u@QH9y$_{x!el@D`fW$h_)KD#xFzrUB)xBiyUg0KQ)*GT$aaWO_aoi3rJPd|m#k9S9rFq(#Dg0PUnDbpA zz^=qf7b3y!h3@4r(eyV_L;ZXE$}aBrHJlLi#G#jYf%VWU#cK%+p1w1BXzF@t?L?o+ z+AJGmT*9$mc^adZcYl>DMxNhc7d4|89MJul7jNJdVN8S(aV?dQVkuQp7`r~dw^^{A zNl_ON(k;X1t<`esED8ii3;;vnWH$6}2v|V+*{C6GCSsVI^AUmwb~Nlzv>a*5O=M=T zwZi4R;yD9p$5Y;^L~~29qH3((ZUZ+@-to>=voWIxRNO4)jQak8j@hm<2D&$U8|`=; zd`NMK;__8i%#rR=b8SaTvk1%BUmqq!2m$=SCOoj%>Tl@ck}&wuQBk7Gl(UQQCP6k) zE033cbz}X~S#td1GH8ZJyrCXTXy7aXcFR<=1n^Z){>%$>+@jCyMM&@^NUM{&O7 zz*vsT7t@(@{MJ5)=ebxl-xfnKBfMa%`gXP+UjX=Imk7a$d0j{iiVwdpAmi8mn^jkT zT+AE4g|OkhN^92=X%pHGxos!x&!-04;a4;JS5X*zJS?FuD z35easblGDKvD+zD^(VWrZhRrQG~!herzM1G1O}vFK&0r;kx#T7w%M{02XLEBxFV_w zP67O)a#hkR3#<&PFKg8^U%KK`+II&vjhk?ySZ?xt9S}vc9fULnha|GK0M0(Hrj1+Jb2aEVdvKekV~$n8Uaj9^9mhHy6<|yyr9tv>~fiaSBAdj{t_%c zx}#CS18~~d;#1h71{bR&uz?$?3rv2bPa+ogW_qaDC+)qoWR zde%iYB5j(24TY46Vcqxh=zE!B4q+}uS{5%6?6XPztm3)o`d})jkof>=2mScrW2JVr z*`oBNqm`@Xa9OD?=srL5{%xg;2-Y=RG!+C3Z>wmNLhRIc5Txc!p4q^26FReV zzryk&a44-7`>TnRy1WO^a-Ww^umiPXVTFnI&UF5Y1 zW{b)&Y0x&-atD-{T-sdHUKtfcKtzKE8z;F<-N}5nZhS6MRh$_AKDL$#h!u@%`-2TJ z01%ae69uUxuLH)bw4wYtZm=}=Rc8bp1;!6pwl{kF3B+ARpyrqu|CVc%@bX3$1jHA>GsqjK#`^Cxa zVxwAZQhIwoyBL$o=a_}c^CE-T@(iBVG7GR@C-PbZD!Ia#=#@-Vqo$3-CbItDXqC~& zTR=Mrf;8jbVN;GXy>BbwN{eCcgsjRIPywY+HevQqrINL!Jd<4G0r}9yL)a z%ZRoj57v+`mYt|@5x_z>Xk0cLy^_hY4*oHfnv-LygJETF8Mdz=FzIFMZ|(a}ChW+x z3IsbA)EvMs5}e#f(}|+5Tc|)xX@>y|;08mqMP~$+XdjC7>`X|ZMTH{g$#P~Y)MR;4 z&3xTyxB;WeM?xt)a$w)DW)3_8j2xV0Po0SLm(X@^Z{%7 z8Xx~4T+DN?q6w6qXb!4%L9bDMCvRz56xW^F^zZ<*r=Z5;J+GJj@6=y1-{wsmdlE^GP7FYnONcdyy^eCOBn~_U zEG*9#b7kPB`*H*cVTSxwch2AeLW&2c6hww z3%GDJ}(ANN1tHWNw2d8Z8)n z0Y}BQgWZq$N2LMSpG)$X{nK<7;|uq05sCZ|C^>^_y66T4bMAY^B}fAg3fA@z~c2 z#^<;J8ICw%obs$52T~m5q0qbbzx&55R&v~&)fO@|87)^K37!Nb+ZFjnU}R+chu?~c z7G^@K*z`bd;R0tkSIB282oxoVTl7~sdYkJc<@b70S>~l8RkCe&!D*J!Ev)-0g;YLU z35InR8Y&FsEa6wdoXx;U71(Ju3~r@^st>ulsQYw+4jz_CejleQ`5QI3rH8OONS&f} z-Jq<2=rE)thBO8eS@uCI`7h$SNYLVQ)Xpq=-O;U?FEhTCqC&nB>H-Yy{r4|ClXo8D zMmIt_v6?-Vq-iLn|4xi`G1PS|46k*B1ovj4XRWB;;w*-bGj2dbXvvi)FdX2* z@k`TB9M@V_PNmS*8X|#_*+PRGY_R1QU+a^Bgf9i=VMlX)x?klQ!Ti*p7(^DZ@Zev+ z7}=1`MQTT{qfM#09lKmU%SFOqMM=*9Xz zUt+$=3;$}7uze*2snD6-gi<=8oVps@k^YOA9@U1V2t#=V(yo++v-@{E7L^KUg`SuiM(=w=lklJ97aEqW&eoXiju;Q~hitDQ#*h)f8&gL4=X98<2d0aA*aK z8cHCZdPJ%THITvSOZH^lXyNU%>I!BRfugH&iqB6{VBA4kn~90mE6gLy`SZwUBmZ!U z*1P1ds!QUmUx^1m7XT{r|1Hn(usH3ou@eaL7Gz&dFDC$Uw;Lcvz6H6jawTJr0O)E86y3IM+nFo{J0roR2>A!dk9@+7Kht3O*Nd=(b zf3|TMvk7I}0?&fg^LuxqxxF@n$UpZ6x3#*H9>6K8gPu?q*9K{<_CX0?2XAsLofAdy zO&vV~eI@_jj#C7f`RW7i#xNR$kWuX7*@A+aFsUxi;72thH~~z);NOc8%0s}=)B?xI z4=4W+iJiUx0dpDSwq`Q@k9Z>uo#%tEwX-?U@E%L=>C+%}gg{6GiR5KTC;sx&v(Q7u49mP}_|a+w9D=7{-v+ZC2$>MbV&m3s zgHE&aO?kf-%EfUowtoHO_-UUl9CdTZ<>q!m#1fhADmP0 zS5Fl-6s}{%y#Ff%=seUTQG>0^2~2IT+|Zj4EeSK;r8r;DDDek?&3hW`c_T>qE5K*< z$3{GB!VB#qs;@1c8Yf%iNBv;C|_C1gcoCD(2I9?xg{&@Hx3M| zDq1LZanxkCE1|lq8gTylO0j?0|C2+{prtP_}*#-7Tgc^<`P6X9rTl6 z$|B=7W`W~6{l5lYm}x4bH1A{zfIw#6HWV%;P)HU+sTSkuSvskE^ziDQDg@xj-BO}6 z;DckW1pcw#s_q(WTR~9z^Tv(c3EiAXX|XV*RzN|lm_5MqU88Hg zY*h{&xVQwQF$B%dh8ZMG9oaN=&j*HaMvW`5f7Ynu%YS)vJisd~JE+rw^x5A;iMyo6 zIY3?2Ita*)6iqqxY?1>wg8VLo{yun`D{8tn6AGS_B=BA&=;f5h$T>BuXHAOE(E{{w zs!l2*rc$9iM~`}|5Qca*U-cc~i*46L+`Kwtib3gOh zX1BV7>37L?pz?%anuZ0an$I$|pSVQfMUB}>dmbQ1Bt)m#4r~eKgH@1h^~JoN_3P)` z2T@VsOs-o1ky^8buT@-WFRlfbX}v+hq2a$9+dF)9QAF_!?8{)b1mh?K(q54 z+4j|LOCT)0o~gx4xa3%ECB>zDp#VN%-fctSVgmogG55Po>xPf5U|3EtZN!PZ{WVYQ zAu17HC>eHOLonknX9H*06VR~GeiYp)a-p@faG_9yyQ2@o;w{8gGf1!=*n`!xP6x3Z zvl7@esWqTZhRl4|Hb6WXlCkPI30`gt4($b?jG_w%KZRCFr_>*jw`VwNmkG*u8P2R- zhtO6yqxKDbl;Nj$VpzZzM%NRS>zQr~Ngk4}hzL`yMY$$mt}B~-ZjSNrALLtaiL{I+ zPI1v_{-N7!PHAuTP)76AjO^H$v)Z^#A;aQz6O3#D%ytUTtg)Nc*yec{S1{2Yal!44 zG(Z3y<^#iw|IRa zg!x!SGK63|59yX>J9$b}0nm+J?35W%Q9vq_u2Bl9;4QY43e>oRf$0$!=nC*)g%~*K zMv&+jq*qcH!dgP#nvU~XJfq-Orjm|e6zIst@)&tKIhCI%QCu;u z=ba3#f---cUPaDziAr_HcNM4h&l11P zC$xf&6*jw|Zyg^JSxy1-sLlw$rXG5((;cr(Q1FxZ6|rH_k5i+Y4hBa|8SKX)C=fGF zg_9zTifgTljyh92kmuBmSB0BWZJclH`@McNE{?q5P%;K`5?6wZA0Eqxz_K2QViNyJ z!ReOrvM^m@!%d2M!^D|BNld>k|9z|9rS50%=l2$7ohOak$N+~%^0a$3Vl~22Azkvw z4d|}$s_EEY)pEpsje@^Ppv6(e)>~i#`wl5Y$hEQto~6lkc7h+@W%}=(@3Qx^ZF#Cu z_@*(Gk3fZ> z{ITd~x1mg8_c9iPO)zS@d>nViA64%Ezb5h>y{t&GNg;hUH0A=5S-8veNM5WV6yUg8 z8~{r|w7-*9-kkrg zU_V=*3yfmcO{7GJQHX;GxF(I|y&eLfKidyJ_+)?@sDeKxHdc|!!~TGB{1yokyF2f^v zu$3sl<418QS*|Fp(>iJWP)mjD$pm5jnu ziwb4Rj>I|_6<1JBwNB z(t3$kX1OGiYy_l~BLc_}&vzEVs|D&4D0eB5L1~-vz_u^NLQx+(nTXHFgYUxjy75bU zqFC%H7u~SDnSt~9kZokdu-^(w1)F;UpR93x9HAmAlptvxHieN^-c(mxTKCpRq;bly zXHj3jKbwK<=b}YT9m1rPVkN6Ip3S(Sz=Pg3zUc+Z!f7w?+VW%)QqR-deQks#0O1EaMF{f|Xp8S8R3~jg(g3mcfYFKSiJ}-NXe^);t_3}% zwBe!Lfr=x;8A@;tV=9?0)u%z;2EhWpLBP4QxlZpzDR5EmT+aHGV(TD-x+T;P(SjJ5 ztzZ8f0^+>2cnl?!VlU;=u!d2~H#N!HU$hlDhY~ipX|ISuqwfz*a8Ur)#6otKd$W+{ z#qEABLf0eo@W3bNven z1K@i%)C*UF88-Eh$2@R|PGGgJwlRX+gM->zfX5()6cot8fn0WXk2^Rad`ry)(>6Fa z!eLB+(UEbtyql?z5f&spA$W+j(RYSGnzSjrk9%z7SmG%RW>eXMdi7c}7Z?Wa(SDc~ zWx@sjc(RC~!M@ibZg76dFY^r>IdHURfogD=uBTT9M^MO-lY$6?8Wd7<%?T3dtxKV# z6A+Le75fnI!}YGa=4Sh7PPWLQQ&D=$Jr7cfmP-@Xl{rk7)P*5WFldC}E<0uS_~12i zJ{#==p^ENbrB!VAC0S6imm~MFFA*18s+!U(X%KRA>f+C+8Ejt-+hV(EMqBM-q2Dul z`4!Bs=o%1w+KA7K=)!a^mwHdDbgbP^Y!De3Ls13pn4}c?lOt*1VSB?Lo(#$eL*Cz# zkxj4dT1`(oIN=nZ_^+qjj*53#|482Je+77`855-fFxv%)@+AgcZwR1SZ|!p|Qx$vR zHRKCmX99t_r5v>pYNi|g#ijg;<{{eviXWevXLC49(6w|gG$vC~SwyerXTNijTz=8X z!`iAo(T9oMm)$zq#4ECkTz&>%i9aTbK7rgN%J~2~m^>%$q2xxMb4q=)9HaN6QUriO zy}9S45;Py>;B5c`H@?^JQBueOw?~+4s{O(}2W*1O@PRFABC_c;9qXy72fDf3#(&-C z_MW6K3u*&?9>F3`b-UBFbSU9i2)KP)d_}&@P*#bYWcj>U3rh4<1{L$o*u4Q};((97 z38DxYvfA#e5Uz}mRCPGJxG?ff7Q~w1Vy@qqkI+w)+<&L~!k=6jVBgg<1I#zqDWr3= zj(PK*x(3YxZG%h~W&L<8W^NS@r?tddZ|a2}lspL$tDHdkiRfSW=*HXeJyuAS-G0bE zTT%yq!^0dR$MOVt*O*ub0HZNHT>X%|g!E;CsI1848im!NZmW$Q4mP)Dt84K4#Ki{j3lj5Q_|IOYn{is4idXWl zkPuol@9W36-@$DOE(DN60l^Ot$TQ-$e;JS|ZaUk~O=ob)6Nv!x%5QdL6ORZ%r$lq@ zS9mrmg}{+=`7TqDT=_X{>)p&{o`V{+k&|<|j#4oj;Ya;Od~EW(Cnom%0v#!ar_eGM z4RxOTN4w7zc&7r1;Qej*Ex_r>eE4_ysw?iY1Lyn>A*I{F3TXv8g9PZ+DlT8B!bOl6 zH)^7}I#d%er>ohOTP`vkDT~bm;anwOgM9WL#{4cP-*(w$C+D(Q1y7H`gsXV{v(F>s z#kE921UD#Pfm{}KJV=}D#5|m#%;V`H=HkOwF$n-$p$&x@L4L1-wXS(yQB+c*0*6X& zSSLaVo~D~nWv8BEJ>?gg`0e9JpMj8v@upieRg+e8!sTGv4^ZMubzeUV5?O-l`I!Ym zUXP+&O{g_@;S{We7~0zq#_X3wRso;griWSPNZyA;g0zV|{jP0Y3$>xyh8zmqF$|6_ z-K!XGE?&4Ziy-w%*nFI zAG2}M76{;U6LP;(8T97OgZ~oG@6QhMH0fe#p|3AbIbZkLg04(R++32q84lw9Vm&FE zKtV;R=ppTbkwuW=XZZSjw**4|Zq4!NPH2;qXu{OX2=6tL++M3Spljpad zQt&iDrzg?&R{i9d!N}2SmYIZ;z0qBAC&uCk&)MC=4q)ogeNZ(S>Z|3v*{Qig^J+ zZ-O0M_A0*qqHd$3toGUFd9;a~=rC~eA19fIoUE>f9?75V*dP^2V|bph_zU(cLjKpL(;EgT=*$RMkYearFIXk z?5<2qiu`K!B!*MU9nByt-PW)v?m{`ckdW^Ddox1(BmeM*IbVfob`2HyINQDJk;YNAs(;oZ^*GU#7dkeCHh!{%MUmxDG+_igw%+rR?&js-@z1u4(( zTXg2`=mSW8U-o>%VWW%L!aR zY&`ViL^YCJ?&srN9Jo6lv|z~BcZ)$~lVYLg8RZ&8{PtyM3ql(YX!9`xVe$K*%n3k>i4 z^C&M=;^&W8nO~O@LwW(=pSO$u#-*7sAk~u(#&>jqvfmikn*@KQH|>`Vz&J> z{*IW|2nkH6O#M`DMA?i{u#*X!sdtd^7*ht5?S47>a#95(NLUVeFmfJ(UI*v-(BPP% z^-EIkCh>8LKCD!v3X`WP@K@jH)^n_)Bqa36?-4ot8WIL1$S#T@*oG8(9g^74gFm|_ zX6L4q(D0CVq2pklv8Y~gP^{2&JOzFZ;WeIN753cD!`#!+bN)n1Mru>@IV1@exIGeE zQ#*mGNN!z>dZR-(;zLT?ecjxDGv1&@4vpt|K;cd|`k9Cs0OqVDm%UHiBw1MYbl9;6 zV6)}Vc7J4>e>Ju)J3eXvw6yFZ|9{-4to)zR5TOq&Ywm$C_eC%W0Ub?2Q|wocDVD7h z|7~t`6-s`uf^#X|Hlb zRAW47<$`QL8ldSo1%B%r-F%K!%ybSe)`X58<&-g7;jv#t`OXIpUK#D`=s9;hk){vo zVaFl$2#CT3Zc=5H6cZ%rK8km7KucHTBD+e5Zn{O=i(3%{h>&!hc`Wk-)Y>P);Ng#1 zdJIl6FZp8z`6ob(1HI4t*MTo3E&)wedrRXFzK!aTj#OBKon7L9%~&i?GTveBRhci; zD*VD60KHdXjg!#=U3qkhJw6dRTg%X5g(p9h))Fd0b0}{@L)JlfhedGhOw9bnrI}TU ztLrJf*wA+YDf+?EjDYU4>fzp8%wLGqK11(h%}Pim=;6gl4Q<5W#vq{5x2}U*9C|MX zT+`@4(Om0ASv6*EE`qdvRdg6UEUVJM@~jdC{?|ZRL`9Yf=xKED`oZ1AE@MS z^iz*Ux};L%dA+O;@Q5%#%H=Fm`P>|T%POCQh3RkOtd6Xoza3nTj!S%Km$>q^X*j6to)X@R%&4;IS1UpHMY zuvtcVm(X!=(xK~!QD4hT5F+!+ez}IzGJZrhSCEI-4Z$=O)sHbm29d9g~@fEDN9`VBL0FjfwB=2bU;#y6&@N^85Ew0Z+Ob<5!vZQJpj;hBQ8vNb!H` zxVa?WKJj`8W~85tORz?-e2pFY-h~j^N#bLeraP2@?pNXfvtB!Lo>C;tRBIzl9n}Z~ z;*gGL3mTeRFol8(z-NHgx#B2rW$(;@Us~&5^Db+qMsqC}mCg#!G^$hMA;Sy%5M^V3S`#rfI@iq zi{GLCWH8D69nL2Wc=@52g3ETu$izBxWZ0BIAQJ!LJ8!0dU=1~Qxa`l02#e=nM8xB_ zK#c8fS=a8_Z?W{-*{fOk8cm{ksU~(-@V8@op~isCmVC_mkOtl#oud5LW4Q(2&r;bJ z-<$`L)q#%hssCNNmsV#7Mi%tx*uFInpjSB+;ts%YJEb`hrON>Ia@d9pX>KW4Uos|{7*~8xoh03HdLALJb zt+o3&0gTA$MZk5aZUvf5eR(kSrVh1NHpE^t zR5>xGqhbqqb;-5xUaa+Eb{Hu^F=eYaCFC7Gek%@#6={$wfrGK}^Z^!F_rZx@ut?-` zh(2RvF8sxSp*RI%I><<@i_`ffpx6T8%}J9kesMKmD?^wBxm9j-s#DZcA`@AW;wW_3 z*biSp1fN>}nd0Iy)6t6{$Gzr+A3Ex7nmy?h)K!r?^wGrjD~G6!TBi^F+6m7 zDc}aC7{4GpiLY!hPcr<-823BO*D1T@e+NOI(e9OPSrSuKS%SW%$YEQ_7hNNGYpfZB zm22iz3EcTtGymae zo$?9)pAh!}hd5;%r<(^jWhe2~b+&Of%xdY!U5FpVI4T?648el6c_VA$nKE1)2L#1+ zJu}ZganSc+Opt6NlDmQg9)~I_8g(kqVNMudBe2$E20AD|WE0l*BW*Z@_sl8S^Izho zn<6N#_~jtViJd!=Y?@k$m@Kdo(Ub^9VhQv}B)#$hTU<_3iui^+DiJHPKq>?9m0!Wa zyhb))%nyK|$QNyG*d`b4aIjAt<>Ns5D6tF8j@Oqd9OBPGXR}vNh*$MNZoMmxu@bJ0 zp@F7;6GBnd|2xD%roX*WD zKk!B_b-t!bR?AH#Bu9Xb)Qu)R*P`3$g`PzRs)*KX879uG-kE;Fzm_3CL1g(aGCZuO zz7YUBV>*h)B4O$Q!^yS+^|2{>IbS}EQ2)vJoc`=D!8UI)V%GzkhaA>PjQ7S`@$;(t zx7y1e1pYP9-36IL0V&jy$sRe& zpI_TA`=*1Oj;3wnbJgWGlao4JG@44euf7;>)aaPfo z2Yh{ewADoo2SngA3cl_cu!qZs7&f*{T#zpN+B_LwP9hDoJ`MszSIfmgW^2Z4sQlXAFqn|B zjYAeeJ99I7%#Q^n_f4{mT$UwKqaN25^Fh7$5eNXGz(Io#QN6|r#nyGmrJ6a@KSquU zj|hFTzP3BM36*9_GK1)FLht{BuX|?pCG4^~gQuKkOVGAJ=I<|v$f~4xe-GPCn|@7l zJjLBbRa~GX6XnC;nc8n0pIf4UJFFK>;Np;1GGJUld)ty(k+g0L9)>8(deV^0m?}ti z>jg|Ei`!~!G}+_Sz8PXX8&L5-a0)<<@cIf-2EQ?^I)HxGmPs3Lfdcjkd zs%xF{1h5t+1ua)nb^qDx_bB=#Uu4iTvlC%dH6O+c{Qrgy0$3r$*->qQw|3<)^Yopt zoNOn>V?7MEN&fAixlaYi+<-9wKVgVjP#TqfutKI7X@LGpnQ;NZe5z9Q?H&-k_*1i# zXEe7karGd=arHOC3tD>1CqAigyaWPOTxSnT)le~BYd7r!eLXGL(mz?mCX^X0D*%VC zSm|t~DnAxn4YWGZ4H9UL?{>ApnhMvllQvB?l7fD+p<|F4cDn5~ssL*urz2?XPYu zCGa7O4?dl6eQepduEcCcupg$xnjvVVfZTWmfb8(PHR;FjHlV}ii|G6O+h#PI(;NUk z)IbM`O8>d4?`5eJRMwG_X+j^$1=&<35_*NmQX!dT>g}qy_WrnEY5iD!Yi-yfe({N| zSKD?R){p7yb5*v$S?r;9W9XJeJ>%VxKE`2Ta|MA@ML)bU>iU4IeOv);HGG0&Zyf@4 z^0#xl7W7Zotpz70b^jDjl*Ztx7xNJ#C!R8LJ8jS&EvXqrYoG%=veM=b_?DaLtjz44$#G6>kW8&N9}T=D(*GZBK)~p0u)W8PdO&s^n^wi^vY=9 z;t_-$39*Si9Ms4k!sy2YK5i62a$IW0>NPIYz<(lK6FYc`AYezqVcg5lVj0PxxD9p; z@G?Q%X6F(xC0(QIehX#y&Dh@?7ZEn;8_%ktOCjL)U9{)&FSGTrY4yV&f#UiRY_+J8 zVU{jafITg^{aB3Y{u@FpYrUioBlVO_fALD5KWulS@K!`+j?*v`P!>(ge@7;}zbB2T zLB1dg@1sWs+K1tNwa-`z{eK7LxbR*~Hd|p<0@uv94>vG*Of2-943!wmk~`T)+ee#C zRI_&&kU z6E#a?4RZDnIh0G-)=LE(MB|wGpEtkJL@BLoM8NmM|my0 z{U8RroLub10;Jlu46hKswPJ~Bt-?EoY8B~v)sHFf! z6jreG^jzEBw~@*BFHiUhkA!+ldQj!-w6LGUOzWZ3~wmGke|G#8dP=Opr6RxdYQQo_Wb^3@VJw zv9Y*^snCWkyvM33O@$!-r7#kCgeh!Iso6mdo{ zZ2po#?ug*Vq|ctpaDu9pKJ@fjDw*fG=03%@5SQoSbdt z-E+m05*X^8+ld5X9iSeNBa6PkJ1}_zRArBdUMPWCiJ$%R%`qR4cBZ`jb z%0~4fv87_`8EBMh7|;#rS$eURHw#NG)j`X|TEJ)Urw7ML@NAW*Lae|UQqz>a+gVf< zESo4J+)`Nu)gFP5L;fvC&J&V#8zTNp98LH0aeHhUqA~FY)IU$ci$Z+{A4Szr zNNl5-EX*0RF6xQWrKp>>kw9U7gRPwu&X+4yMwp&^JQPKCg;~gMs-H4F_O*53E$p}Y- z#BmJ9?HnW&gW^6h(rAV%=^nZDWQH?(l2Al9H-;Hiv5*UN&+3>x5&$cf;xofKumaoR zf1C+e+Zl#X8^Fu}@NUH%qnsD>oH&?KOUmx7D|Cu_t--;P08xl3IN3|(XUuC z?$;QQJu8nKICV*Q4Ay)*!>(_I2SF@Wq~3M-+^l53LQ z`qLXu$uyez(C3Pb6_OsP67H4jPojW?O(>vK2>Kbh>Qr{?;#6Za+`ADE;ryNR5Zf|* zHh>*x+KMQorvLe1WmU||Yt)2tR){kG_Jh@g@d}7vvQn7Tx*!mK1SA)5hpc|gtw+M)e_XtfpxT!_7BAr+1KcW|R zy$cWOZ$m-qbrbqsti)Shh1()dj?jI^GCIK#Mrp<8YCo;}ytaJk8KP~inn>84vS%P+ zHUUut_VcqPVV~~j+PX7BO>ex0T#(EQ$rjFz1{x5!D=pxJmidBKg;D?*m zkFccav{tf9N(3eMHS!zQ7C1qqFm(X}=0HqZ@ow9rcmQ(YR?8g!mz+-!|F<>ynY5$8 z3u?-X4y^c%_9w31b^WUaeicI;+~L*}27(gOEkV$)-#Hrvh*&&sz=aQ(=|{2Nh1<2)cR`xGAt4gln8rW(AEffHv%>Fs`Fr zg{*)=qU@MMEY~pr)#AVB5c>-xE+k6=QGNn(24F5tNxao~EazS1fD-LT{)&ZLN)J>f zB^3o?BTz8SugpPgalKL~7}rVZ{b(^%l$eUlm?R~Fh@oKv)~Tf5al6k+m6)RtRaI6c zK{G(u(!+#aKDAJ*`Rabm=weoQ*>#^Sr<@Zg+kM>-B0>0U2MqXY5J%1^t7mjy8b!2T zFiuPe5D`64l?&9>%156}1!h*pPpgKXMf){K+=1Q&V@vMrxJ$+*g(`Z)^>~y zQs`CNY8%)*EpBLRh_0a(hIR=H@%NaAJ3nyEr&hRu{gm+B6~X<4gZ5iq~ ziW%;Uwq+y1(%_IwQ>P3Y9Y9NmJQ~s*Lt;1wHKw~*z~5QoDktSX1#~sSY*n$V#!k`S zfG>9CHUcT*UGw^l>F$fRc_Yr!pzA5+jB(=B8@zckt~mJu0sH* zg}(^}@MkbwNR$Ku{Y=n#1aL7Ujhcs^C4tC685#Zw8L$f9B$Ty82B}t5VJa1bnR=n1 zZkMg73fl)Uw)yj4_drrFMp*Sna=iYg$?s7$IGVJqV(yi5i4YCp2b)Rr&O85N45Z z`N$2+ekD;@Rw3>tQUpPc-m3XK#3e;aN{{bF9B0q;7~1s(c65Bj%mq8RlS_9yuAL$_ zIM2$aMNWs=jl7y!%0bKM#-!?`_7rB&l)tbOG$=2+u9u{t_k6{c)Qa%hb4p!fjK=K3 z_xq}iQEp|ZPZ;ImK*@dB-83N=M^b^4uTl?$MBXmIaW*9oBZPQoJ=N~y1>-wR6SSHL zoopR@hiw)vfApn~<8$N?zz*7nGj2~`#lVydKbK5=#_qQ8zTr4qGHoMAkhkH)=XNfsgI zjKZ{9{@{TN76c7iz=lGGN%bppFDGORy&@JYH!k+_ROr4V%#krZ{^xKh&lXrEx+Zwi zf5hRZaFJC3bWD(0e;C|I(U1S;RYt3vg;gr96{sh7V3!MJd~_eIwpv$#M^zJqW)z)~ zOp=P{#Rcr|YM9~Ih37>ze%ng&p82NsJ}22Od4AuVt!t!6wTYyg3Ad&Fj`FG_DUo2^ z+8QZbCZv903r~=y7F!>jHtLH%OZ*Q?uxp~E0zAXUIXHb1lqMA&vZGoI;4Mte>hZAT zuH>IOu8QXQZ@W>YwgPqCLGD_Gau}V$@0DY@)<=VcEG}5O<_i)L17tY57+;D^C6c1x zUpEHgaXi}7%BsCOhcWkO z-|dxtPhpBU620izu8wwn7a3{WQQ|_DNpXB476I>Pa561a@7DZwC8Yk=gVqty#IHiQCKIbclit4vT6q2j4& zYA`|+wYW!}6ztPdGAE>cX*+xj&E$;DM+UA~4LJi}6Y}1DZ&=Yyqwdwk7KP3G8khu! zCU82*o-3Rp^70(_cAzcvKsj%qfZCUEZ~^ZuGEVh-oT}1VfjTyo-4w&q+9+^EPyeYK!ZDuD~CvSuRk_1l*Yo{ zkl58GS4c;tx7$j>x;E{oTzIghexa8)jMi-(W%|-bZe>Y?M=*Ig*(p}WTKEkHLq z$r^9As+s+13I-T9f=n9DLkO*#XseO(CfY)0>1kVht^cdRw%K}*wQIO<@rAuhgbJ=J z*J|ZD2!@+-gPySDN#q}+Wq7BoXs0@|gC&>dO$v6{q6w%zvD=VjaJLBGE`LW|G?8A8 zqrICcmrxZ>pOVY9-%|r(oYyLGyj>z(?q*4HVEJRf0lN*RUq%D+HK-9b$i~>ojJ{G< zVr9)-5q}X%t6}454)U}FU44uyY^AorV^8IS#>9Cxawi65IGKQcG19MV+c(Wu8ENZu zf*~BH*vfJQS(n7ENjD@Rz&{IC<@qeqQ*(n%g^a4O^_)De{ec$Fw;$8WPQH4cQ2z+H z;}5_-^hYlX6vIlLDkY_M*3hHkEa-DOOgCiM>Vv*j#tOGBU(FS>MZg*f37PEd?^}EB z$SNVD4JKa2OP=7hHR{9z(iR9HjRz0Il**svcY1gJXae~J1YboSvpW}L<7nbDUvRxD z@J_kF0b~tOn_O(8WG`mY?~u3-b=4cV3aT06AA0CZ;z9G9vq2txGA!Y+FR7_yEnI8LO3k6qXNYcr1{|2pzg`28 z{Y*c*#uBA(>+b0-QjQ_3QSU4Jw(=u(G~>4sTyR2&xOc6jFUjfxd8>5B9A32W0rI!i zZSr_MlJ=&#xpos&WfC#U(- z6~tG!Lx5Z1txu!vhAiSJOU-5#Pmb`)2oPAE7(mfm$Uobcloi_d?BBS_^udW+{$;bM z551lN*|lIiMIRnH+~*DRg1R5f+vS zrX2*uRfS5X26$-5ZEokb)hl?|DCX*0W}NKb>>QP-Qeb#3;uyZI70opn0cQ9cn)toO-GIBTm~Ipc_6 z2E~7$0&gS5ae+rvA$Q4zUnAFmSd$B#0wfTVg|Ok!;!-)kd=71T;t)*utuy5{zQljT z82bRs83l#=4d@UgCgc`08AwOhOwW=%_gvrUOhx->DfAb{yPdRa=M}@~04|+Tz_mS< zt2JwymO5p6$YwYn82vp6hXR?3C7bUnjh7hAOJWjLyetg{MEXobC(#Wp_ES#Mtn66! zt9sX(n|RcFnIGgb)!TkeICw$<*Zw4PT_4=pBKAi{KR0MYqi?zDF6?@DD?|Z+&gOn& zmMZ2>xzzy_{-qcNPom-|W<81n4;E6de->@Ii|4QvrWX)VyckK#{9h{s1%SA? zibdwZ%EmO2>zO)sM^;-VM^~Ndk!m7UJfkWABO_GckNz7z6afg;NBfepAeZkl57Q{DRXj-E?rWPBuRgpTWLDm$D4kACZ|Je-u( zL8&0|%%qUQ49%ZxI8a_{kz)mZC2tX;OKVJV|oz(*(1b1KBzGCJ0)6lrwQ zv1?FsHG%JA>x=Fo;}Qp9NiV?F!%>Ly0JS{HHQ)U9ksHUXT0lt70gO5>RKuTo`ole- zFsgY^(;abW?x6=^(APE8^nf%$YYxS)9+&~8zj!-;AA-9eHvL&c`9#8W0l8K-(4i_8 zNuSr{Hp6DNb<^u|!$I#cFfuLD&=P;2xBS0$nW?I1SS139P(~=ToRcGW!jFED-mEyF zGV@pfh#UKA?J+$cHF&3CEkz99&TLyClk&}A$Y>xv6Lm~=c*GL6ktwOeNgLy!l1#2K zT8W9tK4NmM!uv|ey&+tL##y(FPl$Q;x1UX31%fgb#%|;i$}J<8`;IS>SVnYUD!axS z%k+$jc)}S%qWnCeEV9qe&~Z0{Dx&q#&A zzI3!d2+P-ZjS1_y3mnNe_!;hp?D|5pRI5>0R$b&}qP!{=m$~cLHLllTMrKk;szB>X z1!{jh#?i5@>z2Yp3~M1X*CbhK-OI8RPZ`^wT3V;B-uY@t^j^?={v6x&}xy zkeemKn_&l2}u zUxqvq4SHfM!?D?re>CV>$9hv)8G+Qol!o)djv8KcAoQt>qWf!+$SyKm^FOooC*4LO z&Gaq#>vn{FXiT5()BMXq30&T;Z4lKiOXfhv$XKWt8hFLWVm1Q4U0834Vie(-9?x{- ztO9f`=?1^0FZ>|CqzJ2RQl%6sF>6Cwv80f{KGuy8Ti>%A4%d#2l`G^jU~EIrBt2hO z2;rX}Na2Cl?`dT7J!CeQPbTbqNnPqydaXbVCN6Kc$_FusQu=TXl+UpRCl*emcw#hR zDh`O(L-k1!=wbPT3^E}>z62WKKr4Cz=DKqoOu~UFtD~gx)_~82eH{xXgt;<%+(a9~ z4^0!G{3x9CP*bUEKzoWvR6hF(g21{Gg*Vxj>|a;oUBbga#14he*fOw~tty1E5@W9hnNXN#(!W+ECdc3_f_ zm!49r&G6&21bKmw)yMJrhd0nS!q~Tcnv3>+aomF?ZqJLFh>KxR@VG-B963xj+SVk9 z-CrM$!b(e7K814AO3R5nzOwSy1ouw_dxd-e*K-l zqb6-hK+lB?eJ9zT@(5plW4hshlVKQl>bHk!Mo!T_7Fuk>RSYwXL)Y7Ag?ThKWX@1EVdlF(*{|#iU zLf>}=V#Ur%dySSBuy8&bNXu6)!#060s}IkKz^(z(`ecqFbN8# z)IJ%|%2hg6g|4*T%6~Z>g;m)HA5*wA&(Oi_EJSz~3+I|Q+rF9v}S;}N57Ea5wqOnDKX4jpOhLKrFIA(yv?U5ey%R{eg1X#BEBCN`0_E(;#KnZ(f(#UkG^T84BNG^v0e({vCsSXPrU;CP zq;}}_zOkw`Dgi&7)dj5Dtw;ra`p%EOqIA&6Wiv~8#PTxZG1Y{sVyI@KBS^Fl>-L7xQ z&U%Bm4b?0=p=~%So9n2Qb7^F)(lY*oVL;aP4+d?INKxFCLSqWPpYendiA6**BI%=@ z0kYe1uHoviVeWim2L_SoZn^w+tb_mOLd~oxOf;b7V03yLBIJ{Xx*&MSj}t&eTGEdv z9C0s2)hIKv>-)`a)KCawo|h5!O-^vJRfzP(SmT{qrX$ej?5DuU@)&CHs3DNMDizA=S@GKE7N%~D^z$U zLgL=b`ruP|41tuRkaAh2pUy4oh@C5>@CF;tbL&jletrCn^TV+7h|7U^1& z1Ca?DY=*TivNF{G4sLOmif1~*nr)vQJXm?Z4o)34r_2=C+7Y(&>f!BNgq!AWU@MT= zyblGm0JeER8HCQ1X|Nyb#!>vsIK$+s0akClwQ*pftOKS*I48dht)4B*_9zmsElmI7 z>L-CY)DiYL!y`Iv*QXqlZegFcMU!+(gKw4rvc6MudZ2wrx7I_tC(D!km2B_|b=3bv zlowqUkGE$C&VMdY43^OUG>E~Ab&HGR(svedEkA4vW}SJtEDnW>F+5|>!P%gPC~SKC z>fyUebIwOKIcYT4)`~m?nzOQwMcKSh7``^kUh#EkR!hki(NV9k?uX?a*A|A+tD9bx z^pd!Hrv~!OUP~}C?D1ud4~V)f!iIz}bw&XSSjC{1gSUFHs|~NWf1Jf?nT~~_VY4@V zS^!r&pjssOM3$O@{#^JIYBCa>vcl<@e*b2|Lm)-yfE#--H2^e*%0)$C@q5E>_C!Ho zf-5WARsKk1aOPeJs7P!^;>v2A%+JLFMsB^RV8s(P+<21tSJ5O|PawZoW$jS{xUnyp z%<(8si2wmLT%#v8F)Xc$p+4qvRcFQkH9W_0pKI*Cw;5C}`m*OD9m#!>(rwV{apu)+ zO>*F*EM|C&c%Eo;nHg#)Azne_CfdaP&;vez2rhUKoOj&c06zAbjEvu2t*l0Y_3~E9 zP4`ZW<1nazWZ3ieVm7JG$Nk|H!60%{Z#PadU1_Ffs%V=6pmdW)!sx2e};@HqG6)j>i3 z;p=D1z2tC4WggG4=M(sO4F#s29YBqaT3&q(2MN{`Z4@b-4m>*|Tbc`U3G{Ti;; zf^3D6p`?Ne$)n-w5OhKW{q+Hvxohq(=qr76KjkO-IMPK7M+oK{)+xLkS8B9&CU0^T z*;{*$M0)Z!ioGdv{G!LtWAUU)dvdFgWGqfd#5~{wc;3cP;}J3Vjp?YO9l9t<1Ph>{ zsAQZeha1uzy8|k7WR*b-np676E%FT(IlsE~ZSTC>5?~#VinpdLU^nLQDTP2UB42*h zdHRHT8ymc_UJ54Nf3#sWbcK+p)yv_per5<>leuw@Vto3SRAa=uB!$(n_T#4wp`^#^ z$>FRcjK{Mb%M_0s-e|(Rt?@;21=t}z@?1}>f0WX|MkRBKo<_Y|;OR9Yad=3Rq@gF$ z-M;Rn@&}U_W!;4YO{MM=;^g^Z_E>iuT{<=eK`k9)wDY9G0c6- zw`3*>NI_=O*NZm6m)q8w^&xT_S>}?axhI>y7+(NR?;+OmK_JuTi$vW-AVKIX(i;=CSP5@;h}ulC{VkrXj}|m_>K@@ImO>tt5ShQTBiS}`lIwg4q(;= z2+RDtHM;o64zVQ)whpy*@oIip!pS#jvrOM>%?q{PP*s{BwXf>)hfP6W59Um9X{7+U zu#;)it_tp#oJ1hie1-a4O-`W_1o*w0lIh|L3RlC0HqkPZI# zJu!VFEM#w$A@I(|rc!)q&8i0G)*vWILuEupKU2~l-WPcN+0Q-g&4IW0Q22+VLpt}qqNC&Xs;iB-RLZBS$IGzbT zbvAAJm;WjE08TzA!Zz?oawsP<5%InSuX?h;REy1*e^Oe{0nAm9!D}26n^H35B;2m_ zWk;EiZ-3dmVFO4I6VJR*4ZlgP+dm3da;KBtSdfa7PaJ^hEb~}=GCq;vXg(Iz1HWey znmt503}*)+%xI~O*vurIe(HUjg#NIgopo40!8!);M+aj@^8fy>gE-n@&S~I`00Dx@ zM4r0f#i9wsSxKTJYZAUm*qSMp+>fP)X`H} z%<)OI2Do0M$Z1$-4f2ITCVD1e>MIx6YBdxj&n9gD&{EHcPb;0x292XePc&dYVJv1| z&R;2mBqbaj33x|`Jsa3vscjWWwa5f~2Z!o@fgJLUq|Uk%0cu_be1^)@WwnpZ9ThnO`0vcSoL&x>?*r}j`);88`EfQK%ddM~jU7Q{U)f$v7hgw2cj@r(c*BjUp zOl0`l7GMj4pa*_i6ef_VN#Q}|;BUwGxpzE#N5m#EdCK<2{CgTTC*{Kz=~ek$KySql zG0}y=Tt(Gnqng`$s|>jU0$~dR2mYRt{(t^M2lmpHYS0`rWt_8tdN{B80JI-8*Dmsx z7ZP^9Z#mD1ODUepg!H5O2M1#3=lzumePb{}lhYQ~kzFueTV(}+gE=@!`sd!@_x!`Y zO0WpJ`VUkulH{{KOb*XjPsWd`XQ%|%iOFPZ3vA6cmHjN>UcoD z`o7G+8mIsieY9l4ggU=uD@oMx>*Q>qX1Oamo6_` z34lJP)?ll>sjjN8KhYw%D4QY@ILn83Z(bi93lef2?k+4A(it##G_v-D@xVN{$17wc zYnvhBKoFjFNE2 zVGaB*>sZ6p?`{xT{tLH6GD8p7ruQALi8!sOs^n`*Oox3k2G!3jb`LZq#rUgwu_#)% z2t-TnQp=h0UQn88g(SER6*Hwo>0^wb@v;c1OLj*3aho^RlH7qVCUr+3OMYrA)-1F- zJr_Hc4mS$__}AO`72yJ_Ukd?O+r+bGfxM-EuKsw2ZSd}0oLQ;qOu($?XtbWiWgNsF z<47aG2I$~!OldhYfjTnocEwzl;)Cfcf^IGE z@dqr(=2D$P_1}Gxah2WWWSEQ^L=V265r;gIU`>21#JHuZncm=O5uX@o&LCel*b7{3 zQlz0Tf8r__F|Bd`Kx=7|p^&Cb(7;2^IogPHCAZZ6tB>@rm`=nX@d+j^x)L*INtKelo z5Pc~3b5*n=x#j<_t^uZoE5%If2mUd?n@UlfMt(LqMkSH4Hs*Z}ql3TL9=_-C1G*vX zqB6GC9#YES`GJ`C>G%TNTye5uFXAen)g4&DP_DcPHwxVofmhxkU(PgvWr=a1j@(zb zicUu+VCv#hht#%(w|^gnrUOKEo*LMn?V@}{U%rJk-pPnk+p1IyDHB^5epP5_fc<9BCww+4~Mw(x=EL>Dr_f~D`*`1~NR-8noEcE>c075=7ilvWTFA5gJJ^P2lAihm0|4G{NYiYP`qXoD4Al!$dtJ z%~~^<8WpmR;k!E3V!XjyleM`aZc*f#a){BgqvTq>;Q%Z zMHq_XT6$9sG{^uzC0leg?iioT>t%oA*R%B^!UOELKADJ`ePjnNDzsWF$VH&y{?(jQ=>|jKNfanV)OduzQzRVWCz}UcUqTF+vRa3S4s}!Q zJkaX)o{C~tNTT_wnLxL(Rh!_wic&K?7=161N@e~_0nl(F&rVb!RQo|q`R&ZACvQi- za70`)h}AgC<0i$7*fu`9u~F|9r>>8Yjs9(CFq61EZKF#P1##Rqxy$&=aHre>)YrEc^@4x8(3 zxDI2x50hRf=*_vL=}gKVdU>q$R4!8X^%-2z(UYG`(;E8OxEO#w)0gY8sUlnVb)_%W zA}x|2`q5Hrn3r^})E9aT`b>n9(!0+Av;_Fyb8hJ5#y!i~BL+p~{>`@q)no0(L}42N zlG9yK#`x)sN~N&SLfw|h)Cmf*xd$zIfBkqJqD{6(1p_V)iPrTtj@Im$<{Hm5TSV4~ zITZ#j{;@Kl?;6}lPx@`cr2@S z^GIUgn%SgpL#mDm8tDlwl=n7axb+T~^FkVJdPqyiqI9*8E$2la+_uS}%*;LAy?t%A zWf49ro-bx=@&hfhoB8w-Q0G9fqN@hs_b4<*gL(4T3}RM-wQA^=<+`YDpFQ+o@AyF} zC+lPF##EjmHz>ywr0CH6+mNYD3OAQgL)uY1kjNxbNx%x(7U}odLrA4=wh44;8;zGd z-RRPei6{Y1dBAGj8ns)$!eXi2`7O4hhGN{OVs(|+9d$1_RhSjs-vJkzuYqdy&u`XX zjx$ICQ!8*^uiQVim|tTZm)z2zLOB;0e~vR)LA{LauqXzvokPO*#OyLvt~PH-fvl&* z;L(nriXxUzqH&5*1gJS<)rlDJ$g56eZR+)6tePV5{v?_R%|ebu6*>&MABC{!@sq$U z2mjB(j}6zBuup{qZz1r`o;y!hC)=%w$6}Qr0WogapJ_DEJmOh377^x8q4P54LV;x` z%p|4WmF9Jd7pru08~0>G<;OKs*EPUg*}5_iaz+r9Dhr}*&`mwJ{@O&Jb7B-KM~{5v z*8knhDz-ZLA&`Hgl(tw!jM!A}Z&!IAZ4c(EQ@Pp9G6;w?+m3<@so-?thsv;_#oH(1 zi8oY&CK}1+Lf-lzF*ha=sT;(ap+Z3b05;FSqkSxiGnJ?X5XLko8^&!vqSTbeCxf7u zS6PJBzCEojnkZe(c&xir%0(E~|OhDc=t{n$nB`py2^N#^0|f^=(6QCr>9f%;1AgPU{h#cr}VPF zG-}~?lrM~-ZOEgb@tE9%I;Q7mb%zsUSkee!tn#sUYg~R2T}4w%n`GpnVV1G&=+(cuK9m?rKaY$w>|AdV-{~Lo(55WAMG4Gy zfSc%Zdz83rEv0}vm*kJe`#7%DQnH|QP0hRP+X7zyu5?z@fOatK)1?vmLW3d3V&$}? z%`n&~wZvS9gnZF9K{FYeQN{SAd*?+=2SxE?a(T)K#U0^C|sHHfb(Jg4T2N!sa>o!AdDf@@_6>{bk^m zy3xj7z7FcndUNsc?P)Lf2|_Wx6;Y)Vd1hUrYfjyG1A|R*v*d}VfcXgs^>pzq1xTN< z2>IDl*9Yt~bSsp>Z{c9!{48lkwe6OlKYFY8zVQyw^uLPzMZD4AH#xEQX<5rB}94u5@5h>_fwQM z3(Gr$fMaFzg0M)=N;$yyV}>tPv@xqWdFOj)-;UbWkQr#}8?0juzc>Fo(jNnq69^z_ zE0Qpw^Pc{;ODUWvl1`kW`~S^3y)Zd3PN{%PuY7jLnJ0HKF}~Uf=Y`{%MgV&$Io`#w z@*1bYrnj+iUcuWKN+-}V`_lCDaV~@i%WD>Kxv1s*`U(A)_=m<{=iJOus9(w|?UG)~ zMl_MtNz@XtadmnuI)+-21~IeuxFJOD6lI1_%8F*Jgf!&E9FuRM5w}a)>VPX4CLWuG z8{}Bc5~!XBRq~%(ChjfxY(GGl0A-!4u(^m%8pP654GNaNJ{il9|9eOHhCx^sn0LHf ztmG<`)*td;CLqZA8PDK+tm8%*IKz@tMG_+1KE&;o>oD%U57#q8(Crz{S7uQ*ZCY}V z^@7|UVUM)U-I#qo{v&P6i-u`cH^iYvyocoJEXWFl_@|*E z1%RWCk7h$=1fW2~{9d18X@MS-f>1()1E&kA97)t0Nw>9Y!dLR;y~}N6d8OIz%uf;( zzg^22`G?KT>^T0BR2>441=1c+qMR~?pU}VcHn7r% zu|&vLrg@c7h}Q%VvEbq%f4OuH|0nDxf-EM)&y&84EwtylcI}^I9W%R6gn*uSz7@(( zeVC>!YCiE)@lT7juEc=B8Z4KP?}${zzhrTd<;|@K>_ha;HgB-Z@3Mf1`vZ~3yoCCV z5Occu_vNLugd6jXt54(WF+&hTE1*|YVANpq>zy1I`0`XhMegP^%O+7EUz0ZYKOt2` z3sbahDJ;kL$l>{xi8K4_@Z;fi+kwLLhZ)ME-U$W^B&s8!5Rh1q!@zu8elRBI-z|=D zJOv7wxNvYZ8jDbiUV8ksaB0;^6+1U+W;}UB3(=nr-Wv?S%!9GfY#is7%eU|Dzd`Av zbD9L{cauwrMet+R270L2EQa%?vSNx8)HNs8EgEmgrW&qFYU)$AlHBT{y9z#rsD6ajc#-WkbQsGVVL{%YA3yBIPa=orfcuBGIQr&Mg zI=kgC|FzY~k1skm+hr6054pUCvw6Q2J9(8+iBBhpSa|VJfLz)Ec0Fd{1Yb;;6(K*y zo||1XZOUOM*T{Lj0t7nitMy1`rahaoQ@;#`2sCOWz6hWgkRm{@X$r3r?B`HCFq4%$ zj;BHdu$3-Xy6ukF+cluC@h9+visrg1wA$_8Kkg&JUS#{bZMgH46iI=7-91{B>KJSu$7J{$#rRC9p zOY0lgtdzuIHt2H6>91DhT#|P2)z!p$KrPHWxPzO!AHhXOYx5EmFk#`bQ8GqSv)R&b67^Mgc92(SmH2c3 zdHma>eRl-{GnsiF^1r zJZ8J+5LvXwQo4T~d6P(f8F|h*$BnY`bwCY7eTgiOi(CJc8#8#_bc0ia>(I15&ApSc zK0|)t7ltv~;&a^UZj{;dp0Su3TCC2VzjAim*~XXYO9KR^k-$huyERBUyeP={W9vGV zb5u;SDNL;kCGf_1sbn=H`FO{F&|D`uvUxQ{dem@URgk}Ekaxo zwV6W{kqu2Sysz?$gt~a{BW%Tm|2NH=6-t8>^nCUwlKf;qv%J@t^(s;+?<+ZyR*GO- zyZjm)``yl^@1tAyBB7+kB1mOJUPGMa#@XOpjB7yxH32Cy&7kK);Mf)xnxrQg+wB%H=@Bnt{qRZyXj&c;qDR`9r=V-YAU%VMs5Zxko=WF zNreooBtViL&CqAp;fqK1UP!s<`z4j2fj-js=`-%>xXyfwCY}>v= z3oTO|`s?t|UAZk!mj9)~OZ@BO!2pIU57eH=2luJDgcNMpmmFo{I6kV4XXTKggWleuI>URW z$M$${h#{f|c%Ocndpo08v@10~MWcQlGBQ4AjqMq@N#&~#?4#wZ^yJfAJuxTOaU;l! zKXuq9=;oE^O^fME#{)I`5S*qBz`0b(Ck9N9>t=h%;ur0;#3aPxWcYkKe8HP=Ud>V- zE*I=s|5IRZ3!3cRq&Ga0{=w(yI@aryuuF5;+D!>xoF_zxK!QWXm^7ARB@qi-DpuAr z?`f8#lxDn>CpkBudqint#y}l6hkAs?mq;4!| zL%B~9No22E*~BrK9lzZNxWvhssx+m{R~#(irW>?K&1pqnt~lC(n5qPDUjFQf!tKWi zqu%A7QvUPU)-rIiY@?(p?=Y_7v00Fh(LrQ&i~xax|3W;p>G-$;_Nky*?l~0n1!Dj6 zEbkJz8%@FQYz>@5Wke$ngu}0Hj!Liz*&;lLr}cmXyyN>yeXYHrFq0~`4PLW3$l`U-IE zKv|MbzLz`b6+q|2BFeqRzH%)FQf3?;3unW$bO$D8E1i9vw6lD!!tFCblY0Eak=RJ; zyFZA*3dYIyltX80HpYA+zgI1E)KMPt7}ArTn>#_q|8jR=NO+k!Rmw71#JT&o99()1 z!=fQEL6c0|fMNA8bj6$V*lq`xwv;tz_7fXcG=nqFbk>Rf{Q)Fu`b~Of-1p(4{Wz=oW=4JP+`p|II#i`N3(D0v=M8GFaYQY28K0n zQqQWOD6+$%*rlwHsi5Rhny+PCNdM^HuRM}K)N71{Ke?n@ck1I=u1F8VCk|HK#N zHG9K+3!W~`HH=M=B51ljl`8hxA9$RT`M1oUqh2EECBghi0m#>j47*2RO~MOo&4>R_ z)_+RmI$=~-V!$0uXuruzfHE4Dl)^wtqmn8sa<@CGKA)9yze)tpJ1yIjsoI0>LT3H{ zYTQ1p+jf=-ZTEx5ps|RXt%BwM0kQz-82XosY2`c1WpY5-X3V;@eYN5E&fRk!l_Q&y zxO@jf%2gVrC*}^v zcMEO)Z-EhdoXK^yKB^`Cub~=_7uNJpcUr^kim^KL_;A3D8+7KgZeC zN-?g;j1HUtZtCc~edeefQc{ugKFhtHp*~d4r5Ak9o!!1r&x#9UxxjJ@*10NeYa73M zaL|=?($N}%uQn=xJ5+0G*+@ZGN=1)0MKNqYS=Wdspx;mHY`C29irfO$<;LP;q49Z*Tx~2suqk2oTv3N^^ewZ_6w3 zIo1%y4L}$Ji{$;;S5@`&8DL&re3ExSdS=sl?1GUyzGh^yNuYvln&|7X_M)z(hZf2n zSbESZ%81tyUuGhkgzetQQXHxltmXeHaBDwWe-Wl;szjY2xB1Bhz|bSWUW*G)s@^k= zL5tAh!$KHngW%CG6aJ&o+qi>`)e!@8qc=-}Z|+L{56frNKkO_2MyjbK!JLuXZd(tO zyG@$_ObBg~LY9>fQmexyHuHYGHx2ZAkXrkKcFX8f8fxKNuSa(Inz9a~Cki+pGmDz5 zdP^F5r2r3TYNfVMU^sd?(43BQ<2`fp5-MZ*^Q2aXLLVA-Wf9-pZ(m49&igITN~ZD9 zc%gFn{0i6`f=XLgWXN9PpMEGtlrx>hKAp$b(o0glWG++9EfAgwi%W=N^2T-yu*+?f zi3&8O#GfB_PR|Al{bP(&@VQHo%fdw@=uA1mq!r-nYt1tK#=OeGhD@xic=Sk{T+F`u z`^b(9mZrnNcj{;qusms_^F+8qssEh1cV6;<`VFqC}2EVWbZ3;M(~_IxVmwXHwoo}~q=Fi<3c z&1eB-dy;zITIFz`J$M*PFFTJ{UaOe_hQw_Jv21-}wZL4nnml5(-^YECo`PBF>GXV!VJ(B4y+{7I5wn z%cQG<2fv#`8}E%$jYI?kuhhO0I9ak`Xp0{kYve*g#@Y+ZB}(Cq>!?E0$^y<%35QTY zpJGxl;-DKj54ykcLLpyxpuYgOV)Ly^LG6;+1$prO>Dr6q)KW@1qoy@+Unj56p2L1z zAnV^ySl5;!a~ixXYyF;ZEUyit6ng@A3r+#dt>6%eXOR41=OnPyE&>M|Vczz49$BB6$LrNSdzSr;>^*`-l#PBS#RLfIey)JDU*lA+$Gi>fM_z_oSs^c2g6Q5ndzU|dgE zNWF?tNc89utmU?_h}ZtQO2yQZ;H0`<(Nr%`$dSE7AT{06hcJ+e9>UX@Z=xzZYP)x` zYDEl*VW6!$!3nJnB>X9WPX?~=;fx}3Qil3TgG|bWlpL0xG9&FkgiR7KdAbQRO~H|u zEb%=Nne0uLFb{Lex)zDn#isakKGUI9L1SO7{^6SyFyODxm#2NPARV9a@F9fi7=l5_Jp~%-6_rCUQEr8QOIGqNm z;*Zw@NnZgZS-jCf&-TdT(j&$@zCx2rWvyg#Vk#a49~JV{4!V5116Fu471^a-r&>TadMYYfpHuhHCaA}35z>e2@o*(q`vb1b@bxBC(If>{1FxIWNw%LaLU&Y3g%A74# z12$H?keV%2GZgOulSEwjA;WOd5mqox#6qe$`{AJi;hBkc|F-v$rvsn7!kxlndK!S0@_%%_Cecm3m21rL-W2CAA=!@})o`+p}b^gV*+mm-A?NFhQ3{YZ%CnOI z>IHOm{>86zP=PirbVxkM<%jZBM-&!~$eLjBzB+XVu=-oP3l&rjT>*K4hdHOd3Hz6kz*neG^!Nr#KXRa zL#XeOc>uJ1vrDpWs*B_vRJoI(LG6~ZG3s=x)3joL&RgI?c=Ps{c{!|P_)Wj%U6WP$ zS~j!be;(|6@on*iMyQ=H4rLN_vwW^LmlM-7affq} z?I#nm)%4|R6DFsDaQ9?^k-c9M*s&6p5NMHI=z6k)XZT&-e2@rwB}+74s}zdud$o`L zP|y>{8%f_1ii9ZR1VnxiJ!yP1+7Lw!Ds$Sjetr7z0VXY(a2~*-7da=NLhrKF_F#gU`Go@iTK($qw+wD5#m)ZClWha)os@#mxB9r>2}(gqj%nzT$pOv} zXsm*Mh*q2QntPS zg_=(f4s=)!eos&v4AYn);AbDqMc3IM30a<5B?lN@4uR9J=X2d;=hQ3GVq$UmQ^@;M zZE2B2rPX(wSl%pLTOCtQ(Ez!gvjP-N!zH5Fc&(Z`N#q#UymJ%JD0n&#w6P6o-r_ml zsJT}qmfUk#Cjp>7M$j7Cg|*_H5bOwaN+q=EbItt3EUwYk$>7T_@3G5veNTmoGV446~@5fp4g)~r?iISeH~o6#g$*S$$^#}iF?g_)+i7WRI-oO&iT4!*ts1T8c=6eM6Y@YyX=mrc=SwpY6*HIUu4*GaP^pF zJu}&GWp4th94^*lkeA1k)q#s?&S3r4d%TDT;^Zd9EC?!ybAF_o2h@~J^hAA;@F$Qw z5D*vaFfi+Yd=Ae_ z`nu{k^QvqP$OV)wG@qXV3-K)M{L4=q%5H>kJ{`*3+`$Z_p+J zx%=p$ON2}^hhci8J`>ir1Jn0qi;sQVJv=GU&zyHwPpardIvno1c}TlyEJAjE@ySiw z{UF71Z`&EhBah?G_$CS#5V-dXC?Hbg1QnbZ-;*OGNLwUbd0IkZUxYt^wG<2{!HL)R zT!j`g@@<~v$+a<{E$Tg0z>CuKP)atOcHI|Bb8 z4-66XqvwOfWFN_9g4onrJIHW)^POTi68MkSVVhHoRAhuo886K>Y0~-YBreZy{_q5&w^lGTeLXw%)vZymOF@a}<%Cf|p-JG&WJ& z7dp2R+Q_QL2rnY@(?q8vz(f@IwK|E8G(AXHVwL9uKiFF-W||m+A~Vd27WpBz^7t%h z0Edf(=u7IWf6zB5G`=7{b>@U34~f3!3Z0LW0LF%QKyc@`o?#*3V(elFV`4Red}!=W z(|N`Xs5cm#t9D!{As>ty4$nPc7aVP-!j?wTj3NV_@l!?;6C+d0mo22TXqt<5el-o_ z>Jp%LG_AVzb~IK}%yLOIwF%TupqlWltC{p>rr&P;zJ->Mq5VH!)tV{h!U2^2fHmB} z08x<~auS8yxYS-e0Eiy|y#-u5CF}dIpPvk7(}JnDuX$AGe|_oR+1O&hv1I`Wuy-5h zs?zR}XPw9x8TTz*POlMg9b*r9V}z)sR4x7UEis1>{NER*ZVQll6FL6XQG$E#-qTZd zkMr%7ai+q|*s%E+GGl2&LA2{6t?#+zR_ct1K;b6{;;==kUEz8Cmu3M}i=T$Plc?kU zd)`1oDYIyPYOIpuvj@h6=SJ+;^@A`;-+`$2mKyrqA~U&uUd&@-r%T~{30WPC;H&J? z4p+d$0f+*7XKtVP_9sLlL(g9OYZz*NHSt-wXgeQ$ng~8dMOvNnS=lXr7$>g&TT>vK zaYSs@TO9C;=(n%G9gS90@InR&*EY(>JQeur!tYz4mmlfD_97;OeH7tw#EYN>;n z7OdXpTb-;0CRtKCj3@jmp)HopF8y@e=Hoozd~}u54;#R16`yG%RoFG$#KT*Ej{Fv9 z^%tBy$yn7v=H_)6;48GISNW4!7WB6&Qz&;PovmvX9+uIpM*|@!T0p|ex>hpCO*t$@ z{)ocEukt8=3VR*z;B)v5eu z1}tvwJ+I*58pgX)UT=-*lfcfa+brXu1yB_6ICH6x=!-qCZHDt>&nnp6#OT55<70Jw z15^rX{3Es5Dy-TcgPU^U$w{_1dAA3Pw}gyT}%kQ+-+KTVe2WI|ptE&k2lDyd|uH~V_HSu(X2$44mJm??3+eN$d9$!_MjLt=p z84Ur(s>Eruc_XNx6X{TB4OGcl+wOYU-?RGwg-7znHxvzU-Z11-U<=TvsMHUpA@EDs zA#9%W{FBNT%I+XXp~zW$S60NxUEHZ@4{egCwv0TxEKS$6m)9z358NsQFKs>YxIUz%f~hDH-N+~ z7p92*f$RWkQMQ;%Aa6rTBGpox;jOLFvbTX8I*xlgLnb4|1<2{U`XENsTO~wLU*I2o z4EA-`dFB<#7*JV-W#hC*;f^)`E{krG<2AbG5!(~MR3pUgIj>;&#l6_MEuurMt;iv4 zbsB;{qJJwa8sjLeza8YTfFR)BhKRV}UWb5SkS;&eRr~i2X)roQx`{V`dqnr20QRtr zF|#FrRj&-gQw2J3xt-(s93bBQ)HFopNA+zyi$16Zg4V1#!2lfu! zD#ZB&rKA*?bUbK?Lkks*%3^&^7kmNTQF2@@!`%_xZ(adj#Zbt%1re!{L~f7ze@S$D zqnIm)YLt5V729M>H+9)kXK(Bt`H)e@jPP+gxcklf;w$qO1`0w9`rpU#MFW3)?(KV5 zzE1dO@d(GK+)Lb zW@uorUwmMz7hTngto=-3vCKfP<@nIMlHLNleuWKWv_`%DeFqKkr^#CGp#FRSP`*9@G0kQXGV|S925d% zS0Yild}lxqUl;0mW|5Zucy8=r6P0Y0|Li-fX0%>$V{#5IU-1nQD2OQubls_H#OCYMw*4}E-}z~mFH%P zKa13j7?C{kLQziZ_oz#YGRWoUM&X3SuJi+)U!@W&>MFq+u@AJamcFuX$El zu&$~!vY7W9p};ZkRuhg4onvy_M=URp+*py80d1H&lyPkT`k8-7!BDlVYGX0O0a2)Hfd4024!q0EhX`iM_wv?gu2 zXq8PUx_2ug=ZHgDS8lot)MN#vqgmla*Vl9f?g#sQ&bV9N%b4L2in*xwHotT0vnr2d z?%*N$Fxe8|88+E`65Iyp-d>V@w)DIb1&bHpm->+~)Xo5@X~P~hB9{$Cr%b)=t=p9G zX1V&`O*6}zAu)|p`hx($O|Viymzn^K?U+7V=8BN%+Ro+}Cx(Hi4W|S5(Z1Rn zR8NOeS9TVsGH5t;m}@a(rl94DU<_-iT{AFWu;o{6ooZ5=a#)T6^)eOCf57K|a@^5% zqo;!0Fz|5J=fElkOONm9>!D%uGKi%0JSDMee#XEd$~yq|NeF5}`rf{neCQ)iB&gM( zTQgbdFg-bFx4HDR{G}R5UX6SnCB|X%w0l;IwhIasisy# zmocc9spMET#RLJBp+%GLuxQdcig@!g7={geWLl^Hv+bC;afRVC??@rdltb0NF6nbu z#TF;W(r(~CPAn`+7cWTeKsR{rP8G{Xcrt?Wj$jNY)=?LO3jqH6yHK=C(8*LSV3{a8 zgSQpM?qV=@G?W4Z&k~*dRpv6ueoHTyv<`gp@pG6H==lk6BE)?~$oT|Y9G=4)!0(0t z$nQ~oG>4AgZeKrzm5B25vv!+cj|W`u#OL@8E;(hHU7&8l?VWJ6xmGJWIZEpV!TNLz zN8oRt{{wc)A7Q}w(b)nhq!}Rh@B5E^aS82}|NF$;aRgTJl36TCNg!ssBN(XqvO9tO zYG<3*dgwgeA~a>uxLOFl#PZ1lP<%EhS#Od4Yz?oPngch$){}M;8Eh|iozYy%1T-Sd z3TS!}!m8OI83TIA9%OaSKXXzjKZaak7mSUmTxR;fiWj?_ z2mD`<0r)U=N(CoGt2z;vRJgDR1i~W zeXHn91yS9%Y#$>DvqXk^#~p2I)T_l31u_1!Kd$|z#ZSJn8sDEdtqnWK|4|DDP}q`O z>-Ujo&8p*demn9ZcFGZFytzd!C$}7QdBwK%nC({%MD4OB{w^=1s;9gyt14ziR|NQ= zKH9Yfp?|A=h2=D5>OZ=sc_ie(;;Q26@t3gbjavbhuDPu$J zft6AzupJzumKI!C>&xGC*Hi2d?!Pi(;#fz4go7TTxA6?m{j{Ic|5v>DuzifR_6xR< z(sp43S{;bGxf=?eRK}Y8Z4_$E?YG5PPek?jGjCQ7H5%p}L<dbKG8 zPI$4AooH(TDE4xKrE`Kvz`2+HBEXTYoN6WLys+Yo4+k)+&xJO*POy|QArAj4ME(%} z1^?yP2i%`Ax7*(XFa3IY?@log5LjygJRoR(Ib)uFeF%b*?!@pVkT&dEfFWoGY4wDi zp(Dl_oE^B=2R3LYxUV_jr~Nb^LG7Y3#yY^;5}!3#&HvoZAEE;VLrykz{mY?dk!y5u z{TuxMR!j>Q;(l(X4jkxZ>#u?Q)Vz$sd@$KZ#Y1yACd`mjiufrxQjSx1%Mc$vKEmk7 zU`&l%r=sN;-bjOS5u=z?