From 1b1c111e01a7045b38c82e2c8fa61432cfe89ae4 Mon Sep 17 00:00:00 2001 From: Bernardo Soares <20172413+bersoare@users.noreply.github.com> Date: Fri, 12 Dec 2025 15:54:24 +0000 Subject: [PATCH 1/7] CFP: Cilium Network Driver adding CFP for the Cilium Network Driver feature https://github.com/cilium/cilium/issues/43295 Signed-off-by: Bernardo Soares <20172413+bersoare@users.noreply.github.com> --- cilium/CFP-43295-cilium-network-driver-dra.md | 284 ++++++++++++++++++ cilium/images/CFP-43295.png | Bin 0 -> 79612 bytes 2 files changed, 284 insertions(+) create mode 100644 cilium/CFP-43295-cilium-network-driver-dra.md create mode 100644 cilium/images/CFP-43295.png diff --git a/cilium/CFP-43295-cilium-network-driver-dra.md b/cilium/CFP-43295-cilium-network-driver-dra.md new file mode 100644 index 00000000..d1f08f24 --- /dev/null +++ b/cilium/CFP-43295-cilium-network-driver-dra.md @@ -0,0 +1,284 @@ +# CFP-43295: Cilium Network (DRA) Driver + +**SIG: SIG-Agent, SIG-Datapath** + +**Begin Design Discussion:** 2025-10-17 + +**Cilium Release:** TBD + +**Authors:** bernardo , Fabio + +**Status:** Draft + +## Summary + +This CFP proposes extending cilium to support allocating dedicated (NIC) +and shared (SRIOV) network devices to workloads - leveraging the Kubernetes DRA +framework. + +References: + +[Dynamic Resource Allocation](https://kubernetes.io/docs/concepts/scheduling-eviction/dynamic-resource-allocation/) + +[DRA Plugin Interface definition](https://github.com/kubernetes/kubernetes/blob/d777de7741d36d1cc465162d94f39200e299070b/staging/src/k8s.io/dynamic-resource-allocation/kubeletplugin/draplugin.go#L53-L144) + +## Motivation + +Abstractions do not come for free. The traditional Kubernetes networking +model relies on a set of abstractions with the purpose of simplifying +connectivity between applications and the rest of the world (including other workloads). +Under the hood, Cilium CNI attaches a pod to a logical fabric over which workloads +can benefit from secure network access to other workloads, services and clients. +These attachments take the form of virtual devices (veth/netkit) that hand packets to +a custom forwarding plane (ebpf) that magically achieves connectivity between the +endpoints. Most of this magic happens in software with varying levels of involvement +of the kernel. +This is suitable for the vast majority of the use cases, but performance/latency sensitive +workloads could benefit even further from having access to some underlying network hardware +(a NIC, so to speak) and shorten even further the path a packet takes between the application +and the network device itself. In such scenarios, performance (HW access) is more important +than sophisticated connectivity and feature set. Some use cases that come to mind are network +function (CNF/VNF) workloads, low latency data ingestion, and dpdk based applications combined with SR-IOV. + +## Goals + +- Cilium to be able to recognize and publish network devices through + the Kubernetes DRA plugin API, in a way that Pods that require a given network + device can get scheduled on an appropriate node. +- Cilium to be able to preconfigure such devices +- Support SR-IOV VF assignment + +## Non-Goals + +- Integrate network device (allocated to pods) connectivity with the cilium fabric. + It is assumed that these devices will be treated as “secondary” + networks and no bpf processing occurs on them. + +## Proposal + +### Overview + +Extends the agent to register itself with the Kubernetes API as a +DRA plugin (for publishing resources), and also with the container runtime (for configuring devices). +The Cilium Network Driver publishes, for each node, the local resources (ex: network devices) +that match a given set of filters grouped in resource pools, allowing workloads to claim such resources. + +Upon receiving a claim request, Cilium Network Driver performs any preparation needed for the allocated device(s). +When the Pod finally starts, Cilium Network Driver performs any final configuration before assigning +the device to the Pod sandbox. + +A simplified workflow can be seen below: + +![Sequence](./images/CFP-43295.png) + +### Solution + +The Network Driver functionality in the Cilium agent is an opt-in feature. +Enabling it can be done per-node (explicitly referencing a node name or through node labels). +Upon detecting a valid configuration, the Network Driver is initialized. +Only the nodes eligible to run the Network Driver should receive a valid configuration, +allowing the Driver to be initialized. To run the Network Driver, a CRD of the kind +CiliumNetworkDriverConfig must be present, as it is where the agent finds the Network Driver configuration. +The example below shows how a valid configuration looks like: + +``` +--- +apiVersion: cilium.io/v1 +kind: CiliumNetworkDriverConfig +metadata: + name: cilium-network-driver-config +spec: + selectors: + labels: + - cilium.io/network-driver + driverName: "sriov.cilium.k8s.io" + deviceManagerConfigs: + sriov: + enabled: true + ifaces: + - ifName: enp2s0f0np0 + vfCount: 6 + - ifName: enp2s0f1np1 + vfCount: 6 +``` + +Under the deviceManagerConfigs section, an operator is able to control how a specific device manager is set up. +In this context, the device manager is an abstraction of a certain type of resource. In the example below, +you can see that we’re working with the `sriov` devicemanager - implying that we must account for extending +the feature set by introducing device managers. + +Updating the configuration at runtime is out of scope for now, and we can revisit it if there’s a sensible use case for doing so. + +The resource pools to be advertised by the DRA component on the driver are explicitly set by configuration. +The Network Driver receives a structured configuration that contains parameters to match devices and group them together or apart +in ResourceSlice pools. This gives flexibility to the operator in respect to how the nodes expose their resources. +An example configuration structure with pools defined can be seen below: + +``` +--- +apiVersion: cilium.io/v1 +kind: CiliumNetworkDriverConfig +metadata: + name: cilium-network-driver-config +spec: + selectors: + labels: + - cilium.io/network-driver + driverName: "sriov.cilium.k8s.io" + deviceManagerConfigs: + sriov: + enabled: true + ifaces: + - ifName: enp2s0f0np0 + vfCount: 6 + - ifName: enp2s0f1np1 + vfCount: 6 + pools: + - name: a-side + filter: + pfNames: + - enp2s0f0np0 + - name: b-side + filter: + pfNames: + - enp2s0f1np1 +``` + +With these filters, all the SR-IOV VFs whose PF kernel ifname matches `enp2s0f0np0` will be assigned +to `a-side` pool, whereas all the VFs under the PF named `enp2s0f1np1` are advertised as part of `b-side` pool. + +The Agent’s Network Driver then publishes a ResourceSlice pool named after Name, containing all the local +devices that fulfill all the Filter conditions. Multiple pools can be defined. +Here is an example of a device member of resource pool of name `a-side` advertised as a ResourceSlice: + +``` +devices: +- attributes: + deviceID: + string: "0x1016" + driver: + string: mlx5_core + ifName: + string: enp2s0f0v0 + pfName: + string: enp2s0f0np0 + pool: + string: a-side + vendor: + string: "0x15b3" + name: enp2s0f0v0 +driver: sriov.cilium.k8s.io +nodeName: c3-small-x86-01-bernardo +pool: + generation: 1 + name: a-side + resourceSliceCount: 1 +``` + +Devices can be assigned to Pods by creating pods with a ResourceClaim statement in the pod manifest. +The ResourceClaim object can be seen as the set of resources a Pod needs - influencing the Kubernetes +scheduler decision on which node to place the pod. Only nodes that fulfill the claim requirements are eligible for scheduling. +A ResourceClaim references a DeviceClass which does the actual device matching and filtering based +on the device attributes (advertised