>&hLHGU2Vq8}jkCy& zaiD0GiPvIA^v6?yGo)=_*t6@}(#36Gx&#z@@J7Bc5~-v6*1nN_=ax|Lw-y@^J7+&d zU?G6H;6m$rZ@E+^W+TjIe)BX!%=9@uo1xlSo9-vB7b21~mqO30dvIYV$D+s)UNc&G zx1uEM5P&S2y1xRuCkaXE#q;PdgB0m6vF zD~AJKj&SOZ$WSQxLsHqmS?#>@ADREFYlppaYEeu9!x%FCtGzPd3D4zoGc|H8`iA$J zSwh|y+oE*3b#tF5&~PAJ2;wntCOTL(+H&+*lmO3AV2i&uKd7x@5QvtF|LS)x!yh^b z=aB+7%3DL4e^W(E(mL@|nHGT`W=}=FqY+i;h>}bg0+1p+xr7^&zA@}tPxNb-mxX?& zBnm*u+;+#TPN-DoO3N0K(PG6mGT7={8P^S)1(cV~E=A1eefn&KG9z~O#BWx{wXUZvJP`(om%zBYP!T^^8eQj4y z`P*l*?52u#W=anQLRTpWluFSq5wH*Q$YzMup%h3zY0&dyP zWz_QRS**;U0`e>*6)=R%iuzz$kt!4fy9b^tfq;V|9OrgN$5m%FT5Cwd(M0$!dGxyz zrqno;Y+-XMP^Qvv7CJD5(*HQ!g2mBIr|wZ^p>(EP4KK2cR&UT7lm|qW)<{?za6S~A zFsWBJXDp7>q|KClvv{p!1WTI+Jdl{xv9QN+V4>ZD=03r`3K7C5@o5=CclEc=Iu5hD zPUsWY(UaJ{3grPOOW2x&jlP52LFKFY|1T6cZ%j4Igf79B1CGD!dV4 zeY}}M2rxvs6vlSVw=6<_@;4~tH%&r~AHnN4J$ApmS>ph&ipc`cy z{0M*XZhi=Ea7t#1VOY-@K8|x@!Xe`Vp7TavK`#zMs}n5{00#b@yqSFLFsjHOZ9(}| zVs@OU>JspC=m(dwlaml$VPMAlFndUz_GM6T?S8;-(tNpU?lY4QUa6SZLQDmIcYe&_ zna>^I#*;y1+OIK^LMQ+lC(~__b>pQ6L4G1*p`^7c*Qa3wXh9y03GAmfPvs_^Zkf_; zeb|*e^)OOdA^8!K9x*}bkzzGhA_H($$`9Ev5f5ceBFo(~(nuP6pskt03i2U!>AgC5GdH3)fJ&wl`~dO#D!=e!(^Bufw&l zK^~JKsVf*hd6{;K=DtFu&^J%HSF$gdl(!QDPL4Y=^NAy(kS0qe!Wu0oM0Q_<+#`&} z9NtgkmlmDlB+r;a%kAU*Y&tGdxJz?C3C#fXY2h&Ao`Ke>j8E+~hml)D0{N-U)43^U zyiDl<{G%C$L{>u;w^#}CoJDyW>SsZ-JH?EJ{AFX~{}HX($hh>^4uTZ7Mwzj@??ssO zQA;5BxV}qwAo4e!$oaN{04-%NU;WuId1+k^_!bDNk%281ZNm7TcRtRVNkQEbd^{_i zj{@sLYt16R{El73-!RAl2r{9Kw@Q%nI^rR#JoOVQKiNbwOneJFLBHOpwYM zF-0=vrD|=2H2&_4xMQt7kXtC;mqw~stMD#pQz8HM6jCqvy%vz-bNfP~lP3I4Eim7+ zaAo}qweP3(b%2z>K;cNCzvYD#VieelxW_7R=59<20EQudQDq!|u>2p1^f){O=dzkt zj&gk8+<}WhcPzU1#4`8RNK*4(3pm~=(k;cTF8z?YC&=HeILi1!0YWXATxtFoP4LNvisGxQtDHN|IaaLLf zH+26FV+Yx3{UBy zYKYf&vJ*~^$hEevV(I0UqdN}%BHwOC{^d~JIFHY@iwws(NAf{6jOhbEN2g!-b6^W@ zl_j6#17-|}7J~k${}q6yAU6TD{7=Ar^2O({baTxiET2v62N}kx;?ilGp&T(OOcDK> z_}5J(1F3!3|M%@GmKDBdn9CrJ^;z(EHhh5q-f%OQZDgy;vt#LxegLLR9T~Yj+%of> z@y)5D9Ka_4h}hu2->IQmaLZ%%>L>>s9cLUR{m_Lo-Or6i>$N4u=;etd>j(cchsk3U z7gGDYJH351zJBFCb=XyId$O-U#KK z1N`=U9h13t7SE(4P@~NqrUV;``0IhdT2%_0afjy;o36!HrkG1jyAW1GJ$D`GX2fo5 z0Fu=Pblc)Y{+t(}w<>SfQkr1}a6$^mG#~yD*e)43P}unB_HbqG2gG+%MmT_93s~$f zkW!bnPFfzSJX}-q8j5K!hSlW9pFu6!8e`HlFX7iGOPz7@82M?86@zt#^zAJaJKUMY zdTXjfoYB8!_ug0rcUH27*m#Zvsgp59E!$4IV(r9mh7>+=aE@=kY#p*Q^Rbsw`O19j#-5TKguFt0?6#!1h|`UM{Cwkg>1M-U zp@kbXXM_OwRPs@IF<}jUL+zJM8%-#chg`N)z6STH^S8I^oX^TdA+f_jOgpw~DC;I? zo;X+Xu)29fwAn~Cn}JSFYCgam)YZk+Vz7k9jFdYAI-h~!UuDfCikdXeZO?9}vWK|j zs5!08gS-ryK5IG~T-z#5h?Hp#^GIN}i-1ToLVuwW$d!?K65Bl^rdet5kEJEQf?~dai_lkO~%T3wv6a^su8-IsFHOucD=nQD~LSH4$q#1Y~8$ z%as=??y!Nk{8#KqPd3u{B+~h0Ej$s;_xTnf%K^nN`zR@SpQcc~++uQ`#ze58rD?4{s~V$BJPi1`xhVr;mFL?SAmPz<2_UPrve>k%bqYktZNSOQd zve;=nsyX_5P#%8n1v$Q$uZh#~2j^lh#7`#HYoo@1P8uLwnRu`{lrWV7>IXnD-OtQJ zHY(7iaeh@+jyP7{xdhPdf&EZlHu4aP|6OJ958IXO!WG^?-mu}>WNgi^`sPZVCs!oh zYbOEa%3zQ?i=2x{!P}pE7skRpHIQE_aUW?e3$d2POp^%51hn!nrCL(?_xbuCBiM~U?M%D`{8G%K;+=XiTs3vCEUsqj8Gb00STnv>0Nh&#DpGJVHj;BEq6EZ9F2)nK7qKLL z4-C#}PWZRJ82MK{P~e)Bgca0n{Si+n9E`1s@Wi31)VQ<5c!WpKRw9zqh_RudMeg-q z1@@7qOGsk}83I^QNcCGR`mh+pQ-lFjP9Uz01`NtZmh=}vouDlOSmgVh856InZPgS4odqY%K!#;5!B|AQ$MLD>@PlJ?=` z+cg6Ya3ON&p6wy*o>{w1K84GrV;ey|FjsA@tg5?Y(X@?+UBQ4~SQTMa!E9!-Sa`geYG$X&w_}ZO#DrmI|6&2~j7Ue{fn?xfo?<|z z4c6il&rUa2wai_R2F;YQi(jUOb0Waic^M>O(N)n(tZaEhjV%F)8V#JhM8+tvK z?Ld&>Of6kF%wz^$TBeydfy&uba#AI1YJEYQwGnlMyM9XR`f2j3EAqCzX+sZeNRR-(>h3NHuX^#L)lL=Zga!iL<6Kb)vny?wSA`5fbT&2$a?9?s-AKK}mdscp&9EzDi zRrUQ~--t>Gb%|)8fQ-yj5ms)H==bO$vQ@?s(?>_82XROh`k>r+1qB1UNC>1g2utYG zkPwBcO9w%~5{ME)xPt_pxy%``3o9Z#nKzS|$P~VCVBooadzQXBAy6+gf@6xhtW%oY`u`l9GnP&wmA(m#N{F5UA4h)4(!qMYP7rIk=&67aq*=yvfvfGX| zQb9?nXmdlKKC10Qq_X&X{S$X=kFW?{eu%G7L=DxeMBm6^U$$IiaQWVU0G3?dO@_6T zN(0Lt%62X+dTMGBAmYmtBM**p9(OiArL7<+(T*ZY3+>twIUI|Fw{A|A^@4qEDqG1- zStGJBqSh(nj;^EE_%!+*(1x^G6Q4q+mPJ!Po)WSJz(fcSd&f|o_@|Ah#@2pi0balRu$>rX>6r3*Tt7(o8jW@F&;0A3 zv&b3JuPQv6$ukJsDvVu$e?>5u8=FX&FY!N5wNYey+elmNrfnx|qG|mmtksP+IM6b_ zPPbrN!zZjbU$fp=KiZe4)J@z#Zau?Atf!7SKfwiT$D(gjKp!)F4)fz)27noku>a_M z+1$UCs1x5DW4nN?_9VYCIeR?ipy~;M$(&URmvZ0Y9W07xKyEcLws9ZKe&EE&CiVXA zMu4-4A)F6u8G_7_#%PAUyo7m@n{_D0WNX=u%uSm4=Q)1k@^MzD_%Oem6|}oJ0Uvhi z%`sjzT$QIPo~lInSrUd5pgye9DKbpeN~g+DRbAx_iLS!^JO_}Pv}p_1@%YBYCE}`{ zl#B5OaF3dpj1Wcd-pQ*pTeO|++oH_+4tmPi$;s!^9ODGQfM=W#mQ;l^`z9)p?p7pyFZ*0VD4Y6a1v|1fF~ z!|u);XuFw*>ec8wC*+AyRtvjC2;LE3^DYO}J*FtC#NmoivB_X=I;mMz@Xs5-f}Mp3 z63&j?=OH~|$B&rGe?sStA68QY_gC^q!i`@wh(k~zoh?1<`c?D;=&g90)bV>uUAj7N zynz{r=<9V3I!|Z|-{A@%Abkr~1f;|Tm$=|bKM|B7PGno#J~9M`_2+LM$IcCB7SE&O zU-}nr#&MjaC^RZoc?44GF=Pmckum;S@x^tYGdFU_%+|140C}-=az9(*=B7*NSgrcZ z5>zoN5d4+l6^8LJFu5t>KFK3p97&3aGN5?uNP_oq3lOx--!5(}PQO|XHKSABkERyx z7TUq~{^v>|;Gjsy+1>oOnq-tu*Q7y%bTVbS{`TGG1$|y#W?G|4LY51$Q9L)S3?>J~ zKh1pd%Nd~0;=)`y?XRZNC#H_RNw&XCx8R=WwnO&_yM?F_J-nxxw-ph@qR)BUUKe~! z2w-@0OtMqGG_}Nh0@-vVL~sHW(~9jBK>{IBK>1>Cl9>TVG@<>{1}}iQ1JS2+i15nt z!g6L6Nen+o!+I*6kt@RQQYRzcp-Q}l$)^Mwd8nn)e~Mt;aK6MN*ovxd1|6C2lLrxGUZ%dFy` zqwvs%RW-_)qWW=q0`sXRHbSs;m7|X9vwUVY#eD0(%=l})Z7sG6($#SuhzGZ|g4kZh zRLU~a!IhP|OF~}A`0c39#J|sId4qW`VgZbZFs!P^7xnhf2ezAw*S^ z%zFb&*$PtGb)r{=Ec+?t-~6yr!t;!=(Foha#!{~x`2J`53n*@o1%P6Ra>qT$DV3Gp z5u+V>$SP=Cf z;>0@%VX(e$qljlWkEn?#`;|bRtmV4bA0oER9XOmJDjbq<1TIPImFb9fF+0EcWqSbt zE^M!6>|ZA0`Bdu6)QPt!@NZ*e;m6b+iie$ti?+ZBE)G(!qj2bjlWB5z@FpMOnTp3c zT>J@U83cDBl~+UwNu@64cQ$u>x24xjJ4;wAUeTniX3R@_!_3lgl9%b9xNteBiuwy> zx)WIf)S`=f$&JA@MjR6LeDC}?+ItzZB2ueYkt|5C<~d{t)NjMqxDclr$~ZEVopekwB@mO6@S>rpMu~Hr1GS=^`FuFGyBy>85q@wlpjJiBhiR* zIJclHL<*YmS8JQ2GeE3#frnM`|DXbwky}8l=;A6$qR`IhL#n&ak8946v2L7dfRrEV zuPv;I56s+6ea?XZL*N9HiFDfo&aerZ0yHMf0U!;O9tivZ7U8jB($1&JV+=>hM49i6^L-}cg<2E8uN&mhU*h4B?J$Kt7Ce`i?88P(Xb zEP;BQ)Ra`M$#LlN=p+}~?5iDy^b{z?ODP9Kr3CsOUsQcD@2-*bC0J0hTZ=r%!ZlQV z=7x>yp#7l7YTg(0in>)!6p0ux11Y*X@pmtA1`T2&jL*ZO;ma9e5}4gxuZ}m{RVz~1 z`rX`SLkZ>Mh5+&M8N|7XZGg39I>)4q%#D&^e4C!(+?68kgL|g_|CXj`zlSN%z1bh%#80z7vRYxI0MDqD znyNjQLY(j z-No3QDJ?0C9A%vDej`_(ej2M^wo3JB%;*$!EoNF@$O#F-;@-|k%&AX>Y9?$tI}6>E zpy}z0KSmYcm)_XG+x57W+=K}wRG39VG%bP7pxF}%Cm%D5o+=L(vbCCj zZa9V~#?Eq{*=&S#UlL)da`p4JYO3Q3<$rQ>?N8wZfEtD|9MlT#W>_$0GaB9uqp3s( zf?+cc=GH_T6Z=8<>X~1)?w2L$XWP^SQ#l!O+}D+}B^{rP5ETCqTD9MIJ{R*SL8;So zbjBYvs#yHk(atq;0JUcmDY_D7`bUSwZhV57U@0zhFW(H^kr8Ki{F!%~(Qv$MRq3)0 z-c%whLu|3r<-vlqKj6KqCoWd-EMOz$D7JD|V+7BmU#hrE!KB<(n%*pr5var=jpZEr2}N z33)>(M`HUH5?(ZQc;#Eh&{hPdsu91A+B~+MJtreoTf3Ia3ZA57n~`1FotqAVJ&xDA zc~oIef}@-czDqTR@7UcY9LU1*6W=3ZDi1huPCHYK)k?nDF=<}NV!(Ls!f&eQ zQyH_v`k?99YC?<(jQ}i(sm4puljJlST!J=P3Ek>$0_2~)zC{8eI9@36B@7sR4;s<| zwCCYUWw8#uES(k&C+kRRc6H-YivEI~3QwF|S_KY9q|JpTd?h>*AC8}@1?NVD?~XU{ z!ckarz-jQjNGKoVy)u`weYdl6-Yjy?st{`zcfQc5$lY!V49w$_972 z0_g~DWym%Xb23*lbOK5b1>7V`mC&sr&5o)&)~9c3(l*q8;+t>IoYPxi0#8$+kj{dM zh_;zR$3M^M$5ZxBDXkd?v+Gy%`n`vYnD9fj>v1EwNx6-B;G8(^vj@%$G_eGLN(19Z z&JIB@C0i=Be2js6SC?&?1K@uuushdd$e-VTJP6&1zDTl{&=xNHgKH&|nSy%IT&6-e zUwf4$>~P^16Ry6}q}>zLScq;`au4bA?6M@gXB?fFk=!$NOl^3AFryjFOLwz1GpyL} zP_-u4D)ZZ#x^>M#01fu*#=~Gqr|d_I@K%5MyEWU}9Kx?4t^rZ5+wWRdx)zdbfegN= zHqe#aGu=Qp5(|9}6eXhl{BoG#fW^lvX@1$?{ix%NwpMpa#jK(^jQok3kBK6mzYJAg zC9S9biTYag<$Jz>zE5tlawWqx1aR}{(tOG_leBLMlDPJ#q3))c+;A(qS_lS1W$)iF zIrC{IGSRoktA6K+NC2$@*@dvFreV)n7fr;Fm_U@4pZW#MLBn!Fc7L-;wb60nclse(ytX zIZ$TGT~)rwo0G9lg^0m0_>hEQ?>$T8YoR(JP|E9-bd1I~asCpLgay|%UF7QQ9lFJW zVB07+)=N01jXPI+c0JF zU@ImhUm+m2le{-(d_t(Bt6rMrt)Iz^v`<|s1d9Y*e;RW+p+2Ob%ObE!hGl|YC-9gao)8^xKxl+yV=8|V<6&83?ZO=H z_jwO|g&yI?C;~8|?+PS#k)9I3c(To9`asbzTJax-LcfUZGo5*ubcZav6M=R(0BVMgps^hNg2Qp{wE;JR0 zd=8SVTwFyX@iTy#v@22Z8*&2lG(rDs_BcNLGFxAk-rKww(8*t1<*mnh87i}r9F=tF zHR9xaLi=IJ;KoC6r*I&g5se!|XzHq`|Nx zuHP$Iv#B>fR9#xMYLbmwug|?rY^9XG53oR*&>Pm9gNcm*3W@0fLcU^G&7~kLk}0Ot zLMWOxv&25dGb7qnx}wwY<8-?s@VK*LIzk_|_Odsy*#7&c%vrwDdw6ldS}AYaL5Tq{ z^}BxL?p5xa3o0u6nkap<6-%bG(Ff{)fC|PQ0_2n0ZH?K56sN=pghh96bM&fHU)Cf|k?r zT$Hx+WZ?xX&tr`0&1|yMD%VA8inM2W=@E>Ai~V}0RlYuKB+=W zBc268rXiPQX!rT_p?@1&6MIc3!atnFR=j^tnGxE=hiyh?T^!3Vy>%Vl6hupF z`jps~YeShuRVEDJjnRt`GKjPbI%@DmZqA=sLh=o0Y@RZIZl|Cqx%9%&%gNrWf&K*d zXO1#Sd*e+{$1%N{Le%PoPbDg;0zCT(6ev*sE%LwiYC6=(Gh`%9^Mry~9QV}f>z*os zcZ74kMZ1F$iJO`VIDm};QfG7CB&_kwgYIqZf93y|sQL3ixV3xtRaLCk`T;0(`j>G9 z{`V5D`j{>9HKbHme|Zo1l~Ir)GA~Cc5D@KHl9qWp8H+@sn+IzCk}nb{-E)$-!IO{V z$$_4vfe~hXh9$hXQ#!K^2j6c!-Y+>bEsvYGTlR4XnJ7 zd&gnDp5~}GoC`Nr%v)RUy@icUswWgYUd^JBDE?ZvW;)&3KmX8)w9M}fTFR-AATFPR zsC1k+J?;F0^y4Q>>R?{dma1ZUrC>bi!%4P)gi_O|)$}5M(0IWUyXImk_qWG2RRXpR zfSBTEPmi?5&2%Ev!b)cODp2PJ@ohO+=*K+Q^U|l+jT?D({O;Cuwdw`Qt?%b?TeKQz zsK7D}QN=Mb&14It!WT?MW~vIWKbJo!ON%H3R-kR*++i#8>)s>BIXxAk%t0kGSDwSz zsBKlY^1b)%aqe))<)w0I{hS_zS*JUNTXmk&t}=9)5&M zZ;DnG!UN1$x#7rM(@F_BcmX+w37oAPn^jLL*jLYF&AofrdLC=k*O)a%s1xEFlWe>T zT(Y`?08Uzu|Ei*uGOBlD9>O_516nj` z_JL*bdn0H-cT@RNDI!LFvA$S!u2AVmXX75eJC;Cfk+O`&8~dlu=g0@gp2luwhvAOv z0AZP`d^A1Nqti5Xa{k-q#fgEcYL*>F{Mjd@&H(ou?b$<6K+`GTJ$e`|-W9T`+D3~?)A!OyL1 zh#5W(?)!yyn=Jm>waQCfDm&!63S;haQ#(_Q^>Q8)7d&%DvC*?=aaN$*o-^i$*EkMEbj9}`>fc-hl6y)0FPftk5UAn;>?VX7 zJV&a{vRaQ&RAP-2Oe;^dCXN$b0Kgm}LR-f1#|i1^Q1sm=hc1G6idNCUVdEe%qkY@^ zh9z8%{rU$mKtiX9K6wY1k^pqwnDUeIpJyXPKd~xGOtqihbQ{aCKV;VOkPR@0W5Q9KvifEp)VXBlKdiW>OvGOvD9POqkTrX zgN2FhuPpmo3aJUv@&L}@cYy(87V+g@i%bp}4m#m4w#N1RG3AFd>oUfBSiqZsi3;Bf z|I4|8YIdDkY+`0+yXNqUmDzEQVq)e^4q#cs^Hmz$*}2PZ?Mb&bYYt}5_=c(B(qgMI zys~{Z`PBq}HNuxb<3Vw@Z-w)Ny$#h^?Px#C~w5$UB_Gio!}NAcnPnYxedn~?QkLf;V^K4ghq)wb5*(& z-vql0n-80(B=?jcWUxbbcNbxP`uY4^yHxxn9fEvi3=9Fj`16ghHL6++NQ-~`n&FTt zBd3%C^XiMp0r9{JW~3zi%919mL4 z1l-bpUAc5Nb_-(%-lyHC*=9ap+`a*TE}af9TVDh8bXEZGWokxsA4-*l$)0L9^e)x) zIN@rh61^m7-_K;y-)oHaO%y^VSsw!-0tEQhjZrJO_Se z3Cra{$&I5q%?Zj*8AnCTv|zOWjLUUKi+t0rN&AYa)K<^ zQ}r3{yJ8N`D31(b4E8W>53I62ePOdC0IJpIKNZhuN_q?w`$ur#eYC3-{4(&Rjg854 z5mhVJc4wl752o?JFbl4)rA43eU4`QVU(yRz^?W`J)KC9#@hTNikFx|b`p|o6LO$Mo z7;Z53*m-ua?sryGt|isH3a(f+Ptq$PVV5;`!2H*k)F{Q&m+n_#-_gz`*Y${aLcgi5 z%ljeIE185mtNVE7&?ryPF+3XPZ0j-n+1_ptlueQ7GB#KpDU9JRSZ(CrT{Fk5jN&UOzj52TtY-=V1P$6 zA?*?EBF3;Oug^D<^8<@pdpHy?L<<>lHO$rEhSTnUXVP#U5}Ny=xemdYK8^1u!u)+o zc5n7A)TjdzdQn2Av^NYQcl0OI3L} zwK*IJ_`n!i19~iJheAnT3jFGj6-lY7WT9^$VLA|s;N8^85RlZDy=)Sxun%jyCUX$3 z>T%-a^m`sScEhsF>x=?Bo$b~TvdjT{IMVp%0U(h$mA(1d75{9nYZaG~qGE#O4>lN& zEB#@>fey$WnQYwVn9sL#?geIuBJrD<6ub}NM~5;R^GEHKTl33|EZN{i8K{}%ress* zo(%K3y+p*!%a7=pHNH5;c5aa=F)TKM@XVxG@4VoQ=9m_4Kr~%3P%Id=D9N3H`WZ`VGr4t1t@eaHGr15Wu+L zg|*(9#dPjlQNi0Ey-+#XZRRt$GdQ*}2JS9cxIKbLen1F7<)63mX?-xQU*{s;HZhUIwjc_0t=}JpY)s!_2x<-0wYk+Gh>w1>LiJJdvkh>Kzu>wYj=gDrH7=V$dZi zQ4Ne=r_P_h;`#(b{Y-#-Q$%F9rCC^ODN0lu_J8eVP$qqL8w!1CZx$r7%!PyDR1PsH zXZvHPQz8e9&J#ri?ak%@ij`itj5V|UW3B)dG}Mwhk$AGFPv>cQP#)-{<_L?lCLgkA zVmhi#0X~v_x=9ZHPL!&YJ(DAb~kVsclLN-q&D5~gFEv;7eoH7sV6(j(bNBt^sLIcNN0zAQ16iwus~Hl#~5q6rI4Q zZQCj?H6oVbyM5k;?sa(Ahu~{dWv`QXCqvI!#SG8YPOm6qP-@ zRPuj&EG|%M*YTt)=2Jy2s75|IU{@!&NfehRCV{9?P4#)01(H`r|%MEnfe@~I7w$-k3bi78vHSCW6Ws7Oox;ld1W zq}nZjA=OvR2dgBIa<;NzTup|zt2A8y3t7_y^QRY|-Wf%G@??0|pB+t&-1G%eY+a=6 z*5bc8Kb+u+e|-GtazJLLwRyvg`*p|art|PvtVsPnh#rvA$&bvA!U`7#a&3(n%A%v= z(G;6vQUUf4NSh?I2gIz6h654sBzNe|hKEI&Q7DR!=&fdOd`x>KOni-EbMZ5u?l>Re z@f=osI60A+06#F#(u>Zx8__Y$lB`m*EsS6$ZNnRaYRsXk$7k9nkI%2?Xv(pRO-?df zW)$c%dSmkx&W5fjSZ_VP$N#8K8enuu6p{aVmz+Fyk4Ia34!Pu0ERH4GR@u&%QvGij z{Wmv|Fn{p@eiY?OyF1UV%(P zM>KT{$}{l7z!e317P3`{aio}+x&o!g8d)#`(hue~s4jiR#+kzLgw>{qE?i~(rH-Z! zDsy?8LkyfM-rfJSvVob*nVhLHOH+eTIq#1`A+tbe`A*ALr*u(+Ze78XtqhT;)U12f zudVBs6O$F$$=|q(sTthvWSzYy&vx8$zt|Z7F?KCXoe?or^-fU${=ce~Fd?xj3@*fA z4jmN2LL_tB!FnfyIsTlVGV@17a@%O5q}g-RscCbJO0kJF9tJy^*S7LL8;is-gn-at zlJ9@%s#7pIQ7G{R;+idN0B1Z3&L&}q1dECbg}ejY2%n-+GpYg_%Wd~8ByR=6DA91! z^Yr8;1&^_1|4{?~!{JBYhC%SWEap;S?^BqLK#?JEMS+kDeu93gdt7AGc!2f^BUlJQ ztF3E93KzzCi>c`ku9JFYjnPZL`eBh_z{G!AUstQFX$_k_ypMM|Dx~%oa_~e92duNmrLZGpvTJt7 ztZ=8cdOPLPxGzR65%(xJCd9AQ6M`+-GL>j!;xuC`kjG_&wX{q^yEM5MC(5TT{xS$U z{B3sen;AqkH;KNg6`{`%T<$?ocCfTtF62J}3c4Oi*%z?-{L~CK!S!U)NNPzc$0mu4 zOuUwg;7IJLzp62`hN@qyjTtWs8}`Q1#5!Qqeq)eCj&qhQ_xqruGq*r{J}z#i`&ikm z=ggTXDB(@(3l?JjA{4pS!M5k!8TM{z0xbeU*9GQ_@)^CpOIhZ2#S$B^iuq=GeFJ4Y zRrbgFJ%N@e=RHU%ZZ%Kzr+82v%Th9Jcj|SV+DV3-a#IgPCTIi9c)NIehOSo;N^w|uYQf~QLU*nnq;XR-Y-Qi|)P=Ac~!#qn(VDEn^> z+j7v6vecFE?(#GKi4VaOeFl-BGcDHxDFNTD6XlgG`><5ORIE5KafM#;jN;Cd{l=T(PF>5=OShv=9S|1aB&K0L$Eb#6Ifo0r_U z!jo+_l7x z0e}W^6l^a*Y4XpRu_H!YBmt7DyqMVbE9UyU)mc4G`f5Vr&`^{gt`X_1lE% zmH7%`qzj7TFaApm2Fh8Aci#a*5lrL`BcG9&qgT0xABnXk_nd0L)Q(n0HKf8xAex`a zUxsWwE33jxEpwCS>XvFumt2XxS|I;yw^a;B0@xYXT$RQTZoiL zB(BwlkeIY==8dd!(@12Gscp4E{u?H?J_e3&-&->IanB%mDm)u2X3c)JWn zm(HT$A{4&(qFqNDaT&^8^Sd%bLnXCuK)XL&h)9A|&9*b=TW`f;P>hhmU}NOc{8Cy% z@t4o+$4;J44nvtDp6-xYGV__w|6!S6U`8Vsrj?i+qaQ=vOu%H0oO2QN=BXFdGa8f2 zMujg`XZoonUauS%7@(rm4x1dXfm0L9+?hJ*EVd)oh{)y0#+zn>$n-=;*h&XOROy}Mv3C4@{A`zqy~sXXa$nvy$#K8q=4#WlV~vJqXEqO z6~a6*q-Qq~+x@ALIGBiBQ(+PMM#xX>WL>PS2%VZSKiK``ogc2udBHW8jhv7M zlCK}m?&bwTo*H;zFoBJT*O43yZS;xgiO``43iA40=b1ob-Pl5GbY+H5BPFirgqL5`~+dlU^NvGV|#oLFA+j-30^_4VfJf?rDlCJ zbr_%Ph!Z<8Frbd1%f4c+cSSyK9W**rv39QNDrwVVKr5u|*)y7-$wq0^T(L}{dw*3l znw|sKCiL-YU<>U+tJj`^1F$oB$krp|T8bV_#84R?_fAZ7<~0J2>{mS61E89t$k;0( zLReFQFMCq6-Ov#9BsAi>X?!}#Qec;iu?J=@-vmTD#QR}(ovSK`o%ya4`X2xR&Vw_?QEe3c>`I&UZ^ zYiOD(DLMt?M>{WzjAaw+y+z~e3Xt&RoA+y#!1}xyYTKKTr}?a_Z?QvsY)qa-lgvSs zeKxWE;-t$Jch?qSc6P}eSUT3(g5W=rOW*s_zAr#p>BBke?N=t=3x|D%Nuc+s;Ii2> zzb4>pa1KE4I;%UNTf_3si@{Waa0Cf7)j(rm1ple)3YGiYF;^Eq-Ym6CcC{}EWXNBh ze?~a1g8YCgHWqbY4D`Oc@i6_HZJ_M$sug`m*scv|_2a{lJl%ooT+0C;61pP7znbc| zIg_Lm7(p9|t#{VKoPB4v59+^bH!HvS)SpK{cWX z&Gy@mBP<>_Z6{MjJV8cwT^JgUREjGX5*N}Ij0(a8Qly%rj{U?*&qpylY^7!QOSo+r zliZc#Dt$(7DIq!fN0eS)iN!j?EhWUlq46@TJl}3YHH$=KKh`L?R9Bv%lg^*VsWh)lF5%9-G^mL*VsnZyeTto(2H-28F z?ULRKd{r9Dc}hsYD6YXRxBtr%4!m$%&8hh?V0Z;my#J1181Ci3{gHDliJmzp4xzua zU(9U9VuaL8*v-V<9|?v-gF%{f=tjr#LXfFJa*hx^ zlfV}M2K*fO$uPJ;sa}AVA=ec=h(JEHBB*f?s#b}X$?(6#5_THFdiEGmGX%hykhwJV zDvsjf{%78W94L_OHx^-;*x4CXCn*S<0FAZ&wY!FN%=d-15%ihBbn8!`du;)m2BS-j zlBcE+$fr5xV^loFyhOrBK0SsJvm@EAS`;DDo`(8jAn!i@F94%Jm_B{8ZG9ocQXv_! zL{1@aF~ESAL3|i4F5t86t>IKGj3r{VD&?^YLXq@=*<%;eW}#L1fQ~<7$6R7U@aNdG z7@h!rB}DR+zbWoE{?xxr9T)QlTfAe`IvOB$y1*^E)@zxP+~cgwm9;l7Ea`@HR9SN< zN>3F~44hKDxG^krGSiP!IPu?}bJyUh*mUA>ITYd@u&-xD%gmXG3E)sq(^nq?0alu{ zlQUUxO7D?=G;l1WPL~VS+FXjwoI?If5l$kxS=9bC|1zP6w0$UK&>=au_D=WF-bu&N zpz*`69WsvRpFpB~?p{cEIps)-Q5AqXv*~@GA27nmm9AiGS2rMfkJE_o{5F5ZJ_}UZ zi?v;mxX4wVI@V;2aoca5fk1*Uo)L_|JUIHZG5ofNzVGM66<~7Hr*b$u>CDg;L~Y09 zEy$lrU@l=m|KsO{!V?&IjCoovjlF^&XC+U2nN4uAX$+mR!m5Ekj_=(%Ot+%b)*Vk- zA7H`xzVF(3p77P0+El|h5$Nop&5@p!=7QiH`CnIpJY5=i)qt1F6A&>eE5 zLrB5g*Q@zgXd@#6MYL_Dw?+kmpLO58nDF^0Qos$b9V6CJKk+gI>7>yPU0drIuN=Re z0M^_zGgoe5Hf?3+EH(xnG9u7H>&2bfEB@2?8fQ84CHb?V*4#K6oKFgKXG=?JUp zqNcCJ+zsWmKkX;~Wb+GMj@Tx4+6Ok<+xl3`UwN3QiIbk0U z5+ON$$xAle>^08Zvo}U@*X1ESIbMQ0sK?z3`{+zW#s@{KX1Oqz*r2aSoyWjzpES@2j(afq?J%!TyQz(f<57w1>wxJGMyb{NWSf_4pd=J}~yX@%8hwPr=BR*K4 z>Ed2h1=9y=4b(I<;%vAf?>4Yx^=rFKTqy)h>QMUIw9~uCgJfy`fEXEGmDpDw&hi5vt3P1Wo zGIIOlEX_!!RMwiO<;eC2vsgMi+mjltAR#md3QPU%ScFC`&f&^#2!RCvH$ce0R!asg z`ypB6jc&`j=(10~*)Ee|MU7RGNU47#)RGP6w;2UH!V#6*u1~DxFeEhYq z!DEX;fKPmAcR-E~i@s;f&-HUjzL-M>FzFmWPw;(h#W(L;0e=12mGpbL9ht*oM}?1@ zu+PQ?iKfJh$k$t4pIL!=JSF2DLZ5;)wK5-`bw8t$6n%-GP}dO-q@BX56cwR5i)u~u zM}{_R)-#QbQ1+S#Z@73t=RkgREgy3k9j;=vV2FU$hFU-6Qui@mw$IWyuCqkNN7gf` zF-TRzS*CQ=`*{_VxYc~Chj!h_-J%odKQfE!JP+X4D$^>L;R3M10f?*~0ZtQXN+e1h zo1xzydH>|1U=FWc(`B4c)qns?T?gh(updBj3M#pjC(ti+Wm=0&lP%KHxFf$MdW-`| zgn<-`{N|?!-}hGXq){7!-t|)|q&<2!$0!ZRih#V?FpF!xZhGjESIK#hPJn{hx$Gvb z$$;6#_RrNe$;{xrkV2si64APUns2OSRhcdcO7r3|l80zivotHFY>hGE6t9*8i_hh| zNxNk-y zI=tN9QK-keB0w$SmOYn15)HKCLhc5jpbG?rVe|{Vf_^^k9;=LACc4&2b>qsU4c$!Tsc_q zc&yfcV=cP%1st~`owq)-zb9@|?AD=5s zk!Qk0QUaek8ZABb_3h3DkRkWyU%__;jN7idWy5ECC+rhSZz_kZ$2a_kkq-`ivzFvo z+4xC&PBI=7E`F73WbuJD8NymZ`(;UPBu9abf_$y zJv*xsYp4((F6k^2;jCB|za2B93+^wtn*=qh`S^P4)oK6VRQvWu4c1ndS>rjIbGxT7P?kW znWAirw(emC2`A~KGgxgU35rv|od*8Jmynl=0W8P+FL9Rh0Xyp|J0U4e-l*lt)mbfV z1^3J09|i)50H3u4FlVc-^aO@kt-Y2pW}`m#1|IG-^);@$Wv%(qg85VO<5>O^I_=%C zkGKF^*?C&+hK?%|xhb2E9j@ls*%EfKd1l3SegYLFW(W^fUpZXl;Y1AC z1j-Hog8sA7qdXDbh&t0CikM9iGLi(sId>3F9{r&v1C}X%Tq+;$o+fec;l9s>(pDcM2YZ z0U}T#1rt)KeED`KC#1myCX9CiC#4hXAupumGC|~#3x^$&*S#GrWm=*SW-lrd^~l}r z54yr>Y*!s3vJc`ipNs(974ik-{g3slSzI69Zm&FY6w$4 zTlHFafbqrtYP{)!YKSFUL#~^`5))X?wZ6_k26ccqW423V=oPStOmb}S+`hzSao1hf zz~tKc_XQx%I)$BAq)s~@;PxaQ%p`><5b4$Uw-(hJnjE^(baoSM{6<@0YjA>8*8i&y zWd^?f9fSIweQ$(q)vu{FkH@Ww_y%^Mk}1=>Uw{n!0$ILb zq|$_N9+8(NyMBZHHfWWHz{Aq35D{}fxkY|qwWE$tc`Z2n!>oDQ0J+?_l)=T3FLI`5 zvKYfq|A8UN#g^$B;1%G@`-VoQk7G;N-i*a0M)qkzbV4=T2J6oZ0NEbSkBN&W!zu8t z?qfQ2J=KUt7f9o{5b4r}!v%3k7Ox0Z$DsxnF7X#X653y)Vb*I2vhg2+p!O5a@A;Y+ z5s9}36RTFkrxaGHWTQ=rx-GScfBxK{+Yc>`e8eQIpBL3flEPxvM`A$|$bo+F%ixt2 z7S7wYRh@jiZLDSAsoGUHh7Nd+0$=)sR)g?h$uQ44zo47xx;21kLKTBjU0~OOMrjj=S-OeaA~r&r+>gQ z*G1z&5={%nog3EHy)wZmKzTFUAahiV9!*ALTfNUjr}V6xa8Rous~{H=i(gu3!s% zV+X%Hg;&P6vV%h}(**v#uX*?k{T|ZT-kH<3}`#2ee#f>-5kxocZ_svB{sct2{$+6!&;~QMWg0wV>qfR=fjs|!;7bZxhJsgzJ9p3&@hl|Zp6C^Up4-;Ps zC#uGY&p6@ea0$1u61nF2;#2n9h;{k!3`ULp#!0&D(m&vs`QSamW8=ldq;n1ktH0eDnz^f&}oTELyXP&&Au}<`S3U_g^bo-kj$%q%+OA7uWQdkls&$r*OfmNouEE1+1h;{=|KAK+_kqlTU`` zbI)*EnQ8vTsf-oL(qc73j#&IkuS9@#C#fhEGgvD1VdG9LNJ!G?WFS;htpzi`d!$eQ zvRTigDe&HCKWLurX-Ts0K)06=jsFbjHiTwG)_4kZO9>985&KCZ<_i4$Ow`sd4?mAg zSzvy}^1nCui0MUf6gnu9yL?v0LkIls#PWGm&QzY*|=w(+=$y|?GYNma_A84(E72%M6gpzxjU%dmadsZ1lpKU+4d2?^mq46)R; zhnuVF;7M>Xu6mxg1B~SG%Q(CRu6gdgu2Y`?>nI@%7Y(pB1miKl2y$dP0Mj>FWZfK$ zFoRO;bE~J~Sfl;PLK>CP^e|!@(5GLflc@O_sP)ulc(*!T3AK@{wyEX~^LrD3@vXt`KNPt{wphNQ%6Hnn=57H2fPpz$w) z(0XksJD_g{=gM4CwIUr62oz$5ck9xv-~dgLkgqMr;;_;^!&-DF=ZwXxaVPKIhvkmp+IZJQ zJuVV#f8gWPU*Ji68{fS4_i_iGu=LQ@;SXXge^P$&%a}s$UsNb z`SmS%jd_U$|A!n2L8O2f3Db*?F3T1e&{^cl0PU-T6d9P16|`}_eZu3$CCn+WaRKDV zF*LkTX@}ypiKaw$PUrRlc%(Vvx{p{7Y@C(|>x;CLgUEVjXw7Pg(Q4_O0YEOOjZ?nkuO$|_f&a{zU@w_ML< zs_~ykcPAy6rjYIwz@NHCe)3Gxu8%C&8ChwCOJcWu& zFYm|KWosqj-p340L=Q?61zw>*dHA&Mvi8W(^U==Ch=TNGNktO}r)($~?VfLZeZgPB z<*9(b6PN^T`$n5_Nui`a}IZB8S_ZRDWE=LN(z54iPxD{4Q>aC<_o!q%?y4;U-9V)2be#$c#;Nj0(zduAa4Zfc`?1H7pX?RpltC$w>|s!K zH5N>0SRnS`1~y1A3L}@1^54vtVe{{oyFcr#^{0~@6An4n;bf80{Y||nomkrBIR+*7dA6eG{3?EW3^4x=*l(0s;c9o9b63UkU}v{7+N4MgkSvoYS|!o~<_ zb|(xruc0n}enP~zr;OH9yT7mq;!dOGYI8|{k;dCiIZ*lkS8{*nTvoo1T zreiA5_mJA%)(r_!h_A)y@CrOj$&(DxFdMhAK-pev=Sm9sY$0_b5fjKvB`sOPxyRFq zMC#({Gs^_tV;~W91rZC~SQPTHQ^yWhcP1IkwCgf|jNrH5+ep9bVmn*j*%w3t1RzBVP0yAQq4z_7%Wdt-350K)FkImr+vm@^_^iULoj>` z=b7`oxnsH7Z(7k9oeFtZ>aaMkXgkT&iA0!-+ckU6r0;upIMgmIS0Rs9uAhVHz&=0- zTRREg3e2`0Qf%42z7gvwK{{H8-hX~5IfARas(HyREizCk%1(Q-nN&7?DoKhdt8PSf zdhmQ+(bTgikB)sa*+4ij3N&Wk;iZQ&cvw7?p78Vn&eD7*rX7WHfl{Uilxr^bJL9Y( z#F%hK7E*viD9#Op4K_n~UIG2nYm!}T^T293R2I=I#WOqve;Uq2VFxY@URJQTib<*F z&a0_*8=0W0pMJM)TMZAWP%e?7h|IvYgR2X_<7z>^wE4R4p#=0{IHTmGOHyeI7)UJ5 zYIVwzy+l8hCz;K6-{Od1Q4-${*y6wQW|Nyju@0d;cObfpbrn5tfeO$QuwBf_;@;MK zOst~x{3Nw*rf!fCFbe&wg;@%uzJiRPcR*mH2a7Vt(Y(MwM;~sh%F&rb6b6eM3w$)V z&mefT^~p>DCt93}JlpuiQ|v#<%caDTS6=@rV)r9~v4`Nsp6lNFOyaiJEQi^TnNtfn zpK;9Ui8Q23NnD{#RgzS~9}R`WqY+OyTOZ&xWKEc(`b0wd$ms82Yvg|ER~2>jVtJ{1Kz z;I5OsAi#oNydVy%3Pezl2m&f8kQV}+5Ru=SY(cv#_wnIm90!-S1P?XA`et|AyatY3 zJp{W+D^{4ssPzwO(2(gXUjbNFLdfO6iN0&nQq))zwX6*3CC31<*2^U2u8M4Pb;QaK7asKm#V#Yw%3~(-XJ@&bPn4iNQHKWK4v;}^BasnG= zNhjcGc5=gz78S~eDtX5|BWH$Hk@KU-#@58BZ!M28Vd-&T9$i^%bb^I5y2F)A->vk` zAL#&L>#x{Q2nBqs@WPlfe}@J?;*!5qR%?|3BX?yfS_2BOL&bn%&gL@^JPJA`fmMF` z)q9TTNrRp+Blu&6QTh!~NDGh}qKOeHPLo8-?!mK!gXKfqS63I4JWH{`DNAVSH00B{ zXZ;6n@vN(zPTe?XB;3!DSCY(RLkSU7_}Op&ts|y7i}($Kn8Xg!9{mKs>gQJ)SVU87 z`9WVkT3)eIb|L{7EZZXkZl@m&zTN#>2hN>-+)<#Jf@~S=I_jn(&H2` z1cC%Der_YOjgNJ&E#IQqUcc6am$qg5fyg&PTRg@NFf68Fz8RG{dVZ_>H7qr#{^B*f zeEsuYH}Z`S7p9(ID2WI`8d5Y-ix4g)U_E>YKo?I(T6ej67)h)q;58Juo6yko9KB}S z7N;0~fwCByqh!3@4_FuMXz-!IL3=}=0R_RcgJyH5u{>s+Ybf&+u*fAW8UnOC>$i2$ zrsel$9vx)yuawTO^|mGVL>og+MHkY`h5An!@pYt{gZd?i@I>SIRCA7jtVRjdtN2~v ztDqf@H~{)8{`e&ri1FTy@GVF@WOY82kFGbN+_RQ9di%B%uu)R!&Ye{3%~4D;jf5|F ze4SCwyZutH@M(rhBd$G&d~$rO-9~3yxnO&uBaC)vqIj2fYNA4#RMn@)6Vspy?Xj!t zL^)_TNu~<{$Mji?v(YSo{X6O0X_g;ca{u?hAjUhtXuTJvZc`Fsj4;*-wP#(+vdCUD z2O;R@DKz)?ZKA)w2D+})~qX4=bmN@#?K z%+Jn{n%_er2Pe{<0(yfdUv+dcrJx#1)e4~&E2b*O3BwX~{?Z>y5>qR z&-bPcOWz^@IjF(DioM))53Lp1AQQ%+SKY*P!V-u`Bgt4$C`nsa@1K0IcKiPdFsG%;XKNujM|fo%d;SO7<-8Q}6$ zTN9heU~{Y<2A6+ zocB;(y#N=~esLMadDf3cchR(>-%*Ux6rtbBIdEonRH0Z!Kj`grZRx%fvX)q+EqfnL+@_3miO_t8o~%Ki(oB!3aj&-r~C|I%a`W`D78vrx(+*o9Q0CFiG@5 z4{E>B%Z7E4TBu5-#*pFEsHdC{uLRB!IHAo|fA7f6_7PS;d(gp1jWGKlZ-j_Nmpkds z@!O?K%(^R7U1bTchZptPUp3Vbc}v) zk4O3v-|6sPe_BDekpy{{)M?w-WY94W!tVU($PX^XBcPf)1&50JJ_9Qjqw%aO6eSv9!+pF{zVpz1%=54VKjk(``AHe@2&%X!+s(4R5*9giuS|Lz6?7%%+fp-i z*gtMmc4+6Nt6G}R+J@8)IRs&-m?pL$fS(sCg@s63=>Q*kJBf>^K(C)N#!aEQ%_q zY3*v>m0|n_c1Oh%=6(twGX9Pbm)%K%N5zrPDd2r(G=X`bJC(5tUuJcYOyg#9eo@t7 zO%QYU6($)KC}+g524JAl_rHF!x+og)R}!;Ev8yMe8wNu8kajbSDsx%#9XP3#F}sBLH9_pl7$r3Mz1GXXAAyvS)F`ff?${v`Ro* zmNrjM*SbxYep!SJ0k@hDuoyHrFT{#^lkSv(h}nihBa8N;KeFkObaCA3$lnNnHUkkT z?G&Ri1G^pt_cSoCkG)XVt0qir|HFQ&FJDm6cc(kcQjhk*j}M$mw}TlDQyqQoG@~Qa zHv51WOxvsvRicf!m}hodce^m${l^oeSq;TeZ2Qq03OIsw_z(NeWJ^~OELGas{Lw5H z_vWLafNKsq8vSG&LZFC;PjBt4GW-v^u(jdV1D^MzS2^Q=CE`!YvPo4jU7XeYd!lNN zC46sgv1(SspBN~S(R;^Ki0-cVWp%KkAT?UK zRY5Y+>dfArolei@qe(LzmgCes*)%!*2`v$!!|@ZaKhiLS?elPb!P{$h{N4v;tOy7v z9|#m}#5E|GhS|gFnHMI`VvP#ri6v#=IMq4Q0eAF(1A}%LkR8nW!R@5e)qnp2Q9Gaiod=!Y~p>94^j)< z8aGPd4NO$ts%;9`3zh<4FsO(nO}3c%`zUTOQty|svs#>|vH(sH<}l|?y4x`-9;neU zrM6cx+$UP7OBH3EdfHkDYGmu-Fya^f-MO^WH2YPmgtA%kt)h8mL08a0r;StED<`DU zf+CX$YjHsVPN;({3$ZSwSoO-u1$5yFU8&eS($S?0FLDxROrQmM45Oodz8f%O5p>+F{KLH1j3KoQ}cufw~}Wq=A^ zm^Qsq@M`Gg4Zn5XGv9t`W_J2U4gMP0iCO*fk(GV{c9v5C#D*LYvwl}-T!rS0yVhRE zwwp0`@Q9Iw7$#I8s6#5)CHLo%idUL&`!dYcULrj02g$_Y8%4(wX!@s?b5AKdgw#o& zoacPj97BC-oe|3!235Qbg$w6ZlL4I*v!E6g8hCaY)^c|xkYi42#LzmN$5Au|D}T|j z5sZXOWF6Rp#{f<~T;j6m7TCU1TKCt1Kf`HOKLRzFfLyx=ZEN)zr`sqxzrmeJkLzt@ zDs`&RBo%b_km{qHhKTF+{Y-mDgW4^YILQs-__Jz7$;PQ0N~PGKwg)DIaW31Et`R7>c(uo3BW;6XM-)XU0e5fac=%#WRjaR31Nd* z>t=^nYw&4RpkSK<;zx6>mjpIKp5j6q|6a<=27c@PseKQh+XITh@jk@9B-e**>kv1y z?fl*vtSnC!-1S4oSK{k8viMb)?9b4uv-tB^& zy>7)OyA!bObMYNt^+c*`b4$HpC8!@_fbJ1PI zewI$hFQcaUHP`PJp#r@C44F^CbuDE66jDZEy|@=;&rPVt%`e+B0M}iCC*3}Jz6%ZjDJl@lUiin z-$}k-_V9z%Nt+0Oufl&kOh5P-Wz3SJ$Z4VZ+9sbzI?N;Um2bdWL2-{9gi>0ZYAK<6 z(>i0~;sh%6LJB#DkbWBZHyiWy1VH>SSG?0N9N7_GZow-%Yxmm1e82317?%Q^VXt6R zFXi>gaeImis{qK19kR8Tsa|Z9IH^fm|4K@IuP4q_I?LBY-h%f;7AYE2sp0Huj<uv-1lA)7u~KjAJ<){S4-H$%n@3%}Re9H%GS@y!DtTm(Na-AF^%QEg+GJj?xT z5o)vLGDqBcRK(4x(Kc!(6SJvxj2S|Z1qTL^h$xIt0N#QWO>VQ73f1K}xx^hIP}s4MtSK0_-toOU57?vD2w> zZGlQ$YAKG&3L_rRkN;b0WVcrb*Tnn`d1RCOUB77ZgkUVkuft5Sy4Dl^|KER_bXk8m zB(qShFFvw^3N9qS*A!|Cxx@fdnjpC(YQ}3ziNV@EdEZHD91}IcmO%Z8f>hN-fiMcV zVT8bZy{VO>~Tl=KSRW@Ts1<**+ZYD^q**EU4jN+?b< z;d>DgJZ8ARy51^x#K)LeFwqK4vfRGorlW`r>pTeE(EKJ_}lU0Lz zI6@3i#9Y;%!Ibd4uP2p`mKr*gV10-@s)HSxDePlgqr)G zE&f~(s0wq5PA9ljG4niG6JztaP&bo7VabiEOBUb+yU2Sq1-Lay{KLI4S5F~X1G@0m#Mr)pkf`ld7Rzu+k zsZ&`NDK5$Y8`2mkI2Bxz8t2WH_kt^lSw7zI0oPe+pTY_IW_|V1!49BKI-~>?77!=C zz2JT%8Cr{+xLUGYg6qKhF=b57e?o5PEAOtErNKdkD~VOy6j; zixIE=3Cx@CRo$Wf`h4v6w=KumFIke=Y)C(D^hAG8Ml5edj<3~#PYFf?;lOABw52_j zkr4!3;Vy|A3;JZ5oEDNazG)72-yqmq{DH0s4*Z8)J6S z@3kUe-FUC+a~h!7APgqOyl&ag?q^EoGJfrZ(Gy{JC3V=so}}2VTM-LO+RrKoJf7xI zd7dZmrv@T97oj)cl>f7Q@>i4_DD7P^VPE)H9v$om+9c8BpIR9Q#EI{AT#qE|wFqui z{3&&8_T<*34O3RD-fb(;GPkPb=L4(ra-8uJAD$ZHOo%j*TugB`*UVOf$Ld3KabK*^ zo;6VbVQg*@JY1OYXAJ$O3ijJW(hxwbPjkt&M%+0`e>t5sk>w`+2ndB=rivAf>0Y%5 zNCY^3A9x4F*d=m;QLc6McT<7Y2r*F%<_}AC=~QAs3}093O=eNbhg&AyK>;z~1&Vy* z0{|hsM3pF{nujLz_DrKIdf?Y+@+1ESJjQ7z-u&tD@J!eQ^iFCJz5gJbvxQ*x2X%lm zR)Up<6WMOj_nqMr;dUv#OAz9F?I_q`c$cbLs@Tf%96k!N#J~lA)!zhOVvu`0i%SpA z%?~$A$pvk-rS`IAJGjj;R9Kdpv|fTQL`cJg@U)GXS?>9jgA z3_DO?oaaV37fu7Y1?BTyhDLV?bKIK*4_;`|X#b zg~gTLIvaV%n7Zhq5Io*CK@q#tuq*+PTdr${YSJec-lG?Gd^1gCg~yT~>-p9wMyv^^ zWZg*A(=3mbHqdXls*H$f{#{`c?da(Q!5eIvJYpT57JPmmruAEP{fdhZC1rP@;&0L! zv0VYH78Va76<06j2Q3B^?qgDW*{3_WjTR~>x5u?#KrRnAp6|}_w&*kL6M;GA>BhHC zjx6PGp7uMo^+GVenirPel(Zq1X?_oYTT(v7Ceu7#EiSr&XT?W3`>l%()dC5bchHx;QRe z9?45JVMKo*+83cS8)mvcgT!F}Sl`>TlBt%bd>Sn)Ao*V463<(6or>_+SLEt(s=a#l z#GSxbTqmV2o;>U4F4W+y;X{)%uI#wu?5;rh1mXmC6~+D#YPhA!TcGKjm`4#hGA(Gv zS7{>s&O8D3nTk_#)FsJ`g~a4^bB=~aI7<^+$5#l;&`l{#f$`wkgZY*o84lU*^!KaC zA9i$w6UWBgR4^`al98)}N@E47O1W&DW+A5zj4wnQVWGp=Ex!G!b~g|p&^3f}Ze zn*q2_AX`+PbXAuU=OTLf>iGgkj|c~Dvuv+ckndSk#bDK`-rGz79cOhmalExEzOnAf zfwmJq6Cv*`55a~iX*uA6jsUFK$~|^7L+wp+HBX_$Ut9jLy`zz z+76_r^{c&z>H2g8X^3lsYO4wRy9l&=1YPjF0^sK6FhCF9d%Hks%mj8wn_qPT$iCUU zh-ay$xeJ|+NU7G{NJqtfJ7~mcQQ^1N7E0%2A5PPUAeu$r5qaCmTsdLQuP#hW9l2qy z-vMniFcm*2)tgSLy!e(mz8CSW^9yGRuFc#-L#+Zr!mw|$?|ti9)J?upb5}zp-zfp8 zJGpO^*~RKtih=p?y{pg0x6?^++uyh3uxITU$DBHOQL4L^k2yB;%Toq8gFGc6Kxm?Y z&-!IE_V|skXEBkt%8n~B7gwOw-V3BaUy{|iyw|KUbC+=NNIy|>o%dCL)h^d{vdo3LkR_VK!7Wq z9T#zK9WqYftK!(N#YV<4X^@|#+Wt_olTL16T5L&mZRH}=OoEPr2}M;i_G8S4%XmZM ztLQm7us)+0C}2BuhIX_Qprdu6!x8&dPN@?*3heGT(c^dSMSL+tjg|CM0$Y1j-+^9s zlMJ=1i$V41y%Rw24r%&sV=sq+Bf^_11WO)ya{8BT2fBbbwTnO%$7TGo5x*7jJWi>Q zPdH1;#Sh;#zTn2DBWKkGViM5+7^&>9{n5p*A2mPIityCo*_at+(3S*8MgyMJY$B!@ zXQbQJW?%;O9Ayto6k}SYRt^iMji`s5OC)*tb9kTtGy&T%l;8)0QkebTO40cKb%_Vc${jn}ad!kSK z(XG3N`vSadyi^+upW9#h_fqPudhGMas*1yJ)BmW(I8|6nDcBHQC(n%c_yfv@Ob^+5 zJl*mBiONx>BQ^DnOVBEG!i`_&L18vEqNU?m~fI90en zth2!46(w8NOr0uo$mXBA0K8w47W66btvQ-Xp{P}_@Dxhx;@Aur_V;!fuk7UlF6jFp z^%wujA5E;r&2xtI46&R%5)`;mYJS1qq8D5^n(#h)h}hPx8i)0Vl?bBsz%}R)LJJ5e zhrlN~NQGcMJTEO#85RYICWwCF>Xl5mQ)ML*Dl6RUmU@4QtQAbN8}#+#Dk*rz*vf2! zddYVr!94Qa@k3F`0Yc-e%HjYro`RrN4nV&GwUxpvNJwL(>5{s!#)|?QDJtCt_Uqm) zI==Zey9Rv>*piToR^%;&H(JvEmFe9<_?8>FGespx0^ZOia!mA7 zWg+i2QCXItFo@7(ef0E@EL(wdFn$xZ2opP6d)!!7`!+y4Ky!cf-=PrC&YE`{5(lWl zZbJ8reGDXj9oR@WbxcDaMRvSmImEtAo0`u0v=i44A|=(k_{23OIW`*%j)py(*d)$% ztcFqFu6KuyIBRoKenr+v6kMWlCM*@^<)?=eV=G_T*$7)0bEYIrG}8gL8LYLo>bL;5 zmbCTzqn8W)#3m$et^%)zA>PHjt>K0VTbzO*$e11vX#AJT*yBb*A_2rMBE)w2jwZi2 zsn>VJ=?Oj~0c;!@6%u{5u~Z{w0pIYgV^mu>!AA7H|IZ<=k!%wu8T8jx#ckkP{g6U| zB8rF!j&FPGuJOalAJeF!@&mrf-aWZ41HQ|w_fN=Ah^&^_)Hb$Y#`BnVmpm_|qSF&F zX^7EJdtc)FIYY%l4IM@BfkYYCRp||BA}s^xOD=q~N~3kMO|67(hdC~C6QSzES4+YF zpa}b!-Q0+hV3f~PrGAYuIJ01%t+X1=?yyu`A)MPsnc=-p+JsGsQ6-iUNv(P}Fb+3u zjpM%aTivC+6$D&kX+~PnHuqedFdXNo)ch%XnX(_B-nT)z1XSS`#8lm~4;Jeu<2?+EMj9+U?XN9)FDerzTowrhFnOEAhx4I9t9NNAFZ27d7U+g z?v$j2IVx@Jo`fUrwmN%vT-|{=FJRUde&pjzVx%M0AN}DszK!zZn{uxouA!pxhdpsG ze8TV}1GWrpN3I!$9|@+2v^yoEW{EZbf#2Bs^zDU-)(katBtiQVX>9MIE04Ju)`VD^JeueU6;B%HUD5p>C9IRkpmC*7p5y@0L?mx8GPO`ie}G zE{7rDih^P%%ltOPJwiZ!t=z75akJ!M4jb$Cp`Py9=|4m9r9CL}MKka-0XPVt1Ard> zQ303~83GFDy^Rv0&GZ>TCe0*;4`-!RZr=Yjdv!RwzS^yBNhfPUV*YqaIk&bj#WlE^ zxKf1D9*F$Q0myfF+YVefh=FUEt_eWiXCE!6ZWD!ypm@R}-`oazF(vJvUM1+ZK%mAC z_W~CEsYy3BNxR~O0#fs-Z7z|*U4$N|cM=bkc!UcA5)!eX;P|{8P<~nSO4EuC!&|qY z+&Apz0lXF5ov^y3aGrEuoZ*lzh~&DH#5_`EF#rq3a63mle`cnMS@fFdvGpmc1|pEqBc zH!?einku|rplZI(ui9>%ik7w2q3rroH7$b^(nsZZKdoB&fmK&l*P!7Ui2uuZH|T)l zXAfXr;hyVz0iPe*CH0qCQNmzI`75+Qs%GN`t8~XdhS@ z$K?*PPn+2R^2_W=?Pc(5#KMN@D+-=lv-ASH;*T?bBgUv2WwLqRxYDZgql-|0m>?(U zyS{gUa%J-QLkTNoW+>%u4?^8iTxt|_=aU0?!XpC)0m1qPo>v;Ou|ru?+(~^M{EvMbpE()8!l4gVIJYiy*s%&8sy=WXo;3Ao z+@<@a#1&#;v9^EpS}^wfuk=^k&4PJ$iuJnGlulJ_7`J?__W&>c?r;7*y2d*Dkl?h^ zN;)3_2-Z?0bPiYx$`}|28r3q~<0)rLPVk3*l}`o&q0>YegBhNo-3h9Bel3)fm* zTv)fYwSP0QH%`x6Rq(vf(o5XBKgayZSCf6QtX^31iG|T6XeMIbqzHTOloC5ep1E=` zX{7WNr2_PhH0;IS1Lq)`*UxB~&qbaQ25uD{C;yW!Tz%PYBde!afZP7Ni zfAj-M21zNRbmV9mr|UJ{Ol+aR$7cbUZMojN^U}>Qc?u+6ldF1LP);!qpNRCHNWkpe zQlr#_Rd?Zk;9y0X$2kukBha!CMq|EO3vZY#RBj5DuzB}px%3;g&7Q^eF;P{H*#XuH z5LEdAig@E)g5J4lTulyEi&ht*!c?wym^T(t;{=>}U9$Rh79cWRJI5mHq{}>TrQ^!O zyI-TAgp*&0&9ghPXE^ufU@lpq6!7W7u<@?@2M96XuTJiYRtt>(2V|^PGk`RrKQk8W zgJan*JPSztEQ00{xWq;HZ(0(;&jnvP6!7Af_>tc=xi-PbZttSTh@>oU(Hqzw07r|T zn~#QvpuhZ=4<_T*$PtDjFS#V{J3OaIjo$5-ph+UdEEM1hr{tLT*jbt5>>LkT0!vB+ zypwIO9L3RxXpH~01lIf6i(DUKzE9GT+m$EZ%@^&Lz6-!EVS74CT_EW6y&IQ5u5p;Zp|3l#F zwn?BkTKrA~*bq!19Q2;fev9}w3$LT3)Ag=YGh~q74%O>dxg!n_>Zj^o`x&V(<7*3& zN-n80E}>8U?f-TGdeW0dYGV? za$P~ssMWDF{JB&xBDFc19AfNCR{(sl^7Evbdc@3AT(Ct~9hID(z(mmYm=ef8Cb-d3$iDX3|yzy(jUa&0a3m(+K zBLuG;_-sXcUWidO`k@}AIga(`rd5&8y*o;@Tg@1d)wtyzh)r8%P!Jg0&DqZe!2<#y zp332Ecb(7QBkRwRq(F@#Xa_YJ_xOwx9XZ z+I*?JoH={#$WXQ@@UmZjnct-2&8;s?a&^8e&USG~_g}Aqb7Feh*v=hBJjzdGnwbF) z|H`Yq!ukH<7XmN8x`#&FWzFnLX=ohdG4) z;A;Z6D{1NtjWwyj1N8bEI{q%bquR7@>Ex~8<@+(WBFFkCe4BY;VD-PNO*=(+k5^vMr{9N^~4NR*R zE_FK2DNS+G=)Gz&U zZm>*iEP}6#`J%2e_HCpK6nyX6?_xfX*#_5lu7;yK|K21s=>tB0=r)ynenjqJSYDuZ zSqgidgaq;cwFMISzUg@YFXfXGmeae^pq~Oa2FGpRz8L)VMd?0Z2u^igMt@#3>hsCy zJDVuoNK}86+5|rw-nE@BAvKf}$W?Gt&yukCqrZmlzfrIts0rvKBHbJfARWY)_TLBO zCWTV6Xx#X4P0ec9Mj{6*$E1sziI;M3VIVz1jo$`1Z(URNob#@t z#@^1hUgGSFiM66JZQcpROW^8XHbVpo+!%z@C5w{HBe%*p(2x6)tS zBy3dh95^zZ+rnaloXr1V>v$Nsh_~z0Z1b@(*Dt^~Nd&IqdyErhpl-!86q-JS-uM`- z2r9JI+6F9^i$i4Da4|`R)^Peb=lP6~AL-aqMRCZWN2Y^_t#JMhijZ$_!)i z*<^>Ol7a-f3kI!%UEo%18X8ZL=wa!qLMZ?!#Xd<$jiB|MbBT|iL4E_>fgYM5^j{KgAa5Y4}MYq`;cKK+vOE}ME&p?Se?1)^2|7%%Db=)<%TPTD;_u|xqR>wr zi2kdAq*Us$gSxLZzP=7X*W8RlgSqtw52xxHk|;y4tKjn2NF&YR=5sM3kO2hoJOOSiFmu(U^RB-s{tuUCaMnS9h= zf`RqEvpIBYQu800lmZ=WKpBuf ze)9#l4$wD&ZwAVab+-Zi22{D{UwuvbsB{QFyzwR~cmfEY-uS5&|FJ0Hhf@jjs~45` zkY*-ubnic#(A(KV82cePMWp5M!47!!d_bv>T0u%GzEGd?YwuY;Jdzt8{8bTPVPTMZ ze<e8Lq)?_;_AAI+ZAiY2taR()a-vTDDw>^==9X_7VK9sGWsZ(fx3 zA(^M2i$nF~Prbz=gH-1h>eShB11v1`Z7in52uI77O?6hAZ5a00#dTek8Nx`$lAA>*N| z3xNWsZ33+qmj8V0vac268HZDH{y6e`r(l)}s)Knyl)5n4gx^qz`edKS;cf4KR(BNbsYeeaU`4EVL>Ehamljv(+P8{ zP@UG`OTDS5W^vT`e>FV=R=O<-gDf{h)tg zqh85tIg=)+K`jDY5^j~)dl&N^cRRed6-?Tq(SwxN%d|khj3Ch){y}y>6=+y#%noZu6%Y&vIk7Q=Ev&93vCY{2jD!e8D?C z(2sjz+x&W92z>}{RH8;Ys&1+bN_v28nPydLw+0Q}Dl)+j* z&~Jf7ttL~!%v48s^8qZ_500hb#{d7@1R>DjDnf4y#jW*1-27YWch>rnLMWgb0*hup zwFw1sMt7P}las{;aWFvCzfV5w4@uwKbn3)_6 zo-sjUV(7w&Q@`A=a3}V6>XVQ{hm#*ssOR!y7_$`rXKyNaB#YMHMpj~CwHCYWrC}n> zacx0ZQL&THrY_ABZ3);4Ds>>;p;7=Bv9|n_v#Nx9SEH z(cXOwy=+X06?r)^Xp@J_% zd3Io!rS|>S_N_(=fEFG06MXx}2ye{LPoH3-`P%-~;oSODHDl+t>HN>_{o~}&HhYR| z2@UyD8=5CT@`+P+c09A^_rKjR+k6v{nso9GFys$Wecl6q-^lH}DSx@dLx)vy_sNat zNTlgWqHC}eDhKGwQ=^IAy&pp04AB6|*vcXOzxrhJdMUl)i^uhaxM;Qql!>PbPT_jvwwxO6i|TlwiT@vJLCc6(Ewg=ZtFAzd7j|c`Rv<{DvtOK*rxq@sMSVTVC@7K z?3m79bx`DTLzDhc%+3ySKsA=?XkOqG>6fs*f#{(_K&$OVJxOK0DeCu=zh;OvWn~1D zo`IM_y}VBm|0X-o{Kej*n}v{{qGxV!^eks!eZccMA+L?i&!l0aoeyYNucDPxXPLUF z=wF)zC~lI4W7(TQJn~2Lt+1bk1tF<>7I_P>l`BC1d%Zm;S#>tL_C0a?!SNOgmq$x3 zIEiLGTpvid(`clmU&J#iv0FfT@m*`o(tUlw`oi3Z>jm5V`a@p-)R6~ft{)tUNg+cT zP!YDtC|=<;;pF4*Q%GAQ1b6H+X*~zzEf*^%8pYy`e@K%gq#wfn2M3bfn%86GZpR=K zE54=GI{q$0)rE+tfl1AUAJLx(3Ex*-&la=V?Fn_x0&HbiNojU5SJXL_5kz%TYszZ1 zOe!g8+YUL$=jwE|owknM$618Hk1W`7B;P1@uAba$+DC-i`eR}ooblS(B=@Pi6qI&N zpF>gybQr<>lgPILk-vBa9PIN@--*K5DucCT`1Q8j`s%tam652SXQwrUYH#Y<1)Mn% zfo7^gU4R%@l8qIZ9z}p*cQoH2kBNzIWOr<~?auw73 z^;3wuOTLlt`6bRImQiE8JKSQPvy`YZdWsr$a6n9G{3p_~mY$4-1)stQ5XUOQqZbShh~aiAf}~Op zT61BgG%CZ6I~Xc>PJY@>+8q-38bQJ6Gjb(wnUi`cFfe8O-kA$8sY@v`2jH?eL&BDU z1z>E~UU+UJ&1Z+!?6vVf{+dSJuROx1u}w})%Dsn8G`kK5LChA1_S`=sZ0V^Z>DLP{ zg(RmWiqJ9fGOZYX)Q#;DK*j|YQf8JFw%49|WV;X2FR6&X7mvnCjoPwT;8@-e^^g`j zy({hz!w3uM(#l+oZ{cRZB^-)4`%rUW)BWLbY7v$b^%!7aOeXCv(ElQpT)T*GALetK zRfJXj0W&<%$utla&PeqhGFx5nptYk2U5hds7am;TFid=qpjXJWw2yEU>OrxjTJ@YQRB_Ga- z!aAXQ7SqhnT+NX0odB-u?FB+Ow6xy~p- zk>z>YeEI}td|&6I_CD%I(&>H>Q{9dQ41t*th7v&!vi{KSz|2tiOapviGyX7fv{p&> z6X3{uJu@w%=J4O|-qepql@CoimS;&msOeU>t9TrpZd(>lZ0P|U0~p*aF#_thxfgaS zfIjlmCSdRSC5rISE^O#=MJ6!tjL5eCX>G|Wn-Acrf;>!wuCmrWXJ4fXVU(?23uAwc!h0{5B08tsEei5h+)+F+yk~-oXD?`78tW(@rY>g;(t( zM|hB(ZcgYHGVdGVhSk+3L^ z^p&|b=e5{$(i*3Tg&F(X)7|K5(>6DWnAOr_<+o!2`Tbrhcf-5Z!)~LoH7lV7m zpBZvh{Lyz|SwTY4-4e-x#g#&lIE3kS@mg41uqPl-1fDV;tBUP{6#L8`oEC_cHUZ z&iFS&a>FFLO300|6Wm(j|5_qXlwDYM^10HA7=d1@l$YX$%?qrHZd$L1JW-rquZ+p# zz^Ke8A8|e;p4+D1=3-tJWr!?%qY?uEtdzC-MZ9k{=Urw|nny}{+Drl24j@eN-A@3l zMAYuM5s>At_Vja^mV}UX&cqCQu%y zh)sQ=`;8)N>}^Pdtn?pYy}5)hJS)B}X+TkE1Grs1+u5#>HQw4-z8;3s-~gVgOH3~n z97*8l2`RA=I~cIW93F{SgBeSU4}ua><3Ya)#%=I_1XupA#5}k}dyv73M$X40%AA2! zG;*e`o}YRwxJ7oPY=Ji%RZX$J!S!3uv!$yy8Cwbt_M#NX@@P^z#mx%#{W#Y3W?;UL_hq39aBMCfssIG<@s zF1J0hftt!g|X)ra%iyg87MukS$8_zfj2q3@# zisd`=k&Z_ELsXMrnfpfCCoy{cf3F(w4|@?G#+sCa+OP)Hvbj`sH1#=`oZS+9b7gBi zv4NZ!zYzFAZ|>DpG)5DYL8m5vZjZd{-aK^sD5IVz0H)r~TQyJS#kmTJ=^s=(}u=MUpa)4;|>) z;B){g96a}2#iO^{J)AjsbP4EcUpD>!9@?!`iGgTL3n=yVd zAL9eXQB5He(c2~7|ifK-0jj8j*|QB|OFL17yme2Fc} zKjWR8%H1HsF4dAi$;*dDKiLa22E?z!=4E*IE%v#7cv#W>0lp# zK*o3O#us8SRjPG-agSTj<2u#!^5_=TDGi`qp~DC@e5s7~SPHa&hSWfEBKu8BBCDov z$FtA(sC|DJ-}#@+Zl!Xn3eYd(T!VMl*>ve&<~7+)M)TFV8!uWR}}1C$lMUv za2B(ghm9X+OowB|90}TbOVeg$GH4yNVj*vTy&_pb8ug?(985(&y$WomcMz{=ZZt@q z6Ri_a#Sh9sUp|D}>q(@@?{eKwnK|(38ozXhghO_jT)`-$af6?y4h3`ZX`xdzTesAC zCnfjHDqyRc*#xGn9yz+zHY0|#Q@-fhWa@*V6mSrY=72M zMr)((9{M9h{-)&jpXh^r{ujMt*{$^})*m1a32|<&a~2{{CmNHJi5ZW`s<0vT8I)Aw4lMbC*W1On|H&*WDND7NQ;jaFBJY+HzfRhK zSQ+bI><7vL(EMPgFEi!cbg6`Jfu0ngiPlE{`GfP;$o#Ywr+xN-!Rnkt`Jf>YC8p6y zkiw#5|H2qh$#ft0@2Y)HZx~D56D3MdE70b%=t)p5U1M8%?Kl4lDg3BFAQe(Kwyu6; zT;P6OpkdB4sT;deq8vk&+ME-zxsD5XKb86HV_c>pDntOt@qRaikt`c=qgy%kC6X;V z(G-Eczyn1JI%f3a8u|$pw8pT8fxbo!Mx6V%O0?U61|h@YSpHB$v;m?m5Cs3tluBEL z1kYqJbDsJg7E8bywJXxffW;snX9bC4R>I&>1F1w^EhkivIdsZ&lf^aPl$lqrHf&gQ z6fF$9nzJozE(v6YlKRM)-#Ba(|H$e^<3cnQmtV)7$Z^zi(;7M6o*8}nO(enC?i%E8 zh#zrFa$ZMMxxrp5Df>c0lo?;1<0qJ%K>5AzhKs>5!pZ8fPIU^r$4XXYB83Dn8}cK> zwN79Taz@WOTRzyEJ3~|msu^n*B-nNdxS#o;xUPK>`n zpil>fBteYqXaFZ1I@e>COq72@avou|--6GDpe^$Yr%?jMW?L#0k_XshY*l1}ft6Mi zbda&Kqe;al#;ZO`fZt95(gXxl``%S>6`soXVO!W9CEiJa2lZb;3?lw{n^YbLnI@iP z9+#WhjKc{{-zSAN-9>1Fe$hwg3vj0-Vw)USQnJ;Bdh*3EM09u@!cGvcj1dt~{PUpH z#Z9}od1v?zgIUj~)m@+}0BRzvJK!Hu5DBD_@EJPgtNawK-$wzN>1H`lverRXJY5-J zJCs0Ul5hABYyVbUm+-1?f?O=1P;YO~1_-V+l-;At1Od5n%vLE`G?8CzbV|VUXNy%itr&zChF?2 zn#a_%586Ec!M1`5jJSjYmvfn)F^E7S5hn>A3fx`cat!(?;k*>*igDtbc*SUn4{UDj zX>Q1C=r{~Re~#6i+2opt*3JV>j=Z1mhO*lU?pCUhN7$n{8*vRQrqzIKv-p&3SWPqH zvi@b4F*{Se`^5QTNR94|L6A3wXAmZGsRc?>PJN;jqnCZ>vw|o-+BuT*l*l_3*N635l10jyN^1%Q}gDYL@*P%^W+TQQ*IIrwZQEp zQ9}TJgq4axDA6cr&qB_e(c4f8H@hY48XJ$U6mTrElZf z|BA=U0p0r7E5j&EYiLqnT8p5#^x_6M$fiL0 zWX-Kb75(?&KS3mh0b>^&1H`5dq7YNjXQGg=c96XoMTAekUd6806LM>#+pH0iaNlXe zGm?4IR9Vrf59hXp&90tc!AgGSPUCrsTTMWy`wd^q+vW$a!}&3BeBq4A8~$=gC)oi# zE=a&-@=rX9Y==;`N>Brke>RYBCYka)nrP>z@COT{(dueJ%%WfJcY6bIG-Fgav&zOd zR+p5>p2pf@S1Yn8okc>#`2dLyhp@G&KZco=q>B0!KQcSe{G2$WqWslK!#ylejle;% zFP{$Z%_)=9n&8gBfgcvIriTvQgn2dXj&OYAG(2&;Y+7Gssc__^vN+RvJ?xI_&1*PQ zL#!7fs5NX2`}u3hT-v#q^b3ZxTU>P#&NH!bJ3k(EdOwOUEh^9201i?524Vu%aMl%c z9Yfh50;GA8<&2Y~h=YrXSpTqxoMDt03 z;%m0DjM$`@8WdUI@q{z#F42|Qyl~f7+Xo+U?-t;tg0SdDWSP`sVV|CVA|!^1=c!i# zwK$|8Vd~BU?H%Lvro_5NR8R# zy}6SL{gv=?b)RRee{t!d>Es2WsrtBJFQ3@SzI|azzPP@@151$R9R2G#8NgQ%rvUbC zNMsq_WZN3Mkpk=x?gYE1qB)Mo9M!sh#M7YTnKna(OX53|Y7k>Nu;p7A!3qPTDQFXi zD_Aw2XeS|*T>}T$xS)gDP?ihKP?S(Kvo`QQHbrRzBs%=`zg_sa0XCFR#wFjwOO$~F z3)c&~g;O_p&hi3h)NP&%ee_H`B>1z5yxYl;AI7x3Y_;JACe{`-zj&|`MVe6qfWfXD z3xQd6g1@S+IPV}B{#@&!p{}BdN#S|GF;#OQIK6A-51(8~WqsW6>{##Yrs-rAS5dm* zyD+Y$3$z*xqtyM{G*31vEMOF(F(=Ucb%x$5(Fjn525x?lL zdG>%$XZJKNS+gdV>zuEd+t-n9hw0ydAwl$|X<;)K7fZM6OFDb56f1^NHtMh2#@cT8 z+gsAPE*a@A)5r;gaJxFHw~dQbOK?6hR&pvSW}sbpz@P>H$M*-gWPy1C$jz zC6zICv{Z7Y|2ZbSc0iwBN#66N{^Aq->|j1<E zHs#rK;&TpW#|bYzAxHvrr^Q%?Y>|b3aX+OFLxAUafUu<>bN)G~toxF0L1n8+WT%_{ zbvNyLzDj^J2&t|1PZ?k;CWd9kGZ6L#44QvrYtt+HvQU&D7mBi!e{0r%xGFJG_z zd*tJhw=rvq02I`TD=4;8P)OgJ`|^8h!)}Ui)64Dn8gfM1$j@6QqrKRE;m0wsQu_Og3LL6$FYQx^4TzXY$G;BYV+lAB`FR}gD7ToR*SM;^rVqRFl2swwA zO^bP08w|h9C{BTP9h@St&TlwN1oGU=ng58Sb1eHR*BgRdMnU2>(a-e9yJ$TpfXFVOOyeW8Jb7!jj)F^C)-XVKiCvm^vpwO_3`iD~ao!*23{9Y9L)P`^7YmjHX; z%b!FDzb!)$ciF5dEI0de_T?V5BW_B1Lm#JBlFxFd?{@&gMrLX@PDd;w5;|}sHiQ5Zw;!Up#{g;w0F`RVuMP0ZP;`QHwj@i9%9p} zEx5@=S9HQh&pQOe3LRVb8%C|sd?K$QUMmvHSk2*}r74DQRm5~)SvJ_0x1jX`v+*)Et!ZM#q*=Z{ScbkSzxhhifE7X!)27LeR+7x%nRwK&Ewu!WL z>om9eRa*vkkt{WSXq!Vmd~LWaEOR?1<&}2DtN>HhN5-y=`I{OF)eW>&N8sX5*{U&g4)CVg_S-0a9C4t211K;6hBQQ0EU~`| zH-hV*=9xB8JyRBncqrz+*!Hse6t=?e!3|&$1MGd^{6*}cM8AI1HT?u1GUEFwwcTxP z#AjjU5&P(NnUTqBre&qYBCM%zTfGs%4nN0d10N;6ltdS5hIfY#T?f)~y_ApZ#$GbQ z*o`Zh9bJxIhqQQV%utvNB~N6C%i|U^6L$fG)07DkJW)3>+gt}o9f{3j=D4`%aM!wk z<*=6rKbpL9hhHA_~SwCxLVrgxLA^R78v61Oyk2zGF8)>g7Jg*611_lWnoN@S7!J zXcwyBIcW-OxZ@B^)Hjbo21a(SjdnRFF=h-K!tJiJy2j)+4*>%e8+pP1fG%^g|IG6) z8i1%u!nExjh*IC1l;M&E>!R`Tb$kdiFd)q$lDr~r^ARB=aXW_lZGu^E5cuivOH$Pv zHZ@08J?=rzR4gGTgs6&)!v%q zCf3_xc=9s!M9q^-a}y38id){;=PL*8A=u}=4p48v13e{AGP*Db7u1bc>&AgHo^ICQ zhw@vZuzHl1=$PuUi}g9nr0_qH3u%cSEJLgz><}U!h7q+p&g5JS8$%4ocv|WaLz;?? zY?~0o!QlGjm@DLYSzfQ1iNQ7sc@(4A4v%{w7F`RO~y(pxzSu}fLnnvgx15L@tY*=ki;!OOx{0)J)< z4#Ohgzi=bS5+=}PmRORLdcO7}7VO&Y=KEYkJ%ip4d!x5^RL3O&Ec0$9eyM&9mxzlPYAW zTi)B}$p<+bq#U42K$FP{+Xkuv2I+=#m$ec9gNo~LGo{?z-E%d0T0)iQ|8xMmaP7S& z2Yv1Q@kXrz7{w=lOyxvUa=3l>fRsa7q2X_v z**A+1mU7ihgL=Y})(%+n97>F}wjA8i5RNv*NiaJ%W2S8&f0cRzIkzF|5PxGx*LGc6 z{uvXqoWsnP@ZkMVMIGoBg(Q({l1hCh50L!v&b<}~Y&k#sCo@}p z!|@5qzEgd!(?nv=5%YjKZ4`dEJel_gWq=6!?{+4^3iszz_w}}&Z_eddKUW&UDePCe4WG+1`7qdST(%8;GEz*vfXL9sj9VkFGF~R<*%OoQVii z5t%qC`hhWIVKOl%f;QSBkCQTLT2C1iyHvuB#BM*ZZ>)sHR~pX`e9kPS_O4rclSnYU z`1wnS$-}LYkzP?5cI`SNArp5*k}q-$*uQJEaDe4Gn>Nga7lxg(ycK<&J!9ziU|g@) zIVW7uf1kE`e$wp+=F4W4jpp<2dn%0>D-iM`l5++ObR&5l1LxSU#Iv9xU(K|@FDz-z zfTa+@smuhZzrqcK#`tjg@lB`+y_w;1u43yeU^;^z2>h`(J!B97;3I%FY%bfSL@mAj z4p(6fv^US!v+^r5Tb!NNWI#i8h#*F>Z+Hv%${!fdD%!5^vqRv3TlIxOthsT1(RK;_ zIw7Ym(|K(u6*Z@MyKi&&rxg9ipMtU}C!P2AVM?eTZ5#KQB@yV}s9~^;CAbd%?2v75 znY7*CNBargY_i3(yn7w3P$H{nJa}FJ8tc)z<7pW+zUM?X&qvnH^Hrk^9^?zUuAhJC z8)@wOEd@k5o&&#$xvYtP?8P5m$I`4a-=h{YbY9@R)fR_UW(qs;F`hPXS#LHyYIOVeUHl3GWCFPpnU$&$+&QF5~ZGf}@ z4As7G5un>i^Q&owS1(bo)V@jI;}8cM&Dxq4`&Lg%t5#Bp?@|%$+^GwxHETS2(CDxv zT#ddQcsYGDNLl({k0y_V)hs&w_|N5q_zDAa)mLamwG~n1^;0UiE=CCbWtFF#WC`e6 z^C3Pezbz6wcTqfzIH!*tPUGLV46=-MxU#(al(7t|=<;T@Jqbg%={tcKGn@s(Te@Gm zfo!$$y{gPgL|h>vBZlq_l}quKN=>EP1%hBiHOcOV>3pa8&~nl0|LnIt1b18;+$dZq#&f4toodZ|g7 zp&lXQ;c6U=8Ur@XC+I+OZq<+CbGzu`D|%d3w^ZGf@&NdeE z3pqw%BpIMn4EUhgKq+TA2ztl1{^qIF?EG#c7mM)Y*3x^2OAojwrkHoCfO-}q)>4je0klom6;g}SG8Nd zdbrm6Um=s%nD4_2)ztVzDQZutPIC$<* zR48+7?PhC0FN%vL5LXqgyJ+t1ycT1gbvdLMr%*qhVTxpGE!1HH-Br%P71h(qVBS7? zgrc!yM-vqK;f^Dgmkzu)g9t(}&SQ?4VA7s*jdP3Xh#sp5>d-@65`lP=8Jk+UO*Sq9Q zAhFux6epKBg8U1QWi&1o^`u$FLzJtFvU8G~US7qDaWty4cl^T3m87Vl$UXGSrtG?PC zx57;9y}%84dtEDj6mZJLUbE}v7+bTLajekda4D0*%hELQu4_+f{8z6yyW}`yt|BFg zf-*5>*6BZyh_F^bz8^iB|6|=X)pkB|jeM!w?jW2W5x*cxbnMC~d)(RFcThOls z@Ieo)(*bf@*-z7Hn}PPFSzm~+_l@v>S34TD}1=X+=Kf zdFlG?(V^bcLj>mbTVP?q@L>Fqj3z_T!GBnvhCI}>9$n7n578>YZxz5v8QG~Utrwn6wEgk} z=ks}ns%d&u8s#{k04)hypxeNNm&3TuxR3Q=N!L!|Q@hm(!IvROx`7WeXorDl@!1a2 zE|AJ)Mn$ea$bZMHG@1R@GyvsP!NYqSOzsLWntkuDfDQgdlY^Y*!Y-18ow<~n@~m5> zX=Zi^=Iv?c>-qg&SHK=$sljLY5yg|0p32a4seg_B(bIJIjQ!W|x>PV?8M>iHr8q|e z#ruT!H9I8YLdAbw1l08ZwK`Li%)XJJ53~C$yKu?%J1j7Im@h_AR3`tOC@M%F6ux1t z!fP6O<v7!$%!SlSYF=x1msBs zhwVX30c|ikBrU+lK_YrQhz4nIlFAY1IvWOwy|UlIJI&nS7DTfZ|4H^?kt4bGub~QF zcm!7L?&cb~eIAF;DgdNE!jLE$a>v}-JFYg&PG)>Pehq6h8c}0X!vgMv| zZ&+nDx6IINoGY1oXyrX%o*`L5GH+IvR7!7*rh6dqjsuQk?`F)(M6G(zAVSsLd!Guc zi|~DNTJuPQeM})<1n7JEPcvW>42S2G1v{&ziC~?O>&>^bZG!f47Obq}); zjvgu7eiZ&s_R1zIWpkWU4QK~?+I&9uFY)x9rUx@5=xMJgWEpL{tw+pVepAYcUbD~D z9{-5OM`CJ!F01%t+C%&J-B72D8Zy7u&W0ap_QK2_`bJ?0Z{d1y4`l)jYAKj!!IVpd zyFvwcGQYR+4TSAHn5g#NO8X2uB`zi=`5=m9Q{mk2PBYq@r)D}!peuB6LS?{WG4-%v zh*%5R;#^t=PzvLle>r)Tj!)N)GqNolmsZ{*!Y8bbK7Gqgc*I*s8=wS*rqKeC~1e0-j}m zZl|StL4T}{sei}8O+@b2@2?IKp0F+YNe)O!GRi<0@y0>hy)dq*I@{=KnwO8fi%L<3 znxw@mO$Y7yXr$RC+`HF6^SdiptC$y0C}%nILYKp3_{MOK7yq;vFBK-n*K%)6su1^Q zum>FstGvCs(W==C}&9G*E!y}fmBTrQr`S${R`0uxp50?x{W)YS((3rU~ahz zH^s}7$fVttQVwz%;<@Vb$98)K!N^O}ib75(`ck9102HYkygKb>b++NYl}TgU-WQu_ zUM4mfQYMYZY=h%`Q)mo1^W-1`W8}KKw*JjS@6^>W^%0X|bPf%~k%`|>q*vzKd8+Xe>k!F-cTayUY$X4%r4No&MMk+E!d%rrzbb_M ztl{a^AdLlZz5(Aab{Zd<`BsVHI!I(wQy2fdn`=_hYy5gh(^P6QWon6w(41GLTRWfUcD0{oOw?x^Ma_ zm_@tXp&X)JHtVSbcg}6t*HiWTx|!nA)kXMyu?Tf zs~fAZXjmP5YDOp?bEu_DMxk%R7wEEi@EAl4%0uDAB@fI5kkKCh6btm=6gb*S+EEPy zoS}UUMaIv0=4#6(*0o+x+G8cwgdl1}53sSsM+(w*SlHcwV5CBK@unU9*o#gPEqm@8 zbw=D2rP3}$$xhOa0EOBd5}XY2?fbPLjDlB<09w^ZIiO2-%Jr+UH;!Pw}0K1m|hQz6G28xgwW4&R>HwmC0jt33>~!b zmwy24iKfH6g|nZ#fBM5}ueQ*AOF!CY4XVugXT<1+Pxs81yU&cL%B$z+fD|@&;7EcH zyLWdT!p#El+QlV#uP$*Kprw*P@w;e&X}vn-u3kC;#?*3MJC<#LH8 z`T|3vf@dzf6I3n#;3AtOo@PYl1}>_OZqwbDtHI1rKe8GF5nB`dv4N@$P|5Uwm#9cP zEo9GmB2FOlMpF7gLs}s4(eH6-P1=W;kbS>y^x=_9a#-!Ca43g_j{(e87GK;H1j{_k z{3Y?Oxh3?ce}r!{Tc2L?BP{okKMOKrZL-2@z^qg|ui}0lqD+=(c>BFsEY16y{Yzse@RvvgPr}mpCSvg}#4A zp))T^ez!0G5{dIca^+?zWY==C=H`iRGA93!T>NxByV;>d-yujp80DLC)3vg! zLvG`(Au5@DmWPPrrZ$kX? z`Nfmu_U}oSitlH6tvQXHgrJCCgE-{iA!m=CR zSBOaPKgv8HLawrx92#NjShzoX4lp@X< z&7Y8#rRFN8Y@z~A3Z1tQd?2;n1lDrjsKuHw?l#iGpa26zfRFCZ4!uJ@bzyeJys!8C8ujk*~SI3 zT?#RFM!fl7tqRr1D{zEidpiFkIT(&8q7qahj~{8)eWYDD?^psd>M#8IOy2`xQ6^k$ zEW)!dxc-3+Bp9J;lfxj*YkX5Yn0Zg~NWl@q&v~mWdnd?CJZCvT`9Mf01_fk_-=4gJ z4VSQ7ivkZo>yJO@AQWEht6OlEpin3vc=9zwjha0E@j5_eprzRl$HeGPX9+e$wFP{L zD4%@?zy}{(tXd5x7^*1|Bhlg7ol?XvoNos)PKGq+22Fc>CUJnhQ^U5(=(w6#3jugN ze+p9^S^v-J0xJaxCP!tqV0`z3%YpMI zhYlgYn?65qIINyg8u{mc%VrX)Oh9rRppg5rt_k3td0eHe?${4LeEtMrwZBBNEl>LS zS^%a1LqNR0hcOyy{-sz)Q>aQ_0-nrtK_*MhlMUJ0TRl7VMuG{Pc-L*JQydg_G@(X? z{0!&4wn8sjLjHZ$)XXkIWR5PnNwL@(UO4MESk@m<2x=DsFcZco2m%2?Dqwin??>K2 zyEPChXsR1z5amJexo-j%0RdEB2;?W*fuE6Si-A%u&6-~h;kp`E=a?s^n1QNURF*Gjh}&vzj0=4f4^BIH#VM zFYAM9+52a5bo_g7*%#w8yoVc@fDLs2eq=3bzCK~*)4Bi#(KGs>WvS+lynKN6Lj*8j zgCLMw=erEHV!-@umK{*lp<+kUw~uYH0vO>w`w@Vko87oAfo)hkZ!ezL+EK-1`>dQi z^{4Yhg$lJL&c@^{;K3RL_*{;xtDcT2gR7m`RtO22EqrOc!ZQ+D0R43U8z-EJ$z^oW zBb=f^;$U(h6-mei)`nVs7_8D4H;*L0me{I2q<+&6yrE!N)|JWdPfn9X*3$#QbiIO^ z8JW5V$&xgyUncHvmi%{0>V)SH-S6#8P0peGP| zys=vIf@VL-=lY>CVtr}Alw-j#C6g1En|2h&Uwy88wgzX#w_*vgGmm+eKW30a6p%|H z1rih)ty6P#=<;rAvE9s;;t#A{=3oaP2nPdZ`sil}-%2-?dAGl}{QcDS@Q|SdhX}2{ zXD>qY!BDO)y-FyOzu3fc$m5KH*3P3~(}_IKCD*OE)YEU8@a5y1FXJHtS2EbW{9-wL zMvS1m?q->`<`OY4fszb`Y?v-j!73AT4T+II&;EdmMH26Q0}31|;T6sSN!(;g`R?z# z3Pu7(8e&tz=}{6y{WCD=ZQ#B<_zIA1z?qeJ$8tPT=rbd`ytgKuAEcoCeFE(e{;5%ro{{F7o}T9oMpQmHn!7HmG98MW zF@R?CmVgF`POUaT| zZ)Bs|`GsVqK^xw0GTx;Ccg1XaUy5(6%Oe{w!GE6r9k#+Lw&Hf$`cv_I;IoB3TX5`tXL6=!Te8?@RHaw+3`}_%f3j zc|EIJP(?{cAdpSz0EN{yOrN|i>o8Fmxi7ssR_Yd^i^|EIn;}X=y8?(pU-56?MBkN^ z%<+tyeJON!0)!-A^e}jaKuWo9?}LY(F@@RiOiI`wbl*ay@eF{}RGZ4ok30wVf63Sw zAwns!1&w#AwVv zGm7o#tqja64fq$g?Vw^RHmJ;%uuQhaP(y6^xE%VZe~^7sfyj^i2ylZS2=-U5ko%6- zqL5*`0s42~KRIL|SOpe?Ll4NOi1>fDvY)p#&JjhGyr^Y=pu z*JvrD5`jH66E`FwD&R%6y7NrjfaXqU$2jZz2T|H(+PtFm`{>H zZ)0Pj|0@TejLzI$Ntcr3^gRcGy9E6GtEp+s#y)FXu+C^4ii_uQ`p@GP*tF#G+|TF# zYp>!|e1VH5Whhz>!0OQC2!-bDNY~R_Vr`m`Z765{2mTX(+uVodOAhA zfCG2veym?0fi5RDDbOPbJXfMh?hn|di6JO9zliv|HQ`#=-LAEz0d@6iHcfOf&)3D0 zO`hTMOW!MfUOdDB$~GTyr096 zQ=+l_MN%Xctq+-cu(2G?M371~$r>0sfAl8(hcruOzgpA^hbM#iYKWtZv z2eJVp4DcADu4UL#I7u3Bi@9)v@Rtclw4Ujee_Xo_slyd2ohsi8S_nysv~Q>Xt3N>r z*zcnl5zCH(SJ9PZkReNvBbai*Gx}n^v$^6ezOIxgCk3{<0;=FEu}jPeX)}$Kwdf&GP+^PamjpSYp z7cf716p1+cB*@TPDfstCcNr|yc2Z~t~8p`F;2u852W4{6P99V!<-V+^aO_z!LLlL&+LMZDe`exzo z?lbqgV(0lW#RPo0uTHJkKWaHz1wOQ+m9$S zLZ#2XOL8oi*u}osE>hn%3P!i)-Piz$*zP*JYZ}sI*VLbCfAt^*usyd{mtUfmk@IGr zhNmxYt`uRyu+D_-mz`ytuhXX6M>KybzhaflhreOz^T#n!N~QTERS-*8pCD1-6#`mR ztn5=@C*?}j#E91y0s868x`|$yjCDBP7vb9nV>zCf8-!bX7VahEpcA0(Y%*%rT~xBu z)UkwQ!;S$i3Ab1 >|iV51c@9>GlG*lcETxjuwg8$aS#2x$i_nYp)xHCAO$A|9^ zS-lO|Ovn$w?79t(4R5+84Z z0=;V(n@0X_UXjcP3l6J0%t%tgNI#o+wVFo}kwNxtE&-5wNG>S}Y=_~&^P8`F7^QNY zfqfXIaJN(KJs1{9bC3iAOuT_Q)hoB-?Jw%2D- z1~ff8Px#x)GW!z!evY2p`c zqb{|C;Su6wU?wzsUw^N@G?aRUT5lA(F@Rzp!_mBAkl}gv@7>Y1V@H&k@I8}Lkxb831u{X&*-LSH{Q&begeD&QvON76p|gb&tD)G3uHMs)@m z?f&U8bF!0Z<~Dvhwfvk`Zd}?jqVVurqyAN-RQS|E6qOH2S zs&80m;6LAj`E+h=Ddz_wY+FAkhlvGqO}kg`cAmbPl~>I+%w?d@RbAp!)03)$xPrjb zPH}H%NH~N$IU90e*q8#1?`Hm2<_<@e2)^|i#BU5>x@VLsD1ebc=u9D4i~v6XbhScN z3c6Z_opIA(b+RdBfd!!y)_yX!7s$AGEA6qJx;G=A2mRtm73YZ@Y~*o9zF`uivo|r3 z@|jvWLxNxj@T`J^c{6JsxWhdZIk(|-KaH`FTr%<9f&zyfKj8OA{#J5O4>T$>XF;y2rLJGP{?j1BLKc zkByoIz{Io~%*kjf^`WoBeLO59Bu&5p!N)Rtg##Mn4oAs~TChne5xVv_* zC1fP_#z1Fe%unW1)n8L*&5D#-);Ue z5SkH~c1sRqT^6HoTP@pWfI|GKp_44?R5J=hWX6|e?5qdF*MbJDbAXkBxgmSo0|TC; z>iZG>cx$*rQSU%{a6L`hxWa`{Esa)jzRgxezOP1z=7W-nTbPIx&?L@>xbi%8sp`$U z{Wd<$TucVSY(h?YHb4uWd2Ip=8Za<&lzC?8=l%6sB>ma5DOWnU-hjnL#f(z`PRqOI z?!lA*FqjxxS+;OXQ2d^zhmNRtRD|M_E20;o@qGv80xAldE$+=wUo?#`W6b_>2JOdn zk~wmPSKeapK;DZ|{^@J+amk5Po^!N6qJ$YjZhYKczS|jNc4vwbiQz&@7!*Ud2eUp&qc`1+U(`~$n+UJ9 zfGf!SqjHj?DE@d1CjQWApWydBsZzh(jS{6(2|EhX2}iIkW4i9SevQq@mvRu(qagF&3!t8{iHVTTP;hpjlTqeo&6_{+n7E`q ztuiIM9YP{6bAiZv;U?rU1^y5@B4S3EK(L_SZd`b`qKF_frJZxxz&h(IBLo1AJ5RPqE4^&r)%)V+VCp99*-mEVx zvtawU4d4pflJ)R5)VTHSibnP>5ZLN|zIHiva|sp_vFUg+jCR+6TQ?Ju@1Fsw3xk!5 zI5^QnD62b!cBERD%Y^&UzKaKtI^nMkknh=KEdJLZ1@fEqfEQoSOLxp9SNGREWhWIu zlAl28Mqp1O~i6iej0(-+Isa0OWe=bzwx)8%K!^ ztI+L9wxmDJrFenjQui~RK#P}El~w4QMT#Qnkui$9oUa^5))7Lu+kw%@XfMB&7cV8P zm{kja(p7b5*)~kn-axxC(HW6@-dEQ3xFBv-;GFuMRdqrvWdU=x4^~j zFA%TTi?)fFvX}Sb#fwQZVc^CIB0DknK{OQJhnpuuAnVL?Y0^ziS`$Auz13GVaW&cM z8X4QqfQ_wWu24!m49f;L0aFWpy|)sDNJ4!&t4r!mU;t_wyAp0pEU3>nr$Wotjo`~d zfRFve_pN;y;-I01x{^ww5={e$`T)lQ_X&f0+Rhh3JXn8+24*=S#Su*MYczMT6IiqO z`?0m~C>I+AKQn)KSQD70HXidg9Q8&B0;!K*Mw8pI)Q3XWpo!W(oy}8)dI%PQz0WbL~vKiKm~#|W1NwJ1So)V>9N`PGC`SgTDFwF{mX2J_k-dk z|8$zwCEB9Ev;uzw^d5szxQ-7vQ~`RApj`YHsrvK1q2XL=kiQ^T(Qtl)8l0)na5gmv z_8V`~7kkz8mAySJS0oO~>qu)(hcz}1eNU3uUN8WS7uIkNm$1BK0Vafy&mBeLKoDo0 z{@LZbfV6^C0)(vYK#eGMpp@Gy5sT7W%Y>Cjk1^`hnNb257B#`>!*D2+sLx1lt~<|Y zZid*~fJKcv&nVb043@_8T?#KKMDkjUt=P<6c;bR2>|^5;KCCEO$RzNhG=*mr+JKvd z1v}e&&?_;en%5y+!P~q4#>Y5uVhf%iQdO@FrK&B z-gSc~!q>0O!UI)P-E1xuQDsI11X70elT6xfPsa<09yX>)%Xgnkz{{skpwi*1d3O4E zEF0sfH~Am9k{9QmuqJ`p6I}@%!L6A@LjhjksKP5Y{fOp>5>)Aki}q%+z05IfiKsNc zMYk9rGX)H3+&pfXd4BC$73P(?oGya9*qo7383)DpJn;I?CG>QQLojhq_uJ+OF)U3q z;~JHJJUwPLfQ=3`w{HAVrsjn0@ob8T0{l9#1W0#LhknlLHios5R`hYgfD}*u#4D`T zrlk%8;hK02CY-tCJ)f(Z^6(9Spi)WnCdbv?Y7lJSCM4Jd*j5%PNbczk@Ct*-p#|Pr z=dANZzG7=b)PUV5whrID|9i2m5s_5->UKL@1i{>@?Y@kdM~G}B&6DqPY68cD4=CiP z|IJR?OuFPN;ZZ)L${lFj?iMV~y}Q9`>Qw-DX$ejL@2z8x>Rrd4S@Px(kAv~u72?fe zN5iVt5hj`ap#KX82*ZW5F)#}X<;A{PemqmoIR$E98h0r{!Xwal!TPFABSLLBWi^-{ zkgrdVDA+H;JyCLgiC(j{5#S>)e(bAQ`n~!XhQOO_>F|k%y#b@&YAyMed1wv$0Q)>- z%APfGYcvR!ez<`^QU}(ZFeM`OL1F*4;@Ym3TP~_LkJQk_>y<6o4jfK?k|1Cefwx!e zpJl#w`zQ{}>afUzL$M6Gj|Iq`GyNK?%CtN_3wGg~S>!vH#c>dH}IX*F0w(J+NO99vQo(5v#@s9_9^wyim}K z!edf%AMHmo!49MbXrx5L{+|$vw_SXXFyLud zRbA914^I3Vk`s{NV5?oF#YfksSC}(I@Yti5+z#~FJ5G;SJr`-gr6 zcFU-E;aYMr5(wucM4R387!i9Vn7;;Uc;0b(s_ov%eXw#X%r)=Iz>V0~_gn@{UkCxU zzQF~I67+4W!+Dkb5yHSUs>cxbIT+g@{jg}jn=0ljB%*(}-K`F1Pi(=+%u{@b+Q4>$ zM75liOC70#uIq1E9Cc9WYvk^+s~$UY))hCo?Oi?B&w9I@m&3EiG{+*mpS}d`=EM}R zEXPH*rJ)Neszvlap2cx5jM6)rbBdP4E`9h(4VjlH3xVLsgFv3iot(?Ja_E^pQb}q* zZ~Q!HH5m~9M;Bx~6U(oFcYFinTFjS zx$Tc2Vx0B%5NA(qp}B*$Ap;|>QG7^D#PHt=kBS&@O#KKf zz#-~K#Jv!a2oe;Il9X+We$XHDgPa@e^$V@ubk{p+J^8X>gj&M6Y>M{YuTMbSyjvKt zSJL}sR@Q+Ap65c~IW+%1t01}-LpdU|^*HxGbs%MYn~N%(Q(~6MfgKDAjBf!b+WpF; z?hwq}kxZI#;fmm^J1l0K8ws>+ zknb44J37wgs?0|w=>#XGha9HofPBm>W}zA=mq4=Q$Hi`ucy5&QIGrBc-@$L}E%NS! z(wAfua#}*71!iEBRU-csyQ*bOYnySAfPU6`!XMsS{U3u4Bm}*PTu2EVh>*z@@9xcqxfXdsfyrl(r>VJ8+lKcc=Y8~q9^tI4<*kne$a=pXCsK^{=Jy4qle zJe=EoyN*lvb@M9e^u0+Y&Vn5@InhmkLz|zOUrcL7C!<<~3_JjDS102O?q<4%AgdXx{`8iGJ^ z>;lza%1_t*hswYgIoh%eZ|}4(pLQiwWV}+$@Y`Xv*gZ(NeHcD1+xX0}rWhJ`>W+>- zzVpw#dnJuaSKetJHXu9>l4SZ`o|rqnHog~L;GD#9W@5#N&G%;}tJPPH$d1#Lx72kF z><#BS&B3c7gnY+|r0LkiBd~xr9;Bc8q17tGsO3jaU|h`*Yg;$Hd*1n@8k5FUfCMrq z?LaxKoeh{aYFqB&oBrE)wht7oM06qN*e*-rq@C2_6y?i@X-k_f&x9>;JedS97wZG9 zL>kwMi86oZD!Lfi{so}p%e z)^2*9KKm9YcVSRKJ)`Ml$%@ovEQuKT?dXFN)M40>xNDa7OlKoPQb_s*Bd;2vH+XFT z8vrCz&x1v?884o#lWUk>hxMuByZ+33%xE}Kyd?f$#EdEPcp#Egc7IHafrOp2tjB?k zyg)f$p(6!hTsv$B%@iX^aFW_$G-!YJL7|oC+`_SH7E=jp9Z#PBf9c|yMM2tcd|Lw! zFrc>sc^^c?gBW!qyB7V#(>Xc7fTksjxKVB@`?N)A$=>37eqb;EYBBDaM+vss=5pVr zXivc@b!e_U`SR-oLj+bzz`I4#2PhHKqBwsxj}Kp2SO()gpWxbGbqOvco>+Wg!!|9t zbQ0pJT{(Qf21P@3&BmXLT)YLCmJ(usRMo(AkVtCeq6W`63gL@%5V)ZdO#7B#sdC2++&r$kInm$0V-5faR2$h#1#*N;9khqo} zP-{4JQuk|{OjQ(8;0V#LP;3Vl1c&_wFrA^YB@npSL%UI`9!G^5yz@z}`;tO(*Acm- zddkDUj5;xJw|Azx+L~527N4m`iGMk^65teF;B2{{MR7hgEQx>kdoF0H-HqmpYyQOx zz${?fkkLwVcR+%6B)>OFGk8w7b!zTjVZYW_pFD>EIvtRAxtHzsaMyIEaf0)-l>*$!O|CNw=?N$8z zLWn8g?uXn}XTO9LEcZ-$nF|w+XfCRX?HQRU5lq|+N_ht%IS{A(+Tht{;E#U>uVHNS z@31gs>E8by93CcPAQr~`7Wqnb0)Py5)NIA(MjS|5Kgd_gkIWX-^rb; zM2gcu>Ah1+D-=olb92cyZ$mo{N|LvJ5uu5C9xTF>Q0sH;eLla~o>$|ui{|nqMqV!f z&GssrQ_kMPStcMQ87cyq*hsS_kceESCjV$*nLi+AGYDmuZGAZD_Avn*^knHQp>55^ z6%mqxzlG8MY|iak7hIYT%)Y#BUefTK%KjXC$?tlD&4Q-c?_Pf&dgK$KDI)I9d)>Mv zXQ|^wE*X;G{z*y9+)VmFG<=gfe=LsQs+_%S?~`%FZ<>sQ+@Fo+lR(lZA#<3}SnkVM zGU5q7O=mEu2~eo;oo`=x67GmLNHz995k|j0_+cqMGCS-z{*CQ`PZhALZZz5}?mQXa z&8yEh{$fM1ze=vE8)*l|20|cthNx3a=UUUN1-vE?zzcbf|H0e%z|*gdx$0bpYW4|7@Z31d!M z1cXmQqj1u#wUBhpsEU7;^4h(k+X9(>HOjF�Bi0twrJJ$v2J z%f=jy+Fa8!#wME!l{F@%|IP`S)4xa1A4U+fUylGGN&n;Q+Jg4ZS@YE?GgmssE6Xeu z{&Xp1LU-j7AQHeo2xYV*XNU+6&No@%DQ#X|5}m~OqX9j{XFwEz{vqV=1o->7bMd3S zrVvcqVEZ-S-$o9z%m`gB7cUY%u3r+@2&8x}lZOz2mF0{rdzs!y&4;&I^9=Zcc?j_f z0q69Ua`)=l$(2m1UcuGo-2@`@2y*kL=ohRB?gGQb`3Bis%A~yy4BLxd+*BQCNp5X8 z*q9vQq%=KzJrao~U|hH@rEyu?K2!de7{+GiI17(UV{#DX!KNHK*J^evV^m-0l{?h6 zDfDYYVq|#OGnVfZfg^BAF5AHxfJcIEI56Yf)y$WY-tLJ3TRgBnV&ifaV|K+)n>=(= zUfa2Gs`hSyVQhl|DU@~GGzq(etd(>iCq-#;^GKp$??iQhmrTfC89l3PElD0Dt);LR z+JFky(ui@A3ouE!aUi6-hm>hYpu*aSLo-+)D%KO3+{#FaTI zABA*LtfyEwjDUu}E26k7#iD}~f~u+!E06aomDea{lMZbYi$v85ZUXOWh@TkX$!WiBLoHfZ&Q56lG<$lm9X3DEjg=Psdw$tJ+~h%vXBY*;NeCARhz5zg z>A}a0O*#c4*gUA|$P;WL%Z=+OY`Zr*oYLh2?ea2-8WOI_)L0Wt6FV_|; z<@9L=DVCE?5a_9gj&|niYhb4d%R1XvuX5-UJSR10n#^-4v2_JL&!-i>$DiPwMz}6w zKYyzh#BiK0Dn&qQWfR1-R5Rk901cLGjRm~9{4Ze5}(P3zBCWsGE z81%v`j1Nwe*V?of;XSBy1d?*%{^>W9@XqwvcyB_$SXO^N&eoABdRQ!qI0rJC-_vW^We2fs*i4VfM@-*UkmwB4_G`U*!A&5 zH`z$hnwceiabHzCxbpm+lCVn?mDIr)fiPS{U&=|cSZ?ODqoCBLsc^uN6^A~oX!e&Z zh|I1|AczllVNS!$ID2%5hA>ZN8Zi-Tt!T_xbR=0(pqRv=#0`d&s32{DK<@4#ry{Vc z?gb`D*_~6xbyb1QKt_pgT>y~UVOpoVA*n}`=D3Y&H-Lc@Uo{zU+?G|O7>6C#lg7Uz zdiOq*;DWRzX8sHB8i^y~iNQT$5P;eq^!iVew{f+4eZyKE-m0$l5(&{ML+DU7m*5aJ zw&xl)4#;$Z5{MAQ@6~ckZA=HF?D70`Q6JV79_Sg452IZs!4qG|MvmMl5={9z@gvA^ za>Q-Um&I96pAAD`xMFNGPn&Nd&LuD@F29`zxrYmc(7eCjI`SlIzrvkHSD_d{yW zHDobnr!geQ1TxhaBb#d+#w~SqFc^wX4JQnPChO587YwDMInZYzB?btEP{^1rqRphI zUO1|OvbUxd41VD407Q-Ni@T)%B^ee%W-Ww5Z!|oBTM~>&4*I`vC zF`f_vBn%0Am`v@M30C=|rM=Dd?bBXjKJ|xq)W}WSvEsA@Qtl(yg72Pk{wkm}E*NEj z*i-HhMOtPf@M=k=9P5c0zp@k}xFn?fHmA*erkcsk0C}G4(Ohd|&1|(6g}`GBGSuN+ zI91njdhG?Zdk;8&wy(Plrn>rQ?94=vmrK zW+v8UATW-(?sZy?W6KQaY^wlBmj)Pzf7KtNGzjiNJdVWjWH(dXZTyv~-V@oXDjum= zC5Hpm^EJwR^L>ol-hYb@uEU$lQq2ywEAy~a`*yV;$e<#^twUrtxe?u;hK;9%;@U4qovChB5Dn%9j?nWeBFh7C0r{tGFpdp<(tD+uZ@K{ zE_{JZWHY$=9$M{cA%jM-fKq(7Wu#!Akl)x``*3c0DHiY~b~C)*c~u zHjn?b;mlwG@1`HshW#x<*69<%ilShlO0(}6X+yM-@G2{|l;JY06k|Mq9`5q1PhzD3 zD`fsdU@IG%@(Qz&Kj&b4;x_z;%r`^iKNgOS2e2_(wmRYF{I86@4+;rya9kBDddV&%nHXFlmhT;Mw1Y@7&2|7blD!9| z^!WZHD|tUH@C?tN8fq>PU9*L za14B#k^nXoJj5gQEtay@=k~?LCOlbk$yV2HxC+9)G6n_VP2hDnWL+qhAx~15^6QQk z%4a(GKIfN_=NCWWMtN1ys8W6Tlh}XA>q3Y3Q46#KufssE09&R$&;H5oEQpK0Z(^p>v2FnIwbR<=?A!-pGENbWK4sf(+4*zyuZ-Wiy zDwBWhQ@)HkzxXkym-t%X+iw2V(SF27dppdqk(9NH83c^{9fowvjU*gWG4=;pssB5B z^M0`FfWH&c5Xj`>z#SeUnC*W)9)+M)XpgQ7o2lkcAw{eYy#~DL&kOs=V%CG6)*!%Q zHiM}YK`g0@pNIt@;8USFC*lNwBtE2%HoBjXik9o>KwVJF%rz=A;vI^@>MLE7xl{x4 z@4?!K4AhnMPMU)|tMzu1B==Ma?|cFgF9DPNxfT54&6#h*_g=BAt4CrEAR;JlWYyiJ ze8g#`gA&FKOo-0}6#n94ymFUmVHm38Zs7Y4pGwfaM4yom4tdS~ykU_m3uuA_YglI} zlkkmJn=|5jG2YBgf1TGb8nBiru`j7KLUfme7SKz@EaO&M>7P|_8H;BEJRcw$DDuoI3rUW zfEqx8nO!x=zp*}Dx0opLXbTr>uKg%scuVYHrzD6n1xo(Q;|pg&p2PnCXiq#pQrOAV z3M(|0z&3CmGJ3_bt$eEOfP@~|qbqN&q#||;n@z$#G89Be=je~TtD!h=G0&MqEjMw$ z0Ff!-n_Ny0hXIf#s1GD!DZ)diq{4dgl~$)v1xi{wz@dJ9KL!|4bdDaoUbl104DPSy zF_V{8vW-FHdmdm5_0zER>~vQ>J!-Doj8Nv~ek=o<6*y=$d!2p;RG)UHt=8KSMl|e& z;Ff@23i!T<0BN>Z(XJbAt={Da|pG$5$P2ySu0l-29cPn7nKS zpU;i*j!**!a8;3w2F9GK*Ep58A zhVOj-9D8U4l)&z<2Xt}|^uha4rKR4mg&nPv#2oUnGH#R8Ee2CoLg7z{c%gbC>4`bk zwI`p(#swjh82!hT`-`qEXzC0$cZc7+7;gVq>=F;i*?aGui#kDK@C0a~aR4_Twv?Bo z7|`8u7v)nI1QFyqg`Vsj@y%mc_`7{FvYcoXOOLMdETgtMU7k2p{wokPUvx(Nt|cdD zVQ_v*1xD5(WaT=~)PqR`%GXe`>Qel9R?LNSfU0i}59@~!UbBLt^=$S2;Hdja`j8w! zC{g#GBq%h^wx3yEtHh)RwZ$n$wags~#{(oqGPeJo-YZG0LNQ=*)2fa z6P9fB&ogeMUP$V&9GJ=E_v589#MFsUoBG?~_y2GsA}<=a@$jK^pT2s5xV-R_8SkYmw8rIBzYku7^Q_9=Z z(wiGZk(PP09t;Lm^D+MitfnVyMn7GQ>QAFZqz97|s31ehLzm)*l4g^i^)i;x=0weg z({-M~xxUZ6fdI1(*g2rhBid@B=l{}>JN|I$7@5?@Ko{6=^M>~&QnqbVTlWj2Z2a7@ zX0_~S1v76`blk@kOk~q868YbKJeOF;x_m1FyjB=h9L2=R6rJV&YkAQIfL6LH5UgMj zqJH1|(jTucevsyVS2j*tAeWoEUqx&9eOA)8lUcm4?O%E#_PIMYiVyWtxEQ})bG;p7 zp9=sq+}t`D&(juOk!A^u`y9sKp%kD-pXo{ADqNTHdr z!QuV|Dtm5yAmz;N`SNsyo%6A!RCTzT*G;rjKwElyI`SoK8evpzMxZ5t2h)ezT&@x_ zT;#CeSWQ#%!L_)SvGM(Hslo91{T5bW`{BLqEy)LS(SUh_QJu2%`2W{yIyXaY^5kmc zrxtzS{OZ=_dNXsntdcBatHRQ9alGE{j&%4?Yaal;VC8E^&d+ig;Ltj^E~88^WpJCp#Zkggm-1a7-EM>2k+o{_#A@Rg7X63E zopWvSJ-#%}dAPDW(7?S#uaqx7d`f2wj`Dv%Ovbazb$B4NrPZzE`E)5;{$}*(w(_8j zUjV%8?UHvg)ibZt09u#6t{A6nOlQB6G8vm@jwJHwOfJ(U{r&R4-pXfSbg}a{4l3*M zn~XVy{ zR>=A+f~qjotedlFc2-Zzjh?p=)GnnJxtPc?3N>to469_>5>S-PDME;IplW?jLQbkH zT2i-kKr~ysBbkm#cmQyf9bWN&a#ezg6=WyVhZ6s?V`&tO;vhz)El0*2j2Y*cEjN$O|`f_bWMzaLd?wCT$gJsDr;*}nmg#(2kReCFZ@_RO848iVBeT=;h zP|T7NMykG=*nkB&c`IkbUVeaufx(lC)yoZd-&rt2rQtIsZx#M)rF@;jPs{Lt3jrqj zx1B40e<%5MX7D9ZKVbnVgyGo3-wZ2b8t(4W!eTm~%N3Dtqx}6Hu{XV8zPIRTZO^ue zME=$im(Kn6tbcf;=~69N0;{PpaQ|xYvgVL##=mI=MV={%cO*`1s$~dJoa1JV{qSBC zerm}(l#hulqfj2vCd?9yQ5k1=L#{ZC#^RFxjLujGk`P3;Zckbg74-eNuJ;S9Hi^VP zuQ}f(4;-#CQ~JhEe<@ui6C#FDfey9jvoLH45URGuEfy$4r=ocJ#a)B@;CaK z5Vz{(vqe`BMB%Qv>}!^bjOdiZ6GQBTN|}Ip{qiFUrb-ETEnzM0v*8iVy{LKY31tYq z!bGM90zWXuN8N12B6I_vQ)im7*19$m+glZ{l-+-V4JRQ515NPYky23x!j(5&f?Uv; z6SsN5=fpD}+%!#PX7X4BkA^aVepg8Do(ASo$P(ve$D`BW9Q}`ms1Gz|`i^aY8?(I2 zd8WV=03EzyL5IkNN?z#C4kK+97h43|ZR*qfb}cvW^ri5G8VP+|+KfDO38BuaPr#h+ zLkABQE1{7;VE1BJt0LReWUYDGrsqA0FJq`oe!__Ta#z0g)$Y*QD!xA(!4KAju&ae9 zV(RtTyh)+R#gi*zvF68vqNqAhXMDkDs>7m7)e9`1$_`^~gtop|ZwCc72XT~swl8!Q zn!&sV#wLy2KXparaM8qB7G?Yh0=oUmod^RJx%4wkr>TSU9!h9Nf$|b7Ye*R7U>$Zc};Z9`z#CBu9-)wQzPcR=Y?_QY5Og~m`_g|ymUp|T$>DTHu6})7y3v5T|FOKB%Gc-d= zQ}14_sp~9}uFTO;#-?}LdqQDth=Wk^cN*QUcuRM=dIYI9PHtwPVe~}>yOy#5+>)b_ zr;st~P+TQh`vwc+V^-4IMScIWA4SbVdFT9iMzs*DYdw1X*%-t)zht=%MdJ8znWsiY zK3_+KBS<%lvmZCKkFOA(X(Xf^_3%Gu-<#!7bqdx;Z&@}<#U_TF3_mq7$*=epAv|0F zZ>0PVGWy`;gO5??EK*21A;KON9ak;`RYriJ+z5%r|50C4GmF(uMSR)0N;3DQ5Ijsn znO*BLlWKD3;_zry0>AsOu*ly%-WfO4ABSJPVHagtX`xI#dKy_%5c7n|y^Sr&G{!{t zKpa1{`HdHFOg4UU3DgU2449 z_UtDJhq>cpgCJJZ>uw?5rQtvO4qxL zG1F)g_9Jrc0iNFo0Q*9+l#>2612SpGY~rqipqK|N1c;(&h}*!= z3_$DWzkV=_GIjsb;GD@6_?^FE(7#NnG1OmX=7ZK7L>9Xex+P_)ru)7HDI}5OxQHPZ zpG^1HQ8{}V#sP+^bYWgV{DIi)O9`{NS&F})40@o&+H^|c_&oD+l68ksr=H-N?mBcc z$hT&_uiNb7^~+57lba{&GAQ=U)E)wd3nTsUzxD0=&z=Rl_FZQzhC!pe9X;97V zTpMO76L@_;$3lPq$N>d@-lsyCEP!gTHVU&0^WWjwz4*M!D!>}RP;5igSV>^XT=9}pZz-Quh8BjAGBBQJm_7WpLEXAQ_?~{v$;q(*tw2T zm0r!bV7LPKxw7N8l22?VzkXfK?5sjeqhUJ)~&m~`5ALaf*lty9QSc32?Ty-ylt3=a9=YX_0N@IpfH0vQP`u!iwFO}|Uq$ zZcnzI5o*+<$I)d45tblHy&3-SaeJpQz|W08e>US_U(*A4e?m6tkY*#{Lx%Z?(ej_{_(I<+>$5!}f zZTz1%_B;JgCV<10tvGIx!+@=BdrYwN-Ke6=UvJa zQ`Gh6qwh`HLKxt?1&lqBg3Up}IFrr{_?@6dyhy2su%He?WMCVMn)fbNdO~?p;B8gt ze<{JSqz`($es++%7u5_rYENVnCHPG)`1|fNzLGp~80zL?_b zZ-P%782Hb)_=$wIl8fl;F2GZgHJ`O|c3>1OA8_kh=A--q4(bmLm^e%N{^aT{7VcQieHINinEv zo0BPD@&=-sjV4epZ<8RKjIey1iMU>NJqMi|)!Ox0ciP9ylaCWuM;-?%%aodXeNdR8 zw+c|2?e2*;*ICfV+{=ZO?~T$HSW>|+1mWeo z6^mvkvntH%T90{tcU-s~Soh{8dsGH>vzE~^$4_oPylLh&j5vDqO27o6IGAigKqwoU zAWYnFE|vM==>4rkFrbbll^WpwW3A&$EmWVI54}s%R%Yk<42QhfGLSZy2^CURl81SQ zhA}3nIi%u&jgOGV?WC5WwC#kYf_A2ValXND2lSF~5=RT98V|0)Ot9$HtflyucMe;Dh;fn-3^T@g4Sx5?sJ`w8S%B9E?A(7>GDEKJ9FQ zKbaT6T66?5f0!g@WgRIe-G#2N3|BenmpSaA8)lYY@TqvX5M*rDl?pP=gjk>+J-fI& z>z9%GFn|17vzvKAtC=2b4GWXHpa-=m*!^J{oSaLg&u&&*B}r)%LHu7pqg02x6CsX% zWP>&wUbPw;k!KTkd|)}ph)pY<$p+1%dQUXa^^|?i*W8sdK$WvA7>fA(Bcoo=B6inh zMW#ec#rBN$IzQybqBzGp!g1>4vWoTQ1UC%kO!R_TG-#m+38fGC`*1iXy5UVR33jG= zFFd9RFT8Vvf7D_bL`2As&ohfSPi(ha|Jv9eLNKwCtPa&4XRN+=W%z3Ux4JLsr2rar z8@ayV_dpQ4w{g1V))GKtuOZKSZ!Wpr-&?qRyDxKLfoB>pOr+n+{v`?g z22zz{A%I*&$aDQiIFkUVRIL)0sheVkx^c;yoz_Nx-F+Q{dvaq<)+lE)52#6}eb!Ah z6<^IZNL16xR-4hi-pK_CWoa|og4*$AWSzO%SANd{E&WS%f4f5fQ{fXx9$uEwVE3B1g1SK3A_dA#n_Y;0uC_BGYS^+-h z2qKnN{D@$|1YIWmJmV@t;?EE6J+Y0}r`SbxmzAPMYRW+=^1~lBkAYn`kJKfLv+XQj zqpsW~>oUYe*mp_Cw@5AOge3m_LiuY5_N6lbOD=5ErT?f7Gr?i=2s?o2ZO3SmA&{3| zZ7NqmNXkPxyhE7ytYi(Uyjo-vbf6Wbd~o`W07RbR5Lkx$(k(G{70hI*_GZ3W%H^mm z#96}90D7B|d#vqn%o_<)06Ol9myehV!YyXC=&@CsfJT1G4{_|ehu`WHO*Da}5Q(XY zHcVBjL%lcsuxzTmIdVeDhK7_$1BJ#b%A&rmI>)?%t<64;K`hR@tXlDgV>WsDi0#K6 z{%rczQngLx#JKSH`+CIhxt1%<#$Wv{)|sVobmz7^|6Kd7v6srwuRY@#^x-j6M{{B@-W`?K3p)0TsK)CeSidcS* zqiyUp&O=-hywu8qE4_iZ1mVdsuD{0DiDK=Sl0zuj*@G@s$LV76?iq3uPUJp&qjeIV z?z(|-w0t<%D5TB^PS2g=EWB2Oo12cAXUZD>HRCTWnRAZu_Hn*U1{Wohj+w((3w!#ZAth1b0kP7KsfffKy8}pWMe@v8`25$?a>PB z`-%6#zDPYzYI%n5cYF#L?lXjS23pmCz{ibd8c2sVxL!?i-ZNLfg82~?GL+s>sRSH8 z76hN`AmYx*(U%rimM`})A9C7r^W^X&MCb4c;TN5NkG}x4%dG(P17HkjEvkk<@Mj7p zc;BKNyQHrUdO;lLWsLI8Zn*BQbbZEj=bF@%yZre z1%jyfXkQWlC}i6W4c`ynrDFld(ha&Q&A}Sz)k$SeUWO{^Ycm=9Y=e0JfiU!K@uh-| z{)wfB%M1{vemyRez|hu6W03!RamK(pay~TM<39mfbu;u*pI)RQ%uEAn)R8zFV#S@=Q!)0F>ad^h$5$W->xtM7?k<>I@^u}XW_hH0cVN9KVgaevA{37ATYmpUoY&sQN01pECl(ji)ZOy z*W#}&eza*uFR2w^l-R;(Y`p}K^-2bK13)i>RkX2f5Kou$ZqpyN(=NpeMWpJf{ZS%i zM2yutp_?*1#+d=}@mN}PY*`8fzwC(Os5p&*Eq>aM_jR8x|Duz$op5wXAqj@yw1j$F47hWlf{RR8UP|mh+9?!gQ`DIq|%y* z2#0KDcx(wRk6NE1xW@#Jx>+_XtuhrzP(|bCQ3$IswJ!c!2vWd)KDBmBFmNpvGQSk7 z1J=9U>{9F{minB4`TGd$jTlJ_@o!L*Ek2L&_21HT)^%Qd(=}usG#|pVuE z3F$Kx$w3!LuD}Iu^?iy4v9u!|4@dW}E+v*KyU9?{Q*&hc1B6J|j@>%A-A`j+@yTW8 z>FiJ5%Ys1A?t$H#raa5dTayd%yBHdXUcDAWxilbsaMClh&e5lnhR=v&^6ImcyF$=U zW|2VBhUxJ|fbuU0!7oFqfqc8>`q2>RBsfRWWWw2vtrbt%hYbFUlOL%wui*m5f8HNY zq$pTy0!ii(_g9jRB_<&fJ6A?*Gj{BrTT4;IwY2=uCqY0ilSSj7u`1|ik(&Xe{==%U zFB8o9?=6x0bCG=Sa#pg#sYm=;e}Gc932^R)2pcTqo^jQ))zjOCi8?7ELW%S&1#Mba z2fABX1iE?EYjvYzf5})G6Q_kGsLGP|DJ6rSo+Xk0x`!s#_KTuEyC!1n=`%hkGk-b3 z9>k!o2%;OkU#vR4`~QqXk&me63%qnr9I=(?oDN{)dh`h?&&@u1>%eL;VKoSH@8U}m zwEl*}H9L}Yr3>@;dN$)GLs7&7EwgU78;{DfnfG$`vFaoR43VQ*N3ocVUK?Q{1(JzE zl93pxMP`5gwAH&GZAV@<%+`>!QFPY;3CO*GuID#yR*g<)O8s+Cqfb~UeJStW|yTT z_P@&^8RRlshZgbLti+)fPU`?dAtjNvMYsdw=^#G2C{#_(KQXCJiIZrOdC~?6k6<$? z79hdN#JYAST5)mHasffHF99zdz zhk6-`Gp{4lf{t4AqK*To!^TDtMuAe@@WAk--P8-}9MT?|;=_X;%NGArU~Lp|>oP7A z;@*S(H5eXeZxo=%GL*MG0@e*KHJY${fc6;dFz3o5)cp0oop5i>t0`^vazeTx9fSt; z$>Y2J$a~6gvKH%dDi*Q<wp>g>syw-1Yv z47M@dt`$z0w<*OQovoWnyU^mL=kLJjx8qBkmL~nd9tfPS*3Kee+es#;1L9NgIRraicI{Q9@H=R#2|2)3=-Hiau-CIcLi3bOoJy~3w~IzU4R^eGVZMJWXQ`41Ggzsr)y zzxF}N--A02=bKZ>?{u8w_C(tD>}56bHuC(`zXxx6%{h7ZPLnEG zIEX+`sUn1tfv^X;Kw^Dt+{9za{{#<`N!;IppPPo+9?kzgLJsi{#11Z67I&RAyd_Am zOX~9??3-sI*;!>+hJDvDobY*DIfNZa^z_~i{MEk&N4AZQbh*|Ac&j3Adpl#tOHRUg z`x9zO3e@wlX5|t?^b0taNJ)zNRn#0b6`?6GokPP zl)Wws3{7w|Xe^iHEZlf?Hyn=sl*$em+?x_*)Tz)6a(U`fIaSF&w7wKv^!@`q>;6h{ zgGBRh7qT&%wP7d8!Kfw)YWadAo`&Ssf>c-;FNJ?7y}W5O!?=GPjlr-_-BSNzG7BMm z5b!^Nm;g3}5X)O%wlW!L^_lZdWqiEcc&@86#w*}a&6J3e-93|)=)_yRcb+plL}gu zwhH#x^-P|1p2}ERs{qc@W-HiI$+YOZ2AYY)I$ge-iI{Gi!A6%VLUQRXBWoGMbmDok z?fAu*Cghpu-v%W23^!24rDmpjVIjH0*tOrL&7-cnv4s|dm$lHr^0Y*tZh>Ro z-kt#}YwfuXWdyk)yeDkk$33i1r^dW)Imrk}Z=B0|@x>pF{0XagH}t#9Rgj|iqQQV) znrqkuD+m`&+@z?PE%e%U-u)*>fRX8g8{jtYJQk_S@=3og@B#>&r?YCL!Xr7Y2k07a zIi+9Wl>n~JSB~9O$Qtu~9b@~M1?}Doe+YMVU}abr4uMx0&vo>v6szANwGW_JP`4}i zMJUL8yUm4!rvL|2)&*xP5G^xd{8s2cAqd8Ut&P6Z&{{gzO$=D2M1f1&XRbJUN+#Z7 zw<(IQbe-OcSLjxK{;NR_gc0(fCdvt4M)|rHr9mYYE!4o`p zAJxKac4-qk47(jnE+=@?QIqs$T;@BIT0D+i%6~F%Yk6IrQta_R`EMJuT#{pu_(m=) z?RKW?BRLUlUK!ShLtr_RsZer_F4Qnn=oCpTk2Aqka^Y?MifvPI{6-kw@h2o9OPW$Q z2V7o0XcZGhF2#n1cxcJwo6Z`&Rp1R0LGcw!1_1(^4Qm{67lpsQAAAXgHHWqciUTd6 z%)%yVjdw4&k_FxGIKBZ$Zw>CB`2?CuS~C#p{IstR#!`-mAjzkI>Uq@ zLN8!9Ndxdcm@6FD%;PE&fni*3iwm|EXRNBislay9)dPuBI&+)vcnZD}Sj}s??G<_* z`XpgwJ4z?eA&4+>bw3AuKSuFCAE^fbTf-O>a=?c`Af+6$8n{AoNOO?bCkZloj6>BU zuDv3Bvu$HLK9as%4~@m=A}@zqUb7Ox%E5Ifco-4(i+d8|n#e@L*BP!#W-}$WcI5$L z-CC1+6oFHS?*<{Z(oGY$J2p52Kh9pbb^{*z1GX07xNwGobpi@vMB?7~Gx<9yy^i3b zBrp+TdB=bq;;(lf!9ISJPTy8UI4=2O^fO3Cm!|cT%Y1}5j~Hv*BZ5x?JX<&J=JiG* zJPGFgz?XMS?!fBLE-<|f2G_`7QYN1uxp#bF<>O*I!I1%4C;x->9~37>iv1Q#CGTa) zhuNnM{9+x|G>!ZLVMAIB>0%!lJ-r|_i?5A0s_rHulEplG`J3vUq_%Y#Z7hH6g7|pc z;c;w#Y#Wb@2W$FwgHQHFnF^#Zr}y6>_5eoNYpH{U+s-&tLzQoqT9qF6Suhkeq>FV#`)_E8K9!NF=k zo(Ge@sZn1uk5OD~v5N#Q$x+!Q(PV}@Si`LqkHSu5dDGMGp(cbZ z{RYsVAZD#>{GdLUaMPRhI?