in the ResourceSlice) - and an operator can request multiple resources in a single +claim by referencing multiple DeviceClass objects. The example below show how we can have device classes matching on +certain attributes we published with our devices: + +``` +--- +apiVersion: resource.k8s.io/v1 +kind: DeviceClass +metadata: + name: a-side.sriov.cilium.k8s.io + namespace: kube-system +spec: + selectors: + - cel: + expression: device.driver == "sriov.cilium.k8s.io" && device.attributes["sriov.cilium.k8s.io"].pool == "a-side" + +--- +apiVersion: resource.k8s.io/v1 +kind: DeviceClass +metadata: + name: b-side.sriov.cilium.k8s.io + namespace: kube-system +spec: + selectors: + - cel: + expression: device.driver == "sriov.cilium.k8s.io" && device.attributes["sriov.cilium.k8s.io"].pool == "b-side" +``` + +A ResourceClaimTemplate can be used in case several pods are expected to request similar assignments. +The benefit here is to avoid duplicating similar requests across many Pod manifests. +An example template can be seen below - requests a pair of devices on two different pools +(published as an attribute by the Cilium Network Driver DRA plugin, using the DeviceClass from the example above): + +``` +--- +apiVersion: resource.k8s.io/v1 +kind: ResourceClaimTemplate +metadata: + name: sriov +spec: + spec: + devices: + requests: + - name: a-side + exactly: + deviceClassName: a-side.sriov.cilium.k8s.io + - name: b-side + exactly: + deviceClassName: b-side.sriov.cilium.k8s.io +``` + +Once a device is assigned, the Pod might require specific configuration in it. In the case of network devices, +this configuration usually contains IP (v4/v6) addresses, routes and VLANs. These parameters are passed by the +ResourceClaimTemplate definition as opaque configs for the request. +Here is a modified version the claim above to pass additional parameters to the Network Driver in the claim request: + +``` +--- +apiVersion: resource.k8s.io/v1 +kind: ResourceClaimTemplate +metadata: + name: sriov +spec: + spec: + devices: + config: + - requests: + - a-side + opaque: + driver: sriov.cilium.k8s.io + parameters: + vlan: 123 + ipam_pools: + - pool-a + - requests: + - b-side + opaque: + driver: sriov.cilium.k8s.io + parameters: + vlan: 321 + ipam_pools: + - pool-b + requests: + - name: a-side + exactly: + deviceClassName: a-side.sriov.cilium.k8s.io + - name: b-side + exactly: + deviceClassName: b-side.sriov.cilium.k8s.io +``` + +When processing a PrepareResourceClaim request, the agent performs all the necessary operations on +the device and stores any information that will be needed when the pod finally starts and the device is ready +to be configured in the pod sandbox. + +Preparation steps may include contacting an IPAM to request addresses, reconfigure the interface mac address, +associate a SR-IOV device with a VLAN, among others. When the pod finally starts, the container runtime hook is called and it +executes the last steps in the configuration within the pod namespace: configures the addresses on the interface, + bring it up, add routes to the routing table, for example. + +### Restrictions +Requires Kubernetes v1.34 + diff --git a/cilium/images/CFP-43295.png b/cilium/images/CFP-43295.png new file mode 100644 index 0000000000000000000000000000000000000000..1dd8c66ab4d3e7e8ee368c8f213c2f2406c97962 GIT binary patch literal 79612 zcma&O2UHW^-Zn~;A{~`ZKoAk>NDCwsQF`dodzBibNC;iJNUutlE=ZFuNC_S39i(?e zfzYdW;yLF%|M$D=yX&%6R)(3`duI0R{VUJ&{1TzADo=Ww{x%jC7OA4bGfgZk99!Un zO^6TdAz`M~!NS6RZYL|Nt|%+ZqV5W}v2(P>!g>_v8!MpvRO4>9e>n+TFg@_c*xuVd z{_zFVV;6*;Obs-vAW)KTh=x*Vl2@oE)t@FUi+`fx zo>n?5`zE}b={s%>zn%6qbF_&M^1DyHopd0dH_L9&^So+Rf51ApJfwTK>IH=#MfAqy zktVY)m&8do3GzaHMBi}4_W_51KC5ynp5n&3i1G%xf7R-cx@=`wzX*FD0xin^_Ty6x z1RX&d-N*J<7V&P#A*s`;F?*OEBCt(Pt)Cgyd0*wnX?5`(T4=x_gLT8?lundR_P3;P zPjF&rj{Ks3wDdmVEa{@Z(}mxq_C*10O6b-1tx|0^pkp_&m$T`Oi@t+icwb*~XlWC8H&)s0e&(S-M(VJG;Gv zyI1*aQv+R1+G*>#>%mmSE#XeQ=2mbEYhHwt3#JJc1R)M=I$67$vml%to!!I{P}aX^ zhy&Z0-F&Ppe@}6DfU@er)LCTVuGTCfy!^cUtdh4`SXdygRyN|A&*c8y9QY5)`qJIq zMVyb%)6xOq9dnO9 zdiLivH^vJRO7ZD#gBq?j4>r@EyQ<-92H6p2SF251Qn4Dn@xs(#0-vY z1&qz73*P4KL>%9fWno^cqE^egK?75!{!HJl(Ea>vcz3Ela5@U^DQiDaiwwxTFd4Ecd;~Zkax1?zTFs-<*pB@V((@% zTuVDDkk4;ROUV7n=;o(ffH;^O>>Y#r7_=VXZzy*wx-kX*z&7%5D&}z0Kul-$z8^cJhf^*^kTk zrr2nd&F(B?EWb&3dd;fGB$^#`G_l`PHcpd~P#|UO08*^;dBY4UDOCtlI(Z#LU^t>X zdMjr4ZI|#3Cl81Gb}pAl@?vw_!!W+i`{0ayepi7!T_1I|gHLbrrjS&Bd|5-N$xDTj zsmWcJ%zIen*+J5+HdcCZWk+kf+sTVH(;Y=(ZOz;MqF29pL>gR+4vGySLW$FHT!r*m z_6YmFG{NFx)c*P|`)6u~2@P~LrT9KiVTqyNl!ca7*a4d@pItuEq(8SYZES)EcrdE8 zOPnc;^2c)IB)~Y8dd96asZ=SMz z?NzNhgxu6-JImwX@H7gga!#21?I@gDghJTRN?ax*xu6o{F1_|>2w9~3JrUbT_rxpe zEOz-MX!jUTOGuPYcdZB&FW6h5{D5HwOgGA9d@&D+cRnae=LVfS9pt$#ed$3*0OPAy zt00P0YUBq0U1qg;B0rmcy_`uyZ@QZkYq!gtd#G5u@j5DW7l_0!=4~SCO|%wzhGtmj zd-@K>&oXAy5`uWQdx8F3{Vv^>rG^xevZ8A|o~~#64CG4DIKJb#8Wm43*|f*CUvIV5 zP$l>3iG)$doN;GDSd*Zh+TX2I&dk37%`TzK@-DqmsDPvMiveKT2AayxFmvN+6K#rK_jOF>Mt+c_EE zyf2fy*z@S1Cpn$*JP-XAhv5$rgnzafMi=Bihbw9@g78S5)o5A|=zy-JB%C!BF zyvAU|C7xc27;E?^0x$5Jn3i;CyGRPJp^`{HzH+n_4VvLo$vfAxi9}C0VyUL6pveI- z9CsKo@fC$hFB_aSaa)`};1X^NZi8jqZc95=CaL5-N@- z4ZD@w>$Q{Z=<=#Y52?t-l^{LJUahWC!jlRU?!THy)5?hU@>#BeOH*P^-tL;4zUsV( zBKJQ-oiRA(XnI+yMR4#GKB`_fB_(gP(v1vHwVBCnDsGOExWkJ8dwV9)#@f@M7Ylp)q3K^s2$dL=*upzj{uZ~G#dF0x7OtN5o-iBZ*G|U$8!KcUs+-etJbT3B? zqaD+uq_!R(-s*;+=9*)^0jbWrT8L&v?Cs9;`qgNO@#Y<393*z;7x90t;g6JnX?VuA zi~gr+*t&%SN565r8l_q50ldxE@u{- zeEu=~#nY?&sSo($`wBXWWLyvQ`!d+vC(x}aY@=uWGg_-!Jmey4N3o$TJyi(%Ya6gz zBP-!K>kM(sBj}W{)Cn1OpPDttyW_7gDu{YSq4p5xS8Y$#lpXQybP118>9<}mFJ;5x zre&^!#2vg7Jtr*j3T80a7|rR#FzRL{b_@!%X_k3fMxqduRaJpd*sE5pP7=LH3x?Xe zeXzSqP9HZxi+O|w{C=S`Lylt=H|Q~bd{iXFG$!;fZzy3P*s%!9Oy@S9(r6sZ9d%b3 z8$Hx)bZ)0IEy+7;8E@#$}Ce>miS^W@~> zC90+XWRz)iE;L7~Y`s2t)=jJB?4CXzXQ(%LeGl9oyu6oH4!qrDb|Vzp{2y zCulBnN7p;DHN4%8WvXq#V)x1#52;1&jWV3vWyHk})XaF4PmV`&@s*rSSnTKCQoZkg z9oQ1#kuYXP3a^w6{lhI`;{v{l#0Ap(k9~pPKV6j>%Tn8W>}ZaE?|a9H zr`LwqYd#GxpEUFNl1dcKAs9gCqrMCT36@EQj>3I`QLcGs#}eJ z7tga*ynMb>Qr>Qx9ezf=upJ)bhL;IPV1+puOiOXf z!@$5pnMBuIhztHXscQ)dA`^e)b2K7vKIc?NDs?du({2cFzDFju6yWl!W-7E{GgIPf zN4Mqn;h+Ru&uu^$h0owfp(=U4#y=o5*5OmP=;vMkv+Qd-@7Ga}dDnSg}4Ru~&NXIW+FFTJ#vdNp8|DXCRC3+Zn6+ zshbCdca9KKR*k%Fno5g~T!4wi&cL{q8WaA3+IVecI*?Z^=PWJwp3d_FZj^J5U!I=S zAxPgUyMM)Q4&g@oT$b18Y&pz4{Z&`54x>}Y%NM2eEe@g#9hr&`-{%dCPcOYj!Oat# zdF^fmf9^W#G^aQN#*GQiNY(g)L+KQ!@n!vp=mKK(z>QYZtB^rZs~ni!X5R(6cVBqr z{u&TnB+*g@TkE_k&M30G>_|xVOlt>Rt{9LR(PB%@Dma#6ZvrV#~pI z+TU`O(NY_{%&F)Gd3Rv#?tU2}Q%?z4#Dxn4UF_=L3oI`oDt24>z@vCm8y26FT zJ_hzgR1cE38mt&VX45h zxzR4wp{!vgQXp^zxDm#a1@FCz-;F=JmUhCVuFMge8J-s3Fxet^RS&Cx*~h|nVb{}^ zF-#aoOKbKUm@FC(`EHItz_|D<5?e7 zjQl+8H@y)oty@3}4EzD(ToVDN;6lregvAh%0Q=fR5bN;!EpU@}DY6MdOj0Vl=($`4 z-4)YXJ)(;EHD#pp%Pm!aX?~Dy0(ny=v~SU~+s9S@E|5Wn0hJ8|Om%kPlA`WVT3+jG&^ zGe*s>G3ykH^JEC(MiQFo{kvfr)p^Ai+DC1ISat!{S_indn)AzdL1i;dsd1n8WAGi0 z!|$o6*T9PCHXq(DNGqG*T-R8+tEEC2RL*?0M6e7%Aw&|tsRw z10f$xhE)Hujb?QtEPlfNk;(ilBj@Bs0Witkn%lM_*EgpvF>Q44jJhAL$}D=`t5Kq% z7kaMtf>Hc#QZLmn-_$DttK#gNx-g47|6b_QyG+9H21h)bKWE)iRc)l$qK7`2h?R&k zv({kChgO>#MHDV0!zRe>{8x`6Llf@{Y!Do@!l{TK7GS){H2y2 z(bcBZA8_*z_@J-em&Lo!|A+*?{f>$ceN~*Fd>b&04vs#+s%@>ee=8Sj5>-;x_}J(4 z>tYm_FRc;_q1o|0DD!t*^D3b>>`NM+`lUAquw=#G5cihDjJ=L?4ie$vFX-=2hJvR| zym`uwEQG1K0^29vEJk?=xFRzDt5s&p zSjjP!Cm}C%jfJ_tovj?m^izyQOZ=u~cn&yLieHw|caB4P*YL2{EMF{GMDkFt@4tpg_u+!h$0Lkl-c=k}GU1pFUY`TFSU1}0 z(W^H^55uihGR!6(p7I~ZUd9qUXt|Fg_V8jXx2sPTIZe1*?{9ZU&#?`M57cV3xgM9( z>r^{aV2dMxDyrs8Pm& zr+?E=+9n$v#!U`=!;f>H-XL0HugNX_j|`j$E&`+vK214#BhO<9L~j9?ZK6CB2_}2P zm%MzZbi{a|!{m(^s0)(q#eXM}a!KGI^}YoC#d@+K??U2MC#X!|L0#YDlHkK3DXEk8 zt%o8^%-Io+hSFxa5u>gN5tEKPie{)Cu{VM`lLP!Hl1d2TCDntmOPTip?3;D57r-%mAi6>ycX)YJ&uyuXMBby52Dr4T@5?i+GbsAx>$867oM z_~NuZfVx6T?>n|r*VdkO^7&Dk5>A@>U-$GYNnf$V%9A0zmLxm~u=}D~BU0FJQpd?D zvtN;;v)6heY2C&Mzt?wNEdTFY`MLzhU_g&SZ= zz5(zeY3CkX1QlW;uM4UHS@w={0mFl-{M;k}Q8x z!