+ZbB!H-TdK?}RJ)vDMHxRYR`VPBAocXK*MhMYE{etC4 zI_N;^c<`pYIKC6-4luDEPD7wD0e%Z!AMvp;IC;#c!G0`EtBSAOT_p^Zol0eZv zAwD@1AS4YUW7(}O129Vmo&Tz2n4Q!csA=4Q-Gv8Gu$S*JW1ye-v{-($-|`DTjq;s; z$$sDxu6mQcJfKPzGw!UO8FlitM^&7ye$*8ADSt;YS*-6^^YW-BRI(h*O=F@=mB|BWsHCPS7pyt4bw{@{+| zu+e|mvcWZ6i)jM};K?#6nc}yM;m`J6@)cQ`_Lo_=p4OT#vp+x} zpJ;fnoNwke@9$dVPdFyrDG(Nl>1LJ?>_yoJ!~+Q~$yx<=2pfDK>qg@okmxx$J@%4< zZ5P~$mo;)Zx~96j z_dnoX{EZX$zjOo#8wVhmbkP?Rn5LgaiJDmZ)lBblpZhxT=DzM0tY{CiHm#rGIV= z?^i;62ulbB0`?R*@arrvdu7&>bdtIMf~BX5TM8SYjZTgYaCO5pw1GBB4Bk-^RK@Me zxuEmmKHJW|P7MuIH zD;?JUia63<4@(9p7R#&ER8p=c6h=P>1iyLz8OYlNq;sl$UIlp~E=NC#Ql5kN zUHRe>oNZ2p*Z>&QEUYWHsqFy?Rk6<>x2{a0k*_{QVx407Ter5~KQ3;KGtSNihg!z& zTLWF>x`fEFZ+c62J{ee>s;5^T2i+nE5QgDBEmOEH(idFk?7^G z3K+Q*+HIHI;*vffa!v;zYdg|%!+#mN*`CR@er)U4k6gQKM8(+TI1WUwVI@0xa{3v? zl#4%L+6X$4LoH{YcXdS^=r3ijNlMEXx>$bere_;QEdhJhR`jls?jxj=MOpR4oOs=c z<+%IAAQJ@0ZmEgBjE0r|l+fhbm}~>>+1bb`^cF(510D1% zs2a>mhC&1o8Lm4BFtOiy5E2D;sd$^n+>M9<;k`Avrr-wqz?*Gmi_@M^Kmi&^Vc2j4 zKtd#A#jW?`mGNz4pOqgjY|EIyVYT>S@9@u~HGii!*h_A0({PlbO7IRKgPsPJgE>i; z2@@P+{!W5S?6U!gc!8ZN&L%STP*zZXNv$A;N@cnDFa3Y^v~2CYZBpY4YS4vAF!RBk-w?3Vk^Ju=@4mE3+pj%mmV|POCDWV~_}lfG)!m#u zA_$H|@I#R60@$%82T37^6c5x*$uiKnt7Vx-5B6pr0inHN#c)p26~YD0Sia-X^73_{ zCJUUa3lEq=rd~q7?Ry98Vkb^bJg1n`bb^!Q&-@{7xKCmw&HWoN9w1*Vgv;?q#K=&L+N_px3$9CFX_&33E1KQ0sg}^4K(W45d^7k&#W&RUZ^{=Zj2gw z6E2iY$?>~dm0N+&#;Zz2Kf+qtFp#%oJ)MAt_%7}k4QrdggaeolL6b2p2h&>~YD@wO zTE=~jQ1i4b8WHRZwC)kucrqfj+9Aly*VbWUa~4ErG2t$;&>t*a*Xfrzq7}G!IAhb9 zdyI_&E7O`-NOH@YEW={D#TX=Qrcu9vK&;%iGX`kaD>~8B+~T|YN(|Dox)SxF$rE9% zLAwWBjax1LKuoH5vXCod(s_ zdpdK5acf5Vcp$$tcZK0PY&WyHntSB4gw`DPk6WwYpY35by^yYf0w!tg0m`_6q%{fg zQx>i9Ce9Q4bUWhK-CT{}P>jIdfK9g?S#c6?|#&qz#H7ji-K zaR(3(_vF~ws<~1KIFvjrBB+-{(2M~(qr8eoUs+ol0`$ebSN?2`qKcQyQ*WHb6hp@- zd_(+}gZo=9Hv-_F`kf~JYRi{@F{%ID8Gx*m5n!UB|Lpp{^F8SfMn4n3u*fN5XV#Lh zRYycWrgbtay6n17io|*eh9M8?MY~ETIS4XLZmhstP{2EvB}^>Ajt_|Nj93MYvlJpF&&V`n%7o z#9{=4n@@uNL#3S@dHeI$xyD;eSR2}d$`Y-dVlKC&4nE@l#jg^iX7RLx$jb2;kVSKY zXQoDR1as5NIQ`o=2G*XfztQhUw}WzEPLnpekcNDO7C&_dTAZvHPQ=Z^Q~bH@vcyP` zy|}MAUix__aHr`4Gmx}PKqNw~=594DBW^FkAA^0hI-esmS%ZTYj)kuz52*a{%$XX; z)N7B>UATT8XS6Cbxqb75=^Q9%^KF#5nxOE;V3~13-uug!f5DtVKt5!pevZj^?|d90 znOz7^l>cF!){ke1`hml~uouUg(>vSVS(_X1ih7k2gap`kYsIY^)*tWIJ(Z3)0~Z+N z9X!rGyZlpN+c4yawr!2SaogUFl5g)X%k3v~)Y>3af7oQtjk`du&74egE;AaRHU=@7 zY94F(KIY6Be#{C)!GmW&VQFpf+-U-Sd>hAYgC117JUdL&Xos;QhgkoF^M%(Sb{PcL%2Ve-wi;l*_A{cW`37 zC3)7}s=A1qc&-T)06WIBPa2ZiZ0K z>@BqYR%WU$_tQB#0gx7s@gez>KVkhv)J2C|o-br5RBrFq1BjuEz=QEU|JXKcxQUsQ zO&BoY2)=qUsGf)%TcvSRVZWi5etD8u+?7?uXTZG>W9veIW|T6^YK-LeZ?7_h6%Zfj z4%q*6pgJ^$y1t@i?g3la)k~9;lL#i#lv2{Rb%P>!z>B}RY+c=WDr}WaVrk#^vE1!< zkH`rH&H?^WEN!Gws68a9i-(B~<&sV^3-J|TeZ>>|jic*Eay4n;fzvyl4rCgye=9a` zWB@Dp8+(8x;|?)Uy+O>+gUvBl{LOKUsRRvvZj)6C18=ef4xdS1k`fgJWR}m;fzsunOXAsfpw7tp`RLVPh6{=_2N#Y zg$AU1JRJ&Kn)cs7ZD^Dsr3LB(WytIUmawyz8n&2r6Je@?ler(y-Tm$Ca$XM1#j|Tz@C$AV+)cp$#``81+GD42ae{3;a+Q_8H^SLl~HdlrS zb&*8%7p9PeNSfUsV|6$n7ITA7|D9C{`MQFoB_*eUJc`5({YtC%!!rOkm6;Z9nfm_J z)@|b)KyL^*2L0XZ$o;)9M*)FCXAf{gjQl;zAKdZ{$y=*0eeX!l`Ai@coScG?uZ=e1 zcpiCTTrG&Bzl9XV=NZ582ph`|ou-$4pXV0iQaAL|u#AX{N5cv^@hX7iGnZ92|zezeRSa+~j!6L39|3WJqLY+rg5yr}pmCEaZIKslC4dKc@?fZdMjijM6K&vF1C%r^uoL ze}2LvLEY!yj4$|R%v})1koCsC9A-3f@d^a2$~Db*g!-U6GMnRoX$)JAgh8a5*HMF| z=a_>pyn$3(FR1!CD^MF%oRRoD^%_eV%~C-@+g`;5e_(=lX4f9eYU8~G%H_=i+HDOk z4}vQA;^O^GAQwF9tDdb@o;S%M)X$mf-8sPljHZB~-`~81{EOVI_~Q1j{+fA0%xeB6 z`SJNm&}6~}%NP<*xrDTG6+TA;GF|^f@~-zzSBKzJ@*=5Z3Fo1zYPsjKW|ut?QvQ)- z0`d0Bm3ld;RwJvV_Y4sE+Pt@|rpB8PAj zC6V432=w{O<;HSf`V)t%9d;~>&Zm&e@k2= zX5ZDfu$&9TRKzvRGj(+JPp!UG4c7|rk zbMZUgwVYvur>gqpr^gx!A))|saxUDJb5zT~tAwMzfG?(E{*GNnHvKPb$s>ign^XWf zSN4Dp)UGO{s@2W7!tnwSglmjK3780pFoEV{1&ad~;laQsGT+!L#OKEs{SH4<#L0E> z6#+M)6Zgx{;5D^i#HFiOzJ5elnJ!q+YR};fwV2LAPlP7z%{L8Ow=oG=(xeJk%0Mez zCv!%Qu_C~TGy(oyx?z@UPyY3=fy3Nd-fajN2k^;fz5Y|s9dIHNl&Hf~9Kgi@bMlAL zE;nFguRq}}fF#8m8}w`oFDyNbBDnhGQduvXyu{>DNbeW$R7G_1aumcvh;b&!zB6qi z*ex2c!auG~&ZJDTmZ*c^k*Cwz zJGU>occm;CJz?y?MO_WpwQ}^|S%({1zTx!M&D`Zkgp?cepwb6q;DO*PoR_XOpYcc@ zyewJH zbater4}w+>7(iG$Rr=QR?K2811s9D z-?945Z!p8HivO+W69Ts4mitA3kXv#db(wEYCZj~Xf{Aa&q)nhSR*M!Qr9Uts|(3SpZZ{0YIkU z-3P~hPG5rmqZ3}bt@YGX*_pg_<7nj~7ZmjA8!cFHiS(2Z7P2>&$w^qe;_DkS;6K^d ztCqx&R6i2?;r8j4+>Dh^`DTkrZ!RLRc!rn=chVBs3|{g8e%O;FE@)u85C!;5{G{K=Np_n^JEIR zjNtQw~dHxU-(15{@wILVS_KVjG>3`PLrC9VEREa6sL8`^@r#t>oj`OnKzPUPp zkr+c*^#KCGVMq@{B(pYbjWy2QM*EAe3x-uGrXBv3R8419M(imf%#UvaJrc1c9X3zs z_>UF!iqIAsgWVo#Gj+@rdSqm_ms#Q-!+fErW)EbqO#-tx#mI%S=yF9+Cx4+S;=y{SusOI4^O!_{ z@U=lKN-Suy`6`4@7=~Akf48wEc?@MW_7%iR|F{uB)8+D;3|sfKGaD}aJxOluJxquy z&WagKRA>YQxb^9CDBcL{woC5hi&@X$UJxXwuQe>sa76gAuOJ*it>e*>!q8Y0?zbV_ zt`ei5IiNI~lUXFa9I?;+jAA)MhRSuUP52Bi&3NXTKD|PCx z9v(5)l0Rq{kuzxR-;hgV%p#4;Ic%Qupd5OfDD%J56(L@I8$B4qV>s&O*XpOgc0m+4 zvEa+|eWa-3px5OqpDph5X$a2kyVeNXnH&^(99Ib7S3)fxD^HMJxVUfPWP7r@2tSbm zFrlvY$++<|gU&KPC}3-zf_sK(qu2^?SUy3NewJkQZE6Xis6wAMYskeuYwj4;MTA|s zg*8=<&3sA(1*4`%bvUZeQjZ(LILm1BFxr--41qczB&)wd9Vy@7h+AF3EF+&JsGEFn?|pfJ=-F z!9FE1MB=LXzN6l&3p15$;LowCL8~L^2l~Y74P4{-_S}{?gG9`K_%_^97$Psei%fXr zpH&Bt!8zNNi)uI(x!g!cEk<}=cJy@nMbVazr#V@cLhxv1x7(Nn-w}fv_#C+S&+bYw zE{;BTVzfcDVe-GnP07L#!o%$DlHVy~fxAj-QA zT<&{)WI%ajyaT(96|ZVgF1pp`-gnu*vZ(+vX`@)qj%C<3x=%ZeR1{oll%4tSJh2IZL3H^pXqzSTCI}x5pfXY?Ble1S-w4t zjP1vteTnsO62L?)v(%r6U)Z@)>JQ_$g#kLkoCkcbDX^SLcR^zQ5vF@auLtq(YU~&i zxyxgP->&k|ZJijc?G=-uVr2MNczI-ugEM0q`#Q?<|7dS+4dOK7ZUXl)xB!AGbMw2+ z2JGnqvMo{(*31LuWKcsjeF_eeynhGqB{{_s1~ZHuUpXf+it>kzh0YW^rbk<@h*uM| zfX{U1HrRRLlO65pvVPrv43U%+s7v{@M&$y}8O(|7(iv}d)|`#0imQp77eVy=K?46h zPFM=NIZJ3eLQmTzmk}zoOx8xkVUQEcoAWkzdDK%PkGZGZ%M%CU+w# zR@Nf6Ma<2qlG%GfWC8W_i0LM}h+dHUrm(x|E(Kh}*JrUHgsJKjWN%sGD1Q)s^WwFE zu>)=^w(KeoRPT+FgRv2h4{K6X%wFH2m21VmGE*p=V zZNr!FMPA&){|yKd5`y7r8Z|Q~R)vJ(7%w@*=Q;ZaU{VDG0_PzUvAx$JEtzbjked20 zj!R-zd^AfSkuTg7js+5{0xUaNvnxrU_o)Y0fhef4n^Ih%yf4oRSKW>m*_k8NTB!~g zS&4;y#ccIh*Q}XN865=TDlfLpOzd)B;oDXos@*F!&1s1ibolYPf=4N?R1B{;2(n{2 z!+w@8YTRMlN5-d>a0!q=T#8~gbbu;lv8yw_q#u7=q#j&wl=FG_A(6nU*Y!1yG08o_ z$&`#lLl4nK-q*GmfdeH{o9EAgN_K;-z0mXpT|L*zl_RJeY|_&yjtPf7v<;>vR4Txp z@6LHKlt+MpODjCgjX>zZnUF%;?how6VcN|>r(!ggNcP%^y9vaZ1cwqc^6u-c+C32L zzHElHesrtVjcb1IYw`EU-jPp7cH+kJeySkF^(r^H)Q?i72aSJV0U0CJ5`)0+4WXH0 zvAleVsOrFmN^2{dI4ossR;P2gDKCM4jIp9Y92$ML3cDIz{5G>scNdqVtIC9Mh?<~* zGe|NXo31A1zduukKRO8B{&sHdMITxhVFIDNFJPUVbnCFUOiwwlzBvu~20%N>QbhV{ zZ(>l?H0`vv)Rb^D+4qi*a$VCl-*qM0aP?PM!zxxVh6yZT7F!V*49KkLF$Awx%2Nso zz3iOSsyzxjl(s_I(cQH)-i`D$_y&!OE6^_6nv-z|cYo{8$YXB(ANcBGQ+au4g9la` z{}{1O6)#}){wu9p26W{BsL}N9h8Addj`B-k#U6%DqG`1t{%z(G&%}gq@+6(XwI)*U% zuRq;F8JAgD=w!|gX0SV2p?CSoynK#)~mSk~h>UL+KBsE4vNXjUNIV4xx@oiBl-hQszYau^J zPhO|Qa$WgTJcLg#-jTuTZyqzeucuMWnhvWGC?}ng##rR-WSegCd1y;@NjG@Sv-cR^ zpnTt}e36ooQh@(^sL>ili~2m)h#3wd!sDgs%}_^i!EtgI>X-04M*$Lu-~!eJFqi<5 zrS)x{6gip6cW&a}{Amlblz)`(jSi)nzXTF_KCl--g5P8(9kN7g#A_0ej$Qxz%jJl? z^*)US?mTED^aSIBCrIyHfGQ+fuJ1c+0G6O3nUcvSsVp^FuygNHmJ#D*`KWBorq?5K zDJe7BIWY9$;isX@>-y2)NoW;ZHXGz}si9w=9rX~UU846cgwuM!_U6wsUv-@)k=_e= zcc2$frep*W3{{&E2N5c;9uklsQvyI7x4M{#Lh5N3r}HO2aM^EHKcL8%_Bs{Gmi@!S zg+6BRXMuc%riFjCDJOy(_m_$BmCWzXD*rlNk*#roESG=t^^C=GLd5UFP(KOu#+F*+ zl7eSPfP$xQVIo4$nEnn%CM!8woXO3=fM%@rs`=-no-5?hc5WI|QXQ!P(7r2~>09)i zFfK)dAXl!f32On=vODkL#HPhOqW*Tull2Nghch_sLA?h0AmYl3Z(0rNDWT!kZay=L zDT-pQlWOE4>WV$$k0|mH3G*e_n+~J11|1OP4qRlhpy;#aXJTP+1w|~b(}9@-E<3>+ zggkQU0y)%;b3R^R>Zg#`$@)EzD=r6hSqd`$r7bUu#Za?>Ojz$p*KTm-Iv7+f6*9;| zS-cXF-`N|hz}&)ICX*A+z!LJH{ZM?J4U*k@>YJ0A!#qF3fa7k!aTNP)8|PIbS1CJN zyl7JKRMp=I{PG9J`C3;EOPgR04)Ua5NgYpOFujkT%9F0v-* zGXw*NM;`SFd{e6WKWQ`54$8OkFMt2kat*$9duoOSF#g4>N~)8-@@PEbJuSpnQjRg0 zP=j2l^~QcopxYuntD5JR4xp>2aw@t5-)a$JAqHb#?&Md{RISFwKX%<}qbJTJ&MfT0 zbDGHvn2WCt*X66>gQJJLBR6<|7)UabYz)#%gPD&$BnUtCK`@l;%I!90H}XEqsh??| znC>=1dE9&vOud%c3hlgxs$=NHZdUui23XWhj%9G7_*aj`lyxvM(+ht(@7h|H%p_%t z9?lHsr52RDm<4v!Lv8Ipcd2a$tqt1)FlenWu!<406LNgcH~! ziIfLwrvxvi9jo7B`mZT>c_m3Vh5~3AWMTGWB0ZwxraMAVKTKdE+6Ov-9SMp6l5#0y zU6F>XM^684e4huZl=Zpl%GV~mF@khKm04i!S~k>Qb_3mP=tW?P6ot~0J6tv0tmcBZ zQI;)OfkK6cwRd(wZ!4}+jhk0S&h0~>sj1}e!C3L;1%Ms^z_p#M%sFnSj85i~i>ET- zoA^V2w61ZB@}WuvBwIpJ|C`}uSntBSM)sDP8tK&(Qvl4N9m=YnL!a8O&Bx&~UQ8j` zwoHW~_Sj&m++Y--1}e{>O3}S^x(p(zlx+%#7`z-ox9!)!7qP6~g`rWp=rq?A^7465 z#*WzCoh92$mb!7vH#cn@j1Bsh@+Hk*9K!E}*Onx-iI;$tAFD4o^MEmR@gHJ7dwyGP zLCs59OPSoILkKn4{ffE?wID{g7(Q!HITJieF0^1s=d9WOVO2UXtk%oeQ6`7mcke-J zYO_g31_9b2?-sytpILRI?-G&@g`q`1jS2pJY_1mAKyc1daK@T}=|hndd9B&H)(Zx$ z%AfM{zhSd%98lpd>b}O}_oq+&z?oFtRapHdJuGyHjQTK%{T%$u+U5WT;9v;l0XD-@ zdjPHKKHxUfYc~$C!-o?%ZAA38QyUV8ce+bHEQ8b!;CN!}a5y>?foYnSJ@&VM)Rd!aV`n+ku<4|p}fs_gLdI&MPb1fsl-Td z?Y5{sNMI*pj8`li@Giw6cIlq zMmxz2BO0urF)rp}(|7v$1yb)5pbebFS}$8%q{ydD0$FgsTsQ{WG8q~84g;5v7?sPEVK?ZmqvjZ{Z9bfq(`z2BT#lby(BX%c5fQdXt;iKOGH|=Qow*y~P5!bf9 znW;fwNcjnIo58}i4m>F0_u1DXE!jhP3+JZ341Wh-pY|NE;F*Esm}7pRuOnw>hHx_Z zgvgu&54#ie5 z@(&$=?)4pNe79qNj!9wj#!0PdETbRgS4zFS`Q@({dq2JhgZz=OIi_oHAa1z`#yMDt z3hGhto`5ft#clsK1yqXHh`QFpp#&A{SEz_pr*E_ww{2*Ebq7>_&{anvs0JrZ%4HEj z=MnHy50Zrm`lCKt`xTjs)I80%i!8?$&cc}Ux_2Nz`P{H`M7%Qj^SVc5fl*1=B(MSa z1{ChVI?-k**F~(j2q|cVP`ad2z79S94kWC5H%$A+1p&Qk8aBQJ9*3ruc@hw%K%Ip^-grYP?jc+}T#1%lx2eRv@T46-${gC-k)WOB+p#mruE+EH(WYQJ{^J$p}LVsu3DvY zF?+g=);{;UHbh}VN-DFrKjABP{RXp}<3FM@Uqnx$M8NW~zAgD0Jzyu&m-V7gT} zo2FQV)m1e+J>a&YT>>f!eC1xmp8#P(zN_R2Elm;&fV>M&2{<#~WDjaIKw6*on07}X z2`gB98mo?-j>zUL7qJO`d09qDimK8 z!O4IdP9cbbRbW7K6d}O+0XEOxf04BuWckfIO)2=qvpDABza?k*+>%lR?O^49lsH%f2QH7+3JAT3cvP} zw|RZNOk=E&mY=9AO=+9;2b4CqG=Q24*(fdv)XU&jfF%?6ZJU|A>t5ea0KM6K3~Vq0 z89sGgC`0!cP=7)tEsn25FG#xr1Jk2`*+txwR`=f8e7Mfzy4zG9stTAnVA++6F0MQ^ zkF{J%4Iu^eT16%N1-^P|LyU&RGWqJh>SSmh<^C)eSg5FO9u7)AZUh{PV{HdmzB(Bo z+pC{^7T=$BQD0^`btH0rs{uPnr-ZPC=%z<3d8=X^ngmtZP-Nr9`N}BAAzpju4*cYEb--s9DIU~ulTNmZWJ*T`%4m2!q<+95Sw1R7c_26u658A znUoms9VRNRa-Nzw(tB|M-^aw_W}{Z7d74S=8yS^SuHX&S({G&5**GP!w28rhubzR& zX3IlfEBtnsMw-1*mT=7H`I!|>?;>7ct)lCC%Sp+{d%>Z2#&($HyLJ+|y?WzWe0R=S zzk17wtG%;|fM9ek4q#(W1h#)T2jd1t1j?aINY_3AOsl*$>J+D-DNv2)a$fX@GumfiS`r3=a4I46Z7-v zyp7P-df#JdBwkBW3UWqBGQ`?1_R}#8uCCK`MkXfW$BNqACc@Jy7VJ$bV41;da&DHs zwP3{;d;_naY9$q3f?z2EYHYFE;>tN6ZVY;?*wR+={!b?s?Z`m5OC7BGbF5`yfVUK^ zCR!YVb}5H=vcWmh*>k?@e@e{(iQBWe&CHh0HzvNfeUt-8^#I3QfA|Svu-0Z7qYg}- zH{Sa;@OJ8n0%#&t`Jk`NPsjjHqT*Z(+w$?0x$jgQ z7!#wWf^~q`CSSRJw3JzzaO*oaVux04a4b zeGL;r+)LdI18QByIF`*Bc)-4bYnfxtUvZ%L8fu*_b)Y3cHHy0kbOjJ^fRlR;FV5Jt z6`|z#;uvRtu!t2tpVtQlajPqW&P=8rhDrOr{Cd>=5WytLlOA~-8Cy(JPcM??nyUzY z&JS?<^y13bto0zvpNU@tY?n6$1O`P zyzcj>;rTe=e+zn?k0bE!ob~zCg%zW?% zL&RsG5Bfz5v*N6x3<*V$E#7Gb={`8|^WocR4Opu{P)`iM8VF|dJu9VT)v8jIiP;`C zxHxkuMN(Q!XX1UAlpH~W_UC8ax#fPp)C+cfSqinA?0|$Ym5_RJ(RfhpAF;ysphWi4 zqCID9sx+IT3={+%-D^0b8AYIfpg{ljj%gxudtWBG$s6 z|8&n!AbZqC>6jPGDHbO)8&?!6aQ_v10Z3NF>%YG2_l^)?EPm=biyrS&<)1)geY$7l z<1D6En(4lW=vV)WScW=YnD0I+MZ5-WqnqBJ98+W zbscf)C+A+dGUusFtK1Jg+pE!X{Mz8+#$}0qaEhG#h(N>w;E@Bq`&*!q;GIOeBz4ao zk`I*a8NUJOf2QN9nd%;BqP;j0(S;lGdzR-mi17w)Z6+p%y7Zr;YMT2Mo*$W>A3-u9 zBN$+qNyJUSWLC|#mj2STx4&n#x2=N%N3z^1xg?e||Mi>Jh~GpIy)@+TJHTWv{?y*5 zh@5H)!TbfKQBE};o_fq`fREVDq1!B*!sQ3x*jh+t#f_!Rq5=&F{Q)wR2(PGNE5%1eqWKFlN-6%j(l2i(Fa7hvMO}hNitDpdGbq z&*L(w-PgLeF4Xj*tCU5MWgwi1QY$tYeribMEg6t85Fqu^pMlH+ZQB`-tocvp{6xM# zJ6wFbNHfBSep|R_s7ufJ-Kg-MUQ5mG#zAX7NbA`X*`k8S3R*#NC`=x8WHjw<*GSzd zaCI_2l}x6Apd1O`Z?b8+++5@LJSSO<};Hn*2X8okli zRCLd*oLQqc41sQJMCg;B)!S>Y?kP7}zVMcOUdFJK-h{@8dP80zP@4f_X0Kw3<@ zFwa9oE`#7a+$W)5rCW{YPxipLqTk9=th|&LQfT$2V1L+Z`#5lU!EHX*;Cj#9|A50l z*G9`fhwJP)4JK(HyAljS9c}|*8s*LYA3O71Y2qhCKYEx6`;n-taL^hlZ4CDB3z=IY zjsJ7LK6nS{t-|8Y6MO%S!2x9;{v;SC8Gt(HW8qjqJo%x?HWI^!Q=h?KF9S_RP z+&z}6<=21m>Z@bJB6J+^2F{d_$8cQqHPYYq${T;Y8knS^pq+XG?(kn*)cDYYj2N%J zLVJm}yKT)*R2!7aNfoxx%pTb56By;;U;Pw<}oDj11y14vv$98q-7uj|)Wm zQ>g=0^COk2>?jEsxm(J!)l`J4mTjvi-bB6 zxR_}y`ID}BivgV)WDwLV)zYFQ*FpV}UJdC{XA4?LZVW^m*v~<)1(y8LdcfP({4GDj z=Gz!MWw#3#j>dMLON?2Qpe$QZIJAAe9E^uBxDf=%_nq^uIt9~K6OZg2#5@LmLkQv* zFQpUdR5DHJCwggjMtrWJN^{VUfFG@c|C!B0vIij0p+AcWX0{6czYOL@zs7n5j=F~m zZ-3?gPWe>~cJKjhJh1IYXxuN3p!MC&c!^jD9u+fu<_}JnASD_iYtXk&_}#!43qD=> zXn4bX*jvNLf5R6{m$Z=Juy+_5j`iHwwRERDxP4G|T5lx3&1(E&r$2ZR#bXF8<=RG8 zq1pO1W^oSv?RJMuSFdTu;uA24g7y#r2zs26yWUZ&{3$m$7X0)HFvU0>e z|C-e9QX!RJ2SC)A1o-3-Iva)-UO5t@8ijIvH&;8uEPO7&un-ukys-XVye`B zeB3H7{ePKr))jQyaFW#~U!_>=fMl(@iKYYKodl>P{8KF&k9{y0IJi)4>k-?r^9g{; zq5Cc@S_}=v-ap!`bD*I&zz@S0j`YQKU%Py->HR+evHSJ0jJ6q_pKp7sooYP91I_uT zN8;%2xza+NS*VOHg>@W~REF;p^B)9_`t~_~JV#J@)aCMF-jd@C1r542eQnqk3MI)_ zQMy!Clg43xx+dZZ#7gJ#uRrj!E(K{Sb0)*m417u~$)fiNpUXIjfe!1i$>_)BU z*s0ne$QzmNNp{($@MzKM3`_L)QT>?tR~+JNuLdZ|-pA96pY1k3_nWgrNIg}Vru@k_ z11F}FhN;etG+~Jkfs!3cxhCsK*|8-ZPDUMDqsEuQ4a&@X6~1rpo}gIlF#r>0s<#TW-e-Zmu3>KdNkIVeAG{<&6!k&>w}5$c=kGvu17l&=#hh*3>^C8C z8z^wpSC1NCY-6g_M3qBbFYAw|SrX%h7CQd7x$uE8pEt84z^iw;>@gI#KXgcFxghGV z`rG_2G}#qbmNwsI4rO9j>wC;$3G3+F z581#4gRt*IRD#^8@`vOc5UnK2HLzt^x3IOjcPNfYSL?<=-W~Hwqqps}&VUCPSp5b) z(M`LNENC2@*|_=xdLX4AC)QB)83xCBD-Xvcbx7hwj!sx@gK44gmQCuN1(BeKBp}>z zPL{Rmwz5LO zMTp*Ks61`MZVQ&zjVws+QLg<-eA`)^RbYr3I%@~aFm4d7fw~_$>=IOF<1;B?-LLx= zs*Puw>Fm<~7dTsdVc#w93{FU=?9*V>&8n}`N@iacj*s8R*`J-AscG+E6c?~{JCqZy z@R-q?qTHJvlZo7|Y!--C5T!S{kP8BC*4fg#N4d>Pn&`bvq=tdMrKw?Wv5L&jF^rJ* z3^>@Zjw#!?aVJq&___^RMn6;TyZ@o1c2Q<{iHjKPOA8wTgP5<@SL&J6%6}I*hXuc; zi=>exXDs5Jne5Z_sIWOWP57TxWyNYs+1S}SJGYY4X)D~-@)6&BD%Zu0JBfm&1jFMl zk(T4jZKM;#TzLDWJHx4P9t_YwPxS)MDYwt^kfQeQZ``Im-M8FGo?zn$%U-9e*Z7IU zT&=9+ayJ?G#Xb2mZ-ZxA$`m|WDaVRx#bO>ijUXF%Ya6_Q&@y;)M zdM>e0ymZ&oo*ub-Y3fcOgVw$M)zs^uDJ1x~?4Rv_!QnpV>;v~*PjZAoJ!DBCt^gIL zZJN9Dh&P&N_zyijcNUU~wZL|bTaUMGU2o4r52p%Z3!rvQp!e@bW#*={8EXhE9mHF4TG2A1}R9)7Ek+ z&CVdqI-&Ykak!Ie_Vi#Z>p8n(!EJ-cT$$HHr8vOHp8wH0(_S0v0e4jP+G!@vywwaB z^m%oR1X2-j?Xu{30yc<@l|Wt3F8jBK6X6UHC_negVUwz^r{|}%abP1>FL;H{>+ZQ} zv8aHnnW-yskxtWLg&BHi?Bz!~ZMO+)<#<`W;y6Q~fh^GEU&p6rkv!ofyo(f75$njS zdCQ6jyA4LkSAZh-H^jD*Iq+I1ux>yV3SN+p8rQ5@8OyzsIVGbbTF*s!?EMo`5vgm+ z%_zBw?(>~+voT(m_J+$tI|(?xS6IBT3A4k`2K51{I zb#bv#X(e}duyJbLbOSj=@i!<31#EZwm=E1Bsskp)3eE)-ja2js8#1lV?v* zuJqP%e(D4~Ybu6Z%D>Dk4XFqypNy6L-ovT_PB`*r006sz?#jlO%y@>MR$iu5I;i^= z_H|%icx&ag{8&9Gh zp@~PnyM11{UMK)}%4Cs+h)}V&X~02=2`6U5f@`;c7tY)50=}->f@dZYt)XNRmyD2J?F95?q5H(Ga?lk-*w<%eNHpHI=^_vh<27XSkz zMQXIyzyOOrYlk~F%4&ED21q6ed=@g{PwL&VHd^Z`^eImYWnzixO6{#NB|^B+n*Nrdc?0`Dy*=Z|{2z>9Fa4+$0y6(=*SGO4R>aZTuD3?N1*u zyyF4bPKbe&{pmn7y`8SEDerpo&DkkUOYea+!!E!bL0P4bpR?G)nXj-O*^e4Ps&Hi1!cvz6T5KL;hF-G zry(y8^no!k3dp-jCh0Zxw^2ipe-h5J^)txQ4Bk_>^4Z``E`pP<|#Mf z!n#GIr*u0B)WTw{sF2}oG`;5bCBRH-pxCQ-AnKn6s)Mr#aXq<=1<+4zdZul7PAW1K zR{}N%nd^}9;P>4sDjYf|IpbrlU2%f%*z!xZJoue&rq1qo;Kv9Ye^$WPTeQgAG^VT=sKD(Dq`1DEekMod-3}$vO-UR@h2joG(waF(SoBVmjl7e9`j?UT9d#)Y)ke2u^#!VkK9%Jn-ekaGX~i2oCNI49XI2NYlR ziSZeIBS!r70bnTfsdU+CqiLGH{i=v7!qhAOv4^vO_~jA(9N}K~+Wm61v#2r+NI(L| zT^b2c$RSv0S437Lwi!TtBPoLRCifo+68zoD`JNSNmJ^MwhIn91ud8DPCP`{P6G>MA z?i$4o-dVoTy&MqUcR*5A23a$GyU}Zr1m7hAkj{bk%>;4rK7UHzozn6a`}joyh?&eBW5Yi}`Yxe!@QTfR98BoW^p$w#( zMvX4$>+C`J=c(_ROu>JnN%WAhohY=6+TE(s(Ej}$YzMFU3L>~q6KEi_w3zp0sO#$1 zF9>3*(K(TRt#0w%E4Uk2#{lS1-4E=`5L`j1bHSBWKm6B!>%UMm+MKT$`Ck-q3wX+a zBs?Km3e?JL5P@s#=T7gb6w5`ikLTjNE^1*dcKT$q1qB#?Yvev6iA+d_yLpoB<-{wI z&@)#Tv}QO~h&tW}GXn6pk8lv)2qSI=ipi`CfT+ngZClCt!U69EFkZZ2Lon)#uL`jI zU_DVw0td1$q6^3_tw_irb}R6-dIea@OucWF%=%{kIrXEo0vCfM*XD9hd@uZ~*S4^+ z@88vUd9bKIwyScpiU|h}9G+u6Dy~|V2S6^&1Q9v|*xOG%^D^t0M|PPT0U!+$!6x-ZqNH#GkUX2kGiJ6V4`nTki~3@{V&BBu zrh_P|0wpH2M=K`DLH+c54{<)w2X>*+FkMn8W`Fg`LT!O9g>o=7gVi5auGCY>lnSSb z?I3#@yqxXo9t^-ALtdrJmW!tP;vAL=&ibXr2gP6zB$?0~(EV%G{wOQO7mWdn8#Xyc z?ZqQCx7-q|t3C_5i4E`y#pZ->U-l=McQ^j$OFSoVTp#7oAOKqMw%^^L%<7iRiacYboD#jv79Tqv$M*s~=;Cz}D@~Q+mFBFwHllxu`w_a`~E#YV4 z2$fW~%>3JcJF2_kZv^4J4-#vcs&Ab1oBJj}vEvu!CM^PrTZo${P>1c~PB&W;!db0! z2vS@H&WHckf8)#|g`!5HNZHLA$@Ev{N^)zLjDf7-pHQG$=`UB=kItt3qe##SHxwRS z*E(j5HovHX2?M8K{1SBH`nmcKD&~6GhN_)vGP?uhhxIVCwt}8oSXcuG$rqMo3Bq;yK->uM+WnnGqI zz~X)?9+T5%!Gn;dg{5FyvpD4sT0M0g<5U$2ut~i|ixf(gOf6OChplkcZz&SJyU~*4 zO%IifrH@lThU~P|=Nqk|(b_)JoqfURSA8_v(?`FNuZ_XsdXAkm#=85k)c0Z3+B^(S zeeX!xE{brRBxWCiqufb-%t1<94%O8o3h-b_o*s46P5W1Qu)$(Y&Q)S8 zH>BkwIjlYNk>79S$5pMFakVD(XuhzK1G zr~?v+ph9{P0q}=GTtBbvcTH6Ia6=&vOn{~WmFsuDmr+i>hPm1(QC}{ zlk`*z^Pk7`zDU*{Lh>-dE2dP-i*0qeBut;{8d|t@KITi9^d7uo$E~Q2qZUR3kL>iU z?xEhTJy0a=p0E<&r-ccyV)svX?;c3^wHpjgd+mBFDr^TcqIa-r`G`+xPfso1te(w+ zBcIUb>bC$F6J%5>FAnN}HU660lbDEo~qEIV+7WlX@G zQ)&DCvw>+&7~mg%Zi&ribByKolYTj5Cj=$VmG~;jA-8n#Xx&9!z@am(GhS7Am|-t7KaKgi~tE0~8xH zoe+gwe3QI9W6XSzLt=iqtH9S+GsTKZUil=nviYYZ(3UeK);2w&6ReVAf$!z6^P3## z`QKpaDaU#Kcj;0?_kMY1ur&WChOY;s=OdDr{*Epm@kAhe>PsDL;s@VoBX1vCMawLU z3(*L?YwRz$&UkOLxJ0O+h5UZ6=v@AWqob=r@$KeQcsmq!&3^wiAe4Tb+lXiz$)r%< zk%rji7E-d+G1<;?5wcW$WB(bq>KO}UnhfFTt``pcWxva{RaM;NIYQ@Vz!Z7Ty!{oB0U@9JpNqZ1>+*ITP=N0cnPX1pIAdi-W1v2tDhj=Qx#YleI|nW^!S*M1^uClxnq zQvq+%TO<1NiqQT`tYKw^!4LXG*QGU}39(nBp=!{KQN9;l1L>0^kS*90b7JLemPY{#+mz`_&%}^)61=klfZ^ z@bk?i7~t^O^)Eh|>_84;I5GaVmf6=eY8*zG=C*i8tfz=cjQ#!6k$DR?@XxnW-~fll z*T4Am#XSxu#@%|ez&7q>1Yf#)^EUozQWsH$)p!;mTI}$go4}r23Q$YT zKMi9xbszrk(3gHNylA($?Vrhx;i_KIYhdNsSB9VZ|I!9pTX{oV`Ce}FnHe_w(z_R~ zOa-;wr%xO#p~b3@KQ(Qgty+Q!ww$Wh>+aL#hN+qA;cty*hCSm3zM!2>#NY4Za_-&3 z=DhVJG+`)pQJRhjD4cwM--3yS;UdY-mqvJnWnJDH-)?%q+Zq2lIHVB)3BUIB@A1Cv zjMa@;BogU}a|fD1Y)7pUT;;$QM-vxSajH7_N^bQ35z%5aH+QY$Jyl5r1it$raiuEG zRgc%nHu;x+M^=6G*EE~$h*O8yLD{~AP=#J!ACe)!g=NPeL809=GgiNub{Kg<2lVY{ z7f<_n6T&NE-CNZ|T1UG##T;aquJaY3TzSZFNMCCRuPE;IRoj<2LR5Zb*%b+= zk}?VU_96Mu(Xk`SBjX=bhnqrj3d#~wRnz1%*nH9nx;kya!f~tN{Vheob+v`n`MuWh zSWm*{k^>1)wt0`0ZD&+ORA!ZjZ;5LU)JAH;T}k7`9>eU!)CfjbGkTJa4!AcQO<^`v z#JN;K?iS4w^7!n8Id_gk(ZqB<|kP zQtlk1J4u0MlML0k-bWf;8xTY&O;XU#m%vt$@ROO@MH?ws6eI1K^%@7BeN|$Vml5bT zqB$n_f)@lSI)==vb^bo@OE6saIv5Mh++v!$$NSZOTYiJkJah|Nlg3ih~`p_82%o-smCgPa35C{`|wAmGMjG zz2qcxL9{2*w`xFsalKt>-L(r#e$+tfsG@-PJLW#d#1`|Ox8C9}I4^&!ZblHnH1#0B zA<2Q0ti!@}v!PEo4k9m6hE964ANmHuMxo^2um);(h#ZcQ8dmTC7oIH>wBp~vAR0;c zG_L`iX^jPw8LWlAoA8^8>2{nmO@1E6jtim(2J2iz;K$J-XcA09JB zaVJm$;zyDvC&UfP`Avhm(MUxIMHvFzXJb6qi@I2Yj%zbvz*m`$LcDo$=qnI(Ln&$BKk0m-_&5h)V6o zFrAB$MbReTK#zPIMQmfV85n#>pm~|{)sC**Q-KZ8+PyrzOmoj zebF#`w@{|0&54OJfPx6(oEDAl%jO3}zB6M@*F8{94|gmt36D_vP$g_AL#V6A@j+(V zSAnzPJs{eG^t%Wv$)XTOV|MyZWyOUbNU(nIcB_Z=B=db^IPifkt#fd6VN(d4w(d`0 zAgt(KkDI5G^bA04=Ul84LsEv=u$*P<;OJBxSTXt})8?2u%{){6-6ygbiFa%NY^U`4 z^M-;^wjQRoesXQa8u0!TYY8coma4wy>X>6g)*dc`^e!MBsLOiq<%=Lt5Rdvxmsi%#ULB{v17sO^OMVCW6^StB4GlvbJN1UF(4btVOzB5 zuN=G{x`lFe7j}dkDzH$!#MEG_*zLjzHk;c{PG9qBcw`$furK?rLRfHtKoJ_n0WztP z^HMF1a##l8D_k@Jbh5JT7SdO;tz%#E{cIR#i59|+CJZ7TWf(y+WWtnG3Al>^PcKU` zztC#UcsewfFmJHa$@$hrkZB?ogM{q~AuAVNQ%MUpZ;C7v#lkJ2p5JT46|5Z~|G8sZ zYo$W9*Wjz(7Zc6f-R%x)l~tJ`f1+Rd{bO#7Ya$P}{{lun5;rRTiZWatDAmxj;^_@EXpLWjRw zV|o|W@bWYGw^hUnbdMP7Vhl76;={akanFL^8k@Ia$b~;c{-lIi8tUMc*L2}i{B+Wv zl$tOL6s-#I{7^s*Fsm04=)MKN*;s#OiMlKd%=y>u#3S*B?+CAUzVzNirx}k~&k~+> zU9`P&FMX4qSSFJcq1JPY=c(k<77qrQ|GuB!cnO6fh87BrltPBU^d>*Z8i4_cHnac= zG}IoR?I>uib8D>>Lzh`JqN#lB9`n#)yzte^=m3^J>WxShD5l#?4QXS#$zYHD(MQJ~9dI&Hbt)d23nmjW|(VBD`!*wL`(=Rpc0!fd2#vL-F@mN-P z9V<9ahTB3&k}U13_8|G_r%I)2<>+E@)Daf;tm~zn;uNpa`&%@ltN259A@^BMf@9};3#IL4PR<%Y29<*;^pE?4mncsmVmV|?bxn4&W=9P0X|{6 z)+Du+%%txbU3!Ss#KX*m1B%7ONlJ^VW2ZL(U{2qp`UV&1IcSsO8|;8LWuk z5mEZO>r(eK_T_v+m$O%^g~?`ljSAg}YC382sCZ!=mPX_GFRb)5jqU{iYT>Y`q0kn1dKyr`@hE*LJvAm zreK*KwmHOnq8I)8F%b zV!YfOJ9cm+GH(Q%0X9SH&D)*t4l+@lf{thd|LK3oa5q3deBHhFKyUXFZ&X-guxK1J zT$3x)z#EW8o`E1E7~BmOTqzc@%|QAo8Qf``7mN{Le!Rj~8z57dA6)b+D!JGb%8VZ? zs@?2LmP+22(^Mb&<)xMqDHbnL`lSyZrBLcs_O(+;44zjukyr}m-XbF5^@WHH&%^hQ z=F1$n1w9QK#Gzda=fEvmg=ne&mc}X4$iS|6phFDq7=V#u=!BMax9ipxzA4bc!#^*y z;ym<_Iz0ZausZPJJ9ZHaJ=?fnAn|WGfIFPrIA}9aA2S;Uf+B8zz;8h9;yXH zSg`eGnKR+;2XJa20uK8(;_O1)DwU}N-l%~WGa{pqe@;%)KH%_(Bdz(o>*crj4xy`j z!A^}iEgo@aHX;d2X!9}V^85e%PIkGn+`!6t=G!F-_jhgpRpeo zM_}#!qy?$$7T9QprGfluW|xi+$Wr*H_N@IDu4G7M+qRaY%WNyzctZ4^mYpdONj_1rk=!)a=dDiYpS zyv+12I&`ILL6n-)7Rz`A_gOR zkLC9ROxcO8IvqoP;@RBe;ZCx=80JF1asT0axrjF%QjYRyv%a+n@^dP|gC&Ga;@G7p zWUQ3#WQe~>#0&;YJ&UqKhx;S0PV!JA!a_A#k!Tdp7XXz#3S)4TUc#cyaQ74T zNx4pKdPq96({pqBtz)xhsONw&3AfBseTVGEU^L9e{qR5Jzo&_xbP<9LU} z^f^P{Q!qP#OP%Z$zzBvz1`F0`jMRC>=r}}T{#_f~rT@|3fphW@&$F%e(Glvl1QcV- zc{#(uU7if;t^zyG9!RAlyjNgxv`r_sL;&pflBbq8UI0F#(l~X=zh*&2pryUyMAM{> zAFLSPWgx46+yrL4(RJ!OoFO6`MOJVzmm%Is77qy~aXGHcB;jqTmoJYdz$>Ql6r6HV zPICn$c##0&ugd27E>!X#Od~gylvAe{AHY9VbWfRc(pD1VEA_FmkXBS~YSfGT_xx`# zddf(SKZZ_aqF7|n598huzd!EFvxkpSQ?B%r!FQGG!P4`|o8$DDbW(zfEFwgMwjxZI zQN$FA!w8qdzj>(;FKM;F1@e*vV@mZ9Q}MqhB{UAYLz0MTVfotUaK_G(-|4ZCZCB69GMwT9eAT89PF# z6Q1G;Z_GiUYl%eue6X3Az}MJYB3htV#^Wze%{d&8$lD@_ZFvlk~6vUI4&Evw_NsS-gK6EdcMbvW4Yo90qH+V_DkqQtRmdghV z2zB`MqxB=Zx3Sgpj+gC$BPKn95~f|3c9%@=>{Ou>Ut7%0ttuW@%8In3O7wH`7hS}d zk;>5picSdxUSNpw>Lz6k+hh5u4MemN6n4Q!JmJYIN!Qnrv7Si>R*4_SF!@`LMR}xN zE)!m;+g3~(nh2RGxZ62S5&*rIXa^1}x@R;bWjO?%*5qfEmb-OLV_p8RCIW6CzZlg8 zM#@JhrorOMvDxCK1vq`;>b#~eWLy0cigv=W<8FcTr6&0*s-RnKWQg@B0mNV2M13d6 zN(5*EKv06oc+6xT+j-{3|6ka>;OQmF6$wa~cxHk^>$f2Sew{~UiH5gp3onj{(San7 z5tCT>sm_y^F)h;+kju_czty7S~)TP46 zf}IBv2~U`BHeY@EI*_wTqcyQev|=+#nOt{Yxww6Vx6Gjt;dAy2ha_v2lBmsCvHv0C zH^bQVxoIO8*}YB&Ye=d%oGMI>VK(lxjK{FJ^3JN*?94c3&WZ8JMgvf1fju$n82KmA zQ9({>UaYZ7*FUJzBP3euysgd4P}nMis3GB7J}80rjNA(TJBIlw-V9S6_rcRdf9dE@ zEBOAlFyZ-W))ZrYy^v>kQ77OgRUVs|dG=k3h4Dz&?R6a5-No&T8Xr7g68VNTGc~-j zDE;M!6jL3y@)1Q^5iNo6c4J(t`C?zg=UV*B^FBM2kKbq*H?cOw8+RlNrx6)+6s*HH zk)C&fulPV>k+UQbA2FZzH&WXDhnc4+xNku^4)O7iD6$wa5(w{T5v+Ipjig`_uO#S2RVpr`Fel=aXWhP0&9SXiMQhJjKa$5*~s^P?M{c>jP>bks& zTMu{wz$}}H+ETo!(Nu)@5P$*rL{>oSaFrSX&LRm)ZH!hVc^`kINZlREyzKEE6WA{f zFVJ27fzktSSm0x*H$qV>^tKqyPVwe-91w_6UpxBw*RzXXU98@Uo8cP^=glsBb2(}y z@WLuiky152?&!)b^CdyhG>OS!a#W+(Iv1X2qRw@=w8OBbu;^`T=4$N7qV#uKnJ12? z#KjdVE7Yg5HDWbeRPENWRicMqGfApWK4 zR#?C4C3JVFwr=Q1Hl#YpX{=)@-dY^_7O*?lmkg-kOY^r;7(y{Pld*jmJRT41l;{V4 z;Q%H9$prGRyubJXBUmJOMSVYCe;xj?Exmqs-u46A#J}U~pIe)`bjn}=Y&}}&j+_O>OH-D^=HQM>?enr7l&%>c8E4{ z%y_2j{swLnQQ%zMlt*nxV46{8Cads zX`gi29ob=9t17GfN>jz&Db&6^$UGe`{%O@`8#Oqt1fLL|BBkkX0=@W9Vo`owmP5=~ z0$1?(!!YM9lnAKi%TwEE0fZ=oDlAI|3n&19ZGawJ*h!##ZDJ0aoRes3W6rdV-LMyR zw3^sjlG0U{1U?mv+&4G_azLY*L#Eex{aWPphO#HycEp}y)-OnY)-$GOQz7dJE6o>z zIFLJ#%hm6y{QYWu zS~+(lb0{H%@=`^r1F8hfkUtKI_D$%V2{7L+&Tt6yO^*Rrf_=M;rt}2fq|-!ZwB8w? zR&xR_POx439RK=!$MZMY(yrvIrfSXn2Yl5qDS0kctl0-%`+?;xxD z)uX_IHHHlo#J#cUVfcl!S;_sqRDk_Z!MA1*hr(`5z)ebUA0$4kxGM5Gzo2P$=lZB6 zpKc@8fFnlBJ6!JIB7APntqd#)E_dIXnGjzZzRSbTBoxX0p-W6jdIMTr*qDE9C;|7J z0r@sPTrk%jIGRZ4Y1Y9^ZJ9V8HUwmh$TY>Ch$g_4nB1qZpcL`*H{<1ViSehrLD45$ zL&g2;HC&m*f4`Yfeh5p5sukOV{v;S(^jsyoGVvz*qi?nDk||(+?LugKMUeZ1kIPHK zCOm%>q7&Yk+@3(eRfs(tdj72k3w15cA=W;q=phA42mXwF_4xtY51jgu=BtBQO?ILV z52dj>2)c0AJDeEAlA1T{CV(AL{KFL>h?k!HvQvXzyz3tfXpB zvcBi2GAZ&U=GNz1T$~hEskE}vY^tX3w!`W8&Zno&1$IIw)U^e%Z+5*p%sucf0<2&A zZ&utA2F(yR+fq-TJ$087Io~3}q%=Zg!v&)^cui@yPiSnzi~X3#?|<9j!Tkv(mSKQ? zLZ|hAJ1y>OeQ$X&J>6{Svj8nCv&+%5$Am()dWN+926oTLW+>CDd_e)r^O&P&%>qxT1!*V-j@;t@YZDb<>Z$jso?!{+s1he@g5oLWlM* zu3ifz{CW6v7KI!~HcAS#Q+ap56R}-BADfcO{!j|&J8HMs*ntEjASI;4=?8(aHWO2< zSD1?mq)6GQWA06|`NBKGjeAKi1XAWt-I~7#Kj9tAtJ$N@J#ts z=7b7FCK{R*oF^3d+h)}KURDaq)VAWpgjNwBki2T>^m&OQ=hlxFw95Eek42W%m{ zp8KUo>yaJze_Q0DlZ5V4XAyqbIqh7s8s4wsi>a5@N;$8iod7eRORU;WtT%i4a>y`9VkmmM zX+wS^?dO>$-u^oHX_|0s(JQ{w2pzQ=_?ZI>;+lJkGC=+w^^of*OPlN;8|*GTSE~pO z$7!~0QZ-lICBTT+vtuPmmF(n9G7=-mfF7Tv!j7mO9N%_Wt70@oi*R2%3LmO<(P+JL zdno1bx@ZJ1Ulws~r%SJCX9kpqAOLZr*DbFfj(6JNhJ9d`$K`*hNK}%~B)ka`3m`r* zNJFZIh01sFTEtNF-o8;8@j)jtI2}_iH3OSi>-!3PQV!ZS_+b;PDXBUEUNYtcLC=c( zs&`5Iu_Z6IKzOtv_YMObgXD;>0S(AgcsiHx)~jdYPnNS3wwpBIG)lfu^Nc2(?svN9 z5D$>iAUtM|W)Ofa3<~sRQeX5%v-S-@d8ZHpO-dZt3n0{Js9!ULw_~P{lmXEv ziOR#Gyx!&m--<#VKq$AV+$?uN0OvZO(Wyb@>FZva#WPhJNb`PtF`$|yx75fLiFS#q zvq}0f?1TD&hNv2!y)5R{fYUmtf6G*|2okPNHgND{LyA2=r{^Ei9l`%)|8Wt znQ`E}Rp^SpVG2Nu@YG6iR{6%XDTKk*%r=b;+^S?s#lk7h&SQ7Zs&ZvU?D7#_CWTyz zjX&7NY8wZ_6(M;nq{-nf2;hw z)=reCi>WfOCMLzApUnKvXN2gMb33r81JexA*RiH)2+LMv<21@K5+Z;?rg=f2XN|m> z8VKNLYB)Knt*>@{4z;yagOA!xkm99?fCY5o*9P=qowsDnITBnE;F-`T1`A^M*8X`r zF!UEje7>)vZW< zU8&O^TILi5R(ik&2d`ME?+Ru`9HU!jakQ1yDfXaQl&e3u=wB>eIC;BI*j;#u21f}E z3;?PlA^J^QsY5_h0V#jFGjU311PLh7>(aHrn1aVoX*j)n_lIrguNmRpLoJB$16UgE zgI_v-T+6M2PF!;bVO<6mS-+1=Gs{jNQ}QR>TBWcznQY11rL89h@9CIdCR>Kaejd6E z^l8N<$!UA4a-s{1SjvR33G1t*my7Mv%(9NPWxsjP!bXw1WaWEUd`C2D(Va!Rji zcNz|xcdR}*K=OHbj8Bl{%5z6dmX1b5C8(Ih12<9 ztNfZytI+|(vs7JxwDvP}Z%E{^mUafJP2wIVL?2tNb32(=Q=M z?th-DW0b5fyD9U4>jH2f>S$tX(rrjmn)D@^Zv=H`u)5En(&~yYCY=>R&FNbIT~C4&vl01U zuvmvkoes5EfOz%dH$e6SbA0Mr!}@IKh$t#NLgF04T>}W13drJNazUwW>Y0J-%LWt3 zhn`UXG5^Yp7=0a&D;$hTUz2zu&H$zt0ouPB^&}h+mzJOP$C2f@g>D>mQaS99u-PdI zinE}c0S$db$O%>^PQqOu_a%G2uSHnReTFe&r|P}|4er$T2FT%sr+LB(z^6`>!bQKw zW-v_sM*qT_Gylru8m}m98euUBd@0!mlbWyucAFqrmv3+Q0lIfdI*^b3c(lXz=*I3U zY#ZLLXRD6gm*cJ^hJTnd3k1{k^>mf0OP=pkC$sZ*>BMCMeZ>q_Hl$X`6|o9<4Hd_w za$yo+jXBJD;TqsF;kZU!ys<3DRLXhgZnGtQC?80~(&drc`|uBJ^Ck=!B7rDivIOfZ ztDS#m*5hVxWq48Zb z%uAeV$JKqt+@nX+6JbtcN2z?Wt^*E#j7g-|-PF7%>5(mIjspHr`X5xm2b=iC_{8 zly_jU*fXxXuNm7W;DvGCIllQ*1QINR%H6swO{!WGE7XI&5VST06G@;PD;rc47Ad3u zhv@NlZOCn7vr)gZ=n|qxJq4!j0Ee33nMV8U*fKa$HHsnvpDQg3<9K1r-K$Suy{Juh z3CDG=py6%#BdY_cYr&L3$G>;-g){|jl-L;liwbQe&Cb;CQs;M_%Ge_D9K(OHp8GyI zjgf;2m0E0#X?6XFmO1Ub^WM?JNY*X7YFK|JKxH=zuK!#de}8V!<(zvTCekUc1;h;!I2Xtlweykwq2zGXj%5}+0CjC+=``>FY4*3CqP0ZdXs~Z0u^Tpxm0PEg zGO`Ka>9ajIxiEA=MSBLo_iuW4tqf2e9@cjtIB<3rUfx}K&=SGQeS{9A`kr}*J~*AA z3v^@BUeoD%V=xvDKD!0b>PV0SeiFo45Xn`sU4OLNXSE;HjrsfwG`Y_5cvz@f_Vmsv z?BI~+Tw?gL{p@$vm69Xth&S&!Tc;NLBm7!$_k=aSyZ{O8jJ|#gv=E~77e-FG#k(#p z$ z{Jq0w)6N89x+j*21Wk;WJm4c46=jN!0M_5c%j`#ZT4l3YX#(_jN>hBDYY_nD{?AuU zekwP%)>GemaWXT-_#6t91E2i9qZvN>DRIIpgb)ocL1QxqAM{~b=|dLGhY31) zj1*Wd+*j3(Hzqt6=VDL3_vg^B;}Tv1UqwPM12+}6SCl_AJ?*AZ7ccq!0|)fHoM3hID@NlhzwB+05*efr z@MNZOYqdeT;#+L&QK%cX%CxQotVz87d(7fwu!f8-0vh>;sb zg2#Y4a`uqM=N^J^i|G1l(cjyt{c54?vfGL~S?$%;iG zl)X{l$re9fwU=_y7dYr`OC|1^r9HFQaCxsyP|V1P{9||z+IUA8s&FM6!jex}!)k4)Yxy?N##dIvOo4s$m8&>q&_w_$@VlKb)_yDmmzt8`j#A;<=aN8l|Q zV*fb4-*^X=HJCz_V=E68w{9g19xGVMmXTxJHtvK`@heckbYPsM}^#!P8FHa44^ zOhjddm5`p^s&#r-FnT-G$?#_BY;C+LoPxD%!G1@`(@PnAjQFlAO(g0Pd!`7U`|Hcr zmCYwA0!pS}-hk^^=-=;u+~iEw0+Lw;5-Zl#GoGPH6sOo(dI`R*HjBJ%#cYL9UT#lL zQ9Kd=7S;QV{eqiS6IJc6>&2paaC)a>%>jfvKhn=ZNMhm4$dV{78#$m8NRH$ z2ET7v(F;wtfz7!AvD)_E5dkSa z1c(!1{mf2-{@>z%r*BVf?}JU)iL6q+(<39N z7CwR~AjI{WPywff3*MmKWq&yne#j_A*=>a9@zBO9>^?C*GU^bLP)D0%ggq}p#w|)9 zK8>GbKEi~VC&dxcSnoO6JMP$;f9s>D&iZCUJ$9o%+lak{TK0yu)cD?|j;s+;f?|qa zC@^k{KuW+1`y26F#PG2@e|Gv9@DK_a>|WjEn;Y z)&i~r$8jgrqBo*)`45PnBj}2~OVy4Ej&?o!W|x1$yYr^LG8B&o{X8F}L~%3Ea~*Tq z5asVWr#W*4qwB(3-GrH?5@xn@^A=|_=iWMd9JiD?7yHOs>V$#Fw2U&l5b=t4Y zKWu(N+LL?BCcm=Rk;JRurIoSm$t9y5pIi(rlG63su#{GF_vIC2g8Fn@M&!ZF-MgU5 zW4Gez7@MUscChuxd-Z0<){Q^Ftc*&JYg0Wl*`^wiNGCg9^N&n8cCnu6*g5tuP192qwsiKZyWBSi3yP~#R-7z|D4x%q$2)NJMHjr zo#V~Y)Y$2|wC-k0mfTb_4XY5ef0XCA?wk-!joWwC4J+brmD2`y*Lk2q4Y3atUr^W} zPJX#*n-4?mU^o=?{~ZePQ72U>%R+9%A>GAKeEVBh&_sHcf6y#(Z52~n8k|z5<_=Qo zV^4EK!#GyRop&ogpnT8qHod;t$e5T*su(?TBHcE>U{m9yltCVzCWiRCst99!a*=FY zbl5wReneH{^qX^Im5HT7l)cZUl21sjsJc+d)GSQNCDgcGDy~o<#M^a1q4tT+f59Ld3 z?VDRKbxf&KOx?f7b%=~5BNckICKJOZav2yvfjQ}}{tdQkxKg2XS0)AU8 z$7u?jG3wFDa_reG{CMYyElk(@?d#zbU;Pen!Kf)nd26JI2NUeGq?_Qb)Gc^DmU*!t z9lC!h-vNE`Dni}xe5u#d!`F=@V1cAE=U7D4k^Y3|=xjFyrVgvL2Wsw!JwNXp8GbI8 znA>^jE`H%zMULdYA#|$p3Pl!J@~#CLN;;hacDK%biown1zUcM7Jkgv$H_m+cAVXJu z4xV@gwEfxRSv%HEz6S}qCrjXoYNf)rKMAJdj#?H5ejp%(cwE=~ys=8S0Ka!gJ2vR} zeJhY`x8EX<4nF?=1cY?s1I=o$=f#8L_1?Y-_~U`c2(^vBJMnp812(*fS)!4T)X;IW zKjZM#*xk1TPAG&U`j2I}^x7T=`{jGY@a9gTESNGUkB2W>DeU~2DH1JB1_&Phd?4pJ zd^y{Ul-H4r+Mw1cJ_YmIwLtbCX$`Z@G68B4PJYh#Q{+tew46wIhCWsdsgOWXu}c? zQ{5#n^*FnBFJPk*2`id!i@le?9Q-4!6#kiCiN2<7o7wAicyKa%_a4JbHdx_s%G&b_ zFPAOvT8kRpNwl~vBu2{#I!a|gL@3Azaeek6%V|0n+b_|D*tv%Bg~hb5Bq0ol7WaYr zMtCDS?LW8qpeOr&gwg|ph0j5U`W<&Gma&!|YJ&F?%_!Y?8~byYgG+HWhVEI>Io*cw z^6`bj{kNy$aK0%6{#J<8cpL&G7(j>Od1bhe`|&GS7BPq+g1pdEA^3ZpBp?N>PJ%&% z1p1EQ%Cde6!y7GkU==B3E+;*q!DD#~gHw+$mTLi9eg3rr2LL-H%fGbu&JP7pFMq=H z6JK0n0n+IVG5=DHYXJVhRvn+M6sy{GZw+zGFRt<_8N1XvB?<-jsoIZ^x)87x0rbd2 zKid-`&Vb*h0Q9bUBm>~(c%}AB>fTU`^p{yna-1#*?u@Ui5@|66-@hEduU(pPni~Q& zz6Y7b(P_!mEdKE8UBAH|J$8neE9W3TRC{P)uL)X4arvcE!pSWX zhR2`Qb6OIc3PR#uB?EZrr}ts8tBmSyFku~s4R~&?j2hdDC}UUi#PUPo(}~vg1VfeK zQQPd%+xW@6Xmxcg?dzqu~ zf|6d|D>tDMap&5ArI5vt#rI3jntQYtm-55%$)ZtZ=(pJ%RMco{HV5xMw#qTdTr8?~ z4e4@UU6?v2XCHf(-tmEDRpJDQ8pG&}`QOJkkDLAIq}Av+f62&i)2D3z@V|p7rI!2= zWY)odZID`(Zyvp1?URp}OyQEf71;>eL}AEy zon%P35*%-#A<`l>OwJO|PaSsyd(6(5zy}lU=6oKUjK-$k;Jl0cMv2=%ne>Q`I-|!g zG)UF82F@<3B!v8oee z!^kRGS-pCR?UnR(iKJ+TsiV+hvCvkRwaX=dO%xwgo&!giog!2VLuzXs5H70F%W&d0JmH%O43+Caa zGaV^C4K6h{rD3N98|P~3Jlr1`y_TR-C38JtsK5H@#ptL1gSO`z-@VE*MZa|e-Sa4qkuP(<$_hb zFleK3)S%g8SLJ~l#5cgO53>GGa}1&z?PRwnRpls)I5!7H3FRaAlX&8fc?(;Y4ZRP` zrNhDC?nek?|7D6bUN#RuSU{HHk=DgBR+R<>lt{{X5^)2LWg6-3;kw;em@Odc$>*Sh z?A2>-`r!{U)&jp2Y8Z|vW-FMM*>{~PS zF2p+cVrHDOpCpWIKoF}gk3_xWm*>1_U87g7v!Pw&@uC|`Te+YIUAWJ|X^kCCa0RYm z1d^VV1S$~ORyZ1fdfG*tjmVsYUboW;B_wl3caW8CoLy&>A|&?tSuIi}nFBGe)na*+ z@~QbU!+FrKA$cOx*r*Z0QU*HbcarmngyHsFqA${$z7+*kY=YOu!AHhzmxs@c z28-hhi%*E_UX0z%N_F)t7rbfBSRIxH&_J}uK3+3qC?5XUGXIDwOdQI*w#v+H zaWEakbhjI62&)XfpuB(8fR-|bW6Tqz895xloPbL8XfLJ1Bia6#qNG74X0Gt0BDoYs zqyS{zmNY}MK`-`Z3p)1}j4z-Vc+)ar1x1rFwW+fSe(m*(eGIx+{(8s5v-#sYJEf?e zV(9`4fj<@b#_Oj;770dRvfe{4t-=T8NP>GqU*)=`M7{`pt-Y~31o|>PgNrQupAOh| zc?{JO*72{bdnSY4f-^Kp0X&3**e{@cB=R^*QJkI*X1vgLWG>kzJGw_79a%UtorwcW znWErdmgKi(jL1JSSu*0d>+$N}k(&CZy7Bi7P`VLtiaJ$CX5{^d95O+q;wwL(&O4w{r|pX zJ^oO-M~xE($6M|&PWl-?08POGz#x+;xIgb2)x1vOKGw?PJ}JfV660B@uiEc(rTvH2 zn;hl`aJVOl_j`;?)JBeY(eZcC7p&yct+s^ zWrR}z*__T$s>ZtVD!tw`#WB_`Zm7~jN{zG}`Y^>MN3O4WIjA6)qJ0#rm?^{9aAh%kioFfU_rHp$>0=tu^i`U>s?^O z^6+Rq_X{zDeuLBDgvDr$ibpFg7FJR+*;$7DohJtWqcx!ArVXr=c4SbE78W(=17&z0 zS)Bo;HT)+=$|1T5cI}R;sl%<{Jg(sqS0k$Wa!ahXPzT);hlFXv67ro9HVh~kl(+3{ ze#_5;3?O!86FYFmFXYE*TL5PGNs_M}CC=~7tIY&&JoU0P=8eQW@#DB8?k#fDcp{oY zp`NAda+pawat*5+n)HZ;#yl86fnn0_4AmdNL|4CZhDubg7^}zrK`>BxmASPhO_rR$ zouii+cmKw6hZN`;{&6F?a231R-KssyP zKlBG}#U8e$Hp+F5xmHs@KOpZE%h_7;qpK{zqVmB9CWMTAWF|2l%%6H|iq^V-b$(hH zaD-VH6}zjpu6si@yB6UzUoem#ZErtba9+W1F;FAwGDhT6T~QAYfphd`0bj|j0t)MK z6gBIMcwfH}Ak0W#!jq0KlikeK?i${@X12A4qKH3OiSarzXJW%2z@$5J9Vw`T6CxK| zdh^gTsPXd3_4oQ|Y=kxS09+C1y^d(AMm6C$QXMS1p$c-!xSgK&ul?_TT>%G#Zrojw zLA8R@29gITbRXtuF7Epod@17_vzy)imF(Tp$B^qJ!#a1F<@uRdpH8P|FwTe!_=e}w ztc4LOp*B>G!dHBe4;i%(Z;G1fHTwwe^xX1X!tYY;UOk;_QP|;7ZxDp>^A&2FuavM zf>hIAUi_76Rwg?$sPYU

)3mT(<#+7SKS+nmP3A=-|Y`u4{3pZM*w^mZ8!rB8Hu234AYQGt-$ zMLW~vjvuW)3T7_&R4h)8Wyb4WC%(lcB60z-ycL8z{KXU|XTW8Fv4netOa4!qRXoaR znczr4#Ck<5eYf0NVCJd)R8HqvGXjaIiigs!Bslmw#&EEI&Tz=}`cNr%3(G7C;W3sx zC5XQQ4i;{XLiM3G9{6{h*ZMyUP=nSS_`g!<{) zXJ-q3JfnFwrTK1U>w@xYBH^5w^Dus`(MlDyt6OVfNc`?yVhK$^{6<|q`P|3EPB<(a zl3O)70Sn7gcFeWKfyx5D(pyTRp%n*`A!HR@!+L-b{N_oQa&~=YzcWV7DPe9V?N>M# z%ZWgX1pGmuQ;Z-#?p^96 zeGN8Q$VF9eQpGK~^3IJrDvnLG#__9om(>Z#EMOP&87naw!(m~R{@(OQ2ZDf6k}EMp zToQ$-`ea6&*kIBz@W|-*_1x6bxVrL+zT15EMjsf($#vKrkfvYSjZm2^r|jlnw|I`w zg9m&34>FT1_#f6i#C`JvYm2)r5O<6~ptOTniGpLa4yS!RYf}vC{|ifA2mZoi$o3>q zM=PkQ%54Vx#AfGh@l&-NV9Wx|kb(0e+ttITzt4VJ_sQcwe=e}Rr^-R?{ zp0`vdw$^WMLI+0a*c-XrF7(eBOMcfXivE`&cWd^0y$DAN*6h_sdb(rCq8>^%ZCZ5IbKXwdNlr- z!_+D^BrA!)lRUNDXG$hHGz^-@(NgRh%Jf1fS6%B;Kde;A{m}5}>viAH4mEyt@!Ww- zS3*cVjHh9O^=#Bv#}~FffB*mM5J`5Sp^AK;$4K9GE}RIVhNV*}xDWVFtVr*;ry#@f zs+OhDJ9)4R(R7W4h7BQ#9|S#Oe1G6AHl(-RgO4WAip5v5-*3-qop8 z2g~h?P!7&`f8Lh8D~0z6?J-VISuUY(6g|3(Lzk@2I{)W|DTK<-ym4=kp21dO`2w<> z{)R;}&Txweq0W9@s*13*h`@wW{=9hY>aFY>+xgohxQ}hwLhMXV#^D2n_>3K5gh}p- z2}DFV?6U_;mo^4E?LnX1F)o)RyZ4Vu?Z@G-H%0%rg?ZRLDLUnz#~Ok|;W=VxpUx2D z!s2-w*Ap9~m+dbR4is+5Uus>%S&z%0I8ar@dv>EHl5t=o6xN2mj0a~Q@BYpVCmj7$ zBDc6%KCP_VFG^7cP72=j{?=zvR_ptR_k-I~xG@~MB~+)2w24Rdrf(=WThC*kKIIcv}B6k+iK&2PsNz)QR^-=WN&`cl* z!N*dXNL%)QV#VPd|LUhVQrd++b2YE?pUMokeC}-~jDN}>Hrh!;b7Mf|yFTEeWPC9qF~iD=?!Luh!AZk(zR3rhVx3f&G8s zSa=S;W;%9&I;O-}2$AB+S$j6tQVLq2#a0*=3)ip*3w9;v+q=OQg75h7(v9D<%^AUt z-{jCHTsmVWqb1D8VkVdIbuf95{`@Dc7@aWpR7Vn(8}T-z)gmyg9rSa#%C=QFp83{d z?qu$sv)`DWVPu7xGM^SZ) z=-@;fpbDhVvUf4*rPYQQU9>J*wX87M6rD-L(vuK!4=#qzVo8|J`On#q&$v|52NraF z;2W(?uq?GMwI*xIgH074%*VWhprF}Ct$PB_o6tvIeq?Z_M5VDzNyw8p6iVa{Vd>?+ zRV;Pb#@BUZ+ue1#FzQud%!JtyTzmRsEp%IS$k*ooON|Vhu#o2FIAxT3+SSDbM zJ6(wWvkU)R`w$b3s3#J^qA69o_Av_`D;^oyem`FC3#(G{=vk6tG? z{Ln&|o5Q(rwF)1V26VCw#4@uR@&QaQ%P=k9nhdbv-wc0)aBm+CjzY<|XI+a8OG6O; zkezZ=nF3oJNztnO>6b#ju1)!MR-6U+Tv8&ZY(@hpLB34O*Yp!lzXO80P|oq&Zx0aF z_4b(6IUT^Hl=%mL{p|(vZL-0Pa-U0H`#TDBKKWcUi2UsYP|^>Tq2mzy6TtL7Z132# z$rbpC`RSThv4OPpW*^un0vak=X}+^-FC*6kZY4pwj-c76CnZAxSo!+$CQ@DT>=?oC z5C+BHUHrZ&e=3IZIdyaq%BiTIa0~c8bLI1!8uY=#ZOm;6%2vvlDpNxOje5N#wgm`v zem~|8_<)WVDJF#f{gIR$jel%I!57dtqB} zB!e^Y8*Ip~`Ntt>0)tR71KlTGh~^1a;+F8?BYy4ONJGfN{zLA}B(=%Y(w`ZcDM?gtmHY zS$%B)rwOh^*uZ^d@=t13x-VwhwTe^J7&rAMP$A}!&v;bcKo5TR?S1@pCer=#`4CPR zI6s%)ILf!a{9&XakKOI$9wG(G2=omHKm0n!db2wb)7jdbk>k+_;YYw>8-;_ z!SKG_d)r-XWha)%PA*$Jg(Fic)myzf6>IIaFQ!Pxh2mWg#Y_59a36h#I>uUSdoUO~ z_2{#omrt+>sjn6MGh$goy$UZ8l{`>QRPPv78HPpFmigsBjl@U$cJK6V@5MGEZ%OOw z?4|k->f^^87adGL(!cX=)u;xH$0Wi-( z-gY;6)Jt#C?|V+qYxOa{^vc`3y0q6k>p}N;*~eb-bT*gXK)2$R_~@bLI@A9yw%8q( zc+z(t^z)HccowqR6F1u9Ge4d!eRZ4r3kT>6ZvCvMUT=n@`Oh@hy|dP@n&?!2t^3>q z{W&05(ayLpyv31U`1~%jo#Vo6{mYi~UEs@OO~2+({!E^Cfw#~0x*acYmRIkS?efL( z-Z|3CcR6<_JcioPJP8D2^cV6J_z9>1O0lg`9 zGE&qd_wBp3|IpU@O(=?%P#;+<{O|r!RX(yWC*60+Po3~%>JE)|iKu`Rh6Id`y!6T& zEx+r1AG!ZW5E2#x$-|Uc(PvV_j=z)A)jxYkxzO_C0pztj^ueB<4nN|M0*oE{em$lO z7|mywdt^7;3j`!Vy^$rz^bf=)>KH~88);Tby*^)Gw#a23MysQdE)yW3@)>~2XsT9h zfI6}oBmniQIVC|h**W^u*hymGzLGEbfDY1-W_L>n2T||^K+L7tNToS@m8S?TRBhU_ z>cFl`!mC%(5fr78ZhOM+L;Llgr@ereMgWeo8UU-+>wus}qN+;dcPkDjW99hhh%T0T zDq1|sQ}39!0@$NKiu!MmP;+dt)}#;Bl3dMe42}^up>`R?s-neZE}da^ibN&r>Lu&! z>+2C+)n|p2jFb^oqK$J>(`n@Ku`!Y!>4STdwM(j^?zyB?8`XUG8x>Q_44t8TtI^&~ z2GtvsqwIW;o1gS&T6c$8TT-U71@)A@1d1^0W_&N%<*}QMF~`~!mq;To-KSJggrLkz z(nF<&+!IV4sIcUeM|!@FC61_k+y_lebGB5|dwgcGf8zvYz&taqQbjKAy(W{Yqh*c- zEWd;DUTy#CsP8FclaX<^5fR>uQqJm`5+*q=^F0Zi8n&#}gLoyPmd6idhWY}^(>A!d zWG$%&7$d?ayN-B@)@lNvrJEt4Sntea_fcjuQu;*CTP)EKP&I~nU7E%U(PLsT(Ttge zk36^{A5=Gx@J!p7_8XdN%gcCZvzuO=^1p=zV5S@k8WRWS8N)l&zchjB)m(nFRB(a2 zZN){w#X9TCV*mRk>i_#Vhh>b-kde!?rC-v1a5z=wJml(|-GzJ60oH4l(`mi3Mh*Kp z!(dAZNDbS3G&t<*dGcr6z=VXV0!fN{j*24o;=t*5`JTB8_;kBiVGp-4xUQ>JXhHVc zs`FmCfo|&=oh~e_&x>+3=ZAKygwqUhPB)Tg$HVQ=2n+fbK{8WsWOhQ+s-b{jYuM0XNj12h>r`L~3NC>FAW$TzF^GHt zXxz>UH2Ixk&JNX{Q+x-GWSv z_;xAwv>a1+T;7Rh!AYm6_Qeip4pkj#I`eLcQ<*D3F2k-st~M?#S7xZFBii1l7!Q6W zUi<`{jT+KL zIs<|cHiygM?sk(rMBb2{KjbyJ<_QGu^JM+GcioTz!oOEYJJ$T>#{7Trqkm1ZsjQ_X zi;P>BAKI0^x|Q!H>+y#{Y(ht)!MBfXzS6YpAW#7ni0s?Y9BpVLJL>&Jc?8*T*6JVi zB>^S8&XK)5D&jRS{;ZhW;<81I2Gf8Z@|IEXSCd6S=tR4i7^M7ZPy8goA`{UD;#;#9FV zQ+Z*5g_$aQJQ{_##1l%UP1aD0rd}8xY2M8svR(BhKbUR33)M-U*NQF&ZxOpmFB6NH9+K>wF?55hq2xrEX=7WyzxVUrpx-yEG@#B#;n`3Nq-m62&(lBO(6vZmD01JVe>+m=dDJwCt>}J9c zzddFb-5k=iz`5t)RTnk7_QSI4>+ac-(CpYqYY?pbO_;i-fgR+EhY{H34hv;SICb1= zs;+hNn@=nc%}fuX;nwf~2aUDq(R%4hY38q?7sr(4CXj=`9EmB2?z5DD3P3TC6HNzl> znJ5*zW$%$UY$=AMx4D1-L-afez8FAPHK(E@b@PU>hD+79QDYDaF>!k0?RqQ%kwldt zk|`j8B16N`K?V+h*|2n=h{r!BnGGQj0>O|H0wItl%8}=)^OPwx0s~W7M|>55a9t58 ztRq#iL{?EwjbiswkOHMi(xe1TLGV+6L!1>0;Ez)B)%=y@gs3RpGs zwi$exZxqV+9U7y6brY<#Q^lkS-HZ&Y7IKL&5LI-Nc1rg#n3dN#sp&u~Lc>M%@=RDO zMp{Ap8d(=(AG}56w!VM4aOz-ok*q_GGGwCWkv3W6C4iv1tx_1jdJNq^lRIlB!$;EH zN*!dm3Z*8mIYzS_a)bIU;4VuW_^I?vy|WtIZI^aO;_#Q59xu@#4-5gDs7g-n+ABfY z;HKQu4&fl{bP3U?`PmHJVZ8x-eE>_|AS#eROu@~EYVEwSFPnKU%+7WyS4ek$u*=f# zQa5X{hl{#FwPn_QTmg^@YEI`PfS($*3}@#g$a-tjI9fFTP3O}k2geKYVzP?3^rU&y zRfZ<}y4bAa4;ttgeDF1ZTMFC8`i=^4HZt=YF~At zGB>Ok*Kgr$i@j!sLZ}`5*K9Xj8wm1gW_S;$htz zbP(elP6qiPAEba(KF9~vPB(WOXCiLAV`uAUJSrtR97w%eCfC8@Fjy?UES zwUY!Qsn9f;T!DflLoZh&$tGe@R2oTg^y<7oEXoCH+24)aQv|;s-)!;+dwqx$ehKPny^4(N(w!$! zojbJSUfX^hqPWri3tjp*F`P4IB?Ff&D{ZHTv60NN^hQfH7YLSil5SKmf%0`kADJMkP&< zWcRJ!!LgUh{9Ap8y_G%M+xfw(k=#m_S>#ed7%G6Zgz%CD$RB+maEsVR+h7}QGZ^6` zml(niYDdHVJpl;d=fiFTteq}?08OfGRP8}Hf@#xwZO8A`r(40D@aS_^DJoirPJ3eF z9N^W?)rhXhisJ}ebnSWty`}Vy(tEo12R`(rKQ2Vjk$2&_in1Sv-CxeEw(Ey+nqNZD zyO%c@z=?ZuOYP`A!*YC+=jhL1C>)8#;)!G`oyq3%HF+Hnz3O5Jkf0bRHM-_sMgeYk zkV*};)X_i_A~M<_r!DPhPYWKBjL^6*NH)mca^G1?FIdbB1V$7atF4z<|dF{xY@!nxP#AP?xdhDA(k19X%sT zSRqD<20ej9kU%P#)Y42JlgzM*ZMR2CyK!LBV8~Rt3_+>F!llq>&ccN!AIX?l_=>fg zsBC;r7LGPTRMGKY?zg6aIxVb)T~5fk)gJQ2gefJoJh8LVL)O|;V~+Aq=sTbW}AyEsCC2r&|*$dV%u0SN`e2xUYR zBo?&&m-GZxs91TTLdV2O)TFcwcb&>FqPHNSqQxdwV&M@J>qI9XPnJ9diLGX0z2u3y zP-sJABALnvJ9(0|B8g0C?Ib8Jbu53Ah}iCDBr?TM{?L&`0&+MEX+TjTCw}<(M}(MI`oe zk}P;hyMeG8QD(ZlLk=v*t7DaNvno1P6KbYowe)7R?tRoziq4~YLYkB!Mu-^mGR8H5 zW!KR`g(78AK3~nU`Uz65lGJF*%#@?@;Br8w=}*Oi@zN^fXL zHN$6dUQ767rnO_?@h)|`0@7A;w}V%1uHfMf~nNcEm$jysVO!2bS+j+}M|7y4hTyPxk_ zEVeOIMG?Aa65y-kypX&P-#prnN$u{u^YD!~Yt)DSr%7zL@z#x?JO0}6dVfn%VAMg zv-zTKmaFwMeXE2Qe zYAkiOgAQ@Y3KrF>*`9Z>#i8rro(78z!3fIX^04suR%ylIHnuBNvOS0z!0BE^Vho*@ zV7)^P$NC4pBOB8l-6LW>laq4m%V#2-+i2v8+O;{d0k!&Y{TwX$h2Nj$b>^Qm?tfX! zu`MNXm}fP8oiT;KFSuyp^LRV-uoGG#6pTpxCOl{bp@>3MD0s=OwuuE}$S1Z@OBsp} zXjFX=cI0&&Pkb0Xy|O$avW*y2?nQYB?rfSX$=n2*_BJGzTfp*SCcrVFLxE^aGBGCCm~B$JwmuBQfWkCBONH0cpI4{&alY$9_&|T&7)9ZX zH;#ykvF`^vYIAs9pBxwe1f7{66K+T!L8K#pq>>IYga3^`Q%B_2DvM{lZzz3BrO=@c zdAgg!QiEZ(H1S>P_~vQY+lWM%>Zveg+Fp1Tz>2sCMpdRTN(SF??5Ss><5l*WVx37p}$_v%jpP?;uUB`7A4jUyRDjKakJF^3fSs|B4U@8&TW#WI3v z7{d^{L9`5X8vUbh^o|~QC|Asl>mW*@2oJ`-GhnyJz?V_|(TI?MIY|ee=}(%1;j!?! z6Hy5zAGc@7eSJhBDztLS)a?>yi;StxZx=e*Dq%Ju*v19e^f}VSz)=Q7F%H6^{reoFnj9wF~is0$5t*`FmLAMaia!??8%1KS#5xgJ*Ifu+Jt-O z*55M=b5mmjz5AAvpk2*p;=4b#oD6!+axN7_K53TIeja`QRR}>jwQI(s;D$j$eEQ8~ zLN1+Xgw*#5ACie2wf~9iRa62R;m$KxXStAsee}jBZ<>(bP=wG{dHnycpJf7Um1pqo z$I2w|Oqrtq@`O=J`8edgSE{Fw;zXkY4+YLJFcJLhX8|O_$3%u@07{#WPyjjOpd-RS zvf%}f7@$Rk903#)Xx&KmpFjNM8=RuN3`nROa-OXpzDllld+W2-`tD9Z7d-C4c@GPA zEXccHcgo)(aXaWX@ms}i5x!aICczu|ZYTrgvS){Ynn=&7NQ0E5Nu z7H;An@t62R{HFfJ3Vves0~glotE#i98h)io4X zk@FQKl*@=-2!wzSxCHAQOgRhfi+~Eq1mPrjJ^@CKgO+0;ehJ_N)J_3!_OR=2y5VIn zx#Xe?&O7Iu&MZ)a;`ZDpxZTbP3b*n=I|f(=-M z6DZv&O6BQ8_5)|NP@$vF- zGZ}Oml|m*F33wb9gGM0{a2QlBmYvk-8|T$|!3b?jw2_8`(ZksSsm({Yd3Vb2n`EGb zfECuDCg^!SDs@D!fG3wkkwxAcw%zPB3Qnl_(eAM^*G7yk?wun0%;4UXfx z`#+$DU!Y$c`weIF=R5n0{gJ=e(*yxW3C6rdt&@O_6rAM}DD8$>Qae$%X-5~!j;%C1 zzBqPq@$Aydx67a_>0et+yB>5CbgT0pE<<|`dg1iChWGHn|72PA>4Y!-qHSc~BJrJC zI0*Rv4P)Mp+DHcg4oHpgw0Vw<`r@)S$&s@qj=Z@Xbdn-sN*3ba2tVCVGL_i4SwONllEV;{u--T&-a4g~44gF) zN~1VZAw3F12m#_qqZSI$4)h4xqVJ*-s^D{QGHzjm-zQI#&7@5VQV~b?5sFA;M=YwT zO<7bxl~hd))Iwcp7=45SxD_Z^As7&Fs9*p`zWBT3U*$Lc37_=^fA0S)xT%#7j9@R|!Oj2;j=@mq z2=%ZS$|HOfN8#}~F)j9rH^!S|h*g}&hhsjj;!noqSV|m;l*q}2q)ZMacH$)<`9gYc zYD?cWHyIZbX!_=W$xLm2U`C9Q)yvvhOm=_vm;9!7joi;Qxiyc>quk_sb2a~I`;xXx zJGA{)=iT0Ay_}xu9qCoQ&-XIL?S*r(qWG$P#ICj*t+NO1A4@8$rE@v2{MK~u%cFq=Mp8VoF9SC>N@Na@0Nwr+!b34c5^grQe`8^c9_?Q5vTUG+>lDhB=vGF#_fd zV-GJ36YOU8e_V1-$E9*VaT@Qz-^qLOe*79f=2QLzKjSz2-vnke#6}#6dqq(uJBgtw!Ztv3gyMkFvA9Taw+lKAn!v z7Vqf7y=y83SYTI{E1$nMKVE70JL#|I-1zxy=1pc@yoc--zN*)1ZCZv$aMQ6E9s>9V za*%;Jn1B$B!#-HSDHI?BKL9frK@BB@8-V`sUTA`5$c7krbS~v$&gUaJlT$gF59H3g zlfN!E`9ywO_Vv~N>uh><@9da#G?mlx4bt0bIt{1W(>H%d6H`dHq-*`%Sd}hK-BNY( zI7#Q197}O!AHRz0S8Ynwi>+gL8EP~H`W?=7<$8?-_;?#Q`fww`9A$j{V;8! zc9BNa5GtX@)SarS^4|ZG&Q+}5s$!L>^5YFCG=(UulzSABLRJX!H~EgdLVocL$S%@J z>3X3+xW@l81k7XnAn)Zrjv?SeI?H?`1C;-yVWtb;dG?nNLIX z@dNjurYuULhSdA1f{MuB$(rOE;!olpktcFQfLKj%_#g3CID!x1PW)~7&Da{u#a@No zh;c9``UL$Oy&5@#Y(_qasQ%pU+ub$Y<=y+b`mVey>oPlgJ8I_v?LX~u?F(A!miQCv zJ|TVlGdmvL{@rMJ^v@_7K0S1YZyes@<~qt@uIIY${jPR1Zpx*OyDe^=Tj4Hr^hVh5 z8g9dBF!jG{xE`#%_4~E%KVE&QT3vC~U=HtItlCwpdcz#v{kifgR?*qxvmcsyVP;x> zr<_!#B`&Y93+%vt%xuIO-okBY$>*T>n(Ejvx z5D;~5&7b>AUwK#EdJVA$Jbp*t|Ae$Rg}aw2{0At5@iGJbR|ib@LzVbRfMmYK=cPGD zxAi8rNr&`EpY-1%PL|)9!`p56rsnFKRZgDyHtFLu>%^YU2m3BSr%H0zdojT>|&BT?oIaP4$2 zk97*iaTBDGVU6(Xo`OV23$Zg8Q%rr$`J8qzI*$uxW2dYw=7T2HH&iN!l>_JAO@AuinrL(rZKNy@F$}WvAe{p$}~5CT?YAoh~r} z@r4d82LW?W%LnboYJ?FBO8lh1^po1VA*Mo-L`f^-&{LIZC-cjCerwOjYm(+^YDiQHPch#f{85f zWeB_Mmw~x^IbVc;;vVuNDrnocC|5WjL_O#?mP0IlXIr~$bK=m!tTpkP6E=ihkUfje79`G_*mNyZ$-@NcJeT6|+Ni0~=DOAJYc0k0A3uhwr{lD!kuAd- z2;oy=oK-|A@pos|qu^Xkw<{?KLShvk71OrPt~zl?vsLDbopYI8OqDAIDyCsXIZ7$+ zx&P1$uGmx4daV30=2&}@#}lPCJkxrq{b!P7vjh?jI_N0G2})g^7oo0*(fV4K0o6vn zHQs?3<;$8Yud~lL4JmNDG^Dzx?pYD;=m?4SBkp}%!Bkp94P zPg7eKCO>Fp+oadL9O5u%30w2A>P;;igc7c59La*7dZZ{1aHW~LZ2I@PHtr&Q0pOHN zwCv4w7+J1elb8QyZi=w2^p{#0qU(kSvD?@ETAA&_r6u zrI@<3Al>Am6_lKVWmiH74NDb`sLJ{iB-ud#$4I=4*F_W(#uWo^k7kWaaLI8n*fQBW>RDK?da&?ooaC1~VL=r;ovou`YZ9#SG#|wZO z^El!G-yo1~Eg;DFJBI~hHfaxQY@r-|aZVNrG?fRYY5(@N?8Q71BmY^|Ic(GwoIJ3V zD$#|jH|!DgXL9tZzA(^>WK;k;KE*kro-YPsOgKZrkov_?5)laYX%9d> zI?)vcjfkXCPe%$@Oo1Gkn~0F zQWhJ2FcoV*f<{aT@TQ5mfx}l&NUOy<6MTZ?lv-68WX}A@~HF1n$PbOYgy38rH_o7qwh_$WX57+D;345~k!y zV+Xg*U2Uw~svnNIpQ`@J-irs2k@zzuG@Ksp75k)frEQbzZH(w_9$umU_a=^=ewcC; zG7~&d!i~54Am;|Px9iK<|5iZD&0s74!Th;qH8bha>UrV+TeZYjH?Q4gNBJ}2#>?!d zd)GXuR*>=fD?5!(qgnz?-)d1>Kr;H zHZ%?>HvI%AXt?=rcZ-)?Ed3(v-RKuxqX`lYTR;ygEuAL+BV0XBW!zbHmUc# zoDlczF=m(=A|2`3M&EYh9xWw@8$Y(Y(c259e%)y{lO5DMl$Q|LnqBs4JKJShen&mA zW-DyZe_@y+CJysu?>(J{yLsufANXvRo>3tQ$nRjkPA!m+gPGjMISXC2x_uCJQ5FwQ z8#_OrThHEJi3cl`iNpd^& z6AaqXe8VbDW@iU)NVgaoBqP^!9XFfbkl0>sX9lPAmo(f*_)*%*_O0O~UCd~*nQnpq z#kMK^Q5{tzM#qk-yqne*aJ1>Nk&xEuTPlNSW}4gC_BNZj&6W3WKrBzzUFqt0=R38d z*Dt(|+$iPRbABFVZ^pyC9bL&^ae4ne&G6DQ38mhq-#_m?EPFYw@A3WepmumUal5@< z3!>%Bb<$2jCO@ibsN=0`qh4LHAmH kVi?m8zVOn%lfw57@;`-j08Oxoga7~l diff --git a/website/scripts/subset-fonts.mjs b/website/scripts/subset-fonts.mjs index e4da09a..2a844a6 100644 --- a/website/scripts/subset-fonts.mjs +++ b/website/scripts/subset-fonts.mjs @@ -3,7 +3,8 @@ // // node scripts/subset-fonts.mjs // -// Inputs : assets/fonts-src/*.otf|ttf (downloaded, git-ignored) +// Inputs : assets/fonts-src/*.otf|ttf (downloaded, git-ignored), or an +// explicit FONT_SOURCE_DIR for isolated git worktrees // Outputs: public/fonts/*.woff2 import { readFile, writeFile, mkdir } from "node:fs/promises"; @@ -12,7 +13,9 @@ import { fileURLToPath } from "node:url"; import subsetFont from "subset-font"; const root = path.dirname(path.dirname(fileURLToPath(import.meta.url))); -const SRC = path.join(root, "assets/fonts-src"); +const SRC = process.env.FONT_SOURCE_DIR + ? path.resolve(process.env.FONT_SOURCE_DIR) + : path.join(root, "assets/fonts-src"); const OUT = path.join(root, "public/fonts"); // Every file whose text can end up rendered in the display face. diff --git a/website/src/locales/en.ts b/website/src/locales/en.ts index 724f879..0985294 100644 --- a/website/src/locales/en.ts +++ b/website/src/locales/en.ts @@ -5,7 +5,7 @@ export default { "One-click install, Sparkle delta updates on macOS, and clean uninstall for the official OpenAI Codex desktop app. Verified byte by byte, mirrored verbatim, and reachable from mainland China without a proxy. Open source, MIT licensed.", ogTitle: "Codex App Manager — official Codex, installed in one click", ogDescription: - "Install, update, and uninstall the official Codex desktop app — macOS delta updates with automatic rollback, verbatim mirrors reachable from mainland China. Signed, notarized, open source.", + "Install, update, and uninstall the official Codex desktop app — macOS delta updates with automatic rollback, verbatim mirrors reachable from mainland China. The macOS build is signed and notarized; the project is open source.", }, nav: { why: "Why", @@ -32,7 +32,7 @@ export default { win: "Download for Windows (x64)", }, scrollHint: "See how it works", - badges: ["Signed & notarized", "MIT licensed", "Tauri v2", "11 languages"], + badges: ["macOS signed & notarized", "MIT licensed", "Tauri v2", "11 languages"], }, demo: { window: "Codex App Manager", @@ -266,6 +266,12 @@ export default { managerLabel: "Wangnov/Codex-App-Manager", mirrorLabel: "Wangnov/codex-app-mirror", }, + signing: { + status: "Windows Authenticode is being migrated to SignPath Foundation. New Windows releases remain fail-closed until the trusted build and real artifacts are verified.", + attributionNote: "Required attribution after approval; this does not claim current downloads are signed:", + policy: "Code signing policy", + privacy: "Privacy policy", + }, }, scope: { kicker: "Scope", @@ -295,6 +301,8 @@ export default { links: { manager: "Codex App Manager", mirror: "Codex App Mirror", + signingPolicy: "Code signing policy", + privacyPolicy: "Privacy policy", }, }, ui: { diff --git a/website/src/locales/zh.ts b/website/src/locales/zh.ts index 1bce373..f54448a 100644 --- a/website/src/locales/zh.ts +++ b/website/src/locales/zh.ts @@ -5,7 +5,7 @@ export default { "一键安装、增量更新、干净卸载官方 OpenAI Codex 桌面应用。macOS Sparkle 增量更新、EdDSA 逐字节校验、R2 + IHEP 双镜像,国内免代理直连。Tauri v2 构建,MIT 开源。", ogTitle: "Codex App Manager — 一键装好官方 Codex,自动保持最新", ogDescription: - "原样镜像官方安装包,送达你的 Mac 与 PC,每一步都可校验。macOS 增量更新、失败自动回滚、国内直连可达。Developer ID 签名 + Apple 公证,开源可审计。", + "原样镜像官方安装包,送达你的 Mac 与 PC,每一步都可校验。macOS 增量更新、失败自动回滚、国内直连可达。macOS 版经 Developer ID 签名 + Apple 公证,开源可审计。", }, nav: { why: "为什么", @@ -270,6 +270,12 @@ export default { managerLabel: "Wangnov/Codex-App-Manager", mirrorLabel: "Wangnov/codex-app-mirror", }, + signing: { + status: "Windows Authenticode 正在申请 SignPath Foundation；在 trusted-build 与真实工件验证完成前，新版 Windows 发布保持 fail-closed。", + attributionNote: "以下是获批启用后要求展示的归因，不代表当前下载已经签名：", + policy: "代码签名政策", + privacy: "隐私政策", + }, }, scope: { kicker: "边界声明", @@ -298,6 +304,8 @@ export default { links: { manager: "Codex App Manager", mirror: "Codex App Mirror", + signingPolicy: "代码签名政策", + privacyPolicy: "隐私政策", }, }, ui: { diff --git a/website/src/styles/sections.css b/website/src/styles/sections.css index f10da50..57a3b83 100644 --- a/website/src/styles/sections.css +++ b/website/src/styles/sections.css @@ -1609,6 +1609,26 @@ body[data-lang="en"] .hero-title { font-family: var(--font-mono); } +.dl-signing-note { + max-width: 920px; + margin: 22px auto 0; + color: var(--ink-2); + font-size: 13.5px; + line-height: 1.65; + text-align: center; +} + +.dl-signing-note a { + color: var(--ink); + text-decoration: underline; + text-decoration-color: color-mix(in oklab, var(--ink) 35%, transparent); + text-underline-offset: 0.22em; +} + +.dl-signing-note a:hover { + text-decoration-color: currentColor; +} + .footer { border-top: 1px solid var(--line); background: var(--bg-deep); From a80c6ed455ea73e1e32b5499ccd2e3a206437672 Mon Sep 17 00:00:00 2001 From: wangnov <48670012+Wangnov@users.noreply.github.com> Date: Sat, 11 Jul 2026 13:20:30 +0800 Subject: [PATCH 08/21] fix(release): protect immutable release tags --- .github/workflows/release.yml | 69 ++++++-- scripts/check-release-tag-protection.mjs | 162 +++++++++++++++++ scripts/release-workflow.test.mjs | 216 +++++++++++++++++++---- 3 files changed, 399 insertions(+), 48 deletions(-) create mode 100644 scripts/check-release-tag-protection.mjs diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 1b46d7e..f489ae8 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -32,6 +32,8 @@ name: Release # round trips; promotion never relies on its ignored conditional headers. # GitHub Immutable Releases must be enabled before any release starts; the # workflow verifies the repository setting with IMMUTABLE_RELEASES_READ_TOKEN. +# An active repository tag ruleset must also forbid update and deletion for +# refs/tags/v*; the same read-only token verifies the policy and live peeled SHA. # Every reused asset is also pinned to the API-provided sha256 digest. # The old MANAGER_*_ACCESS_KEY_ID / SECRET_ACCESS_KEY names must stay deleted; # otherwise a historical workflow revision could still perform unconditional writes. @@ -135,18 +137,18 @@ jobs: release_reusable: ${{ steps.lookup.outputs.release_reusable }} release_asset_digests: ${{ steps.lookup.outputs.release_asset_digests }} steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 with: node-version: 20 # Verify the release source rather than the workflow source. For a # target_tag recovery the workflow itself comes from the protected default # branch, while the six application version declarations come from the tag. - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: ref: ${{ env.RELEASE_TAG }} path: release-source @@ -162,6 +164,12 @@ jobs: echo "::error::release tag $RELEASE_TAG moved away from triggering commit $GITHUB_SHA" exit 1 fi + echo "RELEASE_SOURCE_SHA=$release_source_sha" >> "$GITHUB_ENV" + + - name: Require protected immutable release tag + env: + GH_TOKEN: ${{ secrets.IMMUTABLE_RELEASES_READ_TOKEN }} + run: node scripts/check-release-tag-protection.mjs "$RELEASE_TAG" "$RELEASE_SOURCE_SHA" - name: Require GitHub Immutable Releases env: @@ -213,24 +221,32 @@ jobs: # Intel build on GitHub's current x86_64 image — macos-13 retired # 2025-12; macos-15-intel is the last Intel image (until ~2027-08). - { platform: macos-15-intel, target: x86_64-apple-darwin, os: macos } - - { platform: windows-latest, target: x86_64-pc-windows-msvc, os: windows } - - { platform: windows-latest, target: aarch64-pc-windows-msvc, os: windows } + - { + platform: windows-latest, + target: x86_64-pc-windows-msvc, + os: windows, + } + - { + platform: windows-latest, + target: aarch64-pc-windows-msvc, + os: windows, + } runs-on: ${{ matrix.platform }} steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 with: node-version: 20 cache: npm - - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable + - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable with: targets: ${{ matrix.target }} - - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 + - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 with: workspaces: src-tauri -> target @@ -446,7 +462,7 @@ jobs: fi echo "::endgroup::" - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: bundle-${{ matrix.target }}-${{ github.run_id }}-${{ github.run_attempt }} path: dist-artifacts/* @@ -527,7 +543,7 @@ jobs: attestations: write runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false @@ -548,14 +564,14 @@ jobs: exit 1 fi - - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 with: node-version: 20 # Re-run this gate inside every release-job attempt. GitHub's "Re-run # failed jobs" does not re-run prepare, and no immutable publication may # rely only on a previous attempt's version decision. - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: ref: ${{ env.RELEASE_TAG }} path: release-source @@ -791,7 +807,7 @@ jobs: - name: Attest fresh build provenance id: attest_fresh if: ${{ steps.release_source.outputs.existing != 'true' }} - uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1 + uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1 with: subject-path: | dist/* @@ -928,7 +944,7 @@ jobs: fi cat SHA256SUMS - - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable + - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable - name: Generate SBOMs id: sbom @@ -960,13 +976,22 @@ jobs: exit "$status" + # The repository-level ruleset closes the long validation-to-publication + # window by forbidding v* tag updates/deletions. Re-read both the policy and + # the peeled commit immediately before creating the canonical draft. + - name: Re-check protected release tag before draft upload + if: ${{ steps.provenance.outputs.ready == 'true' && steps.release_source.outputs.existing != 'true' }} + env: + GH_TOKEN: ${{ secrets.IMMUTABLE_RELEASES_READ_TOKEN }} + run: node scripts/check-release-tag-protection.mjs "$RELEASE_TAG" "$RELEASE_SOURCE_SHA" + # Explicit draft-first publication keeps asset upload ahead of publication # for both stable and prerelease tags. This is required when GitHub immutable # releases are enabled: a published release can no longer accept assets. - name: Upload GitHub Release draft id: upload_release_draft if: ${{ steps.provenance.outputs.ready == 'true' && steps.release_source.outputs.existing != 'true' }} - uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3 + uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3 with: tag_name: ${{ env.RELEASE_TAG }} draft: true @@ -983,12 +1008,20 @@ jobs: SHA256SUMS release-assets/* + # Upload can take long enough for a repository policy regression to matter. + # Fence the transition from mutable draft to immutable publication again. + - name: Re-check protected release tag before publication + if: ${{ steps.provenance.outputs.ready == 'true' && steps.release_source.outputs.existing != 'true' }} + env: + GH_TOKEN: ${{ secrets.IMMUTABLE_RELEASES_READ_TOKEN }} + run: node scripts/check-release-tag-protection.mjs "$RELEASE_TAG" "$RELEASE_SOURCE_SHA" + # Omitting `draft` tells action-gh-release v3 to publish the existing draft # after all uploads succeeded while retaining its stable/prerelease metadata. - name: Publish GitHub Release id: publish_release if: ${{ steps.provenance.outputs.ready == 'true' && steps.release_source.outputs.existing != 'true' }} - uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3 + uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3 with: tag_name: ${{ env.RELEASE_TAG }} @@ -1094,7 +1127,7 @@ jobs: - name: Upload release audit records if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: release-audit-${{ env.RELEASE_TAG }}-${{ github.run_attempt }} path: | diff --git a/scripts/check-release-tag-protection.mjs b/scripts/check-release-tag-protection.mjs new file mode 100644 index 0000000..ecc4fc7 --- /dev/null +++ b/scripts/check-release-tag-protection.mjs @@ -0,0 +1,162 @@ +#!/usr/bin/env node + +import { spawnSync } from "node:child_process"; +import { fileURLToPath } from "node:url"; + +const API_VERSION = "2026-03-10"; +const REPOSITORY_PATTERN = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/; +const RELEASE_TAG_PATTERN = + /^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$/; +const SHA_PATTERN = /^[0-9a-f]{40}$/; +const REQUIRED_REF_PATTERN = "refs/tags/v*"; + +function parseJson(stdout, label) { + try { + return JSON.parse(stdout); + } catch (error) { + throw new Error(`${label} was not valid JSON: ${error.message}`); + } +} + +function errorDetail(result) { + return String( + result.error?.message || result.stderr || result.stdout || "unknown error", + ) + .replace(/\s+/g, " ") + .trim() + .slice(0, 500); +} + +export function assertReleaseTagRuleset(rulesets) { + if (!Array.isArray(rulesets)) { + throw new Error("GitHub tag rulesets response must be an array"); + } + + const matching = rulesets.find((ruleset) => { + const includes = ruleset?.conditions?.ref_name?.include; + const excludes = ruleset?.conditions?.ref_name?.exclude; + const ruleTypes = new Set( + Array.isArray(ruleset?.rules) + ? ruleset.rules.map((rule) => rule?.type) + : [], + ); + const bypassActors = ruleset?.bypass_actors; + return ( + ruleset?.target === "tag" && + ruleset?.enforcement === "active" && + Array.isArray(includes) && + includes.includes(REQUIRED_REF_PATTERN) && + Array.isArray(excludes) && + excludes.length === 0 && + ruleTypes.has("update") && + ruleTypes.has("deletion") && + (!Array.isArray(bypassActors) || bypassActors.length === 0) + ); + }); + + if (!matching) { + throw new Error( + `an active tag ruleset must protect ${REQUIRED_REF_PATTERN} from update and deletion without exclusions or visible bypass actors`, + ); + } + + return { id: matching.id, name: matching.name }; +} + +export function assertReleaseTagCommit(actualSha, expectedSha) { + if (!SHA_PATTERN.test(expectedSha)) { + throw new Error( + "expected release source SHA must be a lowercase 40-character commit SHA", + ); + } + if (!SHA_PATTERN.test(actualSha)) { + throw new Error("live release tag did not peel to a commit SHA"); + } + if (actualSha !== expectedSha) { + throw new Error( + `release tag moved after validation: expected ${expectedSha}, found ${actualSha}`, + ); + } + return { sha: actualSha }; +} + +export function verifyReleaseTagProtection({ + repository = process.env.GITHUB_REPOSITORY || "", + releaseTag = process.argv[2] || process.env.RELEASE_TAG || "", + expectedSha = process.argv[3] || process.env.RELEASE_SOURCE_SHA || "", + token = process.env.GH_TOKEN || "", + runner = spawnSync, +} = {}) { + if (!REPOSITORY_PATTERN.test(repository)) { + throw new Error("GITHUB_REPOSITORY must be an owner/repository name"); + } + if (!RELEASE_TAG_PATTERN.test(releaseTag)) { + throw new Error("release tag must be a semantic vX.Y.Z tag"); + } + if (!SHA_PATTERN.test(expectedSha)) { + throw new Error( + "expected release source SHA must be a lowercase 40-character commit SHA", + ); + } + if (!token.trim()) { + throw new Error( + "IMMUTABLE_RELEASES_READ_TOKEN is missing; release cannot verify tag protection", + ); + } + + const api = (endpoint) => { + const result = runner( + "gh", + ["api", "-H", `X-GitHub-Api-Version: ${API_VERSION}`, endpoint], + { + encoding: "utf8", + env: { ...process.env, GH_TOKEN: token }, + }, + ); + if (result.error || result.status !== 0) { + throw new Error( + `could not verify GitHub release tag protection: ${errorDetail(result)}`, + ); + } + return parseJson(result.stdout, `GitHub API response for ${endpoint}`); + }; + + const summaries = api( + `repos/${repository}/rulesets?targets=tag&per_page=100`, + ); + if (!Array.isArray(summaries)) { + throw new Error("GitHub tag rulesets response must be an array"); + } + const details = summaries + .filter( + (ruleset) => + ruleset?.target === "tag" && ruleset?.enforcement === "active", + ) + .map((ruleset) => api(`repos/${repository}/rulesets/${ruleset.id}`)); + const ruleset = assertReleaseTagRuleset(details); + + let object = api(`repos/${repository}/git/ref/tags/${releaseTag}`).object; + for (let depth = 0; object?.type === "tag" && depth < 5; depth += 1) { + object = api(`repos/${repository}/git/tags/${object.sha}`).object; + } + if (object?.type !== "commit") { + throw new Error("live release tag did not peel to a commit"); + } + const commit = assertReleaseTagCommit(object.sha, expectedSha); + + return { commit, ruleset }; +} + +if (process.argv[1] === fileURLToPath(import.meta.url)) { + try { + const result = verifyReleaseTagProtection(); + console.log( + `Release tag protection verified by ${result.ruleset.name || result.ruleset.id}: ${result.commit.sha}`, + ); + } catch (error) { + console.error( + `::error::${error instanceof Error ? error.message : String(error)}`, + ); + process.exitCode = 1; + } +} diff --git a/scripts/release-workflow.test.mjs b/scripts/release-workflow.test.mjs index 113f341..fddc868 100644 --- a/scripts/release-workflow.test.mjs +++ b/scripts/release-workflow.test.mjs @@ -9,6 +9,11 @@ import { assertImmutableReleasesEnabled, verifyImmutableReleases, } from "./check-immutable-releases.mjs"; +import { + assertReleaseTagCommit, + assertReleaseTagRuleset, + verifyReleaseTagProtection, +} from "./check-release-tag-protection.mjs"; import { requiredReleaseAssetNames } from "./check-release-reuse.mjs"; import { assertLocalReleaseArtifactNames, @@ -16,8 +21,14 @@ import { } from "./check-release-version.mjs"; const repoRoot = join(dirname(fileURLToPath(import.meta.url)), ".."); -const workflow = await readFile(join(repoRoot, ".github/workflows/release.yml"), "utf8"); -const mirrorRelease = await readFile(join(repoRoot, "scripts/mirror-release.mjs"), "utf8"); +const workflow = await readFile( + join(repoRoot, ".github/workflows/release.yml"), + "utf8", +); +const mirrorRelease = await readFile( + join(repoRoot, "scripts/mirror-release.mjs"), + "utf8", +); const releaseJob = workflow.slice(workflow.indexOf(" release:\n")); describe("release workflow recovery invariants", () => { @@ -53,12 +64,16 @@ describe("release workflow recovery invariants", () => { expect(reject).not.toContain("actions/checkout@"); expect(reject).not.toContain("environment:"); expect(reject).not.toContain("${{ secrets."); - expect(dispatchInputs).toMatch(/target_tag:\n\s+description:.