{l|w#vxxL8P~FQr-~coxcyLsJ&Vxf*>*$O1PE{@OZ9w|aL%KrBZ#MGkFWNX#aq)v z_36#&JKBN>y1_C{85L3^atuy)nY$oDUa^N*1-fJ=I=Zi9DfLFAOS(hvzo55H?sH3^ zJfox?4MNRPklQVc&pe69zvLsGp^1==mX51~gJ`)sH)W(PW9A3UvV#fM3(-l77xT$9 zpc^GfK9a1g_;-3)btWo{4WtSL1CAXOkY^-JRNwjCVP@ZhopJ2@f(V$KGZGJDfYnO- zvho&An*dZ3ujS~|H4vnblH9)rK;o$BvHfdH1@e2flxHJzN-ob?dcY{%o|5g}JdP+I zGo@C!jOF{VrRWx+(rMKSdE@*{maObJ-`ahTUiOrCd;~|k(xsDZpFi{Fo!Y~^*!Tue zdk;NIR9V81BQ|yJJDJ~)v3fY>>(-Qq*liIpPRPoX%f@6)y6s7_+CZ!!9n%`htpKg*wix#xwOH4I=--~KpL?EDVMy@o6q0b z;$;wA*%YNW;aNi9v}D#YL_?&RbmJ*NNW~sac$BY}$dsz7OOSuhD4=laL+Hf*BQ-^` zZE&WxS_FYF7&N1~B9q0=R>P6>K67ecAuQU?Z%~Vl9dzaff$3lU4kj#09ammoUzT5= zeEX;u#^AB=fo>{qV;HZ9^R)&r^FKkrw7F3jA*)q#vHYOB!7D1_+@~4=s3n)1F24{!~W<&YGL#; z4XR}P$(njgk;J%$h-^)T<_G>s__m{j0fZfFhg4N1RkPPsC4&@m`x!RnNhDEX$u3WK z)bZ3IJRH$^0KU04a1fi^w^H{U3~r7y@7lq?JuLI29HR0J-dqE5l;QZ$7`P}ZBa-yb?^Xwzi&@irS;MH_Z?6U-g&d1BT6B1t4 zPznxPA7HV>+1RnkS+yp72@8YxH@NSX957^IO~&K$Qj1_9QM1U~b5$juNk$z=WQIe& zi$NHkk1~C?)!Gm7eY<~s(9OKp`*i45GqsVeLS)!|6iHJOe@E*a8A|;-r>tCp)t53Y zKN4?&xYP!@(&05Zi)j*QBC`w@^b-3!Y~+KuK)xXpeD4 zkU6r1TZBh|gpr?8Wjhu$49T~7aw+pTB6IAJ{KW)o_g{W&8gpeAv(Xeo5s<`CRg?%M zWh8P1GRgPFf~}5hYFQ zZFYIo?5rgE9Z9>~tdEZ8AHWnqQ438*f>ZBO6mUf3G!T;9jawfpow8x8@1I@bj}!=y z1`QI(h0szem|k7>l^>n2c$%B$NMaqi9F81z1Vw!&F6zKDBC$L;X-f+W&!lX8Plv-U zz2e4&r?`)S9R(h(@`NrzmhM9tAFx3MJ%d5XZbMK}RUHnN)h;%^K-~E;ys)G1E(xOu z{?g|Z@_c0TGyc~6gIiOxL%nS98u2FabX2OsUS4g1 z*;)%Yj)7Rqiv-aYFRDck4ke=dR3M;DPAAwZ#lCZ=*=(Hhjqe-rofLX6tI<1s=|XR` zLOBsXt;3VTRH7@Q%n>Gd6=`zGd^!B0WOU=EJ6KWmQ-O?culK~Q2XRv_Gg7!WxJKtp zc3%DR&#ZqwFBcGvyOA(z@~Y*~Xj#9tnhx1b*iN{FPyXHnr7Z4rTk8RBZ_fORe%F<@ z$qwzza%WbjI$OfcW%m6CxZ_LfAFa>q5lgF1Qy&-4G@m`p|g9 zusIu4&8RT!?fu7~*Cdn&>T6CRCY<_~+!m}OQbF*S0CQ0t z9f&P!fAr&3!ZI)_g>FsuK{YKp6ee;+;nD_XAagfM?BHg3WgAEmv9fLUv z{E`@=GrOal59rVs??5b3d11i6>}RwvM#$^c90=r*Q#UN|yR7m#aS$eZ^$47QlcIE^ z*MI(<_?F+nQw87cU%rr!zAM&=CmFBtKXJnQ%&ed^v-{c5_4UWPe`bH*+VI@YbWQ-X zmQ~gVoe-`p6!Pvr?eZNedTTPgEx6>2Q^5^S+{$!f*F%SU1I}z=}B*9!*4%D!B7b$&(>B0 zRd6#7BX4(_@-op0`%Sr<<`Q@pX*-PrtP*V2cK{V{LiJGUb;3S_{Yn_0lPLH~=-H2} z=_v*rDXaJx26^&_SI?O}LaJ7}*buR>yqr6d^s4JWqnwe1UiDw<$i@K_uaRarL~3i5 zr#wn~VY?Yi2d_HO8y*qHEIv}`O-wR^+N1K@r^-`TO_cR#ap~f~xim_PpY=LlPw8GT zMLPT)W{|N%&s~XDKHbwcGGm=Nj?C(&k@*M6)Os~nYiXusazpKcBYJ+@1n5Si;xQ+7hh%ab%!g1Z-GM{aJ+^ zoF29NKrNmEOTU{P5$oIsj;P&GrQAlDN077K9D1L7PkaFMA z*L=ea&%esRU-;kOp{Ye*=}Lq;HMOo99)1hRLa(eVoywY?KkdfR;wu`9C3iTvhsM>5 z!O1R&)c#$&pmpZv^+E7MOGC~ql6{mRh5&Zh7RG}Yr0PMqFAe`D{KmYj(pf2_?sNJF zAK&w@3CO9G*JRqpcvg6ZyU^!q_|40X!74+y+UTH3cxFdcf;4dfAtn^mo)o*oxzc6> z%2Lp2?uR*33BR;^)boE{BBwhGNfVBkputnNp6WLp6LJ< z3HNNKveD2%!sOIio4zUA?~8v?axltl-8UMz)W^g9PqUv<;0xS-S}xZ7rAa}c12z1Z z&*b|ZE5!RufzZ0;e44~2M*Rm*UAhv9Htto;lNsJGI*l@s-uOuMy)rfg1fdqZKh#UP z6+?({nPgV(blRyS+&|e{15kQY7*-&48(l)pakGh{#hGHq74rt`D5{M@ATo@${l(sA z9PxuOlw3J|(@}a(khyYbIpL(3puc8E#lyht1h!#Q%6-_&u*7$u`lgBXqGSR|WwNN- z@K9=ULBtbB5$R&56~*%W%_>o+{n5k3siB{g3jM0IDScGmsMLy^I3;#uqZqv`Czub; zM&z>V)}yM0)Y9B{WJP!I1dC|!xWVnzh*9%Di8OTTvm$w$obbA#N+RPOY~>(fpT2YU zG%at}n>N{OIkWBx&du)(`BTwL@Mjvxatl8H$!21ISTkqMovlC)`SvpHu1}&3BF|hk zvwBtmT*QmD=QFPq}#OXX8!$4^~xmdDc4|TNcGv0aKe?tFRMT-!-|TYz;nkfb8C3x zwukEGzDc*pjP96fxT)9d(c~lpda}oEEY2hWwq0{%bdoo9)${~U^LrQo$&E}tP-Jz! z-MONXqYrr&<}S7Qkd_S>a5{0~KKpub)%dtCVRg7SuG?lGMM)zGvaqIBG-TheZbvOn zD)Cg@zdfanCF$}TGbUMmWg8|%#dq?(u_HN^cS7Aon_qsVDfRyNe$l^_EoKG5O*eWBB3S_PE0lJk|c-w271B=Mpk=Jv-*#LI^3tD`CW!LkH(PA~FS;Upk2n z`-GU^-B;(g3{QCR!RI{C!RI<~S*_O1obV3wbotw)_Y`e3-ufekT?;xsGr^s=9KQsV z{m9!-Z9w^Bcr4LROLdt{kKxe%+3#8mW)l&$n@`iYcV);fW{ZA#DS!$GDHQfz_#1eJ z=5PMR=vyg^qyv_Me7Dbn&ITU%*HUE5bCcqYLMNxwQ>DV8^h6{}98w*HYtMS9?4+Lh zeSu;deynIF<`Q#j`-Hw2p`@Jw7K%ufa_jM5c8i~$Z8(j`c`L)t`9PD{c$Q@4n?81ty+{7{qs^tpemX zS^=&YjR1ctd-Yq$hmi18$P?bjGB5?<>#f`gM%T_v706!=2wn5$M-Igt6XvBR_bHy* zf8dx%G*KJU0%aIBChE$s+kukGET0&+C~vPET0(Km`Ycjp45*ZKuro{?-j=TCR3)vk zlysm*?LYU~&9bH~S1R;(x;5JSK9yI+w-a`)$j48kZ&{~lOnYFc={S1$u;ovgEDMi> zxzVRP`yPF=Gx?2krO(w2y2i;dZ?3q*tC$>?S&Lj9N_nW%{3pXg@=>#0!*b4%ftC*``R&m#JuUne zPNSnW_xnLb5aC)*0w!&HD+~$B4PHxtf`Mp&Eq6^6&69cbZ~$P$>kt+K6PCujm{S@Mf1)R<5sH3<*5M--Hb(&HHLM-t%y9S)LyW6PDH|beP^7pHz zr1684`J^dDge z8HW8L8-_&w2j%}O47rUFhTN^|?|4Ay-{$IKc zl)*4%F^5HmdifAT%7SH%WpP~ZOf`@(t~hIt@FtP zMAM7Jgf9&kU0gEfCZX{>M*lROtvu}mpr*?io(n|sjIW*zLRy?zTrfl*2J9|0DQR*$ zzO4Z$*nkvJn#?1$(UQlh@cWo};Ey56%kTXRSYbh#eiz$%e)iq=vqa-phgpAii`ks) zUo7meD?pk#fsB8g!OGm5q2~NqCXETA?I(=E?A{cHy{K4u%XKo2y&qO865vX!KNKR8 zQiMBxX>{#SB3c~;kX~U^X(G~GWz7IJR+&L?3IOaJB=??Eq#o#gqz5VElgH81?dy3L z#+FGbn{vVgk6ii>P_~rY$<1p?W$BFOW5wwr&^xMP=F>K5PAe$c3k)sGzmaNb^Q#M_ zfSrlX?{?lF=AZYNGB*Dh@$fID_t>w<%{>rC#(eHHV~7gUd^1zo4f-k%V75cd)TTZM znTzQx{j8&Iwef1}PQ5HJkPUF;?fMsd^LvC}+{^8i=gS`) z%7_4JCW*8AFB_c1mtS0pdVrlNtI6RS2yDN^>E^K6i6 z(mg+T{cAY-3}0s^Og**-2P^XWtl2bcaGd;RTb4_olb1i(lOxaN={0&h~ozw z2LvHrL${aeIw4rc%W`i**ObY$%x#F~+zO!n9d`JAlG8<6MCaYdUNU>-z)1v(Hn(xG zuJYP9ib4tK_P$*@r#e>kx>~G6scC0Mevb_ z6b8+yowkTHcUgW@QQ2qcX9#(`Mrc1ND|MfhFMo)SoQ@Q;e9ayvcR<*w{Se9!@id zJhQL+?(%(?836l2@znjGVt(-4d=O((a-le~qz=(1FU7F_`c4u8oGiZ!JB;!Ng<;+n z(ZIlsxGZ>WhHzveSOKO}z`UEulZ1rEpm`dVGl{V}tys@ny$A7Mwlx|8eGH!xei!WL zHV1kj_uj3P7h8*!#X-rcP+$l+6aZ7ugcXnj^!I+oo(~5J2qHGvU@5lV__HkXFj3E? zYSHhq(~D>S$=xRa=^nP{clz~}>PAWVH+mgl(mx{J;{}kEqOhN~>96GU5X&JbfQh45 z1qgbvhO>@4Y9yC?E&h6b=j$kdA|F2usF%aY?0E5-HXZBD4psg>;xwTO^mzPLU_XY4 z-<+y^vj^~Y5zP*^nO-*a*C%tRDA5Jl%~3}8VHtA({EiNs$O!|{bMQ%B?W2}EX-r89 zGm-X2x9T=Cy+hOB-@t=Y?2CXwpbip0sz}{f3L+mS_{8@mdDR zO%jRS3fa`xvvy8F&Jf{0H{E* zaYYIdKnV~WB{KU6wEfCbEHOJ8%W>j`ZWPoB(4H~lK&>1~E9HQt&CvdonCC8s@)&XV zr>Xb0nP6Tqi}0inHoP|!g1{Y=?*{J#hBsfX5x(0YB(b;`6#jx-{oe{$+upd$AF|;8 zt1OtrTn|#58Nb-m7dN`k$r0AH6@-!7CXD6(r1l$4S{*s2cl?(sSl=}-(sB^qd$-)L zu-m|q+weiT74dd5JAKTn)^nOGgPliJ>kJ4sp0$Y|sU7zByD2Kd9dwgya zwVFNo>%zp1O>yz<8VmMqZ7tYDP$w|!C|?6+Rczb~P*H@iC+o4ExQz6N#PpaaNuYA@ zUKy!5S=?HQSLUSyWD-@=U%Pbp0PnZnWZwKBUHViK{nI9-Suv zeFKP)Rin|-3XT=nQ0_0?WFml^ju(d4TrMum ze0#aWSpKK?;-!h1YU+-#%)L7|?+HTZkJ9a`Zif6$zDyg606LP; zjMuZA1%U9s_mw1_Y|`!@dH5_~pBTf0h<@}8*|Y+N!;7(NO<|@&FfjyoYhCoRu4Wk! zP6|V)MH1r_#I`&S^|Thy#RJT16N#ceJvk(oc?+7ahO2@@1{4Y7>F+pK*KBlXC6sw&dGDSS-OIi_BMU8Oz#=$6m3ToFm_{Ve zQj4J%4&+ZpLrJ1gV-n%2^WT7-X7>KFHDd9_?&t=iU6|?uw3)3BKg|{;=g7Yi(9xCz zLyqv8_MCXi3dlglB2LIZCtC z1JxPbOFXCdV(D8hSKR`u9wpUv$}*|@_ViMUG`L&odAxDg=%x1Oz2YFFv=M)k5t7x{ zyQ0Bh_E$Gv#JAJo-#Ean3>l!@!o^b(ea4)+^cWCdKMlyNI^Rg++jy~*bepw@iU*^h z>9O2;>XFH(k!PxHzG|?MCa~?_c8lhn&&s;O9$muCG5!$BqTs#FTd2(zCEwxvmeUw~ zW=S4!NLz~-NT{X1`?DLM?8XkqYSVsVHVR)@dTuo4Vf-b!dAVi{@c{_^-x=YdeIwYW zc&8*ku*OQJ%4re)Z~{8O2*O7gG1wKyj>{@**CD7c`7;TfLP)&x6DsqHazb?IPQX%s1nYlgB%07 z4HXDzdg8VEgLotJWV;`h17h;I(HB|^qZwa9jtp9O=+H!<-h|&r3iObFX~c!66?6xw zfxh}xqru;_V?s!Mk{Q>CTkeh>H34@O`-R5K{tq{3%?uuGe?=YR!N;=L9&$wAvK*u& znS`)XR*m*yHP(~w?3F^W^eV+8RoUg6phQu3+}9ifYw#In-Y49tBU8MiOqZ8x`5|VJ zbApyY3b+CSk9HIMxcC1209?6JjJEN!~=2g?^j7iua1Xo=pH&e%~VI=96m`vs>o(DZM8p3$+Dw9oF z_j7Yktz&VL0F#t`XYf8UBfxRoSLIz}f0> z-VXxQ{{RlZKW-M30nDr7E_h_vTP4791VNYLQJ4wW$H1_rR+es$sY3`2Lq2lU=1A)X zK!Nk9@AR3P0E|%5nYVuOmGs z;mZtn+ZaYi86=3456H23FS>7Rr)vR8PRNr%F*X$-Coxafw;>8+_CsJ|%hg(143Ye! zG_Boqtx$&uI3Ll4xn?q?7>eh-D^iFXG zgSh+~kYn6?wT-$ctsvNEwNF2tYJ1?3g@9fEeCcW>MN@IB1u*u<4Eo9G3l>35A^@?1 z$t`}!@Cz0H`hZZtCHc25{>|Pqve)5Ct_nkdDn3w!*H~OE8Nm%*)3pYWDfeEua>|+^ zq?qi$?Q@jU_S$wZ$3R-%dXh^ArF<};e}$gZ`U2Gi=72PcxSyxa zh(vBJ=xG0|7f|12u$^~2(HsCxZq8k4R{w;0jC-DWGud!eTcJT`fO&Xj`9nP=HEZF+ zf)-_0r4uDJRaGPus^&E8^_llTG-hqDt9gkS=R?oMURJUyeZ zqu7ZwpC++2X4yO+^MG;+{-$0UtSu%$%#~y@+`Z4<#=tPd3&_DL3CO-~g?!!lRI;Lr zcjkUqwn7z?V6^}R1Eu~cLocnF$l0N(a$Mc>GuVMxi^Eo1u`y{$_adA!xD1R-HcD%sS*#I zV4=F_OXq;b?~Zrh)_Y*C{a%*H&SV145vk^H+>_7sA^LF#r-3@1wEH&K-q^^J)T}cV9`6 zQoaB4y!;+HIW_jnd}EG)Y?S1rNDuT<(uNbN0A)h2WJpiR=SEyw9D!P$SCSh=TYD@#mmP?K zbH#Guj1^L{DujZ3a;K~~SL}lr2yBNmM(2sJ^?sVr-&&!09?;cuok8l|&&O#mjO>Sd zQ{s0+x>#2FE*UMDXS4NoN;FbzwZosNAFmni=K7Vp-Xc2 z*r}_iJThahH2}&Z8zV?hWd=b2d%=hQo$l}-1P=^E!D>aR~wx#6&<1@A`fNg!Y!PUDQuvU%<7K2QE2nRBn>` ziUA-6Ke5E{M@dizUhbgBnn5%-X!Izhf5<~Q6z!3~!J$0mk@)*>ZA$e>x5rhB7;4==w!E*C zni?q;ZloGya_n(oMFQQK`I_ zmdOF3uC!{^n-iHODs?kUh$)7CiPxa$#a2Tvi%|y2!`1&S40?$e%?U4nZ&g(Qg`(~F zhNWE;03nbh`+4!qZdtcIv}syB=wEfn8eSJUBXiDiTpUjuCy-0#2G*gK5=rb@A`<-7oXWAvXi_hJZ<*G`x{WM_m>a3viQf4KE;aK6WqHr2#eB3JStIQm8;~VKaT8Ff3Pg)9hDL^( zcs5`gzrPx^#90Gn+oX^mtJ7n0?Q-h_?F@Z79erDDF%ZGQufZHswHo+W=J2u%X`3$t z@gSy3nlxABQi&b&oFReTLGIt!+BaO9{%E9igkm&%14NZ7XGyqDFAGwDsFcdp6_|G= zYvx8WZ2<|UcyQ?t*^(~!!G7$mFO0p(>Ck!fS9}KZlrPUEft(VUxNAiK;1_Fprr?RZ zD*}e@PoD97GxAD^=G`6G*7WN4L<<3t(SaFp?WRKg+TXj+I#g_ovo_cIB-)ODH7ywm z#d>epd!?$Qh7kuJbVjPBMJZtnjkbYv$$t|8lAu-sW*>^v!!-9%MUS@S&!GFurS}O=KsMV{>4+*N`oPOo6^`bR?z9q2D)$wYmiEe!vh=t-)S+Rck z#_3V|U*5ce!pzcE#1`}@F{_kc9pWy<7*FT_@ISu=02J^fJ`I4r)uVO62;ZB($#JgE z>-|k+8Uq4O(><`C(Tsp`RBqQiEP7qm#(w09H_elE4^i5&`Zdn`SB>t_@5}4?*L8nO zj{==pm)i72N8I%>&d>o5jp!_J&xWF>iQ;#-L5KdFX=80kP z%uqqs-iN65;Si`#N_kY{x+wYJ=z{9jrfjcIFt{!Y_8EZemX!^N7)1K5WEE~k#T8BB zDk@L-;{X0ULG{$ozki>=wU~KBFOpRBYfTIQc}NRLY~;oeq5mplqFy9#`2%%Et6`0E zj>`r>v7dQvKT!QCeg!ZOL&k(bUVHS7D|q-A#&O_iCxsm zDB^_gZrx>=a4Y$B2Uv!cAyKgNyNNYKJl{NbJV`~Se?)Dz+ZAR|hka8MTgEeD3)u+0#ulKU+gph!I|`2u_=o>(sG+d zu94DMKA>(!nXg&s>U_wb3==qDDk)IF&o;~*Y0Iyi7gQz@1+ZLFQTNOdAUT)2i{r!R3RESa0S*p(7sJ72o3bsTK3q2tj z$TGpl+nAGRJxT`TDn6T zfuS1)r5PFohDN}1yaD57=7nw zq*+ft(SI@jGvhH&tQ)v;;=ofis6g}r{dO$Uzv#O~rx{PWY%eU4tk<6NYA0T>VjakP zVBMcc0q(&f*s{M@Jjei+yPXD@xr^o^lO?i_5gJxNGVI?Gw%YmmB`Ikn#qiu=JL6<{ zSIg#W_IJ4kMoL>KRvQzo$(9~Rd;@gOvxILXg2BD(Cw8vt$l3Y3MW$+Dn`SyO0*&re zw!*rDjHL5)hL-jnwMJFROxMo2XA=fd(OJvbk!{y*CTto%*v=sIB|&EpdTrogp`olJ zoHfL>BN{#wTSj}%z_d6%2+}C5j$uLN3|_M+XJk;DVBm9bcDo;RvMNnSwSHBEXoskc(=2u%U1zf1gQd#3@N8T%t!91+Yt> zBt5bKbbv~*6*rIs6IW{KMW5$d>tY@*M^V~qh~CN|yoPXn6?kZt0{#@z zO`j><*?+Am$Z&$z>}5#)T8{YE!iYciQ-v?w#O=S5GZ6!H8G$`k^3MVu1NBKC z*B(u}|DRju8Tc8Z11ckDPXB!`qyJ+DND^C}U!Qc>t`!GO)21eQQ$ zhO^$322P%tx35ULxZUISm;Q-Pb-&abv)^Gs6;RLiMgnrdkS-2Mwkwi$f)c>CwN>;sZY1%Y8+W)^BYD*u%9bL)xoT=7XYn}R7)t9Y%erNgq`9$7{ z=^SxGrkB4n{&EsyY}F_cOS)EERP-<#eOwY%~qPn1TQ}=2l z8NiSX-Cc|fVL;@b^}5WB*QJ~n&iOY&_vb1*0(awF^oeI^5;Wcdjz{<}r_Se0?CI^( z>K+3|_8P-|dsRqv5ID<_i>uFA?{{HzH}{PAIi^20Qg(y^xs;cdgPM%Bb$JMDPkPw|?_nFQ?8 z^&2~XUJ~V&+vo)9uZXXzaiRv~^=cznX_3Xs2hJ3k?&BkurbxfG+MaX1K+ALqjb^S( zj7^e)dqYuL*?0F@EOniTZ+CwZUu@N{nJn@XHN<@c!c?=C7F+cFpPR9Y)~V(@Tkl5<+%s4|3}wJaCP6K z#GlM*Jl`*Br8V)Ua%=~USGFGDvd)42ufs>{1Y6Iep=j_=f|5WIFdLMoC5M`_8bhFO zO2Y>lLB*h5698JHTwR|W8;(7PUgDr`F&GgAc!5D~ww9YcW+n6QOc-KKg8i1LaEE1b zDl+`F=M#kn_CIU6wc9PE3qKcl%X+Tf{$v^TqE}@6EhPI0n%bA`0OOw=sxP}APPqlC z_^uaJ;g^!^K{EdaY<9hFvpIF+Blw>=&>tfS z<}Fn^>eTSPDsnUYvk1P}oAQ2{KaxoxTrvlo!b^mH&|ryOIH9*mqDt{Om=FMlLl8(9 zND{fO+y!O6g%<>##FR{ojavslXU;_pUyeRC1C$3!$i>~L$a5W>_;-yu;liJG8Pg!O zb`?>TeeAcB`uYQcaL-N(@Hxz&23>0s;6wS46&D|Zws)|UF$SmyltJOrC!CNFI9J-u zM+%v6;XEe3$5z!~zG;Q<7lqaHAH=`s&Ti5+9?2)UwG^)aZGwIbD2}hgz}N6g9%G~D zid!jy<&sJHs!hqTOu%j5ZX%#0d~@fG(9*l4mt%T!z>M1(T;}*Yq5!l1Hh7_;c5#UY zQ;H;4ENyXu{)5fL%#2XLAw_a?X@=$@ySxG#f*K&kbU>n7u0a*$)Pd=PgdiCNXr6c8Ld|Ag;JgZ+K|Q``vrqSG0kEX)!seFWA1^Z8$8o5N z902Oe;*2kv@a90-pVT5;>ea~NpMU>^3PyxP75iG{M$y44!;i=RMLoDMJ&`>6!3oxr zsvYNo?{c1D#CPp1N49l6(I!K&KR%{JS1HHwEsmCa(rJt>OfM7*&vZRf6b{F_jMP}! zgeiKctZom&+6aAU2p>wUW|TAx-HjUppT(2~W%G5p5VUpm)hC}^_>v(viShCjq&We@ z`FbUQ#t48~W}9i~EM)`a;2(6=gJ6Ku=Voy6QW1!F?vjjY8@(K*JBoCJf_EKBp@r?V~W7*eNU{1NZIrBDHZ?`n z&$HZ>t0>I2Vb5?CFtJuWxNb~4Y_ov2-MGEG-9}{HNIxV}fU(G9cm~0=WI{ON?c;y)OQf^I?$ISl-VBS$&8I}f#uVEvGk?KgVh^wYkIcoCU<%ZE`1?q z5)ympPaxeAlmr!*4m z+7Kz{+U^~)+N1g4pb6_lc$e*Y9vC>Z^=|5%i@scO3uSaaDszoAuBBDkSEvN@P)Zd1 z$Yv+P7zMy+B9iP#Fa{^};=b`0%j#4W=SEr_KR~Sd@#~NZOkL46qv=+F(#NY$5tjQ;$lDs&A=QQElyjJX{0Zez=P zG#cchA}`G!eI;yF`C#vUp%WkPhWP7WT7FvRTYl(A*pvlX;@AY&BbSW(-JPtd;6a_U z^G)mht)DFlVqBuj8wKFAC!|kWR`PVN1!Jl&7*pAiXrL^MW@vJJ51zc;2|OdoSzaGC z`crGVXtVpCO$ojw1w{2vd(Q5+Lv*HUXJ@czl0#7>!`x28;w_&oFJPu=lR!DAB!1D> z2-bc8h~h0=vs9-C%R-#yLqT~+yf&x2fyW>hy}~G&G5#C`pvXyii|=7TfT@*SZ1PIg z+)*>7@0CN9bfhlbYqA4*RBBU+t>YTAZ~WhABa^RzrwWjFM!S=e61?ybT}5o;Po5;_ z?EL&nEpqr~Zwbj-|2FhgK|!73RUCi&_=0s(hR8{ z;`_=)UH2iM_zMO_sokkbne7#hX9RU zikDD(GO0&yK_avruo0;%nS}U3Tqx_=pR>d8pLPRx+nFVX$sIne-_{3Bw1vs4opu<1 z*HequHw2YSEHdNIT$BG>)SnaLrqt3aO&sdk1X`$ASmxF8l?{ilSlxl2_1ZjWXZG{n z?R|1eXpBa7v8P#Z-Z@mhx_J1Hx)#=ygK8?)h9F@s5JH2Kk&jX z%RlN9*m5%ydcWyf(Hu)J$nFOWtD~cZaIaGvW17T9A*xif=5rNZ?%8g_{0mlv^anzI zn-Gu6ugB3Mlk+EX&qn5ir@`SL2;13p2xDR2S#4w_XBuzx>ixG(>PZ2;)Rdf>r39W| zU;DW`&Xv6J*PwdbDgK2#2|ZniC=~$mu82v1gqQ0TifsrqGVPx+6I!07Mq z-^3za&TFp6L&?WPh%on~K+g}_RcO7^G`3BpwA{9Vi(RLrF8+DjT6I~+#0R(>$X`H; zZPynhrsO$x#-Ov+&*C&zfISMYNufQCX{8A9YK;cKn1SY{A~yWQg32GI_UQd>n(N!o)upp2L^o^| zj4g{zen7!OKelC%$onvJm?6y;9{NJB?fn!cfXs3@J+OYSbmtRi!*Zuj?{YSVl-!)a z;6RlvrByTJfp>lyyA~=#8wlS?z}=?ZC-PQ2aKSU+wEs~% z`GsSR&@a;ywWWQQ*VZ28Util;@an!~jp*yjpI&|UhHabJnnJso#RSDzQ6xoS?RdDI!<1kh4f zMo>08+iC3h>?h@(K?7~XpIv-+A{M}gYE#5FJ&4$juLTeXB4S&!{^OqJCV>pqI>^YM zs$fj{kB@o&=3CW0sucuUY{HxVfW&fWy%M1UA%}*{nJXAxdCaF|)^gI#w`g9~0axrV z3J32-s==3_;1n*=kQ>06JH3BFF4&vvwTCI8HKC7ZdIyp8;&+Y&Oix@|Xni-tg9-vb zo7=wh7YtVRCBQCb;U~B3)r0LDy$}KE!1IPPnsrB7b{T+?7`(8YI(vgC#n*YbN>vNgEE8ro+B+W}sz9N;a# zaSK79mhFqWAf{jSULj$w5fUD!#mOj3%cNz=>yi{ss@9Px@lO=H3s%5k&!o7w^a{ z7htJA_{5&$qCcLc(+$kQDDVEanw|TDh4?I;aqU5BR{i}Z$@ z^I=H&>#oc+tx#F$UNhFV!Np$i94g+5(Nupgmve{gQ;8P!3h+^iYA7mg$-y4NCE??5O_sI=z`_RvESbN4+<$3P^9 zj*cqA$nR|5zs8c#SnVduE%Ee@4{ZcJ@@(SfRLx)=pd#QmvLT6m9hnvpp56#-XD4wS zNDgltpIdV?`+b}V1ly!W8Af5t5(3eI=mP-nQfOS^I)$JgK~D6>?Ay2K(hn(Tgk?oy z*O&j@ys;7EZ6RQY>ThGx4@}$XZ9}O`&tV}MmbcEg=x+<*oKCW>uw?dwfMVfNcd;DJtXUI zFp7q_^wBXuZ*akoB~Ypa58=(5{F>aiveWdwj0@{g&oF@4T$f2w-){e^>bbvd0quc6 zMB6h7({E0sopdvLmh?|?vT4k{D91NZVUB;J=$9se#6SNcXZv6KEUXDFKMRu!bo9J^ zJo3;oZ%+1>iw(w;MNx!WX0VOmU8Cp_%+Ge7!ysZUnC(qdzGO+DLq5dG(H;!^ z98@qJCvOZOm$Mstb3s(XDu*w~30RfpkX32Si_e5ljvpinq#loM$6&=pI5I+2Ag~At zXXPCs5M7MXJUAlamy6#PIt>1-bgIB#Z-d5ajO-<{KK9I|bH2s@K-%&P?Vp#)!b{PS z3ip&HWDQ`SQ_a*iP&z`@>OKofuZhi=UkSWb4L8$z!SPx~H^>qL2iO{rqb$`y$?y zJKwhR1C2wF8ya}aey$B%Rv-lWe%6IdkhJorypLuBszRX#0HN0dDCg`XtCN_NAo|)n z#9deOp52f42?tJB6oOw|g^0Qx`XG*m7>Xuk1X_Da6yL@`>ZwwAsb+_;+H$T`?bs{c ziTf9eAtAmoGL|iKPE(!2W02S}jH7}hTXh_Mn!(f2`qFhLejyT$Q}YBHa$W>T`uOs^ zkc}Ji$PqLo2`>b!Z)G`umEjNKXMwaT&*$d)nQuwsbG;FgdiU}M6F&U>S<*m!RwUnj z;)BXgmZQKXg~}`5f>q=yR%?bG=mA{#-qmo|3d`_#r66bLA=g;Vo`Iw66M&VLko5$q zWsuI1BBu^K=JII0b^7~FfZA6MnNN3RLnIfV!QyIrC#%GvO&k)Qk>b1#ds3%ODQ9 z{MN#=U^VA8=T4JOE1QR!)ah+Czvrv-RNFL^ua`F>$!lC!=P+E9m0yZ(Ww$$aGaUt*iF~Tg9RvcgU|%I`5}NcxPk#}}xvxe{!R ze}P)El(Zhi#QT^s!^1GIpQ?c?MmDUCEyTs@9#ByE`%!x|8bog+-~XC5{QfZhM$A$$ zZImCH#V;(#)wLN_DEf5{@7cXCRrgxOpO+30Xh6y(V2B@>+4sc(4buRGrdg2A2lE=C zGuyza_I^8YxLGE#Z-9d%R^AkSXOo_YyQ^Zu z2WTnAi{m9+#CN%}W2!o#_CY9PXMmXE%1WM>>^ZtIORbi#!CIox9>fP0t1MNseZ|7# z;I`9ybzGtO zn@n&j(^8JR3uR?8GvStO+RvE<_3`J`{|yd@3_)Is3T-OP4`fLL!E!CMZT3Riu^gb# z+KhH@(Es;pOts`qukge?$giB^uLq`^z57aMPNW6!58(c>=X;!xm8Q7e96g+UTH}fZ zF$NefLch>{C#D#Za8}B+<46)2Uy1ngICgRzfzOS9HA-W9NV8q>+oir=VBmg+Ka&n^ zUA)#(y5tU4IgQX|Ia(C#UXgH^Gcc=Ef`|xfC)p41(m_W=pk--aKrDoZ-yyaOH zOUrI`s3=wry+p39g9~RF+t2C6hk3Pt2>X1`<@JeNLGpp)^CS48R zfKRX`idX)dA^ur<@i+tIYL7r!sD&##=_+3hHVUJuaDnB^G7{+IWBp;_m<;w`H%Qmt zTqs`U55DdG5qoeiDi0DGF+ir=E8Euv?Y~&}>g*SB~UW0eqqiIc+_VWKOpX?iw6=%9j0|%}e!wg*egq79y@* zL=w$E@gz9($XPVrb@WGY64j;~S>F&j-t~Hb844RirUXXsjm2OG(v}$9ElnvEmOOpG zYyJ?RraxWWfKs~IL@@8l;z-a(F_6^K;(l}qwt*MV*gl1W0ejF|(GnRU)$7^eSUh(} z6(W}=X}$t1&+pUpLr34Kn3-*Ksb}EGrp)iChf75}1-*=b1m5XrIlf(t@h@%a7k%OZ zG6QNJ>8V@J`ZIlP9LU}&7j#;_>SCx=oCf+a;5-+X{0e|dAH^NDjmkw_TURyI?y?$e zdp)o~)kDZ@%p{j6I;~IF89G$~BUeAiZ{zY8U2m$n9=#@UAf^mnxX2;C^GlOAF0hx~ zTTi4E#eDU^axPZNi>PlS@^}s|2oc{Zhx@9{*muHB#qKdx-{qR)-6LWbnkgQKai~FY zTgnZ?TFVzm+RZp9bP zGu#9X1)bytTb`mmUl?r#nzN|^&_qnyJ1mr@0ry#x>G6I_kyG5nM_#0q59Uw(P(m@&|G4H@PWT>54kW8D66&?%2H3U z98|x76;ij%`g2^grr|SHF+=fZ#M!^J{Cgi>7mYm}%#qBl+5qLQ%Mi|6d^ySGZw(IM zHv=Glt8IO6Wnlfj266oz$ox8m`pg}#&7p}EI@p7Z8<1r~x0ezf1Hs?>?!i&9BCXIR z@xRSG??bRtB0hp5tbeT`V6UZjJefX71#wdGos)`jW70iFDo$rhUz%~cs}O#%1!`5z zlwM*n0pQG|%D@Jo@0Kf0=eXmyL+UIB6oVJ;;{~$qjQ9h?3NkLHe4VMI7!5mmGgJp-IYTREk?SLF*KqJ7k z3U1$=y@@seFQ66d$Zw#kIa0laDDFl96K*C{PCsJ{SVmIXe!$2wgHXUL9eja}q8L+D zG1#I94Qt3qO#))RQx55IBVZ7kzkUUNct-(;uJR#>uD6@DF!{6XWDKXof%XF5!#lmg zPVSDkYUjTG&jTs!%C=eW-0Sd^JDzPL)a+D{HT74O*0_$xK%E6OjJE-dmem{d5#}P~ zC@#(XIY0cz!~kWT0;G+bmltOAiK9C%oW{Mz{gvbL4Z!Tu9SMBNl+k3DsfVM;!Pjr{U8^jWKC~_z% zIP!VW`v1fZ6ht9ojFG+R`|~$91N)ztyGOAqY3EW|3ifnj_duQV76t22V*3@gV+ipo zZW4M{TiqvcyEWqBinW{98$=)@y>EtM$ec3%eH?X&AeVF|;9%aSu;Bv%O{ePE*^t=? zQ}SuR-z*5dJcW`3-k?qvif*| zapKgeFM_4A#4hsKmN1~lB6^0;v4De zEIf)Cqo$feD3fHIsbVPO(c71aCg|d|w_Q!Ov~T$(5k^s(IGA2CE~e|!4H4f~o2f+L zVu2EoMoZ7UEK$q?Yt|7zeFhu7>-4KzH|$i`dn*{|=gnx{4~opyX`-j-aTY0~n^iLu zs)KP3y8@q5uP5-5KuXp;x2!bl_oW=3{Nno>0a+0r*W0`W-mtyl^(;fTg6vWgI1wSG z=?dHOZ1xAGfsO}0_`H3qcxmK~U_Kr5Miq6Hvv4y$W{jF$IG z3pRCCI5fyL5;vAA7!W>f!