*\n\s+required: true/); + expect(dispatchInputs).toMatch( + /target_tag:\n\s+description:.*\n\s+required: true/, + ); expect(preflight).toContain( "github.ref == format('refs/heads/{0}', github.event.repository.default_branch)", ); - expect(preflight).toContain("workflow_dispatch requires a non-empty target_tag"); + expect(preflight).toContain( + "workflow_dispatch requires a non-empty target_tag", + ); expect(preflight).not.toContain("actions/checkout@"); expect(preflight).not.toContain("environment:"); expect(preflight).not.toContain("${{ secrets."); @@ -67,7 +82,9 @@ describe("release workflow recovery invariants", () => { }); it("binds the release tag to all six source versions and exact local artifact names", async () => { - const packageJson = JSON.parse(await readFile(join(repoRoot, "package.json"), "utf8")); + const packageJson = JSON.parse( + await readFile(join(repoRoot, "package.json"), "utf8"), + ); const releaseTag = `v${packageJson.version}`; const source = assertReleaseSourceVersions(releaseTag, repoRoot); expect(source.entries).toHaveLength(6); @@ -75,20 +92,27 @@ describe("release workflow recovery invariants", () => { "mismatched source versions", ); - const artifactsDir = await mkdtemp(join(tmpdir(), "cam-release-artifacts-")); + const artifactsDir = await mkdtemp( + join(tmpdir(), "cam-release-artifacts-"), + ); try { const expected = requiredReleaseAssetNames(releaseTag).filter( (name) => name !== "latest.json", ); - await Promise.all(expected.map((name) => writeFile(join(artifactsDir, name), "x"))); - expect(assertLocalReleaseArtifactNames(releaseTag, artifactsDir).expected).toEqual( - expected, + await Promise.all( + expected.map((name) => writeFile(join(artifactsDir, name), "x")), ); + expect( + assertLocalReleaseArtifactNames(releaseTag, artifactsDir).expected, + ).toEqual(expected); - await writeFile(join(artifactsDir, "CodexAppManager_9.9.9_x64-setup.exe"), "x"); - expect(() => assertLocalReleaseArtifactNames(releaseTag, artifactsDir)).toThrow( - "installer artifacts for another version", + await writeFile( + join(artifactsDir, "CodexAppManager_9.9.9_x64-setup.exe"), + "x", ); + expect(() => + assertLocalReleaseArtifactNames(releaseTag, artifactsDir), + ).toThrow("installer artifacts for another version"); } finally { await rm(artifactsDir, { force: true, recursive: true }); } @@ -97,7 +121,7 @@ describe("release workflow recovery invariants", () => { workflow.indexOf(" prepare:\n"), workflow.indexOf(" build:\n"), ); - expect(prepare).toContain('ref: ${{ env.RELEASE_TAG }}'); + expect(prepare).toContain("ref: ${{ env.RELEASE_TAG }}"); expect(prepare).toContain( 'node scripts/check-release-version.mjs source "$RELEASE_TAG" release-source', ); @@ -110,7 +134,9 @@ describe("release workflow recovery invariants", () => { "- name: Verify local updater signatures before immutable publication", ), ); - expect(manifestStep).toContain("node scripts/validate-release-manifest.mjs"); + expect(manifestStep).toContain( + "node scripts/validate-release-manifest.mjs", + ); expect(manifestStep).not.toContain('if [[ "$RELEASE_TAG" != *-* ]]'); }); @@ -153,11 +179,15 @@ describe("release workflow recovery invariants", () => { }); it("uses the target tag updater trust root without executing historical scripts", () => { - const refresh = releaseJob.indexOf("- name: Refresh immutable release state"); + const refresh = releaseJob.indexOf( + "- name: Refresh immutable release state", + ); const resolveTrust = releaseJob.indexOf( "- name: Resolve updater trust root for release tag", ); - const download = releaseJob.indexOf("- name: Download canonical build artifacts"); + const download = releaseJob.indexOf( + "- name: Download canonical build artifacts", + ); const localVerify = releaseJob.indexOf( "- name: Verify local updater signatures before immutable publication", ); @@ -179,7 +209,9 @@ describe("release workflow recovery invariants", () => { }); it("fails closed when immutable settings are disabled or cannot be queried", () => { - expect(assertImmutableReleasesEnabled({ enabled: true })).toEqual({ enabled: true }); + expect(assertImmutableReleasesEnabled({ enabled: true })).toEqual({ + enabled: true, + }); expect(() => assertImmutableReleasesEnabled({ enabled: false })).toThrow( "GitHub Immutable Releases are disabled", ); @@ -196,9 +228,111 @@ describe("release workflow recovery invariants", () => { workflow.indexOf(" build:\n"), ); expect(prepare).toContain("environment: release"); - expect(prepare).toContain("GH_TOKEN: ${{ secrets.IMMUTABLE_RELEASES_READ_TOKEN }}"); + expect(prepare).toContain( + "GH_TOKEN: ${{ secrets.IMMUTABLE_RELEASES_READ_TOKEN }}", + ); expect(prepare).toContain("run: node scripts/check-immutable-releases.mjs"); - expect(releaseJob).toContain("run: node scripts/check-immutable-releases.mjs"); + expect(releaseJob).toContain( + "run: node scripts/check-immutable-releases.mjs", + ); + }); + + it("requires immutable release tags and rechecks the live peeled commit at publication", () => { + const protectedRuleset = { + id: 1, + name: "immutable release tags", + target: "tag", + enforcement: "active", + bypass_actors: [], + conditions: { ref_name: { include: ["refs/tags/v*"], exclude: [] } }, + rules: [{ type: "update" }, { type: "deletion" }], + }; + expect(assertReleaseTagRuleset([protectedRuleset])).toEqual({ + id: 1, + name: "immutable release tags", + }); + expect(() => + assertReleaseTagRuleset([ + { ...protectedRuleset, rules: [{ type: "deletion" }] }, + ]), + ).toThrow("must protect refs/tags/v*"); + expect(() => + assertReleaseTagRuleset([ + { + ...protectedRuleset, + bypass_actors: [{ actor_type: "User", actor_id: 1 }], + }, + ]), + ).toThrow("visible bypass actors"); + + const expectedSha = "a".repeat(40); + expect(assertReleaseTagCommit(expectedSha, expectedSha)).toEqual({ + sha: expectedSha, + }); + expect(() => assertReleaseTagCommit("b".repeat(40), expectedSha)).toThrow( + "release tag moved after validation", + ); + + const responses = new Map([ + [ + "repos/owner/repo/rulesets?targets=tag&per_page=100", + [protectedRuleset], + ], + ["repos/owner/repo/rulesets/1", protectedRuleset], + [ + "repos/owner/repo/git/ref/tags/v1.2.3", + { object: { type: "tag", sha: "b".repeat(40) } }, + ], + [ + `repos/owner/repo/git/tags/${"b".repeat(40)}`, + { object: { type: "commit", sha: expectedSha } }, + ], + ]); + const runner = (_command, args) => ({ + status: 0, + stderr: "", + stdout: JSON.stringify(responses.get(args.at(-1))), + }); + expect( + verifyReleaseTagProtection({ + repository: "owner/repo", + releaseTag: "v1.2.3", + expectedSha, + token: "read-token", + runner, + }), + ).toEqual({ + commit: { sha: expectedSha }, + ruleset: { id: 1, name: "immutable release tags" }, + }); + + const prepare = workflow.slice( + workflow.indexOf(" prepare:\n"), + workflow.indexOf(" build:\n"), + ); + expect(prepare).toContain("node scripts/check-release-tag-protection.mjs"); + expect(prepare).toContain('echo "RELEASE_SOURCE_SHA=$release_source_sha"'); + + const upload = releaseJob.indexOf("- name: Upload GitHub Release draft"); + const publish = releaseJob.indexOf("- name: Publish GitHub Release"); + const beforeUpload = releaseJob.lastIndexOf( + "- name: Re-check protected release tag before draft upload", + upload, + ); + const beforePublish = releaseJob.lastIndexOf( + "- name: Re-check protected release tag before publication", + publish, + ); + expect(beforeUpload).toBeGreaterThan(-1); + expect(beforeUpload).toBeLessThan(upload); + expect(beforePublish).toBeGreaterThan(upload); + expect(beforePublish).toBeLessThan(publish); + expect(releaseJob.slice(beforeUpload, upload)).toContain( + 'node scripts/check-release-tag-protection.mjs "$RELEASE_TAG" "$RELEASE_SOURCE_SHA"', + ); + expect(releaseJob.slice(beforePublish, publish)).toContain( + 'node scripts/check-release-tag-protection.mjs "$RELEASE_TAG" "$RELEASE_SOURCE_SHA"', + ); }); it("uploads stable and prerelease assets to a draft before publishing", () => { @@ -244,20 +378,30 @@ describe("release workflow recovery invariants", () => { const wingetStep = releaseJob.slice(winget, summary); const localVerifyStep = releaseJob.slice(localVerify, stage); const mirrorVerifyStep = releaseJob.slice(mirrorVerify, upload); - expect(localVerifyStep).toContain("node scripts/verify-release-artifacts.mjs"); + expect(localVerifyStep).toContain( + "node scripts/verify-release-artifacts.mjs", + ); expect(mirrorVerifyStep).toContain("MIRROR_PHASE: verify"); expect(mirrorVerifyStep).toContain("bash scripts/sync-mirror.sh dist"); expect(uploadStep).toContain("draft: true"); expect(uploadStep).toContain("steps.provenance.outputs.ready == 'true'"); - expect(uploadStep).toContain("prerelease: ${{ contains(env.RELEASE_TAG, '-') }}"); + expect(uploadStep).toContain( + "prerelease: ${{ contains(env.RELEASE_TAG, '-') }}", + ); expect(uploadStep).toContain("files: |"); expect(publishStep).not.toMatch(/^\s+draft:/m); expect(publishStep).not.toContain("files: |"); expect(publishStep).toContain("steps.provenance.outputs.ready == 'true'"); expect(verifyStep).toContain("node scripts/check-release-reuse.mjs"); - expect(verifyStep).toContain("did not become immutable with canonical asset digests"); - expect(verifyStep).toContain("published immutable digest does not match attested local bytes"); - expect(attestStep).toContain("steps.release_source.outputs.existing != 'true'"); + expect(verifyStep).toContain( + "did not become immutable with canonical asset digests", + ); + expect(verifyStep).toContain( + "published immutable digest does not match attested local bytes", + ); + expect(attestStep).toContain( + "steps.release_source.outputs.existing != 'true'", + ); expect(attestStep).toContain("actions/attest-build-provenance@"); expect(attestStep).not.toContain("continue-on-error: true"); expect(existingStep).toContain("gh attestation verify"); @@ -275,8 +419,12 @@ describe("release workflow recovery invariants", () => { }); it("verifies existing immutable provenance without minting a rerun attestation", () => { - const source = releaseJob.indexOf("- name: Resolve immutable release artifact source"); - const validate = releaseJob.indexOf("- name: Validate final release artifacts"); + const source = releaseJob.indexOf( + "- name: Resolve immutable release artifact source", + ); + const validate = releaseJob.indexOf( + "- name: Validate final release artifacts", + ); const attest = releaseJob.indexOf("- name: Attest fresh build provenance"); const verifyExisting = releaseJob.indexOf( "- name: Verify existing immutable release provenance", @@ -290,10 +438,18 @@ describe("release workflow recovery invariants", () => { expect(sourceStep).toContain("--pattern 'CodexAppManager*'"); expect(sourceStep).toContain("--pattern 'latest.json'"); expect(sourceStep).toContain('actual_digest="sha256:$(sha256sum "$file"'); - expect(sourceStep).toContain('if [[ "$actual_digest" != "$expected_digest" ]]'); - expect(attestStep).toContain("steps.release_source.outputs.existing != 'true'"); - expect(attestStep).not.toContain("steps.release_source.outputs.existing == 'true'"); - expect(existingStep).toContain("steps.release_source.outputs.existing == 'true'"); + expect(sourceStep).toContain( + 'if [[ "$actual_digest" != "$expected_digest" ]]', + ); + expect(attestStep).toContain( + "steps.release_source.outputs.existing != 'true'", + ); + expect(attestStep).not.toContain( + "steps.release_source.outputs.existing == 'true'", + ); + expect(existingStep).toContain( + "steps.release_source.outputs.existing == 'true'", + ); expect(existingStep).toContain("for file in dist/* latest.json"); expect(existingStep).toContain("gh attestation verify"); expect(existingStep).toContain("--deny-self-hosted-runners"); From 71fc92a4cdaf30fb30c29bc33e0d6e47dcc4ac83 Mon Sep 17 00:00:00 2001 From: wangnov <48670012+Wangnov@users.noreply.github.com> Date: Sat, 11 Jul 2026 13:34:38 +0800 Subject: [PATCH 09/21] fix(updater): bound artifact transfer time --- docs/release.md | 2 ++ src-tauri/src/commands.rs | 4 ++++ 2 files changed, 6 insertions(+) diff --git a/docs/release.md b/docs/release.md index 18851ff..dbf5352 100644 --- a/docs/release.md +++ b/docs/release.md @@ -70,6 +70,8 @@ signature, and 64 MiB for updater artifacts. For comparison, v0.3.1's largest updater artifact is about 10.9 MiB. The exact vendored `tauri-plugin-updater` 2.10.1 patch and its upgrade checklist live in [`vendor/tauri-plugin-updater-2.10.1/VENDORED.md`](../vendor/tauri-plugin-updater-2.10.1/VENDORED.md). +Manifest/identity checks have a 30-second request deadline; artifact downloads +also have 15-second connect, 30-second read-stall, and 15-minute total bounds. Because Tauri's minisign trusted comment contains a timestamp, a rerun would normally create a byte-different identity `.sig`. The workflow first reuses and diff --git a/src-tauri/src/commands.rs b/src-tauri/src/commands.rs index 7df44a2..e19bb53 100644 --- a/src-tauri/src/commands.rs +++ b/src-tauri/src/commands.rs @@ -179,6 +179,7 @@ const MANAGER_UPDATE_STATE_EVENT: &str = "manager://update-state"; const MANAGER_UPDATE_CHECK_TIMEOUT: Duration = Duration::from_secs(30); const MANAGER_UPDATE_CONNECT_TIMEOUT: Duration = Duration::from_secs(15); const MANAGER_UPDATE_READ_TIMEOUT: Duration = Duration::from_secs(30); +const MANAGER_UPDATE_ARTIFACT_TIMEOUT: Duration = Duration::from_secs(15 * 60); const MANAGER_UPDATE_MANIFEST_MAX_BYTES: u64 = 256 * 1024; const MANAGER_UPDATE_IDENTITY_MAX_BYTES: u64 = 256 * 1024; const MANAGER_UPDATE_IDENTITY_SIGNATURE_MAX_BYTES: u64 = 16 * 1024; @@ -285,6 +286,9 @@ fn manager_updater_builder_for_endpoints( client .connect_timeout(MANAGER_UPDATE_CONNECT_TIMEOUT) .read_timeout(MANAGER_UPDATE_READ_TIMEOUT) + // The plugin's per-check timeout does not cover artifact + // downloads. Bound slow-drip responses as well as byte size. + .timeout(MANAGER_UPDATE_ARTIFACT_TIMEOUT) })) } From ad3bad18b5fd9054a3b4bc9a3e6fb4f296acf661 Mon Sep 17 00:00:00 2001 From: wangnov <48670012+Wangnov@users.noreply.github.com> Date: Sat, 11 Jul 2026 13:41:19 +0800 Subject: [PATCH 10/21] fix(release): authorize release tag creation --- .github/workflows/release.yml | 5 +-- docs/release.md | 3 ++ scripts/check-release-tag-protection.mjs | 46 ++++++++++++++++++++++-- scripts/release-workflow.test.mjs | 38 +++++++++++++++++++- 4 files changed, 87 insertions(+), 5 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f489ae8..e1c51b8 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -32,8 +32,9 @@ name: Release # round trips; promotion never relies on its ignored conditional headers. # GitHub Immutable Releases must be enabled before any release starts; the # workflow verifies the repository setting with IMMUTABLE_RELEASES_READ_TOKEN. -# An active repository tag ruleset must also forbid update and deletion for -# refs/tags/v*; the same read-only token verifies the policy and live peeled SHA. +# Separate active tag rulesets must restrict refs/tags/v* creation to the named +# release publisher and forbid every update/deletion; the same read-only token +# verifies those policies and the live peeled SHA. # Every reused asset is also pinned to the API-provided sha256 digest. # The old MANAGER_*_ACCESS_KEY_ID / SECRET_ACCESS_KEY names must stay deleted; # otherwise a historical workflow revision could still perform unconditional writes. diff --git a/docs/release.md b/docs/release.md index 3e3489e..228994c 100644 --- a/docs/release.md +++ b/docs/release.md @@ -131,6 +131,9 @@ Before `prepare` permits any build, and again at the start of every release-job attempt, the workflow queries the repository Immutable Releases setting with a dedicated fine-grained, read-only token. A missing token, failed query, or `enabled: false` response fails closed before draft upload or mirror publication. +Two separate active tag rulesets restrict `refs/tags/v*` creation to the named +release publisher and forbid update/deletion for everyone (including that +publisher). The workflow also re-peels the live tag before publication. Same-tag reruns reuse the artifacts and `latest.json` attached to a complete, published GitHub Release only when GitHub reports `immutable: true` and a canonical diff --git a/scripts/check-release-tag-protection.mjs b/scripts/check-release-tag-protection.mjs index ecc4fc7..d12ffc2 100644 --- a/scripts/check-release-tag-protection.mjs +++ b/scripts/check-release-tag-protection.mjs @@ -63,6 +63,47 @@ export function assertReleaseTagRuleset(rulesets) { return { id: matching.id, name: matching.name }; } +export function assertReleaseTagCreationRuleset(rulesets) { + if (!Array.isArray(rulesets)) { + throw new Error("GitHub tag rulesets response must be an array"); + } + const matching = rulesets.find((ruleset) => { + const includes = ruleset?.conditions?.ref_name?.include; + const excludes = ruleset?.conditions?.ref_name?.exclude; + const ruleTypes = new Set( + Array.isArray(ruleset?.rules) + ? ruleset.rules.map((rule) => rule?.type) + : [], + ); + // GitHub intentionally omits bypass_actors from read-only responses. When + // visible (local/admin verification), require exactly the configured + // Wangnov publisher identity and reject a broad role/team bypass. + const bypassActors = ruleset?.bypass_actors; + const visibleBypassIsAuthorized = + !Array.isArray(bypassActors) || + (bypassActors.length === 1 && + bypassActors[0]?.actor_type === "User" && + bypassActors[0]?.actor_id === 48670012 && + bypassActors[0]?.bypass_mode === "always"); + return ( + ruleset?.target === "tag" && + ruleset?.enforcement === "active" && + Array.isArray(includes) && + includes.includes(REQUIRED_REF_PATTERN) && + Array.isArray(excludes) && + excludes.length === 0 && + ruleTypes.has("creation") && + visibleBypassIsAuthorized + ); + }); + if (!matching) { + throw new Error( + `an active tag ruleset must restrict creation of ${REQUIRED_REF_PATTERN} to the authorized release publisher`, + ); + } + return { id: matching.id, name: matching.name }; +} + export function assertReleaseTagCommit(actualSha, expectedSha) { if (!SHA_PATTERN.test(expectedSha)) { throw new Error( @@ -134,6 +175,7 @@ export function verifyReleaseTagProtection({ ) .map((ruleset) => api(`repos/${repository}/rulesets/${ruleset.id}`)); const ruleset = assertReleaseTagRuleset(details); + const creationRuleset = assertReleaseTagCreationRuleset(details); let object = api(`repos/${repository}/git/ref/tags/${releaseTag}`).object; for (let depth = 0; object?.type === "tag" && depth < 5; depth += 1) { @@ -144,14 +186,14 @@ export function verifyReleaseTagProtection({ } const commit = assertReleaseTagCommit(object.sha, expectedSha); - return { commit, ruleset }; + return { commit, creationRuleset, ruleset }; } if (process.argv[1] === fileURLToPath(import.meta.url)) { try { const result = verifyReleaseTagProtection(); console.log( - `Release tag protection verified by ${result.ruleset.name || result.ruleset.id}: ${result.commit.sha}`, + `Release tag creation/immutability verified by ${result.creationRuleset.name || result.creationRuleset.id} and ${result.ruleset.name || result.ruleset.id}: ${result.commit.sha}`, ); } catch (error) { console.error( diff --git a/scripts/release-workflow.test.mjs b/scripts/release-workflow.test.mjs index fddc868..f006be0 100644 --- a/scripts/release-workflow.test.mjs +++ b/scripts/release-workflow.test.mjs @@ -10,6 +10,7 @@ import { verifyImmutableReleases, } from "./check-immutable-releases.mjs"; import { + assertReleaseTagCreationRuleset, assertReleaseTagCommit, assertReleaseTagRuleset, verifyReleaseTagProtection, @@ -247,6 +248,21 @@ describe("release workflow recovery invariants", () => { conditions: { ref_name: { include: ["refs/tags/v*"], exclude: [] } }, rules: [{ type: "update" }, { type: "deletion" }], }; + const creationRuleset = { + id: 2, + name: "authorized release tag creation", + target: "tag", + enforcement: "active", + bypass_actors: [ + { + actor_id: 48670012, + actor_type: "User", + bypass_mode: "always", + }, + ], + conditions: { ref_name: { include: ["refs/tags/v*"], exclude: [] } }, + rules: [{ type: "creation" }], + }; expect(assertReleaseTagRuleset([protectedRuleset])).toEqual({ id: 1, name: "immutable release tags", @@ -264,6 +280,24 @@ describe("release workflow recovery invariants", () => { }, ]), ).toThrow("visible bypass actors"); + expect(assertReleaseTagCreationRuleset([creationRuleset])).toEqual({ + id: 2, + name: "authorized release tag creation", + }); + expect(() => + assertReleaseTagCreationRuleset([ + { + ...creationRuleset, + bypass_actors: [ + { + actor_id: 5, + actor_type: "RepositoryRole", + bypass_mode: "always", + }, + ], + }, + ]), + ).toThrow("authorized release publisher"); const expectedSha = "a".repeat(40); expect(assertReleaseTagCommit(expectedSha, expectedSha)).toEqual({ @@ -276,9 +310,10 @@ describe("release workflow recovery invariants", () => { const responses = new Map([ [ "repos/owner/repo/rulesets?targets=tag&per_page=100", - [protectedRuleset], + [protectedRuleset, creationRuleset], ], ["repos/owner/repo/rulesets/1", protectedRuleset], + ["repos/owner/repo/rulesets/2", creationRuleset], [ "repos/owner/repo/git/ref/tags/v1.2.3", { object: { type: "tag", sha: "b".repeat(40) } }, @@ -303,6 +338,7 @@ describe("release workflow recovery invariants", () => { }), ).toEqual({ commit: { sha: expectedSha }, + creationRuleset: { id: 2, name: "authorized release tag creation" }, ruleset: { id: 1, name: "immutable release tags" }, }); From 48bb0a885e281115c12a443fd400c1d08f11c88d Mon Sep 17 00:00:00 2001 From: wangnov <48670012+Wangnov@users.noreply.github.com> Date: Sat, 11 Jul 2026 13:56:03 +0800 Subject: [PATCH 11/21] fix(updater): redact transport URLs from failures --- src-tauri/src/commands.rs | 109 +++++++- .../tauri-plugin-updater-2.10.1/VENDORED.md | 6 +- .../tauri-plugin-updater-2.10.1/src/error.rs | 42 +++ .../src/updater.rs | 259 +++++++++++++++++- 4 files changed, 388 insertions(+), 28 deletions(-) diff --git a/src-tauri/src/commands.rs b/src-tauri/src/commands.rs index e19bb53..2ea859d 100644 --- a/src-tauri/src/commands.rs +++ b/src-tauri/src/commands.rs @@ -318,14 +318,55 @@ fn manager_update_identity_client() -> Result { ProxyMode::Custom => { let normalized = validated_custom_proxy_for_settings(&saved.custom_proxy_url, "manager updater")?; - let proxy = reqwest::Proxy::all(&normalized) - .map_err(|e| AppError::Engine(format!("configure manager updater proxy: {e}")))?; + let proxy = reqwest::Proxy::all(&normalized).map_err(|error| { + manager_update_reqwest_error("configure", "manager updater proxy", error) + })?; builder = builder.proxy(proxy); } } - builder - .build() - .map_err(|e| AppError::Engine(format!("build manager updater identity client: {e}"))) + builder.build().map_err(|error| { + manager_update_reqwest_error("build", "manager updater identity client", error) + }) +} + +fn manager_update_reqwest_error( + operation: &'static str, + resource: &'static str, + error: reqwest::Error, +) -> AppError { + // reqwest associates the final URL with request, redirect, status, and + // response-body errors. That URL can be an object-store presigned URL, so + // never let its path or query cross the AppError/CommandError boundary. + let error = error.without_url(); + let category = if error.is_timeout() { + "timeout" + } else if error.is_connect() { + "connect" + } else if error.is_redirect() { + "redirect" + } else if error.is_status() { + "status" + } else if error.is_body() { + "body" + } else if error.is_decode() { + "decode" + } else if error.is_request() { + "request" + } else if error.is_builder() { + "builder" + } else { + "transport" + }; + let status = error + .status() + .map(|status| format!("; HTTP {status}")) + .unwrap_or_default(); + let diagnostic = if error.is_timeout() { + format!("network timeout (timed out; {category}{status})") + } else { + format!("network error ({category}{status})") + }; + AppError::Engine(format!("{operation} {resource}: {diagnostic}")) } async fn fetch_manager_update_file_limited( @@ -338,7 +379,7 @@ async fn fetch_manager_update_file_limited( .get(url) .send() .await - .map_err(|e| AppError::Engine(format!("fetch {resource}: {e}")))?; + .map_err(|error| manager_update_reqwest_error("fetch", resource, error))?; if !response.status().is_success() { return Err(AppError::Engine(format!( "fetch {resource}: HTTP {}", @@ -361,7 +402,7 @@ async fn fetch_manager_update_file_limited( let mut observed = 0_u64; let mut stream = response.bytes_stream(); while let Some(chunk) = stream.next().await { - let chunk = chunk.map_err(|e| AppError::Engine(format!("read {resource}: {e}")))?; + let chunk = chunk.map_err(|error| manager_update_reqwest_error("read", resource, error))?; observed = observed.checked_add(chunk.len() as u64).ok_or_else(|| { AppError::Engine(format!("{resource} exceeds {max_bytes}-byte limit")) })?; @@ -2629,11 +2670,11 @@ pub async fn win_uninstall( mod tests { use super::{ check_with_manager_fallback, download_then_install_manager_update, - install_root_from_picked_dir, manager_update_matches_confirmation, manager_update_root_url, - manager_update_versioned_url, normalize_windows_source_base, sha256_hex, - validate_install_root_path, validate_manager_update_identity_claim, - validated_custom_proxy_for_settings, ManagerReleaseChannel, ManagerReleaseIdentity, - ManagerReleaseIdentityPlatform, + install_root_from_picked_dir, manager_update_matches_confirmation, + manager_update_reqwest_error, manager_update_root_url, manager_update_versioned_url, + normalize_windows_source_base, sha256_hex, validate_install_root_path, + validate_manager_update_identity_claim, validated_custom_proxy_for_settings, + ManagerReleaseChannel, ManagerReleaseIdentity, ManagerReleaseIdentityPlatform, }; use crate::errors::AppError; use std::collections::HashMap; @@ -2700,6 +2741,50 @@ mod tests { ] } + #[test] + fn manager_identity_fetch_error_does_not_expose_associated_url() { + use reqwest::ResponseBuilderExt; + + let secret_path = "/private/identity"; + let secret_query = "X-Amz-Credential=private-credential&X-Amz-Signature=private-signature"; + let url = url::Url::parse(&format!( + "https://secret-host.example{secret_path}?{secret_query}" + )) + .unwrap(); + let response = tauri::http::Response::builder() + .status(tauri::http::StatusCode::FORBIDDEN) + .url(url) + .body("") + .unwrap(); + let reqwest_error = reqwest::Response::from(response) + .error_for_status() + .unwrap_err(); + let error = + manager_update_reqwest_error("fetch", "manager release identity", reqwest_error); + let message = error.to_string(); + + assert!(message.contains("status"), "missing category: {message}"); + assert!( + message.contains("403 Forbidden"), + "missing status: {message}" + ); + + for sensitive in [ + "https://".to_string(), + "secret-host.example".to_string(), + secret_path.to_string(), + "X-Amz-Credential".to_string(), + "private-credential".to_string(), + "X-Amz-Signature".to_string(), + "private-signature".to_string(), + ] { + assert!( + !message.contains(&sensitive), + "network error exposed {sensitive:?}: {message}" + ); + } + } + fn manager_release_identity( version: &str, notes: &str, diff --git a/vendor/tauri-plugin-updater-2.10.1/VENDORED.md b/vendor/tauri-plugin-updater-2.10.1/VENDORED.md index ff3f91b..ec1e33c 100644 --- a/vendor/tauri-plugin-updater-2.10.1/VENDORED.md +++ b/vendor/tauri-plugin-updater-2.10.1/VENDORED.md @@ -20,7 +20,9 @@ cannot impose a response-body limit. This vendor adds: - an explicit `ResponseTooLarge` error before an oversized chunk is retained; - the selected static-manifest platform key on `Update`; - public reuse of the plugin's exact minisign verification routine for signed - release identity files; and + release identity files; +- URL-free request and response-stream diagnostics, including fixed proxy and + endpoint debug messages so presigned URL credentials cannot enter logs; and - regression tests for header-declared and chunked/no-header oversized bodies. No installer, extraction, proxy, TLS, or minisign artifact semantics are @@ -42,6 +44,8 @@ candidate upstream version is verified to provide all of these properties: signed release identity before trusting a mirror manifest. 