#bXCnKvI%hwr(GZGd;#bt7fh0e#OgG^t_!eLLB)n527# zhutQ8CwAyt0JCS>NYIi8SAA#dZ=)#S1$7s#PtCsnaJg2+Q;8YuH!^};|CWNcXLBkg z9yKgQnn~I_a##vHaK}a}20~oxU&0MgzB1pt4ipnwihTF;Fmm4?xV;Hu{2Vmbl4NrE zo%1SM?JO`nxgRhhMvH;X5I`w&DnKLQ(heaHFzJEnM|VVMo)eV0h)bQ^H{M1ExHNQEE&eNIe-yjB~1@TPT?}wD>K0B2MKf zKk9+z4PI(RJT2u-v*^T*EF8_N_w;hf=0%H|aFBT8)acKQX-T~;?c9!#To@zv%JrY)nLu)Gu8l0!8ROc$1yb-eM4+b> zDVzNG_lIz`C(tg92pE;lt1AUN-BC!0xSAkxm>*Y+jqbSK;|BySr_C`<9}dl5iwJ6)Be z-n=yVaXFyXM|Llz#D@TucJ=fj;B7w^J6WBupnCmo?mLw9I0y>`-KP@Sw5Tf?g8ZQ_ zOSx2&kM(kU9%8d+kGwzx#5_#`9AfePdg9k-QT;mr{u(ATk%fAFg=xd$4?p)50Kre8 z$VrKH;UAc|uX_Av$1wVzzq@B5HU2w#>&&_0_HG(fXA$>XiwBRWNB(-3nPeI2)wlob z7x{%oFAncDh%dX`-}^yzMejj`a>UrAW=MVaids636~&^q{NZbj^iO12#V-mCQ(}rb zkrxj)?{VPW_^Fx^nDe+wswmx+<=bPfssTD6I{?6}T2@LwZ{!btcR58~6eoq0%N8*Ymd{V8sZjP9bGV%?Bp>zqB zzIs0_L~G4v&;KVMO>oKImp-ZFLYk<6rdhEGEi69_XXTGv`2{q#UuuTn|06r=SL%np>fGAbNRX3O5%{FRYb!AJJ)Q0S&9um)Mw z%>6`L&Y^CneMjuu$rc#u=AhI^H9&&2$jUWjbD5(f>jy9tD3%ZP!IrWvQ?TC*GqBnYRToXP%H($GKkB`5+l2E1rSx$*ROH?ADXd-lY6f9)4>D4HzrCnWqfHtoZN54Ps=&&j@yehKWyt)gO~9QOvvX` z-ziXVcnmE63oSC%BC zJLowMAOo~8bl%Qy2=D?l@E4~yFOXiNbH@6E9FfNNC%HP`~rA;5>U1Co=r@ExD~SoiO5DL zfVF5h4Fxe_9O_(m7{8vGgtPsY)XGlevi}g!C=9FRPvVUtfIm16gd4 zIPiw&XgMcKJ?2!Q@+H5LnB2iicR^RC(^lXN*e;0f`!6C{O*7BZ%hDk^^mK{IbUn|o9=JCHGdleN z2Zb4;geTh!vYk+fNk-Wfgx76?4&J?0ULKa`DJXwJCUi2;W2Pkq73JQ25wxWBDx!=tku9}$`prtrGY;ynzfyUxXqFNv=w zx@09I(m>XP5EBk1_?}&K^f2as1Q>8;iV5g%Pq7VJPg4+qB-uCSe$c8r`g99Fp5FQ+ ztM9`k&IBeF{2RCXsL_MN4;mtsH_Fsc~%^KM96)>bO-fa$|o6nKxp=0f6w^r z&qlIaIlKJm!McI{^hNG8!p(-|djbNl=;_Kr?{KD5way+?)h)tnoZ5X8gDmFL38D=z@K1-rvm z$7H2Q$P=?*H=-G+md~shKCMfhIb|{0Ud%&BLiEPpl!fl&7+FZDwpyDi1HzjGikLX` zyvT13Weg8!%G33%#N;ID#0%FxGZgxms&KVPT#vU3203Y`3{n2yO(FkIGAl%9BcE>I{zXo1Oeh-}qgeahbCMtmv8uPj-(oTd+vCQaV+(9wLDY z&7&@|{p__MY4m%%o@zXkFf)rvN@j*a;db%cl%Wcqn*-Nb|NGe_MD2V8(ZbP`)FNTI zlH(%v*X0(PqSK9we&x45VXi$fei>^(rT6g(1?ty+La}7gf_7??mo#gTlQY?p&8+Xt zy7uXQHR}z8a6|2+s~@W5jrW(&9r7D*#vI8$GP@6Mt$-Fo=xYRr04*q zTwo}m-e>>5=;!QM*y3uil$RB$Q|~kl!e`OwM~2YXRfZ8qWWn)+TAd(eMfKnr_(vLt z97-B7+$D+vfvX{zilsqqYQ5ljU_@HmP*Zr)QVcjB;V=RCWcg8V{gC16rhXG;(KI@nL9C)QCMlslh4BYZ zbS)*&qWb|{r;SO$ow8Me8?u;<<5iCwCbNU@b01FSPXs@V`#ig!QqgefV?vU&0U9(? z_Z|w$Hea59;6$slmTQK#H&cq{HFk0UgKLryid|7C-<6PpK(mWKTot7%B|>)0OJ+97VHGDJuI*LM-vXV>9Y20{~tHg+`F`x`fvH*$>LAHY^MoV316?z&4p{|b$4xCmm z0aGROJrKyu7t-+H_3Cn2bP6V$v#*SBFjE1)=LGy~u36xm zo2^T3m1JD68ReBLJchce5Hb;K&{a*Q}tu1JxHY1!G9owkvK zZ$5p`6TDbK*X^RBNk-Jn6zF=M>p@3^D|5>b>Aph0aorKE&YH7BqjVDOky5`KW)Eoz9staM^PvFuMUY1r#befeVk_OrkD_^-=q)pJ^q4; z(o?O%?I)W&`y7B9)7*Gl4EA(Oi+7nkS3XNd=TXkMsap-k-!`~@Xx9D{aXf!4l_1>- zzCEEfJC^VGi@W|Ry;==Uz9jqG#f3%Y0^x~ViIvssW36Nfx9=**ji*&sF2(bIDDbXu z<(Vm$*qTTeZX50j9E`g=Me{j8N%~=C1^y~8YZFhIP>jc0uHkPTfU6wn+WZ|vDQl~eyT-iH62B|FdqNJqo=#=8meaGm?c0on#lplL~k*-Q3$1ipLY z)B_v?1WqiPqg?ip(sL=`7Z6D-^#vRBp@OREAH%9S%49bwY@&F>=t2l5?|zxvQyEQJOp$ zrW%f9pb-;kG^lQ-!Rm?zC&o#bbv8M6f_te=Ets*WuH@5tXDd3}>;;N99EP;rzm$J{ z0IV@VvZBu0KZn>IBvbVTXC)Ds4>y>I=v(wAUra}{dDY_-6nc$2b0^k2KYf*dW@UKj z|J~!_(B5E;Lx`DXFxN{}bsgX1-w^fYq|dD(n)!6m;|3dw(*B$7=Zmdv@;RNKuj<(s zD1~?Q77Jih>sV zuYz%L1%(xANg2epb90dKp2amo$3C5aV=j`X4;u~_HATGeDon9uPt`M%@-atId~AqR zhvo~&lD1Z*z@SJtQ=qUaT4B>M`R%T!Xtr8OM3UAYVj zR>C{``#246J}HnPqpbiKGGms$jpmy6kX(%SBUm)btlnrG+w21 zeeoP9WQFsiS`M49G@s>b4hNzDO+9bO;1MOgFyo0pRCg;CBi-eJ%McN5x)!Z39yTV- z%yXj#^M;QSr4a%DeX=1-SueNYF+nTY7|`L!;9enrI6|_=ec`T%fHoP$@B4W(Sos+s zBBc8M{yAg)c;iwnI0_~MwEYCZAd@k*=R;!}q?qQtqG(u-d9 z2?i+BY+dl`1xB5W~Ds_Uta>CgY&j~m6RTa(rU8{WIHYtNAyy7`VUuUlb#ZxKkG#4rb^Qf>6nZE zf^~2pQ8i}*V1y;=@O>3B7>3?pl`>?OCxnV zj6!^?%->d-YlIJ7JM4UvFfUEEOa#p7_b-vFI03NDp+^^*NlIahR=GhR6}w5K5s%~k zwKVEDRPW5`BvCn^z=sF5*iySEzBTvf*f&J-FmgM^W`b6Is;ZetZTA{y%FrO1qsUh@IGezifb2VeT_& zsPl+b;0ld2amv1KK66z9B3{j&bl~^MrgGTmPMVVX8q{JBpS?g8g30V=b{!38yu%~U zP#Dh*k9o&O4+|(%b---KbUeDRBlNBwM?-n(reAzp2u#m3i7A2-tlrxG~6%;5P zit&s|;uw#~$8gGYu^u#-1}fWd@r!eZiPYL`SyjYG~(Hm=Z#EfwzdJv27V2o7%e0g;>;42n!63=B)yRZ^8I zZ^xb7i<&&D$lJq<0%CJbHWI*xH6Uzgna@T-Q)(n=Sn(8qvobvtc!T$EF0_#H_lOpIUmC|JhrhC@ z{{8FQFnIOx<8iJ1U<=0PNDtwl7Lyq;{$?Ok*VEALhXtfnt4|+*crRQ4ya11E;yA@m zz<}F*rIl}#o#vT7GgaNc#ivkP;5iJIT+QR_hpV#M;L5ZvQs0Yp(~0*rsEjaPQ1E2~ z2ahCI*y9;}ZH;3TSb>df(KuwZmR)p^Y%Ga=&8tcwjbgizbX{o|8=-NaE2Mu~2%^w= z`Fr0&o^nWf8JyB&y@D%+w>jm_9R2;65)L-wC#y{X*Fv`4J(931tR4F#%8UX7{n6vRxhEbTAFH|%BZ0dSC- zLEwE)0f7fZ&rT=7+wwrUS9+dcIb=S;>`w7Kb`xikD1cP92kIFDTX(+t{V|2wXOp`w z0115CSP}OXr{6YGPc!Bx7a=I1~$WTNF+0%PjV)b0(wnRI_ay{!8){dU2!efoW zrM>L40TB_G>s5<@_*o9@JM4J;UYwxQYX#b6;8Zv4g}K$GkK1|vc=m#8`^Vl~5VLx` zp|kSzs2Knl^cOusC|2DKZK`V6FE~!nOnLY3LpTdgU{UGRF5_i9S8T#Ykm#|pQZE>@ z-DLg*IzKeQi)@5i;Q8w1)#fHsGJ%DUxL}XdE>rU0|wu&I(gkZRzFQA%vkI;%eF*}G9lC* ziBpw8oqdwLM=9coa04B!OyH2D>$oM6{j2#LkcD)%(-%3=z3q|lvHs%WA4FH=?h8(H zTqaH)bH(8v{J>b6Dm>F2zB0ehj>6fB?{r1zMT8VsnqTl!dS(d?k~LHn0I#y#Vm_64 zU0at`Fq&Gj-tZysJ)-rr=O8><1CUuIMc#`%?`8OSn+3tjddu2&NY~;CdC^mkMdkF6 zc2Ody%?dH8!=5v8Y+$2!!%g9faA)Hi)wbiA(f8?nqveU-SvdS#7dxP#Ve~wfC z2pTywZ`%cqi%HU*;I9hT?e#YVo4sQAv+eP+b=J?Gn@=dBZ3s_N*ZtW(xuG>Lg_M1q z3GR|qPue?s5^@3eDN9O~Ig)z6K_{gP<2+dFza8C^!1d;s&pOsx$L$&m?7lJ8Qy>i5a z1Kk(Vc|Cmbr)GG>DHmvCZg^Dpy+Z^c84QbjHtkJr6VzbtpUJ-(=dg51W+A@e^D+NO z#-v9gQ?c)|kFQ(FUf7-W5eBgzV3$8)N!?1q5ZxAOEACqW49SG8d3}Z!2c->a`wK%}leE}qH%fLBN!pXtmoM&Ur;uV=>VuWl zB(qQMcURm?J_4F>%Je~HRVKKcN;DoeG~UcR=t)XgzOQ4p$<*{HI$lc6z>81c$q2QV z7)*5a1Y0~d1W4KuP?o108>Pyv>iE!CdXID9=mZzvm_!<7927}7G3aCZ(u!nUs%WOd z^@XWqQg!4*p2E)DOatd{%Tfm4bhq4kQ?#Yv&ia=Axv^sBBVdH}S(W7N4yr1=*k=&x zhm9#M4yNz993|TtX8#%XjKq2P^Uf%(QaWpw8d*>I_P4yMER^dhgRpB&8PcMc+z{SI~Q}k8>V^IjUU!Xej2K+>_5a5t^Ud*>gKR$7o3v3SF)0I$g zZfHv}GyPs*-mNfXzo<6NkR=~(h3eDz5|DMzJ`8q8%$cX$G@@DN?8z$~rUEl267Ore zI;$XP-rr4HoPVLVmd@;bjni&;XwVPty!MS`XsU^4RXrU0?gtmed0p7f_29c^hcoLw8~ioC zp#lq-F*#e)p|(ImWXRm1N|4{j5-|`IvW3WiW4EzKySI5M{#j;7h_b@`1&75gf*HoN z%rl+sHq*P<`irUYY>g9f4f$ z&1_-|k3v;-9-<`nAmOnS^Ue?`MNnkZ?)#d(VZ?&`n$4?=vQD-Fi*cS7sM zyEBPZ^7n3b3_bm!xwOgT<%^OJ3gX%yL9Xr^9B`7)@FGkH#egEi&V=|ynldxr*7^>1 zJeDnIo5DDOfLF^}>$n}d*;aXfow#2sZRLBT+p$f;q#euQUi(%yOvh2uAY*tJ_HgwZ zF2?E8uZf!mR$g2v3nysWpQuQrljR2Huh1?;ilAqbVn<%-mEs#MqpjpK6mW0bE#yua2wcfr7$wsY>-w1OhN{LBBs#> zllf#c!n_U!W-Z=_f|7;AVM>XBjY$OA^|YWJ?@pUQ0mQn6HcK$gdO7HjUZ#d0~g*nF_#5}Q7 z4c1^%5Q0l(sKy6T^|ijE1!!KOvEC6tWlzyyYu5F&)YLnd&}ko9?8Hmg_*5mSU5kyi zmAFmb2si5b*%Hc50Ma+DukD+aQcgK7hV-!!*;(B@JQD&8lWFN~9LL7E$4uSU-Hw^S z8lW^J6$5}=7N%==cpZu}+km)^-VvC0ztX6Ov$(q6#>qm~yoku;vX+9q36do$@FJCy zsMiIR2URAUu^XTX=24+Mm4^=WJ6vdc*ayRH6omRrOfp`P<$7wf+98GlkOj-8@Ya#djA%9 zk;RfK>Cn_=9sE})_KsqrL`h|apZ*F=n3>)A6uzj*BNijl9Ce4cu`M){1NiKDka7&> zbFkK6Q1F;ct1@p~mjRtBk*9taERh)Q*tspP4Hk@M8UgSy{rUGP6w=jID!;fn`p@rZ zp>ZN8wgpl_@;~@DkZw9llBX-HW_VZSfK*lQmU`+!Z zxTAJMNDV9_<%L##j=Nn_7+<9D(G(g$YVKD+-M<{tPEm3leK%(YorO=uYv4SO{oDR8Nb>xZ^(uguQ!l9Zq2mj)JcWxg_Wx-Wo_IG>r=L- zC)MF0=)BSp(_GR=Ij3RY$(G2j(fE7b z%+$^|y=v6BJH_lc^i*~$ywvGYBYO}KWUOvU(I`w_G4QWLorG?<^VOB!xY_qKOdIji z>BOkLi$~8YA?)ciQ`YyjYFM-%-OHB3|A(?SkB52>|G$$^8L1Rw89cH#;Dl(q%on>8?pzh2TJ#wj2}p!W7ntv&*^VF)%}Zlp!ZTOU ztjKf|(d$u-pu*Fi#O119r2kpA^r?(>5cYM)Lbz*TKG22}DYsHzP$Ibg`*P)n^n9^1 zF1T86RbrO45o3U5I@a+z0jBqtkb1R?FTo~CChFyxoD}Z0p@$C>=OloURqgPT7C1($ zn^JMOWrNjS2iI7z9FaOzib+jX7-+N|yYGklv1G;>lwj+%O(8ua)bx1lHaE;+(ODmW zS3LD==#Q7t0|pLLkZ@&|v|XXjoMIE}S#PXXSG1ytM6@-&V|v&2MShsew|u zCAx6OGLC-U=P=qY;EsH{8s9f9cD8J>+Me|CE4Zvr)X{8VUC1186&YheH_hbvi{VIu z<2*>ydOhKn%~3ol^G(YQBSwws#o|cV`~)JTY4(MQ2l^3AiO*fnZMn;CNdLAP@4h`~ zus7;+8e+lX32?%WfAf_k-QkZf|Mi6OG|nfV^n^au?72x(F_PGZEK_dH&N@F}FBj!> zaB)-Rqx@8c4&qZE?-JJ)cURsT;N<3$iZK#-S7;v0{dr#XSt8y^*tb(dW@N*9N)xw2974--%!YVg@JF59>OuUU-z&}YBr3fh*Yw+?sr@JNPhTlv zJMD^tbx;Zwm+nK;=sX^)k&0M8=PLjFo`MGZ#t=jscF}X%M07C|mfM|S-js%TbMc?d z5{VOARbJm_^y0#xnRi~OW|-`KAx8b7`lAtu-zpcLfSfpYW5IPkkM$rvsREI~~T+0!qbYedi zlcFQchQ=$OE%$$!v0;D6?Ys;OY%Jj=ME=mIyK4}`rgN{`H!ZNNZ`!af+~4vYKKE8G zs6}Ms{4BaD?r#3ryi*F3I$IRJVN-p4R!ULh0`6>!_KS#+XN1I|6gxPTJc!DAvsq0M zt)_!N7n8k$D_M0h_}4^i_q2VmY7NXhJ*1SI5*EIRbk1wLolzogjy!`2c&BmGnYOqF z&q75~th$oIZ(NrDR7DIuvl@p9f_sBF_d9lna=4k=8=~cw*Lq&Z4VlStS|f=|wjSh> zKb(UL0n30jjSZ5J&FYqb=%^xD>zlAu{e?uznr{F*^CqZ6pGPG+DQMb%Y;DyMk%rpI zj<8I&yMzyf259{6C%VDfyU?g!1fd78`a>roS}Zrn{1#q|l7izE8EYv%go#ckBGmNx z1_iEwZ#LQtGFHxz7B{0Xhuw7czImqCYIL9lwu$foQv z-hXcdm^;M!Onq^Z&+dnr;xkS?WZ@6SPJX^oXOK#AhR@WvMqJr5B&VN+Hgigr2zgYF zTJ3v{Ke997>BE1LE3(dipZa`7at>xT!s8s9wAJ<{jy4BVB*{Z1@b4ht)L$L%i83FqOPOsF8foRmL4;lQuq@Q)iSooR*_}K7h2)^+X^m z-n}ROV3npA5#?ELQAN-B};45NND zOjg`HJpr-*GuK&QkAEYq{dl6fF-@xX&b9fY)wTJJG_^J*h(M)CZ>l7>ZYjrb?<8;FF#iGSi@l*s}5Q@Y8O|VD}~uCHoKohE43*Wvj+_I&B7=z z`T6&@T%x8|ksjlZJez7gXn?Vmf)XjJJupyP&bK$7k_~WXdQu$*17B43jYhqB?JA*W zmXPLHC)0@M&xXd>kEjXoJ41zc;Gv-Vm|7^OJqa~+Y!wF&W_~E&zCAY^o;cZ#w$w(X zhDQ>TR!vUxpgD9N9oE-#9xpw4N?s(USBWL{qZ&pa8=3XY8Y*_BC1h{SHCa@jsT>he zUF*wJ*f{!NiBxHg7J89SRcnUM$??$&4klw#o{KnKZIsV*S(7u_Ms51cuRUt3j=knf z6aQ8-Rc6$$Pr0skH+4$W5=LJ_S%y|qja;k&3{j_)CXc#TxT43GpycF*(y(cl5WD#E z98cI_gq$^}^c|k28mFA;*{JA)m#wO=_hQLpubj=Wv!27#GqUb6(bc}l6aJ|3gwMsD4({Q$?3KxbUhYr(%v%OWY~}5(6w^CR$*k4+*142 zWj@o=U&_RrJbSBU;JN~o@9S4ylWhc}icmkO#q6Y^5qh2G02@ojhQ8gDvw`ZBk>iUR zqx5T2$qSR_HCOuWtcPSV~2LM zJs7JVK*p*UOxY8adFj_5G}zMFoT;Z`_uNl2V3PinnNzdBOEC{i`gS<%!pP&TpsS>N zi6>6&)X0lSNlP()=il1pPs5k}T$-qMzm$TERVGsOKEV>fvJQ#h(cDiMrjl57?KAVt z*W*@bnWZ9nsmA9;LQmh%N=``fyx4#2g*|wP#>C8c{tPoeY*ebr@#6U!L$*N$3+J6) zf}Mi#<5?A((^GIHE5Y_SBW-XuEse3eQBVAPkSe3-N5Z6qn;kB@3S;!zgjxM4PbrM; z-;uda7nrAFI90{oBj|V;|LKeWcu=F0J}TAcNDtY0EhUsKx4?iSj?)H7t|8U>wgf8= zu6Pe2+}j`vD`8gnSE!u_Z#G>cCa5=8=Nzo7bM))A37-LuA{U|{ggj+(QM{Bw6EN#oDBT$gs z{GEdr3_a_X(|038BcUw7q@19q--(70yK%Qn6J2f&3$e1k4POd|VE$Y#piuNHq!KMH z!Vkuq;+gc~I)m9l^YpAnO?Dcn(I_8_=b-qDTf5X2sNV7-fcS~^Jk-t*ucnPvRp@Qx|n@q9_lBle(!)@ zSP1qUI*>{cjS%ho+70`=<;gwYQ8cvl;l)Fk%gYCsni_zKzKq zeTK2Gt;r!uwj5Yk$h)kf5j>QM?!lbp>DEoKD)i=I4XB=2Fpf1(SM4)tiYUj>OKWEN zI!^aoqn<&YO^I$pw*t)~`mf)EprRkTN;?aTPm_CDrzmAGtE^|tWfW#ogZXubmEIsp zk9M-K3q4y>%grx<&AnOVZITDfSw^FUP0KbtMuPaM0v&6Wf3~MUTvtKHje6Nn$Yy|B z+x)!snr811hZDUFR+@=XPU4-JJ`zd~FV! z&N@rAr>YCd=^GBEn>m0QEx8mf;z*x~2T-i%(VyQKfi^n9k#OvqVe`O#tV=v~!t0_% zd52RqbYAm=8Xxpr!<0vqUYaiEv!b3nZ9NYkF{NbzBU=usH|xuE$WggqpWI%&=*lF7 z*^TNhWUcKQaZ;CDEm#j#J@U9HhpRNFL7T@~(bS~}f0A55!71Lx7 z_Wxu0;!2k9U)TBam<(bMn# zh)vudaA;Vb)~J;1RU-}c!Bg3_F`1Nv*b=YUak)2jE>YIW2%0trSyCk!;Q*%og=T?P zrE?`GN5dqi-{u2ibCU7`DZfh?n15RJ0&`d6YI=<*1^YUKFmeLj%?TbMd9P7c<8$9= zBVH$*?{(F``C?&*3Iv8`+t2Z}+fR_{G$30%@KAY);C3fl!1x13e4kXvaA#Z#NOmDrY~02UP*=XzcP{0v(P?kT-%~VhGMM} zJbZx%wG~LiaaJsTJ!TlfH9zJFUo%(d%jPJ-SqvADVC)5D|!b;8THpMODiB{ zYpgj@#4JS0?cmavC{A9#Ef-OvfiHkJKjq2K$fMMfyipu{Qg4eluKYhA`4{ZTlO%Z! z{p6yMhl^qv79odz7`}k+M4u+@R_|Qo?u%fB8HZKRX3Z8WtY-)#|CWl24akYE|J1*J zG=fIY8WAUcrVly%P>=stn7}b1GKttR@hdk7v>`n4k9~ScUp6gIY_duJOB|xYY1}tQ z7MvfwF-Q)gvAeGn?Y--NU_=&gI44xRFQeEf7}{A>&KIlnrvbv5?l9eLV{ChttoYw= za-2QBF6IVZ`R%i90ILcF^c#yyC~uo@zCYUj`3c#?9>d*8zMQT)mc8*vkl7DgJC-`Z zB1%*4jWx({L}P7DpjtC1*E|0i0+u)a8BJ9uMadCslV*)>%BWRp-DO4b^f2vK%aW+~ zda699t~Xo%kdOJG6Gp4-@KG7PZOkPbgq{J0)f`kf^RWym}9C5 z$ne-_r>$G%)mas|X9M4vdBSC8-{~^04}a$T_eHAZ^+wn3-}Qfh!Mp_4)NZxfi`|4N$F#X3{28SL}VILLOAHl{HK~nirAozB&h#3G>i!6#uj$tqQoD!W{PNv zt-{z`u~&IeKYC?Gdb1<^#?#m!6l=0+tBCr#c_H6dp-kk0h0Gph5Y^pE!E{4?|3|D@ zlkFZvaw`IwrLj3@_b}nX$zA*pk3QJG&7S|ors=p$ZkhAcDlWI7wo#o?tvLr5b&Hal z9ipT)zCkUXco2+gTAIBV$*Th|3dP8)^O&G~CLQX|mPG1Z;=l>Hbs!IP(EYb+^M6=X zD<>XTsobwxzg;dIwNyF4@o;1iR^q|Q)UK+_>QE<^fMKC9ldHi&T;G{Ft`s|6oEqNEg zV>MrPdJgF*<%4(st9arD*&pwt87<#a`+Mrsu0M5}9Z6Lu$TmW9e!*2Tg%I2V~7z#{~1nD zpAao}5_j@r6{Fg`)Bzjv*&5Du*ZLjMWiThBr(rWO6ruH=xKS|RePsKfT|xa8#bb^ zR8pG{)JqP9T2JY2EpK6Uj)n(d6VIhAUXP;rg_OF3`Ok$-#XgBWPFl1Oyr3k>lzEj^ z>m+^zF_>*hI)RAv$@tSkAlb~uEUWi8jC79LLHbm8Ku-dwMHik67Vt1O@ zavDNGuRk^(_LxcIU%AC9O9!ER)2ubov4@x>1oGGasm<>T_Hz5<8rsjM$u|ZIZPXAA zjVf{sX*M?d8l*|*hdh=B4Ag2_bUiX8eQY|d*SxjMBUJ|rj(tpC+ht>0QV}?e)Cs;r ztPQnP9Y;aJ*%pL0Y!I-UeL3ig-Vn2R5y2Inpv}$tu#d54{|~Fhrdq|gpAw#>+8$Q* z-b=-iZJ3=$ngPZw{WGy}H1G&r=Pz8|JGw!*6Wo41XYJAn6`lo8n%aP%sjgdz)}QZ8 zOkr9keiFCUB}+4^{N81nwno-lk9hAt#Tz3MrJ=t z0+X`$_MNE2N?_4@oE%)t)k*t_mkxIKo$hiTcyeZ2V^Cxw)%RP7;S3{II&{zI#v?D% z?w4`dLR(OmH5Z5YEg8ePGPsviY)#EI#(vyp&e7?9V7hR&fnrEk*e2W5r( z+O5EkKWVyjEIu+OdU8z>r1dC1Emm8!mr}rFbaNx7OTQxgM0Kev9# z9WZS;OJ}EqS4`8S*mqew#{Aqt*l+zTw~91kuJsG=J?62wTf_n|PmIU+s+->G5vUdn z#=|4SdF;LToZ-U0Tms5X>SNAU0OxOq1>D-%U1dJx=9i!CE>MxvU8wKoXuzVb{$^*~ zN9wul!s#nogBUy#-1l>;x~O6oJ|?c$JAET`;7h@-fVt#$Jk&~yOGgc%=;dtVkCB1% zf8(fa??KkCZ}zoJEahQkpG^55K`!Uq6k(pIs%`ZyMUS3sO}!jw?SpUW(@&+1$xG^+ zHIDI6zkblu&Z287fYe@fexSGM-80?7&UF@NAzA|R37XX%8j)YK_If}IJ`mH5D?~rJ zu!hiOO%S4E!?>}K!NVy5g2gRjiy75fZpT#OIDAhKOpkO4i(k(&?8w{45LE!FafgBA zt9{S1{jj#<;9nosArX5(k;XL==Up2vI`YoJ_H=V?X!+z%n|f5SD>dYvvH6-(b)pX0 zu4q?#C;o4<^%gORaL7esU^=CO%2_$`$G+b@29swRr`xkt^!22Dh#&e-<4BE7WdU3w z6BywO$<_Cvru$HS-guw@Cj@Fiswko|e4;xz?dKCzQ^h&7PN@@AF?&gUVj#aS!?>sc z<36TgDR`j_^vemA8Fsd&nmVx&v~|N3Quf2`nT?|>=RV9v;R|Fy-s^-eAVyQ&zxRir zOid|Kxfsc7apVnW{~*}li(!>8bI$>j>RG#el=KlbRf70@Yx9f=pPp+r)htG2pNyZ+ z;wNvyP3tmu*46Nf^cjnnMn6TecN?${n$DbYYcqRO<;qHV+HOz^C)?8P)6kl`|CGH5 zX@AtZeH{PHMmGzzA*M6W#bAA9v5)amvZGG|dJ{nH&j+G^lKd*e?g2C{lVrDr{Q(3G zWCg1;NVtLy{l@;h+LqC9h{0$;n z61VzcK9Zn6DdPR~sz0;jk7Q?X>!!l!P#pg%{umiT=2IZJK#KXkS%+ay;6>memn2{lN`1qR0IO!lfoCMlRKH#FkN!%1@3i;aX4M9zGmTrl)4*xZ>P0LjK0H} z4^n*P0q7CEiZ?HYI{H!Ay zxm{CWK5`7dtm$>-d=`L+TJ!`<8(R9r{(?7tGhc)*<{hVK;8l4()}B@&#|_m+Fw0oA z!M+Sf=fT=WX=dJvQ>w&fP&QlgseN6vS*htU`j|LL=UEuZ)Hip9UR!IHU4O=94|-^A z)axZM61tyMm0ksBpXHNZ)RqH`wFIN6RL}j&cN0e+u%FBbcxhmbHu;PbWEd|0c{w1p zigcgUaJ|U6VDphOK;T%%oD}~A*=-WGanX03r6TzAUm{)Uz~nHr60Tk?{LHk>iRExf zcyR1XO=Z;4DZZtv@Bl0u*pNvUM;#lQ$tGEiR=du{Zyy-Cv(9Xc#UgCHQqr3^Zf=Xm zhOe8iS=Kea>5w-L(G%xzKq_0WZ6bK&#{xJRS36ncjc35bVK5>^uv^a3g?ftUjx$j@ z*HHFz?9SIW%NvK8veO69WZptx`qj~LUX=#*-E zUammAaS~^HpK&!eePC@rRoVWHDYst0j;a{8K!R&~EZwku*f8fP045?<0|vqT3KfO+ zYI!O3cFeU&nb*eG526~Xs9d|7+kJ;?UhXD3UNK>+l{r15f5a_^O_!DaYpm^*6+r3W zikd9|Nqr18jURZ+C1u;LP-?0QsK#Crs?%y9BF>QtLqfP=Tvv@mVSr$-w#3PeMbB0} zY{58y<6yvc*J#tOp^@k@?ZSw`5ta+tWvAc{$GsmS5&jYv=j87nk1L2ga-q#7%X!x5 zJpX8I7|he|2876dg=Es)KVt7MwDpmXYTOmhga8d9br;J%gnylUf$nqg5g$9r@?yCe zw7|PN!*;J1n{aOM0RT1crp0}zQrtGf*<*SWE7MX;CnwRE2+os%+jbGdO|s!X^A=3$ zOd@PI2LBoe`mOtYnHz6ytZj6UJZLF6)?fRbUQ0ZwEcc`gmpd9vkMLg-jnvtz^wqVf z^c!Uv4grSZAdV|i6)!Oy_?|re=4`r#Y&*>X_U{?Vm-C!s|FYtDPBg9V$lfgJw((CL?R6T2F;+?k} zm?~-$MhPYXV9cbFzb<`HCxJ+>_JOr7*i;qhcvHm0fY9+pQf%$~T3l=XUkWZ^vY#v3 zji>TWRz6&d;5d$s4@2G5f`Q(sKMf^_>~U4!V73=xZN*OoX~ZPlE7Za`QF=7W_NVYa zs#+JJU&`ZVWfs94gf-6=(haqbG`OVd_PVuC9nS@pISp2EO1E4#zbp4Nb$vfQg#Z^O z=i1c^WUh9Z(V+1=t}Ljn1R7H1P1@l2eY=;dI@(_!SEuK2K2@mPB^)Zu;nE|WR&y26 zX-0z)H8z{N-x{E8h#k8Wj{d6CQ8j)3Bj4lTVFb%lK84)I*GEq1?8vu%BFTwl+3_pC zK?aJ~M3t5Ccp7c64({mMI9;@Xw}_~S){@Q1VG!inW=NqYRSl5uJc5)3K^m#Uw~%jX zPT$A51V(`toeQCLF$h0F99@qb+h>FPPbqr7a%j=i%8d4(rpxi~p1|7OHlU=dz2>}D?t~y>|2=cXD+$RAtEP_3Gtmw{OfwARackd*n}_fuQ>1{>KD8o_%#EPn|&jH{n1YjeC|>Aj0F&23Hp_o zhQ>vY%jX@xqrd+0h0)3fI*4*NIMmN+TYQ|XB{4%HA7F2}3pWLKkV~Vck>4q?g`goM zt%;Ho)(=T(3CMnf<-($JtR3k${B&_4btSJJG2@q7q)P@0yT(BD74LwVG+uMU#5Vq@ z7516LVen<>%&4@KXWuV3VEC=MA}{@U8vKZYl~DO3RB@vvC`a$=?F`G@4)7a~mw02l z^=B7tvcB;za7x6uWDdHzCr7)GqWhltr-~Pvg=m@oCE5@e1A+LlF{v1Z~ZpoBrS-0TlhK5!H zis9yYxWpk~YMPlYsK#|3@tY4|P0%S>T+W9j5?e4zR|({DRMfVwrgP$*hW4;2^sM@Z z43u1*plH9~RDuA4TVEdj+3te9L_$i11B}oEL%yTwwWSrmAKOQ#po*Af&t)4A;)!^rym@qI+b8WmT7EllwbH|r& z&4Jx<=U2>)6B~0a^p4agaizdul5CQ!P#p~%oz86afi~DL+;ppyUm>0YpBTcbqb(f0 zzLru|c}UTmHS(x7uF)0Y$z?7o9Uz>{znQ6iR-}F0@K|)h(La2I%N_L`mq_~gr5l=4 z>+K_Wx6>C=t8{1x->(lU&E{;eLVu^Cp4>~Lli_Hw!nuKg!2Nbruh~p+Z5M5=;t;F& z@@ehD?{;8Flcd4x5fs=~I6X-O=m-Z~O@jy_p}9!iKWL!&n+68HaO^l90iowFG;B5Q z`OT$w{N6KZcyJ~kP9ioa+mLUdf|o>6e90M`ZI^Rx@~&ialpB2PD+3b^m42ez4?$oF zfP+l|2j9$@W(TJ2DF8uQp97N6Uvm6DkR@p_LAh8d=?VYZ1)VyULyy(z;Un|8ZyULF zO)>$)coFLXZ}uK1ACVC?0lRsOH=(=3^;}h*K&>Y6oWWDK^O@8h&l&-{pEPb1O-JZn zX4x|*FMsTLH22rZiE7+cu7hktS!&*XtZf>5=diokZ&>Wql)m1@D=+tgo+DeG1XHDD zWE=$Bj_zz!lR@@9rDu28HTIew>r+$x8?5hAj{ky{Jz}aNkRizA==YeRo>j*ta;Z)O zIXt)!3eTZgL~0+XEmMuVzMip^Vk{RC%ekQNdK#ec9i!Hgu)7JebYeq%0yaoQ>Famm zjF+6nKlQy2>P;3K+q<08k_IJ{87%4uU1 z2MY~)PX>}yIeCq4nG(5%4Eem66olA~`*x;SNNMF@!37AlnKQkse;W_0p5cv02MOjZ zFOTp?Fo*CwK8OlYpzkwZ+FEK;MdC#cb0*q>9kRr*5Lk)H#5_pk7Y`5L9+;GlYZJA# zg3n8Mw1!