5. The tests in this vendor and the Manager replay/fallback tests have been ported and pass against the replacement. +6. Manifest and artifact request/stream errors discard associated URLs before + logging or display while retaining transport category and HTTP status. When upgrading, diff this directory against the exact new crate source, retain the upstream license files, update the checksum/version above, regenerate diff --git a/vendor/tauri-plugin-updater-2.10.1/src/error.rs b/vendor/tauri-plugin-updater-2.10.1/src/error.rs index ca4d559..a02059a 100644 --- a/vendor/tauri-plugin-updater-2.10.1/src/error.rs +++ b/vendor/tauri-plugin-updater-2.10.1/src/error.rs @@ -102,6 +102,48 @@ pub enum Error { Tauri(#[from] tauri::Error), } +impl Error { + pub(crate) fn sanitized_reqwest( + operation: &'static str, + resource: &'static str, + error: reqwest::Error, + ) -> Self { + // Request and response-body errors can retain the final redirect URL. + // Object-store redirects commonly put credentials in that URL's query, + // so reduce the error to stable diagnostics before it reaches Display. + let error = error.without_url(); + let category = if error.is_timeout() { + "timeout" + } else if error.is_connect() { + "connect" + } else if error.is_redirect() { + "redirect" + } else if error.is_status() { + "status" + } else if error.is_body() { + "body" + } else if error.is_decode() { + "decode" + } else if error.is_request() { + "request" + } else if error.is_builder() { + "builder" + } else { + "transport" + }; + let status = error + .status() + .map(|status| format!("; HTTP {status}")) + .unwrap_or_default(); + let diagnostic = if error.is_timeout() { + format!("network timeout (timed out; {category}{status})") + } else { + format!("network error ({category}{status})") + }; + Self::Network(format!("{operation} {resource}: {diagnostic}")) + } +} + impl Serialize for Error { fn serialize(&self, serializer: S) -> std::result::Result where diff --git a/vendor/tauri-plugin-updater-2.10.1/src/updater.rs b/vendor/tauri-plugin-updater-2.10.1/src/updater.rs index 81cb404..3420f09 100644 --- a/vendor/tauri-plugin-updater-2.10.1/src/updater.rs +++ b/vendor/tauri-plugin-updater-2.10.1/src/updater.rs @@ -42,6 +42,7 @@ use crate::{ }; const UPDATER_USER_AGENT: &str = concat!(env!("CARGO_PKG_NAME"), "/", env!("CARGO_PKG_VERSION"),); +const CONFIGURED_PROXY_LOG_MESSAGE: &str = "using configured proxy"; /// Safe defaults for callers that do not override the response limits. /// @@ -66,16 +67,24 @@ pub enum Installer { #[cfg(test)] mod response_limit_tests { use super::{ - read_response_limited, UpdaterBuilder, DEFAULT_MAX_DOWNLOAD_SIZE, DEFAULT_MAX_MANIFEST_SIZE, + read_response_limited, UpdaterBuilder, CONFIGURED_PROXY_LOG_MESSAGE, + DEFAULT_MAX_DOWNLOAD_SIZE, DEFAULT_MAX_MANIFEST_SIZE, }; use crate::{Config, Error}; + use futures_util::StreamExt; + use reqwest::ResponseBuilderExt; use std::io::{Read, Write}; use std::net::TcpListener; use std::thread; fn serve_once(parts: Vec<&'static [u8]>) -> (String, thread::JoinHandle<()>) { + serve_once_at("/body", parts.into_iter().map(<[u8]>::to_vec).collect()) + } + + fn serve_once_at(target: &str, parts: Vec>) -> (String, thread::JoinHandle<()>) { let listener = TcpListener::bind("127.0.0.1:0").unwrap(); let address = listener.local_addr().unwrap(); + let target = target.to_string(); let handle = thread::spawn(move || { let (mut stream, _) = listener.accept().unwrap(); let mut request = Vec::new(); @@ -88,13 +97,22 @@ mod response_limit_tests { request.extend_from_slice(&buffer[..count]); } for part in parts { - if stream.write_all(part).is_err() { + if stream.write_all(&part).is_err() { break; } let _ = stream.flush(); } }); - (format!("http://{address}/body"), handle) + (format!("http://{address}{target}"), handle) + } + + fn assert_no_sensitive_url(message: &str, sensitive: &[&str]) { + for value in sensitive { + assert!( + !message.contains(value), + "network error exposed {value:?}: {message}" + ); + } } fn install_test_crypto_provider() { @@ -121,6 +139,204 @@ mod response_limit_tests { assert!(builder.max_download_size > 0); } + #[test] + fn configured_proxy_debug_message_cannot_embed_proxy_url() { + assert_eq!(CONFIGURED_PROXY_LOG_MESSAGE, "using configured proxy"); + assert_no_sensitive_url( + CONFIGURED_PROXY_LOG_MESSAGE, + &["https://", "/private", "?token=", "private-secret"], + ); + } + + #[test] + fn sanitized_status_error_preserves_status_without_associated_url() { + let secret_url = url::Url::parse( + "https://secret-host.example/private/artifact?X-Amz-Credential=private-credential&X-Amz-Signature=private-signature", + ) + .unwrap(); + let response = http::Response::builder() + .status(http::StatusCode::FORBIDDEN) + .url(secret_url) + .body("") + .unwrap(); + let raw = reqwest::Response::from(response) + .error_for_status() + .unwrap_err(); + let error = Error::sanitized_reqwest("fetch", "updater artifact", raw); + let message = error.to_string(); + + assert!(message.contains("status"), "missing category: {message}"); + assert!( + message.contains("403 Forbidden"), + "missing status: {message}" + ); + assert_no_sensitive_url( + &message, + &[ + "https://", + "secret-host.example", + "/private/artifact", + "X-Amz-Credential", + "private-credential", + "X-Amz-Signature", + "private-signature", + ], + ); + } + + #[test] + fn sanitized_stream_error_drops_associated_url_and_keeps_body_category() { + let secret_url = url::Url::parse( + "https://secret-host.example/private/artifact?X-Amz-Signature=private-signature", + ) + .unwrap(); + let body = reqwest::Body::wrap_stream(futures_util::stream::once(async { + Err::, std::io::Error>(std::io::Error::new( + std::io::ErrorKind::ConnectionReset, + "forced stream reset", + )) + })); + let response = http::Response::builder() + .status(http::StatusCode::OK) + .url(secret_url.clone()) + .body(body) + .unwrap(); + let response = reqwest::Response::from(response); + let raw = tauri::async_runtime::block_on(async move { + response.bytes_stream().next().await.unwrap().unwrap_err() + }) + .with_url(secret_url); + let error = Error::sanitized_reqwest("read", "updater artifact", raw); + let message = error.to_string(); + + assert!( + message.contains("body") || message.contains("decode"), + "missing stream category: {message}" + ); + assert_no_sensitive_url( + &message, + &[ + "https://", + "secret-host.example", + "/private/artifact", + "X-Amz-Signature", + "private-signature", + ], + ); + } + + #[test] + fn manifest_send_error_does_not_expose_endpoint_url() { + install_test_crypto_provider(); + let listener = TcpListener::bind("127.0.0.1:0").unwrap(); + let address = listener.local_addr().unwrap(); + drop(listener); + let endpoint = url::Url::parse(&format!( + "http://{address}/private/latest.json?X-Amz-Signature=private-signature" + )) + .unwrap(); + let app = tauri::test::mock_app(); + let updater = UpdaterBuilder::new( + app.handle(), + Config { + dangerous_insecure_transport_protocol: true, + endpoints: vec![endpoint], + ..Default::default() + }, + ) + .target("test-target") + .no_proxy() + .build() + .unwrap(); + + let error = match tauri::async_runtime::block_on(updater.check()) { + Err(error) => error, + Ok(_) => panic!("unavailable manifest endpoint unexpectedly succeeded"), + }; + let message = error.to_string(); + + assert!( + message.contains("connect") || message.contains("request"), + "missing request category: {message}" + ); + assert_no_sensitive_url( + &message, + &[ + "http://", + &address.to_string(), + "/private/latest.json", + "X-Amz-Signature", + "private-signature", + ], + ); + } + + #[test] + fn artifact_send_error_does_not_expose_download_url() { + install_test_crypto_provider(); + let listener = TcpListener::bind("127.0.0.1:0").unwrap(); + let artifact_address = listener.local_addr().unwrap(); + drop(listener); + let artifact_url = format!( + "http://{artifact_address}/private/artifact?X-Amz-Credential=private-credential&X-Amz-Signature=private-signature" + ); + let manifest = serde_json::json!({ + "version": "999.0.0", + "platforms": { + "test-target": { + "url": artifact_url, + "signature": "not-reached" + } + } + }) + .to_string(); + let headers = format!( + "HTTP/1.1 200 OK\r\nContent-Length: {}\r\nConnection: close\r\n\r\n", + manifest.len() + ); + let (manifest_url, server) = serve_once_at( + "/latest.json", + vec![headers.into_bytes(), manifest.into_bytes()], + ); + let app = tauri::test::mock_app(); + let updater = UpdaterBuilder::new( + app.handle(), + Config { + dangerous_insecure_transport_protocol: true, + endpoints: vec![url::Url::parse(&manifest_url).unwrap()], + ..Default::default() + }, + ) + .target("test-target") + .no_proxy() + .build() + .unwrap(); + let update = tauri::async_runtime::block_on(updater.check()) + .unwrap() + .unwrap(); + server.join().unwrap(); + + let error = tauri::async_runtime::block_on(update.download(|_, _| {}, || {})).unwrap_err(); + let message = error.to_string(); + + assert!( + message.contains("connect") || message.contains("request"), + "missing request category: {message}" + ); + assert_no_sensitive_url( + &message, + &[ + "http://", + &artifact_address.to_string(), + "/private/artifact", + "X-Amz-Credential", + "private-credential", + "X-Amz-Signature", + "private-signature", + ], + ); + } + #[test] fn zero_limit_rejects_first_nonempty_response() { install_test_crypto_provider(); @@ -608,7 +824,7 @@ impl Updater { .replace("{{bundle_type}}", installer) .parse()?; - log::debug!("checking for updates {url}"); + log::debug!("checking for updates at configured endpoint"); #[cfg(feature = "rustls-tls")] if rustls::crypto::CryptoProvider::get_default().is_none() { @@ -630,8 +846,10 @@ impl Updater { log::debug!("disabling proxy"); request = request.no_proxy(); } else if let Some(ref proxy) = self.proxy { - log::debug!("using proxy {proxy}"); - let proxy = reqwest::Proxy::all(proxy.as_str())?; + log::debug!("{CONFIGURED_PROXY_LOG_MESSAGE}"); + let proxy = reqwest::Proxy::all(proxy.as_str()).map_err(|error| { + Error::sanitized_reqwest("configure", "updater manifest proxy", error) + })?; request = request.proxy(proxy); } @@ -640,11 +858,15 @@ impl Updater { } let response = request - .build()? + .build() + .map_err(|error| { + Error::sanitized_reqwest("build", "updater manifest client", error) + })? .get(url) .headers(headers.clone()) .send() - .await; + .await + .map_err(|error| Error::sanitized_reqwest("fetch", "updater manifest", error)); match response { Ok(res) => { @@ -663,13 +885,16 @@ impl Updater { ) .await?; let update_response: serde_json::Value = serde_json::from_slice(&manifest)?; - log::debug!("update response: {update_response:?}"); + log::debug!("received updater response"); raw_json = Some(update_response.clone()); match serde_json::from_value::(update_response) .map_err(Into::into) { Ok(release) => { - log::debug!("parsed release response {release:?}"); + log::debug!( + "parsed updater release response version={}", + release.version + ); last_error = None; remote_release = Some(release); // we found a release, break the loop @@ -688,7 +913,7 @@ impl Updater { } Err(err) => { log::error!("failed to check for updates: {err}"); - last_error = Some(err.into()) + last_error = Some(err) } } } @@ -857,18 +1082,22 @@ impl Update { if self.no_proxy { request = request.no_proxy(); } else if let Some(ref proxy) = self.proxy { - let proxy = reqwest::Proxy::all(proxy.as_str())?; + let proxy = reqwest::Proxy::all(proxy.as_str()).map_err(|error| { + Error::sanitized_reqwest("configure", "updater artifact proxy", error) + })?; request = request.proxy(proxy); } if let Some(ref configure_client) = self.configure_client { request = configure_client(request); } let response = request - .build()? + .build() + .map_err(|error| Error::sanitized_reqwest("build", "updater artifact client", error))? .get(self.download_url.clone()) .headers(headers) .send() - .await?; + .await + .map_err(|error| Error::sanitized_reqwest("fetch", "updater artifact", error))?; if !response.status().is_success() { return Err(Error::Network(format!( @@ -939,7 +1168,7 @@ where let mut observed = 0_u64; let mut stream = response.bytes_stream(); while let Some(chunk) = stream.next().await { - let chunk = chunk?; + let chunk = chunk.map_err(|error| Error::sanitized_reqwest("read", resource, error))?; observed = observed .checked_add(chunk.len() as u64) .ok_or(Error::ResponseTooLarge { From 592c39465e5339de54694b773f533bd21e8943af Mon Sep 17 00:00:00 2001 From: wangnov <48670012+Wangnov@users.noreply.github.com> Date: Sat, 11 Jul 2026 14:03:26 +0800 Subject: [PATCH 12/21] fix(updater): sanitize invalid manifest errors --- .../tauri-plugin-updater-2.10.1/VENDORED.md | 8 ++- .../tauri-plugin-updater-2.10.1/src/error.rs | 3 + .../src/updater.rs | 66 +++++++++++++++++-- 3 files changed, 68 insertions(+), 9 deletions(-) diff --git a/vendor/tauri-plugin-updater-2.10.1/VENDORED.md b/vendor/tauri-plugin-updater-2.10.1/VENDORED.md index ec1e33c..80622ff 100644 --- a/vendor/tauri-plugin-updater-2.10.1/VENDORED.md +++ b/vendor/tauri-plugin-updater-2.10.1/VENDORED.md @@ -21,8 +21,9 @@ cannot impose a response-body limit. This vendor adds: - the selected static-manifest platform key on `Update`; - public reuse of the plugin's exact minisign verification routine for signed release identity files; -- URL-free request and response-stream diagnostics, including fixed proxy and - endpoint debug messages so presigned URL credentials cannot enter logs; and +- URL-free request, response-stream, and manifest-schema diagnostics, including + fixed proxy and endpoint debug messages so untrusted strings or presigned URL + credentials cannot enter logs; and - regression tests for header-declared and chunked/no-header oversized bodies. No installer, extraction, proxy, TLS, or minisign artifact semantics are @@ -45,7 +46,8 @@ candidate upstream version is verified to provide all of these properties: 5. The tests in this vendor and the Manager replay/fallback tests have been ported and pass against the replacement. 6. Manifest and artifact request/stream errors discard associated URLs before - logging or display while retaining transport category and HTTP status. + logging or display while retaining transport category and HTTP status, and + malformed manifest schemas never echo attacker-controlled string values. When upgrading, diff this directory against the exact new crate source, retain the upstream license files, update the checksum/version above, regenerate diff --git a/vendor/tauri-plugin-updater-2.10.1/src/error.rs b/vendor/tauri-plugin-updater-2.10.1/src/error.rs index a02059a..9fed4d2 100644 --- a/vendor/tauri-plugin-updater-2.10.1/src/error.rs +++ b/vendor/tauri-plugin-updater-2.10.1/src/error.rs @@ -24,6 +24,9 @@ pub enum Error { /// Could not fetch a valid response from the server. #[error("Could not fetch a valid release JSON from the remote")] ReleaseNotFound, + /// The updater JSON parsed, but its schema was not a valid release. + #[error("invalid updater manifest schema")] + InvalidManifestSchema, /// Unsupported app architecture. #[error("Unsupported application architecture, expected one of `x86`, `x86_64`, `arm` or `aarch64`.")] UnsupportedArch, diff --git a/vendor/tauri-plugin-updater-2.10.1/src/updater.rs b/vendor/tauri-plugin-updater-2.10.1/src/updater.rs index 3420f09..24e1ede 100644 --- a/vendor/tauri-plugin-updater-2.10.1/src/updater.rs +++ b/vendor/tauri-plugin-updater-2.10.1/src/updater.rs @@ -271,6 +271,59 @@ mod response_limit_tests { ); } + #[test] + fn malformed_manifest_schema_does_not_echo_secret_string_values() { + install_test_crypto_provider(); + let secret_url = "https://secret-host.example/private/latest.json?X-Amz-Credential=private-credential&X-Amz-Signature=private-signature"; + let manifest = serde_json::json!({ + "version": "999.0.0", + "platforms": secret_url, + }) + .to_string(); + let headers = format!( + "HTTP/1.1 200 OK\r\nContent-Length: {}\r\nConnection: close\r\n\r\n", + manifest.len() + ); + let (manifest_url, server) = serve_once_at( + "/latest.json", + vec![headers.into_bytes(), manifest.into_bytes()], + ); + let app = tauri::test::mock_app(); + let updater = UpdaterBuilder::new( + app.handle(), + Config { + dangerous_insecure_transport_protocol: true, + endpoints: vec![url::Url::parse(&manifest_url).unwrap()], + ..Default::default() + }, + ) + .target("test-target") + .no_proxy() + .build() + .unwrap(); + + let error = match tauri::async_runtime::block_on(updater.check()) { + Err(error) => error, + Ok(_) => panic!("malformed manifest schema unexpectedly succeeded"), + }; + server.join().unwrap(); + let message = error.to_string(); + + assert_eq!(message, "invalid updater manifest schema"); + assert_no_sensitive_url( + &message, + &[ + "https://", + "secret-host.example", + "/private/latest.json", + "X-Amz-Credential", + "private-credential", + "X-Amz-Signature", + "private-signature", + ], + ); + } + #[test] fn artifact_send_error_does_not_expose_download_url() { install_test_crypto_provider(); @@ -887,9 +940,7 @@ impl Updater { let update_response: serde_json::Value = serde_json::from_slice(&manifest)?; log::debug!("received updater response"); raw_json = Some(update_response.clone()); - match serde_json::from_value::(update_response) - .map_err(Into::into) - { + match serde_json::from_value::(update_response) { Ok(release) => { log::debug!( "parsed updater release response version={}", @@ -900,9 +951,12 @@ impl Updater { // we found a release, break the loop break; } - Err(err) => { - log::error!("failed to deserialize update response: {err}"); - last_error = Some(err) + Err(_) => { + // Serde type errors can quote the complete offending + // string. An untrusted manifest could place a presigned + // URL there, so expose only a fixed schema category. + log::error!("failed to deserialize update response: invalid updater manifest schema"); + last_error = Some(Error::InvalidManifestSchema) } } } else { From fe8df9b1589c86850215e1c98b9c2587f2a910d6 Mon Sep 17 00:00:00 2001 From: wangnov <48670012+Wangnov@users.noreply.github.com> Date: Sat, 11 Jul 2026 14:03:26 +0800 Subject: [PATCH 13/21] test(updater): await handoff hydration --- src/app/managerUpdate.test.tsx | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/app/managerUpdate.test.tsx b/src/app/managerUpdate.test.tsx index 2c02324..f55c67b 100644 --- a/src/app/managerUpdate.test.tsx +++ b/src/app/managerUpdate.test.tsx @@ -417,7 +417,9 @@ describe("manager self-update state machine", () => { ); renderManager({ currentVersion: "1.0.0" }); - expect(await screen.findByTestId("manager-status")).toHaveTextContent("installing"); + await waitFor(() => + expect(screen.getByTestId("manager-status")).toHaveTextContent("installing"), + ); expect(JSON.parse(localStorage.getItem(MANAGER_UPDATE_COMPLETION_KEY) ?? "null")).toEqual( expect.objectContaining({ from: "1.0.0", to: "2.0.0", stage: "installing" }), ); From 244d14a8c8b799a3a2eeccef7346f884f03b328c Mon Sep 17 00:00:00 2001 From: wangnov <48670012+Wangnov@users.noreply.github.com> Date: Sat, 11 Jul 2026 14:29:02 +0800 Subject: [PATCH 14/21] fix(release): run publication from trusted main --- .github/workflows/ci.yml | 3 +- .github/workflows/release-source.yml | 33 ++ .github/workflows/release.yml | 440 +++++++++++++++++++---- docs/release.md | 40 ++- docs/releases/TEMPLATE.md | 3 +- scripts/check-release-reuse.mjs | 6 +- scripts/check-release-source-ancestor.sh | 42 +++ scripts/check-release-tag-protection.mjs | 19 +- scripts/check-release-version.mjs | 4 +- scripts/mirror-release.test.mjs | 2 +- scripts/release-binding.mjs | 264 ++++++++++++++ scripts/release-workflow.test.mjs | 373 +++++++++++++++++-- 12 files changed, 1127 insertions(+), 102 deletions(-) create mode 100644 .github/workflows/release-source.yml create mode 100644 scripts/check-release-source-ancestor.sh create mode 100644 scripts/release-binding.mjs diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index da040fe..faa91db 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -2,7 +2,8 @@ name: CI # Fast pull-request gate: type-check, unit tests and a cross-platform Rust # clippy/test pass. The heavy signed/notarized bundle build stays in -# release.yml (tags only) — this never builds or signs the .app. +# the default-branch release.yml (signalled by v* tags) — this never builds or +# signs the .app. on: pull_request: push: diff --git a/.github/workflows/release-source.yml b/.github/workflows/release-source.yml new file mode 100644 index 0000000..70c893f --- /dev/null +++ b/.github/workflows/release-source.yml @@ -0,0 +1,33 @@ +name: Release source + +# This workflow is only an unprivileged signal. Tag workflows are loaded from +# the tagged commit, so this file must never receive an environment, secrets, +# write permissions, checkout, or artifacts. The credentialed Release workflow +# is triggered with workflow_run and is therefore loaded from the default branch. +on: + push: + tags: ["v*"] + +permissions: {} + +jobs: + signal: + runs-on: ubuntu-latest + permissions: {} + steps: + - name: Validate release signal shape + shell: bash + env: + RELEASE_TAG: ${{ github.ref_name }} + RELEASE_SOURCE_SHA: ${{ github.sha }} + run: | + set -euo pipefail + if [[ ! "$RELEASE_TAG" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$ ]]; then + echo "::error::release tag must be a semantic vX.Y.Z tag: $RELEASE_TAG" + exit 1 + fi + if [[ ! "$RELEASE_SOURCE_SHA" =~ ^[0-9a-f]{40}$ ]]; then + echo "::error::release source must be a full commit SHA" + exit 1 + fi + echo "Unprivileged release signal accepted for $RELEASE_TAG at $RELEASE_SOURCE_SHA" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e1c51b8..1f3e8ec 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,11 +1,11 @@ name: Release -# Tag-driven cross-platform release: +# Default-branch, tag-signalled cross-platform release: # build (unsigned) → macOS finalize (adaptive icon + inside-out Developer ID # sign + notarize + staple + repackage updater/dmg) → collect → publish a # GitHub Release with the Tauri updater manifest (latest.json). # -# Required repo secrets (Settings ▸ Secrets and variables ▸ Actions / release env): +# Required `release` environment secrets (never repository/org secrets): # APPLE_CERTIFICATE base64 of your "Developer ID Application" .p12 # APPLE_CERTIFICATE_PASSWORD password for that .p12 # APPLE_SIGNING_IDENTITY "Developer ID Application: NAME (TEAMID)" @@ -36,6 +36,9 @@ name: Release # release publisher and forbid every update/deletion; the same read-only token # verifies those policies and the live peeled SHA. # Every reused asset is also pinned to the API-provided sha256 digest. +# Configure the `release` environment for the protected default branch only; +# never allow v* tags. A tagged revision may change release-source.yml, but it +# cannot claim this environment and the signal itself has no credentials. # The old MANAGER_*_ACCESS_KEY_ID / SECRET_ACCESS_KEY names must stay deleted; # otherwise a historical workflow revision could still perform unconditional writes. # @@ -46,8 +49,12 @@ name: Release # vars.WINDOWS_TIMESTAMP_URL optional RFC3161 timestamp URL override on: - push: - tags: ["v*"] + # `workflow_run` always loads this credentialed workflow from the repository + # default branch. Never put credentials in release-source.yml: tag-triggered + # workflow definitions are loaded from the tagged commit. + workflow_run: + workflows: ["Release source"] + types: [completed] workflow_dispatch: inputs: target_tag: @@ -69,7 +76,11 @@ permissions: contents: read env: - RELEASE_TAG: ${{ inputs.target_tag || github.ref_name }} + AUTHORIZED_RELEASE_ACTOR_LOGIN: Wangnov + AUTHORIZED_RELEASE_ACTOR_ID: "48670012" + RELEASE_TAG: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_branch || inputs.target_tag }} + RELEASE_SOURCE_SHA: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || '' }} + TRUSTED_RELEASE_INVOCATION: ${{ github.event_name == 'workflow_run' && 'tag-signal' || 'manual-recovery' }} # Serialize every credentialed mirror writer through one release lane. This is a # correctness boundary for the unconditional IHEP follower, not an optimization. @@ -81,51 +92,107 @@ concurrency: queue: max jobs: - # A manual dispatch may execute only from the protected default branch and - # must name an existing target_tag. This also rejects an empty-input dispatch - # from an attacker-controlled branch named like a release tag. - # Keep the rejecting path free of checkout, environments, permissions, and - # secrets so an untrusted ref cannot reach any credential-bearing job. Compare - # the complete ref, not ref_name: a tag named like the default branch must fail. - reject_untrusted_target_dispatch: - if: ${{ github.event_name == 'workflow_dispatch' && github.ref != format('refs/heads/{0}', github.event.repository.default_branch) }} - runs-on: ubuntu-latest - permissions: {} - steps: - - name: Reject manual dispatch outside the default branch - env: - DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} - DISPATCH_REF: ${{ github.ref }} - run: | - echo "::error::target_tag must be dispatched from refs/heads/$DEFAULT_BRANCH, not $DISPATCH_REF" - exit 1 - + # This is the only path from the unprivileged tag signal to credentialed jobs. + # It deliberately has no checkout, environment, write permission, or secrets. + # Every field is copied through the environment so event data is never + # interpolated into shell source. preflight: - if: ${{ github.event_name != 'workflow_dispatch' || github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }} runs-on: ubuntu-latest permissions: {} + outputs: + release_tag: ${{ steps.validate.outputs.release_tag }} + release_source_sha: ${{ steps.validate.outputs.release_source_sha }} + trusted_invocation: ${{ steps.validate.outputs.trusted_invocation }} steps: - name: Validate release invocation without secrets + id: validate shell: bash env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} + CURRENT_TRIGGERING_ACTOR_LOGIN: ${{ github.triggering_actor }} DISPATCH_REF: ${{ github.ref }} + DISPATCH_ACTOR_LOGIN: ${{ github.actor }} + DISPATCH_ACTOR_ID: ${{ github.actor_id }} + DISPATCH_TRIGGERING_ACTOR_LOGIN: ${{ github.triggering_actor }} EVENT_NAME: ${{ github.event_name }} REQUESTED_TARGET_TAG: ${{ inputs.target_tag || '' }} + UPSTREAM_ACTOR_LOGIN: ${{ github.event.workflow_run.actor.login || '' }} + UPSTREAM_ACTOR_ID: ${{ github.event.workflow_run.actor.id || '' }} + UPSTREAM_CONCLUSION: ${{ github.event.workflow_run.conclusion || '' }} + UPSTREAM_EVENT: ${{ github.event.workflow_run.event || '' }} + UPSTREAM_HEAD_BRANCH: ${{ github.event.workflow_run.head_branch || '' }} + UPSTREAM_HEAD_REPOSITORY: ${{ github.event.workflow_run.head_repository.full_name || '' }} + UPSTREAM_HEAD_SHA: ${{ github.event.workflow_run.head_sha || '' }} + UPSTREAM_PATH: ${{ github.event.workflow_run.path || '' }} + UPSTREAM_REPOSITORY: ${{ github.event.workflow_run.repository.full_name || '' }} + UPSTREAM_TRIGGERING_ACTOR_LOGIN: ${{ github.event.workflow_run.triggering_actor.login || '' }} + UPSTREAM_TRIGGERING_ACTOR_ID: ${{ github.event.workflow_run.triggering_actor.id || '' }} + UPSTREAM_WORKFLOW_NAME: ${{ github.event.workflow_run.name || '' }} run: | set -euo pipefail - if [[ "$EVENT_NAME" == "workflow_dispatch" && "$DISPATCH_REF" != "refs/heads/$DEFAULT_BRANCH" ]]; then - echo "::error::workflow_dispatch must run from refs/heads/$DEFAULT_BRANCH, not $DISPATCH_REF" + [[ "$CURRENT_TRIGGERING_ACTOR_LOGIN" == "$AUTHORIZED_RELEASE_ACTOR_LOGIN" ]] || { + echo "::error::release workflow rerun actor is not the authorized publisher" exit 1 - fi - if [[ "$EVENT_NAME" == "workflow_dispatch" && -z "$REQUESTED_TARGET_TAG" ]]; then - echo "::error::workflow_dispatch requires a non-empty target_tag" + } + if [[ "$EVENT_NAME" == "workflow_run" ]]; then + [[ "$UPSTREAM_WORKFLOW_NAME" == "Release source" ]] || { + echo "::error::unexpected upstream workflow: $UPSTREAM_WORKFLOW_NAME" + exit 1 + } + [[ "$UPSTREAM_PATH" == ".github/workflows/release-source.yml" ]] || { + echo "::error::unexpected upstream workflow path: $UPSTREAM_PATH" + exit 1 + } + [[ "$UPSTREAM_EVENT" == "push" && "$UPSTREAM_CONCLUSION" == "success" ]] || { + echo "::error::release source must be a successful push workflow" + exit 1 + } + [[ "$UPSTREAM_REPOSITORY" == "$GITHUB_REPOSITORY" && "$UPSTREAM_HEAD_REPOSITORY" == "$GITHUB_REPOSITORY" ]] || { + echo "::error::release source must originate in $GITHUB_REPOSITORY" + exit 1 + } + [[ "$UPSTREAM_ACTOR_LOGIN" == "$AUTHORIZED_RELEASE_ACTOR_LOGIN" && "$UPSTREAM_ACTOR_ID" == "$AUTHORIZED_RELEASE_ACTOR_ID" ]] || { + echo "::error::release source actor is not the authorized publisher" + exit 1 + } + [[ "$UPSTREAM_TRIGGERING_ACTOR_LOGIN" == "$AUTHORIZED_RELEASE_ACTOR_LOGIN" && "$UPSTREAM_TRIGGERING_ACTOR_ID" == "$AUTHORIZED_RELEASE_ACTOR_ID" ]] || { + echo "::error::release source rerun actor is not the authorized publisher" + exit 1 + } + [[ "$UPSTREAM_HEAD_SHA" =~ ^[0-9a-f]{40}$ ]] || { + echo "::error::release source head_sha must be a full commit SHA" + exit 1 + } + RELEASE_TAG="$UPSTREAM_HEAD_BRANCH" + RELEASE_SOURCE_SHA="$UPSTREAM_HEAD_SHA" + TRUSTED_RELEASE_INVOCATION="tag-signal" + elif [[ "$EVENT_NAME" == "workflow_dispatch" ]]; then + [[ "$DISPATCH_REF" == "refs/heads/$DEFAULT_BRANCH" ]] || { + echo "::error::workflow_dispatch must run from refs/heads/$DEFAULT_BRANCH, not $DISPATCH_REF" + exit 1 + } + [[ "$DISPATCH_ACTOR_LOGIN" == "$AUTHORIZED_RELEASE_ACTOR_LOGIN" && "$DISPATCH_ACTOR_ID" == "$AUTHORIZED_RELEASE_ACTOR_ID" && "$DISPATCH_TRIGGERING_ACTOR_LOGIN" == "$AUTHORIZED_RELEASE_ACTOR_LOGIN" ]] || { + echo "::error::workflow_dispatch actor is not the authorized publisher" + exit 1 + } + [[ -n "$REQUESTED_TARGET_TAG" ]] || { + echo "::error::workflow_dispatch requires a non-empty target_tag" + exit 1 + } + RELEASE_TAG="$REQUESTED_TARGET_TAG" + RELEASE_SOURCE_SHA="" + TRUSTED_RELEASE_INVOCATION="manual-recovery" + else + echo "::error::unsupported release event: $EVENT_NAME" exit 1 fi if [[ ! "$RELEASE_TAG" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$ ]]; then echo "::error::release tag must be a semantic vX.Y.Z tag: $RELEASE_TAG" exit 1 fi + printf 'release_tag=%s\n' "$RELEASE_TAG" >> "$GITHUB_OUTPUT" + printf 'release_source_sha=%s\n' "$RELEASE_SOURCE_SHA" >> "$GITHUB_OUTPUT" + printf 'trusted_invocation=%s\n' "$TRUSTED_RELEASE_INVOCATION" >> "$GITHUB_OUTPUT" prepare: needs: preflight @@ -137,7 +204,19 @@ jobs: outputs: release_reusable: ${{ steps.lookup.outputs.release_reusable }} release_asset_digests: ${{ steps.lookup.outputs.release_asset_digests }} + release_source_sha: ${{ steps.tag_source.outputs.release_source_sha }} steps: + - name: Authorize credentialed job rerun actor + shell: bash + env: + CURRENT_TRIGGERING_ACTOR_LOGIN: ${{ github.triggering_actor }} + run: | + set -euo pipefail + [[ "$CURRENT_TRIGGERING_ACTOR_LOGIN" == "$AUTHORIZED_RELEASE_ACTOR_LOGIN" ]] || { + echo "::error::credentialed release job rerun actor is not the authorized publisher" + exit 1 + } + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false @@ -146,31 +225,46 @@ jobs: with: node-version: 20 - # Verify the release source rather than the workflow source. For a - # target_tag recovery the workflow itself comes from the protected default - # branch, while the six application version declarations come from the tag. + # Resolve the live tag through the API before any tag checkout. A + # workflow_run must still point at the exact SHA carried by the successful + # signal; an authorized manual recovery may resolve the immutable tag here. + - name: Resolve protected immutable release tag + id: tag_source + env: + ALLOW_RELEASE_SHA_RESOLUTION: ${{ needs.preflight.outputs.trusted_invocation == 'manual-recovery' && '1' || '0' }} + GH_TOKEN: ${{ secrets.IMMUTABLE_RELEASES_READ_TOKEN }} + RELEASE_SOURCE_SHA: ${{ needs.preflight.outputs.release_source_sha }} + run: node scripts/check-release-tag-protection.mjs "$RELEASE_TAG" "$RELEASE_SOURCE_SHA" + + # The root checkout contains only the trusted default-branch workflow and + # release scripts. Check out application source separately by the already + # verified commit SHA, never by a mutable tag name. - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: - ref: ${{ env.RELEASE_TAG }} + ref: ${{ steps.tag_source.outputs.release_source_sha }} path: release-source persist-credentials: false + fetch-depth: 0 - name: Match release tag to every application version declaration shell: bash + env: + EXPECTED_RELEASE_SOURCE_SHA: ${{ steps.tag_source.outputs.release_source_sha }} run: | set -euo pipefail node scripts/check-release-version.mjs source "$RELEASE_TAG" release-source release_source_sha="$(git -C release-source rev-parse HEAD)" - if [[ "$GITHUB_EVENT_NAME" == "push" && "$release_source_sha" != "$GITHUB_SHA" ]]; then - echo "::error::release tag $RELEASE_TAG moved away from triggering commit $GITHUB_SHA" + if [[ "$release_source_sha" != "$EXPECTED_RELEASE_SOURCE_SHA" ]]; then + echo "::error::release checkout differs from verified commit $EXPECTED_RELEASE_SOURCE_SHA" exit 1 fi echo "RELEASE_SOURCE_SHA=$release_source_sha" >> "$GITHUB_ENV" - - name: Require protected immutable release tag + - name: Require release source merged into live default branch env: - GH_TOKEN: ${{ secrets.IMMUTABLE_RELEASES_READ_TOKEN }} - run: node scripts/check-release-tag-protection.mjs "$RELEASE_TAG" "$RELEASE_SOURCE_SHA" + DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} + VERIFIED_RELEASE_SOURCE_SHA: ${{ steps.tag_source.outputs.release_source_sha }} + run: bash scripts/check-release-source-ancestor.sh release-source "$VERIFIED_RELEASE_SOURCE_SHA" "$DEFAULT_BRANCH" - name: Require GitHub Immutable Releases env: @@ -207,13 +301,18 @@ jobs: fi build: - needs: prepare - if: ${{ needs.prepare.result == 'success' && needs.prepare.outputs.release_reusable != 'true' && github.ref_type == 'tag' && startsWith(github.ref_name, 'v') && !(github.event_name == 'workflow_dispatch' && inputs.target_tag != '') }} - # Repo admins should configure the release environment and copy signing - # secrets there before moving them off repo-level Actions secrets. + needs: [preflight, prepare] + if: ${{ needs.prepare.result == 'success' && needs.prepare.outputs.release_reusable != 'true' && needs.preflight.outputs.trusted_invocation == 'tag-signal' }} + # All signing secrets live only in the default-branch-restricted release + # environment. Never duplicate them as repository or organization secrets. environment: release + env: + RELEASE_SOURCE_SHA: ${{ needs.prepare.outputs.release_source_sha }} permissions: contents: read + defaults: + run: + working-directory: release-source strategy: fail-fast: false matrix: @@ -234,14 +333,49 @@ jobs: } runs-on: ${{ matrix.platform }} steps: + - name: Authorize credentialed job rerun actor + shell: bash + env: + CURRENT_TRIGGERING_ACTOR_LOGIN: ${{ github.triggering_actor }} + run: | + set -euo pipefail + [[ "$CURRENT_TRIGGERING_ACTOR_LOGIN" == "$AUTHORIZED_RELEASE_ACTOR_LOGIN" ]] || { + echo "::error::credentialed release job rerun actor is not the authorized publisher" + exit 1 + } + + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: + ref: ${{ needs.prepare.outputs.release_source_sha }} + path: release-source persist-credentials: false + fetch-depth: 0 + + # A successful prepare may belong to an earlier attempt. Re-fetch the live + # default branch before executing application-controlled build code or + # exposing signing credentials to later steps. + - name: Re-check release source before build + shell: bash + env: + DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} + run: | + set -euo pipefail + [[ "$(git rev-parse HEAD)" == "$RELEASE_SOURCE_SHA" ]] || { + echo "::error::release checkout differs from verified commit $RELEASE_SOURCE_SHA" + exit 1 + } + node ../scripts/check-release-version.mjs source "$RELEASE_TAG" . + bash ../scripts/check-release-source-ancestor.sh . "$RELEASE_SOURCE_SHA" "$DEFAULT_BRANCH" - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 with: node-version: 20 cache: npm + cache-dependency-path: release-source/package-lock.json - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable with: @@ -249,7 +383,7 @@ jobs: - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 with: - workspaces: src-tauri -> target + workspaces: release-source/src-tauri -> target - run: npm ci @@ -532,11 +666,14 @@ jobs: echo "Canonical artifacts: $artifact_names" release: - if: ${{ always() && needs.prepare.result == 'success' && needs.select_artifacts.result == 'success' && startsWith(inputs.target_tag || github.ref_name, 'v') }} - needs: [prepare, build, select_artifacts] - # Repo admins should configure the release environment and copy mirror - # secrets there before moving them off repo-level Actions secrets. + if: ${{ always() && needs.preflight.result == 'success' && needs.prepare.result == 'success' && needs.select_artifacts.result == 'success' }} + needs: [preflight, prepare, build, select_artifacts] + # All mirror credentials live only in the default-branch-restricted release + # environment. Never duplicate them as repository or organization secrets. environment: release + env: + TRUSTED_WORKFLOW_SHA: ${{ github.workflow_sha }} + TRUSTED_WORKFLOW_SOURCE_SHA: ${{ github.sha }} permissions: contents: write actions: write # dispatch winget.yml after publishing (release events from GITHUB_TOKEN don't cascade) @@ -544,6 +681,17 @@ jobs: attestations: write runs-on: ubuntu-latest steps: + - name: Authorize credentialed job rerun actor + shell: bash + env: + CURRENT_TRIGGERING_ACTOR_LOGIN: ${{ github.triggering_actor }} + run: | + set -euo pipefail + [[ "$CURRENT_TRIGGERING_ACTOR_LOGIN" == "$AUTHORIZED_RELEASE_ACTOR_LOGIN" ]] || { + echo "::error::credentialed release job rerun actor is not the authorized publisher" + exit 1 + } + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false @@ -569,25 +717,41 @@ jobs: with: node-version: 20 + # Re-resolve tag policy on every release-job attempt. For manual recovery + # this independently resolves the immutable tag; a signal run must still + # match the SHA carried by the original successful push workflow. + - name: Re-resolve protected immutable release tag + id: tag_source + env: + ALLOW_RELEASE_SHA_RESOLUTION: ${{ needs.preflight.outputs.trusted_invocation == 'manual-recovery' && '1' || '0' }} + GH_TOKEN: ${{ secrets.IMMUTABLE_RELEASES_READ_TOKEN }} + RELEASE_SOURCE_SHA: ${{ needs.preflight.outputs.release_source_sha }} + run: node scripts/check-release-tag-protection.mjs "$RELEASE_TAG" "$RELEASE_SOURCE_SHA" + # Re-run this gate inside every release-job attempt. GitHub's "Re-run # failed jobs" does not re-run prepare, and no immutable publication may - # rely only on a previous attempt's version decision. + # rely only on a previous attempt's source or ancestry decision. - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: - ref: ${{ env.RELEASE_TAG }} + ref: ${{ steps.tag_source.outputs.release_source_sha }} path: release-source persist-credentials: false + fetch-depth: 0 - name: Re-check release tag against application versions shell: bash + env: + DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} + EXPECTED_RELEASE_SOURCE_SHA: ${{ steps.tag_source.outputs.release_source_sha }} run: | set -euo pipefail node scripts/check-release-version.mjs source "$RELEASE_TAG" release-source release_source_sha="$(git -C release-source rev-parse HEAD)" - if [[ "$GITHUB_EVENT_NAME" == "push" && "$release_source_sha" != "$GITHUB_SHA" ]]; then - echo "::error::release tag $RELEASE_TAG moved away from triggering commit $GITHUB_SHA" + if [[ "$release_source_sha" != "$EXPECTED_RELEASE_SOURCE_SHA" ]]; then + echo "::error::release checkout differs from verified commit $EXPECTED_RELEASE_SOURCE_SHA" exit 1 fi + bash scripts/check-release-source-ancestor.sh release-source "$release_source_sha" "$DEFAULT_BRANCH" echo "RELEASE_SOURCE_SHA=$release_source_sha" >> "$GITHUB_ENV" # Re-check on every release-job attempt. `prepare` is not rerun by @@ -642,7 +806,7 @@ jobs: gh api --method GET \ -H "Accept: application/vnd.github.raw+json" \ "repos/$GITHUB_REPOSITORY/contents/src-tauri/tauri.conf.json" \ - -f ref="$RELEASE_TAG" >"$release_config" + -f ref="$RELEASE_SOURCE_SHA" >"$release_config" if ! updater_public_key="$( jq -er ' .plugins.updater.pubkey @@ -666,6 +830,7 @@ jobs: run: | set -euo pipefail rm -rf dist + rm -f release-binding.json mkdir -p dist jq -er '.[]' <<<"$ARTIFACT_NAMES_JSON" | while IFS= read -r artifact; do gh run download "$GITHUB_RUN_ID" \ @@ -693,7 +858,8 @@ jobs: --repo "$GITHUB_REPOSITORY" \ --dir "$published" \ --pattern 'CodexAppManager*' \ - --pattern 'latest.json' + --pattern 'latest.json' \ + --pattern 'release-binding.json' test -f "$published/latest.json" || { echo "::error::published $RELEASE_TAG has no latest.json" exit 1 @@ -717,6 +883,8 @@ jobs: done < <(jq -r 'to_entries[] | [.key, .value] | @tsv' <<<"$RELEASE_ASSET_DIGESTS") cp "$published/latest.json" "$RUNNER_TEMP/published-latest.json" rm "$published/latest.json" + cp "$published/release-binding.json" release-binding.json + rm "$published/release-binding.json" rm -rf dist mv "$published" dist echo "existing=true" >> "$GITHUB_OUTPUT" @@ -801,6 +969,37 @@ jobs: dist \ "$RELEASE_TAURI_CONFIG" + # A workflow_run attestation identifies the trusted default-branch + # release.yml, not the tag ref. Bind the separately verified tag commit to + # the exact subject digests in a custom, immutable predicate. + - name: Resolve signed release binding + id: binding + shell: bash + env: + DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} + run: | + set -euo pipefail + shopt -s nullglob + subjects=(dist/* latest.json) + if [[ "${{ steps.release_source.outputs.existing }}" != "true" ]]; then + node scripts/release-binding.mjs create \ + release-binding.json \ + "$RELEASE_TAG" \ + "$RELEASE_SOURCE_SHA" \ + "$GITHUB_REPOSITORY" \ + "$DEFAULT_BRANCH" \ + "$TRUSTED_WORKFLOW_SHA" \ + "$TRUSTED_WORKFLOW_SOURCE_SHA" \ + "${subjects[@]}" + fi + node scripts/release-binding.mjs verify \ + release-binding.json \ + "$RELEASE_TAG" \ + "$RELEASE_SOURCE_SHA" \ + "$GITHUB_REPOSITORY" \ + "$DEFAULT_BRANCH" \ + "${subjects[@]}" + # Create provenance only for bytes produced by this release run, before a # draft can become immutable. A later failed-job rerun must never mint a # new statement that falsely attributes already-published bytes to the @@ -814,27 +1013,90 @@ jobs: dist/* latest.json + - name: Attest fresh release source binding + id: attest_binding + if: ${{ steps.release_source.outputs.existing != 'true' }} + uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1 + with: + subject-path: | + dist/* + latest.json + predicate-type: https://codexapp.agentsmirror.com/attestations/release-binding/v1 + predicate-path: release-binding.json + + # Verify the just-created bundle before any draft upload. The standard + # workflow_run identity is the trusted main workflow/source; the custom + # predicate and exact subject set provide the independent tag binding. + - name: Verify fresh release source binding + id: verify_fresh_binding + if: ${{ steps.release_source.outputs.existing != 'true' }} + shell: bash + env: + ATTESTATION_BUNDLE: ${{ steps.attest_binding.outputs.bundle-path }} + DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} + GH_TOKEN: ${{ github.token }} + run: | + set -euo pipefail + signer_workflow="$GITHUB_REPOSITORY/.github/workflows/release.yml" + verification="$RUNNER_TEMP/fresh-release-binding-verification.json" + gh attestation verify latest.json \ + --bundle "$ATTESTATION_BUNDLE" \ + --repo "$GITHUB_REPOSITORY" \ + --signer-workflow "$signer_workflow" \ + --signer-digest "$TRUSTED_WORKFLOW_SHA" \ + --source-ref "refs/heads/$DEFAULT_BRANCH" \ + --source-digest "$TRUSTED_WORKFLOW_SOURCE_SHA" \ + --predicate-type "https://codexapp.agentsmirror.com/attestations/release-binding/v1" \ + --deny-self-hosted-runners \ + --format json > "$verification" + node scripts/release-binding.mjs attestation "$verification" release-binding.json + # Existing immutable releases are accepted only when their downloaded, # API-digest-pinned bytes already carry provenance from this repository's - # release workflow and exact tag ref. This is verification, not a new OIDC - # statement; missing historical provenance fails closed. + # trusted default-branch release workflow revision. The custom predicate + # separately binds the immutable tag and peeled source SHA to every digest. + # This is verification, not a new OIDC statement; missing historical + # provenance or binding fails closed. - name: Verify existing immutable release provenance id: verify_existing_provenance if: ${{ steps.release_source.outputs.existing == 'true' }} shell: bash env: + DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} GH_TOKEN: ${{ github.token }} + RELEASE_SIGNER_SHA: ${{ steps.binding.outputs.signer_sha }} + RELEASE_WORKFLOW_SOURCE_SHA: ${{ steps.binding.outputs.source_sha }} run: | set -euo pipefail signer_workflow="$GITHUB_REPOSITORY/.github/workflows/release.yml" + predicate_type="https://codexapp.agentsmirror.com/attestations/release-binding/v1" + gh release verify "$RELEASE_TAG" \ + --repo "$GITHUB_REPOSITORY" \ + --format json > "$RUNNER_TEMP/immutable-release-attestation.json" + for file in dist/* latest.json release-binding.json; do + gh release verify-asset "$RELEASE_TAG" "$file" \ + --repo "$GITHUB_REPOSITORY" >/dev/null + done for file in dist/* latest.json; do gh attestation verify "$file" \ --repo "$GITHUB_REPOSITORY" \ --signer-workflow "$signer_workflow" \ - --source-ref "refs/tags/$RELEASE_TAG" \ - --source-digest "$RELEASE_SOURCE_SHA" \ + --signer-digest "$RELEASE_SIGNER_SHA" \ + --source-ref "refs/heads/$DEFAULT_BRANCH" \ + --source-digest "$RELEASE_WORKFLOW_SOURCE_SHA" \ --deny-self-hosted-runners >/dev/null - echo "Verified existing provenance: $(basename "$file")" + custom_json="$RUNNER_TEMP/release-binding-$(basename "$file").json" + gh attestation verify "$file" \ + --repo "$GITHUB_REPOSITORY" \ + --signer-workflow "$signer_workflow" \ + --signer-digest "$RELEASE_SIGNER_SHA" \ + --source-ref "refs/heads/$DEFAULT_BRANCH" \ + --source-digest "$RELEASE_WORKFLOW_SOURCE_SHA" \ + --predicate-type "$predicate_type" \ + --deny-self-hosted-runners \ + --format json > "$custom_json" + node scripts/release-binding.mjs attestation "$custom_json" release-binding.json + echo "Verified existing provenance and release binding: $(basename "$file")" done - name: Resolve provenance gate @@ -842,16 +1104,22 @@ jobs: shell: bash env: FRESH_ATTESTATION_OUTCOME: ${{ steps.attest_fresh.outcome }} + FRESH_BINDING_ATTESTATION_OUTCOME: ${{ steps.attest_binding.outcome }} + FRESH_BINDING_VERIFICATION_OUTCOME: ${{ steps.verify_fresh_binding.outcome }} EXISTING_PROVENANCE_OUTCOME: ${{ steps.verify_existing_provenance.outcome }} RELEASE_REUSED: ${{ steps.release_source.outputs.existing }} run: | set -euo pipefail if [[ "$RELEASE_REUSED" == "true" ]]; then [[ "$FRESH_ATTESTATION_OUTCOME" == "skipped" ]] + [[ "$FRESH_BINDING_ATTESTATION_OUTCOME" == "skipped" ]] + [[ "$FRESH_BINDING_VERIFICATION_OUTCOME" == "skipped" ]] [[ "$EXISTING_PROVENANCE_OUTCOME" == "success" ]] echo "mode=verified-existing-immutable-release" >> "$GITHUB_OUTPUT" else [[ "$FRESH_ATTESTATION_OUTCOME" == "success" ]] + [[ "$FRESH_BINDING_ATTESTATION_OUTCOME" == "success" ]] + [[ "$FRESH_BINDING_VERIFICATION_OUTCOME" == "success" ]] [[ "$EXISTING_PROVENANCE_OUTCOME" == "skipped" ]] echo "mode=fresh-build-attested-before-publication" >> "$GITHUB_OUTPUT" fi @@ -925,7 +1193,7 @@ jobs: # empty. GitHub's auto "What's Changed" section is appended either way. - name: Prepare release notes run: | - NOTES="docs/releases/$RELEASE_TAG.md" + NOTES="release-source/docs/releases/$RELEASE_TAG.md" if [ -f "$NOTES" ]; then cp "$NOTES" "$RUNNER_TEMP/release-notes.md" else @@ -943,6 +1211,7 @@ jobs: if [ ! -f dist/latest.json ]; then sha256sum latest.json >> SHA256SUMS fi + sha256sum release-binding.json >> SHA256SUMS cat SHA256SUMS - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable @@ -956,7 +1225,7 @@ jobs: status=0 : > release-assets/sbom-status.txt - if npm sbom --package-lock-only --sbom-format cyclonedx > release-assets/sbom-npm.cdx.json; then + if (cd release-source && npm sbom --package-lock-only --sbom-format cyclonedx) > release-assets/sbom-npm.cdx.json; then echo "npm SBOM: generated" >> release-assets/sbom-status.txt else echo "::warning::npm SBOM generation failed" @@ -965,7 +1234,7 @@ jobs: status=1 fi - if cargo metadata --manifest-path src-tauri/Cargo.toml --format-version=1 > "$RUNNER_TEMP/cargo-metadata.json" \ + if cargo metadata --manifest-path release-source/src-tauri/Cargo.toml --format-version=1 > "$RUNNER_TEMP/cargo-metadata.json" \ && node scripts/cargo-metadata-to-cyclonedx.mjs "$RUNNER_TEMP/cargo-metadata.json" release-assets/sbom-cargo.cdx.json; then echo "cargo SBOM: generated" >> release-assets/sbom-status.txt else @@ -980,11 +1249,14 @@ jobs: # The repository-level ruleset closes the long validation-to-publication # window by forbidding v* tag updates/deletions. Re-read both the policy and # the peeled commit immediately before creating the canonical draft. - - name: Re-check protected release tag before draft upload + - name: Re-check protected release source before draft upload if: ${{ steps.provenance.outputs.ready == 'true' && steps.release_source.outputs.existing != 'true' }} env: + DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} GH_TOKEN: ${{ secrets.IMMUTABLE_RELEASES_READ_TOKEN }} - run: node scripts/check-release-tag-protection.mjs "$RELEASE_TAG" "$RELEASE_SOURCE_SHA" + run: | + bash scripts/check-release-source-ancestor.sh release-source "$RELEASE_SOURCE_SHA" "$DEFAULT_BRANCH" + node scripts/check-release-tag-protection.mjs "$RELEASE_TAG" "$RELEASE_SOURCE_SHA" # Explicit draft-first publication keeps asset upload ahead of publication # for both stable and prerelease tags. This is required when GitHub immutable @@ -1006,16 +1278,20 @@ jobs: files: | dist/* latest.json + release-binding.json SHA256SUMS release-assets/* # Upload can take long enough for a repository policy regression to matter. # Fence the transition from mutable draft to immutable publication again. - - name: Re-check protected release tag before publication + - name: Re-check protected release source before publication if: ${{ steps.provenance.outputs.ready == 'true' && steps.release_source.outputs.existing != 'true' }} env: + DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} GH_TOKEN: ${{ secrets.IMMUTABLE_RELEASES_READ_TOKEN }} - run: node scripts/check-release-tag-protection.mjs "$RELEASE_TAG" "$RELEASE_SOURCE_SHA" + run: | + bash scripts/check-release-source-ancestor.sh release-source "$RELEASE_SOURCE_SHA" "$DEFAULT_BRANCH" + node scripts/check-release-tag-protection.mjs "$RELEASE_TAG" "$RELEASE_SOURCE_SHA" # Omitting `draft` tells action-gh-release v3 to publish the existing draft # after all uploads succeeded while retaining its stable/prerelease metadata. @@ -1054,13 +1330,30 @@ jobs: exit 1 fi cat "$verification_log" + release_attestation="$RUNNER_TEMP/immutable-release-attestation.json" + release_attestation_verified=false + for attempt in 1 2 3 4 5; do + if gh release verify "$RELEASE_TAG" \ + --repo "$GITHUB_REPOSITORY" \ + --format json > "$release_attestation"; then + release_attestation_verified=true + break + fi + sleep 3 + done + if [[ "$release_attestation_verified" != "true" ]]; then + echo "::error::published $RELEASE_TAG has no valid GitHub immutable release attestation" + exit 1 + fi release_asset_digests="$(sed -n 's/^release_asset_digests=//p' "$verification_output")" jq -e 'type == "object" and length > 0' <<<"$release_asset_digests" >/dev/null || { echo "::error::published immutable digest evidence is missing" exit 1 } - for file in dist/* latest.json; do + for file in dist/* latest.json release-binding.json; do name="$(basename "$file")" + gh release verify-asset "$RELEASE_TAG" "$file" \ + --repo "$GITHUB_REPOSITORY" >/dev/null expected_digest="$(jq -er --arg name "$name" '.[$name]' <<<"$release_asset_digests")" actual_digest="sha256:$(sha256sum "$file" | cut -d' ' -f1)" if [[ "$actual_digest" != "$expected_digest" ]]; then @@ -1070,6 +1363,17 @@ jobs: echo "Verified published attested digest: $name" done + # Existing immutable releases skip draft publication, so fence the final + # credentialed mirror promotion for both fresh and recovery paths. + - name: Re-check protected release source before final promotion + if: ${{ success() && steps.provenance.outputs.ready == 'true' && !contains(env.RELEASE_TAG, '-') }} + env: + DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} + GH_TOKEN: ${{ secrets.IMMUTABLE_RELEASES_READ_TOKEN }} + run: | + bash scripts/check-release-source-ancestor.sh release-source "$RELEASE_SOURCE_SHA" "$DEFAULT_BRANCH" + node scripts/check-release-tag-protection.mjs "$RELEASE_TAG" "$RELEASE_SOURCE_SHA" + - name: Promote CDN mirror latest (R2 + IHEP S3) id: mirror_promote if: ${{ success() && steps.provenance.outputs.ready == 'true' && !contains(env.RELEASE_TAG, '-') }} @@ -1123,6 +1427,7 @@ jobs: WINGET_OUTCOME: ${{ steps.winget.outputs.status || steps.winget.outcome }} SBOM_OUTCOME: ${{ steps.sbom.outcome }} ATTESTATION_OUTCOME: ${{ steps.attest_fresh.outcome }} + BINDING_ATTESTATION_OUTCOME: ${{ steps.attest_binding.outcome }} PROVENANCE_MODE: ${{ steps.provenance.outputs.mode }} run: node scripts/write-release-summary.mjs @@ -1138,5 +1443,6 @@ jobs: mirror-verification-summary.json mirror-promotion-summary.json SHA256SUMS + release-binding.json if-no-files-found: warn retention-days: 90 diff --git a/docs/release.md b/docs/release.md index 228994c..c288c7b 100644 --- a/docs/release.md +++ b/docs/release.md @@ -3,13 +3,18 @@ ## Release notes 每个版本的 release note 写在 `docs/releases/v.md`,随版本号 bump 一起进发版 PR; -tag 推送后 `release.yml` 按 tag 名取用该文件作为 GitHub Release 正文,并自动追加 +tag 推送后无权限的 `release-source.yml` 发出信号,默认分支的 `release.yml` 按 tag +名取用该文件作为 GitHub Release 正文,并自动追加 "What's Changed" 与 Full Changelog。文件缺失时回退到 `docs/releases/FALLBACK.md` (安装表 + 升级说明),正文永远不会为空。写法与双语风格见 `docs/releases/TEMPLATE.md`。 -Cross-platform release is tag-driven via [`.github/workflows/release.yml`](../.github/workflows/release.yml). -Push a `v*` tag and CI builds, signs, notarizes, and publishes a GitHub Release -with the Tauri updater manifest. +Cross-platform release starts with the unprivileged +[`release-source.yml`](../.github/workflows/release-source.yml) tag signal. Its +successful `workflow_run` invokes the current default-branch +[`release.yml`](../.github/workflows/release.yml), which builds, signs, +notarizes, and publishes the GitHub Release with the Tauri updater manifest. +The signal has no checkout, secrets, environment, write permission, or artifact +handoff; all credentialed jobs remain in the trusted default-branch workflow. ## macOS signing pipeline @@ -133,7 +138,19 @@ dedicated fine-grained, read-only token. A missing token, failed query, or `enabled: false` response fails closed before draft upload or mirror publication. Two separate active tag rulesets restrict `refs/tags/v*` creation to the named release publisher and forbid update/deletion for everyone (including that -publisher). The workflow also re-peels the live tag before publication. +publisher). The workflow also re-peels the live tag before publication. The +peeled commit must be an ancestor of the freshly fetched live default branch; +tagging an unmerged release-bump branch fails before build/signing and is checked +again in each build, release-job attempt, publication boundary, and final mirror +promotion. Every checkout after resolution uses that exact commit SHA, not the +tag name. + +The `release` environment must allow the protected default branch only. Do not +allow `v*` deployment refs and do not duplicate release credentials as repository +or organization secrets: tag-triggered workflow definitions are read from the +tagged commit, whereas the credentialed `workflow_run` workflow is read from the +default branch. `release-source.yml` must stay an unprivileged signal and must +never download or pass artifacts. Same-tag reruns reuse the artifacts and `latest.json` attached to a complete, published GitHub Release only when GitHub reports `immutable: true` and a canonical @@ -151,7 +168,18 @@ an immutable version key. New releases are uploaded as drafts first and publishe only after all assets succeed, including prereleases. Immediately after publish, the workflow requires the Release itself to report `immutable: true` and canonical digests for every required asset before any mirror pointer can advance. A -historical Actions run still executes its historical workflow revision, so the +Each fresh release also publishes `release-binding.json` and a custom GitHub +attestation. `workflow_run` OIDC identifies `refs/heads/` rather than the +tag, so verification separately pins the trusted signer workflow digest and the +default-branch source digest, then requires the signed predicate and attestation +subject set to match the target tag, peeled source SHA, and every canonical +subject digest exactly. Fresh bundles are self-verified before draft upload. +Immutable reuse downloads the API-digest-pinned binding and verifies both SLSA +provenance and this exact custom predicate. Both fresh publication and reuse also +require `gh release verify` to accept GitHub's immutable release attestation; an +old immutable release without the binding is deliberately not reusable. + +Historical Actions runs execute their historical workflow revision, so the release environment intentionally uses new `*_PROMOTION_*` credential names. The four legacy access-key secrets listed below must be deleted; the current workflow has a hard gate that rejects them if they are reintroduced. diff --git a/docs/releases/TEMPLATE.md b/docs/releases/TEMPLATE.md index 8c81d84..90cc7ce 100644 --- a/docs/releases/TEMPLATE.md +++ b/docs/releases/TEMPLATE.md @@ -1,6 +1,7 @@