|Hsd=MA9?QVbE=TfwRJs4p55I(mu3@Dn56c7cgc3w4I{3w!ZOaBHkn~;8mFFNq0u&Uj7^wmVkrSsxEDU0Q>HhxCAk*l#We&Gl zoC>vQAbmoSD z9uFmQjR`@anVWki}Kl;mds42Ke5F3E1vFJ3i{&_>(*V>C2_2;LDH&> zvgol}z#XgmoXzZDWu$D*as(fbU`Xek#IdP>+u^4a##LtNs54!G0^_I}rd;yZ+&Jf{ zT-->&@-r+DQy8VNSvqUO>+V(V)zlylLMpWOj6V#;NPub6m#4=nUUfH7>f z2H!0FLOSPri)qXuAep(AC;Qsn@B2@@{~ykKtia$({PJ48xWpUYhTK5s-H&u+0UF-W z#{Jj@9Y9aAR|{(!e?Mr%=Go3fG`x_$AnrtLjl;d2``0{vT=-{-j zb)>K|Y8BOt?9_C&KWkg97cm=@ZpqMbJ8W%8?E!K zNjUG7_otPz2fMd0eE5ucO0gu!j-J2^PIxMT-LsjgC87*mX(BBiKm~PkI+M>^NSt}o za*Gjg_GzL3{-dNB0XI`>y=bY4{&`J1I;&-0e2K+yL|E=iJjW=Z&dO~T(zM)Cx z$trE1GTwJAVkb23#w^N7m5paFyB0R`zz?d?I`1?HMv6AOCen@VpOi$5A$wW@jFhG) zTa1dw`Q&*i){P4{c{PKTs8u7B7M1?or<+v`wFZpmi3FLxMX+X$7c^b?$tY!!Q|qP( ze-$Vuq3jF`RA|ao3wD79l)69_%sbXw&8X`(pJ5wXC?`ipH+#C&9e(JZEZ(scAY0pW z0{w%2`8Fe%JW^VPdHqxycn!;M5UO*lz`oWqT84c=Q3?pP*LC39Nc+kE4ZkjF4%i7ch?qD@Kds`Q(sY%SqGiCWCT@|=@XrpCI0^!e2H zKF;U6&9?R=(D=PJOsiLI5KuLI@VA=BRjpc~khU&etcYPf$XbUSLeA>PDW7_)4PP(?zVoOLxX$8ALI0o~+Tx-YXeWBl%soyRC=$y$h> z2*tbIn4&D+GjG_@i7c5XvdjSxBZ{Ce#Lw%(*J}2LzUtV7=tlxKGCYS>C_IKgy>}AD zaKG8%=OKDpHQL=23$#@t473ak zMmrIe5eboZhAfJZUm6KW9JC~&IU>mNj`Rl6Wap9IUU&b<-}jp((dSx-^{wwT)oIA7 zj77WAXpgzNo%HM5UvrGXQ~j83l5_}_MdxL`UH|u{4rg6PwM~=$+eUBlf{)UB4!S?E zH^^uoDWYmiN1nTgMNL|ljz#Bm>QJ!g@oWb_0;!z(F2KiKuLXih?-Aci88_|~yWAHr ziRgB}TQekk#x}O+A0}xOnT21_Gkm2lO(UrBWb!Cq-n$$h`ePS1NdEULPBtv*Y!E6B z3FvYkRr4}psgCAFl^bVdsJ@xzRa@3q1>)o1JNl~dH9`)otbEqY_4-fNNgpA zNm5WJqPHe=Hh;`s|KZh9)UZ1J8Qbb^t_VR@HuRx3@=^NFcX;=g(@BnW{+9)Sg|jMY zEIiP12jpL@Ve-g#qAYBwMEeeSo^0O)ogn&l;3!KNOLs6+AV(?_gjZ6m~%SB|4@Uvq)32& z$F|o^+xXK}C-O`64UE}MgvkDf29@H#tHq_tTyZ1ss>K;iYi=Ht@rxt-dp_JOX)=8C zz_=r{J^f_kcjNxofyuF9Y+_q=ka2pdVApLeLM`Kd7c<)O1H~ig~)1Z(7_TEy2@Y*cK9)xqN3B?+SDa6_YPB29$*en|w?@`W=1o zpH$Cc4te}42VOA$x+l5k8N?;^DJ`tmnsKPlGFbVuRz3uzZ%pQbpl}x(!ovnIwaZ!e z58NI^N||#BAboh1C z6eawsTRh2~2R)|g!mQh6b4dHq>jB0i9#E*hym`dRQ4tb#WM67dbq@ER060J7?1z-} zdVWK=F6RxeKYSF&^R1Yq*E~IeeW>Huyfp6cRHNaIPCVqfWR!g?4p{8G_F7O1wOQP> z_#}*pnB+G7uI#L|fKPO|n4Z34*ZN0u>1b(~^aA_+@sku}_@xORYixxKur zbS+l78>c5}iEX1>COR4wnrWSIkov}+d|S1KOip==joR~4v8S^#_ zcr)f=y6_<&5~EW2GrC%0d4X(0;u7FyudOj)$h9if-bt%@MhRv1lod_La0LFkyb-g< z?*+AlFRk9rWO0fSfx$DM*J(khpzWA@Qu*^*_2p}9Gk)KofVTubLYe=${pC$atAB2O zuMjD@ZQnHHrsbzFcb#BBRd>;)`g2kQv|;ZM62zhu?rJd%=Ah9yjlmyPtm}C;n0aN%r7g zGdLr^OC{Akg|fN2Cg-1qlRmqqHH9ZLz61Q-(A-8;4WJenXqymM6$6c?&H;&iuB)^G z$>1v8XdVI`&!R!5yYHc)N`c@F~9YGIDZQyVDxoq=6dTUt5K2t(<~&nW};` zIEX(OV`|r`ok2QTByMhy*NI%usd@ z@0I$%)b2;Q%?0PmLQH;^D)p)Z{>9LBwSmBn5<`QCThU$5Yyk`>&kF6lPG`t!k{n{| z#T7W4z>uZDw5gL=pD2Wp-vA%h=H4MTcabV3c_v6$I`AS|5GvdzjsGFkR{=-wiqn{s zVy`)HRZgI&Fp){5N^|wCscp)rd+<=fN^k^{r&SCwb}&EI z{ytc#U_;|qQ32j_BH_2y!1to&jwoK+M>BaEUhX@;nOOhB(k^$UZblB;y1b z0qf7t&`Vu=`dGEAHQf!_jPiPLH+bYjDYg4(-X_ z!6;qV1fBC8{kWX9j#Hj%eXQGwxs1V3Kovs6&sFAliO{0Pq~`Lw9R18efBKlm({NZggyG^?gdCM`a`_3FaEK`f32?`P zD|!kLKlk6rit;pMU1nwJUGo<%oiNRaWspHS7UD%-j{7z-H!yD9>Y9fB%cZ^L=b$X` zngS@~W5VO`Q6&<{)pNJ_*9*i*RHk~60IlVfrvW*YEMYe1ZfHQxJa!Y`|AkaY;B`QYbzGjdtBb$9@ zDSRY&schBc$$kA}FDTzMc^-hgy^Z}ftim(DB=l+Lw!pm>#sy&*=vq;EJ?ClCRxZ01 zYtnoKW-3M>uZ7mTx_Fa3)<}{S{$ZY(#HQ~dymouJpI2AB@^ftmzn>Fm1$Y8qkDq!W zYWe{fivrks+HyVOxCA^;dbvw?Try-lF|DG-ADQiqMLk9qn|6Y+Qqq*bo+4@n@A^b% zn~(9b){2wC@aWyDZu>l#?~nUCvVm4NO9-{fqRlQVnJ9DfJC?=oTi_o%ox^W_5$#jU`0%#dP> zGRc?78FN>Cx#%(?s^5a)aa-s$rJMS3pfixl7!8-pbYb}c%mJtbBln+N<7pC{+ng4z$($1fyjgIfhOs?)jA{A`w zaV`aXfxW7O>&Ki6j7;?PLk`T}(MVTq%=#Z9yG{R76Mt$ksJT^|j&Vb-gKjgj-}TJJ)vO6gZPVML4R)B)@0zhTUzR%(;Le58ROVc{|w z2}&iG+{gadEbKAiAPq&0I?(Rq%9ZGUb|&`j9zW7Xr}=~VJ-!Pz=eor3A`vT)wL)Bx zcj^0}dW`mNE33VD2!CKo2%ig&qsfm%xkz8G1ze3AdWwvLRAPEhK<4Ue8!^Kl94uAw zDwR68Tv;-eM25VBPB{#t+%tQKw~z{%rTNOHy{s6J61X&;mf8@-tJ7!)Im`qu_m_Nr zWe5Wj4I#C<2?`?*f?G+6x3dEyVYGSQ6&)KLcw8l^vw~V&kC{5V4UxsA z$Ru*vyfmCJG-1{h=mvS4gnD5|uCHl4&`D4ZK8J()FC~1mqJ886qkP5bLTBRYb!H;u zC7@G!$GSUD1r`fE)>jSdJn~??(GJQosy4dQgtW? zzaw}-CAoT374CCvB_Raj1RFxlTW~X1=Cm)dt#JLphAE5`Y4C#-px{!MUTa`A&Llse zQ~J+fsaI1M+i3;gQwl)C&wUO8KHwt#_+O3goX+>Qk)4Pg?3#j&?Jx|+Od5s$dgG@4 zTH`Ll2(W||Tz2x~*aXpiFR~$oxtd@1A-C`be_<8RCK9gXJ+x=1=VS-&92u^e99(FK zdQFuNYiP9~uo->SI+qLM^?xrAgua3Sb!Z;>)&aw-JM!7T?Zs1g2CiO3i=te0n~W)q zxRd`q3-J`hSjEA@H3Bp6|COA+54nl<>G&Ys%YT1tzyX9V<*8W<$|%mng1-J(Za}2Q z{l+X=lO7Yr-eZ#52&Ai?s9hRs=k`1<^NB(&q;$shSS6T*sF%O(KXuVWgK0j6SuTKI z-!fOL@&kGH=70)McqIbY2L8XmwRfVA>#A8>TTA!9>}%G5SY{Q7;3QmElghL?J?>Uo zmVaA*&b9R1D&L3rrZFpa@J zE!f+(jAE}P6ZdD)x#Jf*kIX<7a*)>Hs5F5$QSZ3J-D(d-y-XDsQA&l%21LU?kNC6&mMBzi@`(Q0{6fXE5_-U z%prFUWI`he=oJTk%>NIoZCO3N&di?G?qb=V{4ADrU5Kt{*16NW@r|i=`NMr|a)O(v zA`v3}_92nNK3n#3Ib+G-8F-64rN=o(`YyZ8X^sDr)YG#?m)=?2e~z4OZn|j7RsZ zep4)xk3)c;ur@x)H6^Z`iE0er_J~*MW{MhmrPP;&`v2x0fvsv>alV%A-$C3s<-yJ< zmoX|*E@fLEL);7_z~gN*Zbvq~S!pV#!saHWtn}iv%gRQEQz8ZidY!a|QWFpGuB9;= z4)|=Z=%2B2L0#mdz0Q%@0mr}9{P18*y%RSc{0SD*#*sUZ#95A$&4olS^E>2eMC4GP zcOEG+s`@;ZZ;&q^vi!i<1h*X<4p9E=@fQXu(dPwG_is;G!@aGudZK}GM1K98`lR)0 zRCa(Y$-nwW@gnZWv2uUT4W{2vXWuJ@EX6K}7>q+A6Ltz5Sn9an!S=@&DpH1TgO06= zOir9=gPeUmM%JLaNQ8v;UXzWj#UDnSM|_8QC3JU6aa({&mLac3dMCXE7IkT^(hxxB zcTO}5Q)yhtqU(eeVfAHqX{467g?G#4*hJpLx)k#<=z2)$zUgiLa9^c~|MR|$n-tz^ z*VPj{@~93Df_Ldckc@1IX<;t&wnT`+8u9~dBL+um&6Gag5_Oyae{lztZe*5``yu0) z*z4ShZSKO?Vy@zQ! z*AB|kvz@-u-kgv79%DOo`&2&UZUgOfZPl$5aEyV4$oX{xy5hW9%SBEU;_wOOw5dNZ zTQK&vtXgXv8?uGa6;CS`{DsEoyJqy(N|#}qPb#u**K_$bj|vzp-@ju_*q4GuMi-k9 zff-#0yoDJ2SLLf4RmeKW7sz7DfeXBLt#;0?=uVgblsbb|dNSbDZzSjqIL7y=>4H-GO@#%qjHXU^kMn1@-rESCVhl`vNQ9!jR^wXJDkHZ0d0(PB|u)P5NnXU!1 zH37S~6K&zyr}MizO9tr0KY@e(VR2k{@u5l*VT5wMVUQIntFyGK0I1GZ^KaD8+a3hF ze6+$8iGY;`Dazx?&e<5l!c`Pg^Z?A2d&MQbXKY5$ZB4cyJfm{lRf|Pt2K#o$+p(WN zbjXTb0H)7(e=8)t88_V=?lE!o7wX5rPKOPRm&{j;4%o=JrIhbqMe)^N_w4ZJT9 zM!sA0ejnuyNSxg1e_;t+b10gFZzs5gH(V+T+9~kGIYS<5+EepH3B3IvxR*giDLq2~ z&ZC5F7W#7~ZP;+%^%b%lmmyq7Oc#BXK{huOK+BjG&Lh$MrAwbKI%W6l7s$Y+3@h4k zYjXIlUm|+VyALTLeg)gp$ktO;M!}p*KUGGDSSt{{cuK|2P0iN3V@BSqIa2TZRtiHH z{TL9JUloR9tn=`TGW>V!1eG((niRASWgub0F>p`4XDP6Lnc>%;^GTznAX$(EnZU)7 zLy$;^L#E2yT3vQ^-DxNZL>P-w+)e`P~KC5rcvb5Dz2r zE;V^YFnP7=^7wK&muM%6p$L#+MSVsp?kBq})0J_{znj*AOs z-jojL@?%$lEL(;g0qLQW7K)Ha1R%hKe4i`>cMM^S&jCEu6ZHKccSRuE|Bx)-alJ6! zunQ*$;D#@uQLtl4LR`VyK&~hz1kVzeA9~^a;j)oI$IktuBHcw109h`@b3{#!6Q*4p|7@e3f9G5 zU;f!~2{Fe!+aA4hj;T0WRayf7MQ`Q3#<<=U>VIB*h@CHUG+FG+7tMGkiw2z2u=v+U z(Y7)Ag9N4hTROw|P%`+!1k1-E>y6xzUBRnC za{oF35BPFqxW`Gv@TvCuUT6F(ng*F~Nc;dketK|&>FfY2pJ9cAv6Bdqo zXw4%b&RO6Wn5AVZLspO?nNlTdcBxOzuBT@fK06)sSL-)02oVOR$vERu>X59VPgj z1;-`R;zbH)myp+D@IW3CJj@$DK2mTz^c08g9uCvxON+-t>DjWGh}fn;`kqPYwURB# z#pt9h6Wcu^g>O)Z?&TED?YJSe(ydk!*`L7Te zJmn0pdV+Ga+#5+lvaK>?WWrMy-jgr|JBy(@-!X($|3Nl86dq?5dlAAP_Fr!Bc|Z7N^gOS`x^ z)gU<-)MW|0d)pM9L-^G_1f~-&&FYfe6_e>~UPzr^`B0!(?@2?Mq||&h$ZPYvKPg4A zE$PboMGw~}ocwJ>>1zShsGqA80JHYy=VhleQ+kmUpcY)R4-yq0b3OaB?-U&hVYf?s zI@xzFeElcqAPBYV1*st!R!iX+mkH@3@%aGUlm`)qcAe!$NqQ2?PmZuR$G1ZX&skdj zX>5mQtGg9)tGz*W(xQpF*!frN&EH7Pip2?Z*KW18=ZypWPEU?$wEs1A3I0>4_@)b= zuPjhHxctVnH#%YMxSyQ?8?q7Qg$cI}DBeGbe5bRh(ELgx9V2IPnVqA4>5*Zy9@84g zwFQax?Qyy2D;&de#lZ4x1av-d3$a=`3)e|tBH!`n2O+{2K^lGfq=HPHyOyHu0gr;n z_J6NoB@zf?2(a`FlWJS~-DK49c#)Z6g+}kox#&x`nNl!6vU_VT%$!_WWJzlb`ucma z@Z6c_Yp;?owW!yWZ0hboN(=Qw7evZluRB_1f-1!Z8)_=J1;0KWo;9{z31G_H))4;|)3-&XFM z4Zgm$^(RDnS@)y<3@8SF*5|x+Ow?2ndt6t_2Vyn)cI8l`^n0Z_X+Y|HS>1;`xd#%! ztp2mJ(~hF-9}rCx3DW zl75PV*quuaFaY zzLu5-o!=~gH_E$*tTGC!S27*lI-O^NYJDBZnQ}?i=v<-@xBq8Ncf3*jXsZqBxlV`F z;>C!XFss)@DM9v&;>_o~RwU46Yl4W4Nzm1SPhd`fNmX_y?6s}+s<4e~A+36~>CUQ4 zMNR&Fvv;Exvp1e!8IaJjQ87fJuSjk-;cGc;&N7p2Uzl}_qzn6mFWAX@*`OyAl&TqTxc7k0`uQ2V4 z8Vz#-H3Za2wNL?=#QF#6Dwn#+A;F~XzOGr<0)4@ znSwlpgJ9FE97oy2_f}RS;hW#_Y%0Art#b(JA9rhjg?w38X#B_gAduHAEgnkAhD))} zihcy}FBds-kHnan_+t8S)sG>k7r^auIqNd}y0W1$=q5F>n`OV0-vaPjcD;$;mnq}l zSR){0ZU5?YyUiuTGX?RxyS1QbBj;XdAVReGzIh6Lx5-qJ!TH&h-#ASbucGdpeQ`sn z;_IEW292kbP4P_K!e{krTTdZskH+4Rk!k#Tn;>)3r+)nNZ{6IcN~WgItv94YW@q>A z&UtAQ#=nnlc5Zf-7td?p=MrtyjE=*;8#q4EI^a8)3?C z4k3tYLahQ9vdMW$QtqdBj+b-4)C;?t*&*&Ia1Q*&?N{6{br?ceQrm<+K0iEb&9Hs7 zXtnT$kNn?1gC69zJoRc`*4_flDmE~ zaa$7FW2JB+9;xuvwgF{pRx^??X{czE>13%myIYeY-)6iZ6+@(b-^R?H$XF>?2!=Vz z(bjpTHeXjM#0>PBV4RSFeo5}y1e19xDxS!X#cWXcL)KmLA&CHJ{wo4%|&4xOqp5*0V5 zy81j5d%&S1=3~R}#zjxjZeyRPR(w$5l-fb^XKP{Jq92_1evtS!ZjHv@%NIQfuMdw^ zI9XV&J(4ijl_=82xBFZj>DaU+A!dplM5^wp zCL3}{6o|U8k1U1D8VV^ia>DEV`H30h6YxbHI`xG-M>w0j?bbO{+|OzI2b;HLMDr%? zWweFfd_Un8krw_~UudU(I0m7PRob!+iQ=&n7~ym=))=8PX&*d)FOwLjmxu25VSchP zD%r!Sg09w*icXT}kmwX;(!gUpU$9EakCx5Cr^Y%Yv{SaG<*$emf-|0)b|}HliZTfa z%gD0sZX70*yS|T6_?GXeNnm}=*+Q@v(zY)|HfC7W8^2&(U}f4~#5izznPjkf!C}U= zDi)$|<9Xy&E?^swnWf=!0-o5Q*lILqUYv@kWSh{#l#sL_C0j)szYEw%@Ol!_r$psV zRuC0%t;I4m=gLz9+-;rru=ogZcQ&)y}peC`bvBP(VhvsChO6<4C1a(6gbd-%b+0^T3zWVyBy^3nFU-X?*e zpBS3j#ePD4YEU5mkU4GzS0YgNBl8y4l%2a^F<986;C_uy=>7=dnowf3M@!yFqC43n zF@8>$a@L|Pfl`ZX944G~8S3564`4TH6sj9S79ppo@w+c5eBvWiK{tuuNU>>C$}Jmb z_L0F94r$&^%l3fL0YSr}d0dWXC8V#lE0Yck&^DKkF)d6I8OQR&Sc5FvrVk6xS*sFD zDL2A8K3uL?_S7G6{(P``fUUtw`S@3=N8j5whyU3t4)%jrotb^YfB)<6U$i$rcMH*J zVSefSOK_)ueqyx%-M5zfglc#E`Qdk$&)oul6+oMY@vZTPLbkyfTXzr&->T9vw9O>8 z?}w%LgJoI$77;vKtLb=GSf%*|EKfMXpnCQ$So%DMiAiKd3;vy-#;+7n>tpp+&T=C$ zz0{i;m_;CU*R7k2r*+z2)aqdZU&Kb1nGl%+H}#c7ll8nn2RVQUPNN*di={C^A4F+R zQUsww^9!5(R?@s%XvFgWHqO%$$re4)1{v@iHLS+c_1OIRYcu9Da9f2MO12t zt}sa7sUTYKpSV~wvaQ0HdujQJa%pB!^qlwQO3^u4bVcv~T*=#Lf(C4Wy zq=u+ySzJ@N^t%D&1jlD9#K06)MAPGzZ$q#CrtS0U3e40IUzE6~3U+wKOLCOctI$P( z(p~iOU3{t+eN7=PhzqPzpEp(1cO1b=f`OZ)ge_UHx8bc+7M1c;(iaA^&bJ?@(9p?r!jJQsBXuHume1l$#$V+D%;gnv+fvp=Xdm9iK4z`Qj z-IG~)t@p6Gp!Ku0%`U@YCc(GeA7l^Hqj(^ze~yB?U{%|6TsdP8A1nE5<0x$?NsL2c ze*+W5$t)IPQRg8ugQlm?rIfG&Wu9@_0z5zq->YK&CWIst(~ayi^Jz|u{5ibsNlxjL zva`@$Yat4U^wV&^-x|N zI7zd4@)W)aa=B8iOn>u7L+G^s&$_j^1ImD+58oyW|9jgF20L)$=GGmrgVp-aqLu!5 zS+>*S&aXds&vn_!pM)3G{dQ^|8L zF$=F?Taq7ADLZ4}_d&wO7A9Emxw^n}HQ!?U&OH1_uls{S3QP!p%SNrT;8#;zb%Pc7 zhiKybr~!XT&atA9zS{W^jTz=y_}9G8)tV#ON0d_8=76ly(LC|fl5OzEJcS1tN5bQq zjjKlS`S+FSqexmjVRUbPls$AwDpdRu0Vr;^$FFb%bS;*p)_T}qxhN-C@_Avu)e?6B zHhIoOU~f8fFONP1U{^FPQ9DF!Jc0|gyFOZnu9`n5RJRdZr-t3^@DlyySN(-;!Jiz6 z0TKH8|jAymQf*G zhLD=q0cs95jMe_l`dF)aD?x<6V_UC$4~qYVL0duvCwmS}d<3Ze5-LtfO7rfxR7Owf zR>+UVzC33E^QEV#q~!26c7$TpStVOl`TwL}w7}Im9`b8GLX5GdtZb505bvRU)2gEm zJCGm;Hl>&-01f;a2X;!&SiyO|o=BfY)=5A$vW_@UAxfjx@vi=LQ*26xKD3tvyS_;{d8^t(gMLmJ=4**!50 zR2rBFECOjS_*p`;E*7g2D#S&~!Zlz?(F%AOcd@szSuKU6H_IyZBUP z%F`=wcoAT>3j_f9UfcnArw5A+uUjM0`U3kH7{GNeHcTlns2Mw@Tq3YHX}9-o(;q;e z8n9nJi9&m;cKeSuKx&i9JpjcMfVOONoPh&bzxXT_>tz4BX{cs@t7QKHz0~UMtagF1sxfP5>n;2v1q0P-hQ}9`Cq{R_k5=k&vZMjO{|7)(>0(N$ zM!)SVfHQ5BA5wAp`O$!!&ns4p*9xFJQ;S~vYhHxlU%ol|+rUt3Cq&qQ5L34GPvqc- z8%?1*P2(W!To?+w9Dkc^ENJyy1UVMw8P+5|4T8NN*dXB%ez;aA&SnQXaC1ClDF7zm zyev9(PM8G`W!=sjeXj*hUB7-PoL0zov(=KlZmXb<(#cfzWBY5KmhwH2$i}uG#t~%i z_`s@>F1F{Jv;A!x3=RMQs%7m1HIRIShC*owq5JEh9NEBN>C0*6KRmyr^?ky7(vfo zjF75O=?wA_5k}0{`}QaD@9iz@i@It^H(9=i#&x2ZL6ijH%gAc+cv+jA5G2HB3tce? z{aReB!`w-_??dF7Hxgq}Dh`uK*p({Ibw|ybfTOwn4S1g}NtifLSl8dZ^F+xkbN7um z?|gO0Y&FF)0@x&W?+URLfouz07MnYp>OS0uG>~ww4zJB~ui(uRz*cctNfe-<2I=*K zua(2$8IfX<>x1=j1DRbTcFV-4QA)_5K4@qdE~_CBxE;Rn-mr(pRQu_(K~bJJ%Ui^F zL%1mo@SJkTAk7=Y^A8_?=_iX(#ttQTGX+V}gLei=%<`p~oZRy8k8D{URjlQhA*$KP_>hY|5njLZW`-5Hl2%t2ry~ zc1Xs%M!&$W-rFy(QJ-ol1rJixK z^#WA>xZe*0THW&dO^=pZq^gO6h(fChA5yclOdKgzVjLQyxaJxsrTO!^C#Djl{j)<) zGdz$K6yJQ6t?u3^Djx95d-KxQyQd$xC4u27JM3?@mat#2Z8&qN7+VE7p;4LCN zP>*>s!{TSvu81l*^@%rOmQ<=Y9w##Joc=<}ZXB9t_z)+$`oW;momyl4q};i&ebqZ? zwQZn4X066Jo(Ltr;{EiC*KLMDfv1poxKb^{psDOa_~Cx^Fzfp^-E-b7j8<=9Gy$?J z-_P<}-ImF)^|&v5>a&fH;NPyah%?7^qJqIi;Zapn9H+sjo=h5u04WO%_4wG?`Yk*@ zw)|$MI!%TT(GGs@10{b^(mn$oxK=ik-$aAueCGpt-|2yn?oP|NZ;Y*Jvc+Jc2=AKO z7yYd4xX~$jj!Nh zj-2h?NPlkm0_=f^KQBHy&ODX>45P%1;y5JN>@u?A`-iaEgyC*n zc@6X%QV8w{a~rz?P*3xrHu2vuony@$bZh!i$5kbjaE2z4C$=qvr$!g=o*r$i-)qE= z#GH$Xq!IX+!7f;>PL2+v_Jo@0@sYB*HkjpteMb-@|)xe9Ym+kA{rFdOl`xukp)N zt3UmpE}g0mt>u+xzl$vlQFB5fL_eU#sNKXbj=@vZ4kulqJ=y?6&|K`g@CX0Sgg%*NuF3i^`l-(?frIKEEqw#-*+&n_`L3(%U9eC+W#yey73Q2Asl zH#ywOwQGuN@Q%C8*Oss}FLIWz%9oW>)q@ z`^cTNSO9}LWYc`Zl%ggmJyxJb%O^+L*yawB6Z@7vT{hZTCejm?`pnLh%PU9?GH*x` z(^b=g8TO@DKi!&smsfV*^PkS=;4hC;j1PROA|vFhGtQ4?jSq9*m;Lw0_5Jx^Bd+Si z7F%0nzA3)_Zxd9AfbNoAZuiYF%>3h_fzZW^f!W6_-W~K!tMBVq=3{4XMpD0==l)Ql zY^f($g**YY?-qeS&T%~5%?sVilNB{#gz%Dg^*5v;Xyq<_$rAiG`S@axY<3+{$JqbE zKB&?MvYAzm6_XCyx+(|8l$s(Ny@Bl&&l$5UqWA0rC$xd);%cP%;tQgcifa?IU*WUK z#*HYhDi|xKJ^yB7w9U6#P_7li3ZJXAa#rSv(NB~-PGJKdY?6wpTsg&QPIvj9dQ64& z^T#Nz<#S5ta;(4LZmjLfo3+M(4s+2L-uPou6-}MUPfTRbHT#uoY(qcX9ir#jBgcpA z`*Yo*+~l+cG+gntD_DbE@L>E~=aNV;99}v}j5K5I7CXl>*sX}3&lfiaH|X)N!BW_U?w#{odYY z8l>x5T7CAvkHLRTU-1-0nU}76U-uYmBb0td=s_TgN+DA16;#beW%)0aIG>35CUfaw3 zH%cxAlcy?RVc!C}&d?1guGxVA#GO*dRgutL**+uz0vL*d?ZQ1#=^03$O$&al#kUu_ z`{aEvJljkr_$L506oiLgPN!tGM!3tkzkPO zFt6LrA=Nq>5;!l|plZJQ&b7(vgC!;V@$&bgPkNK`(~gWA@*i5a?u>z8E+OQ7FtC^a zNi5cM#xojNhTK#-v8T+3c1|E(H??z683JsN_lJf(H;*bB$p4b$D z#r?4IPvuhZBr2(g?aC2yD&epEGJ zbFMNpr&ne~)_yQihq?*&ys~g>Q z^=kF7G2;#G#1mt@mIdGd>+M9&S?M{B1f!ON~eN zicM-z@)`r>JYk^on;OgNM!_0}K@*IGPpFCF0#~q{tOg#reN{616S6IVM;>#QnO8sa%{`Z; zB3g8%{52tRs+#juJn@(|INr|Mwi#Op4PlUu2L7cAjXEu^j>I-3(hT6aX!=A0paZ<@ z4(ZV6oR+@F?c|6UY7bdIU%%~j`L`_ydJRA2YVzA$xx?G4Ab5CRKDvQ9nKSMTw@({t zl7;o@U5-z=+60Ys-NDyLN;}bpqRa7>AjWT)A>)O#R{7E9O4uk=0UMQ&4X-|3mtybk zOFl-8TVtd~vdA0K)cp;%pHeXnNjO`%hAtD#T)pZgCWUO+ZP5P%Py?%JeB_fR^%i&x}Gy}kRHsm6<3;vfEV zzW%+6sSv?HJR^_(_c(?)hCy&+d;j}@18VbMD#8akj;YU5bxatFPZj>>Vg5a)>yCdK zpnC8~zPoz{`vsSt6AH55+Ag>wmpv#8wtc+v{?O$99mp@<&z{bbaLdQ ztVU}R!oV@VQgf}hdVSb2b2_gnKm}lWVgp{iV(>S@%_wJsdHm{L(=a|^*k7!J91@3M zz9-2$9`J?oYkqxr#!_}3@KEON_w2|mLSS8QRw_K;lONx{%m2W0eRtQ7w>L43vbOWV zq*7UntL+VzM`waXTU1g>D!|Sxvu|pXfot=bSn00HLKAWM9p+<`<7#$@Jcp+7u!YE` z!#zNz;y-AHw``Twe7LU#IIX_C&kM8Fwa8Brf98k2OpjajtW~Tk=l2HKtUftPpy~Dc z;Mkhw_o{+594{#b9TL-LGJ21n>eOR^ouHo`TogK3?xoj#hjg4*}-r&NgZ1R=@#s|+_x%3;_)fg1sOR}|7T}(EdQu3*B z2DGEe-Ap#wSr9*z?r!XngzmcGee~{WW$W5wPrJrS$LAwf{Qb6&gW2a#CpZud?OaZV zElV~-04H{+D&|iN(%Ii}wCsxATQfNrdKEjD+D6QrT4d9;i^7on6o6R(C^WHhr= z#+sJ(3b8WnnOGhU;UX##53q9ks5A$NNVfxEvcUY_HKDm?#6Yc&QaV>!P}@r$mfa*k zs^Q0&Z7ssQ-i``ml_=NtuL*6*vSMz-j9VYSJ$R$hYmuxA0C#_VqPj_=)frp>twbhr z#@-7#3z+qYRh36qYPVzzsMzZ>#BJs~8gpFj?2lGKXNtJSnyn@$Qu)Q<3^RuL%Ne}} zLlD|J%!n)mAXNpipMSb< z_6pZun14`&L;K3Npx}Ga|M}nF8&CjLM$EJjKPN`acFd%gKhkEq@#Nrn`)dyyf(ck1 z`kXb4&pDceys$ow!^m(OyK{gWsQ?mRKIx>yfcQsk=n!OtSF}nkp}$osT-$wvn?GvGG6pEX<5j$jkBqw zb7iZqO!S2kRW~Ii+Y;3DDE8>5MfqjIBevKwB{bl_Ce!cT zd@<=tASe_uJH+(9@fG)F{oQ3@keSTtwNeM7wekKmAG~F-++d>BUC={LM3aA;im&u? z0ae=|{FhZzMmz2@ESqghY5S=HZyp#e?^8qc?fkv|3PJFRqr&r}$ru`ZLMr?eueZhP z91-Oh^%?SFr~QS@3ooNo1@!?eUXkW&tV_8T+D8ilqbx5_km|py5FLqMgpDR*LpXYy z4tJhEVEJ6v9bVTZqSwtL{S7cH$??sWPRwFp)iUkeY0&3pp^3*Kt+5!+&1dn=scZAi ze7h+srZO?9mzKDQLYr^IjI%}DXg;?Kd%z@^RTA3nnYMrKoC$v1wPdBud%!%h0hx7X+Y^G6fo=< zxHGM@$jfk0koPz%V=F4YO7;w*N6LG?gLyVawx@Fj-eAXdscKx#JUdUyE7D@CD^Bq` zlpWvKJQ@1}ZG;=wp|8YNoC4qY(EG^?J*2j3WFY^fMh|Mgw9slSqfauO%N3$7;YULM zrWS1FqR}A`u^AM8YBcDOmEVQ!!+!Oq;8;Gm?@J(ra5VLV#1vENm=j8uyuer;?Dx0r zM2%cFMKb-<4M{qXM}zJh#9yIanCCj{keILJjc2f`DrIK1fDn zp89N6}?`+sl^i}7ZRBFLASqI~?;@Ezbl^zdX%B^`{I)=2~ zb4|_4r&n}~!6V9dx^h-0>A!ZZz*zTwc9pyvDXNZ|Kn{REk>^mQuyKpsDX|LIjPef7 zsfv8P7J~@)i8&R+=Mh2Q5-WFzcL91zZOQ4r_^BpyQcrCY_E;5&1^PO0lhr!+f+JpQ`O}yaO4w&;u~M7I$S{OB{pshd2{7}UYxvhxJv!0Y9}paHZV zO8j$#rWie}=D~%lwo0+`|4YRJJJ`I)#N{JyU@v3$&&v2mqtktsI^jk@5CVgB3PCRyd`mv0)!QV%)H<$4uB>3(FrrklZ^8{q@Dytff4&f=gkIo#X$dO zDz-Sx75YWqzg0{bNZ4-53732CDG{$tG@>Z)A9$yTR7yOr%JcZpfrp?5!Co+j5dH&^ zWZ=m|l4}(jUV;?c?{de zGcS%@#n#l3b!8e~7FUd7YnTHME-~D*l125`!e}7B8;zbKyZLq7XMXc1CMoNh5b?o~ zDQNw`Rzj2s3^3`?c??Zp9tX_refMlU2+xycY_ioSG%JH_tlDa0=QqFLn!U!hoI z`$XN2Jm!$_{7{77(DQe+(c=CxX`*Pd>R#A%F1$fSjhwpEmOWz97wZ6&bI*e-fj(^v zKK2E`HDgZXONzz+$cOB2GlVQJK-`-5SQs-q1m~gv3LK1VHOsyLs2lBMu=7gIwwQ|AqyL8Mz%dievHk&Oi?SJhQp z8_HFy3IO>Io-Ch1WU%i6N%{?Vn*=)&Hb7+S z2$9L+`C0rMpCoau;~s|)R4d&jo>ssTbaytJ??JoVBWbY9^=0M66oWTlk$+g`vmBU) zI1Ywg2?H=6U7<$?jwWsF#2I-35dKy+K2uO43gwBjhAyjy_ExP^+)Kvwnu9%ERr;2ld;i6Qc52MxZ2i#r&Knqe3OL_X?y7-29h4Mo{FrCh8sOp( zHGuNdzyfQD+dytDh)(fBbX#FD$Vk;&#b*Kz->dgz**loT5${+9ss+2r7&b)^b2UpF1 zl8pNF&y@y1HQh|dO+5?nq6@4Tg4serIzmOsd7kquRb;?)dL}idDHMxntaRz1n>2s< z5Sp~sFigY1tU}p_a3TUYczbdGLqgVEOT&70}}H5p_bD!h=n;zZbj11B}fuJ^hX{pk7X#H7-2N9%l~D z95vaI3N99T7762(wh^^otok$w&qX-#>8N@oeP_&_9ojQn8foz7IeH4ga^3akmtF_N zC5r%E+8GxPrOtIQRBE&nMSmo2=TjE-ru3)-CrR1W{!c#s*cynlg#*q_;dm^pn9pn{ zCKU(GzC42X;hJlQ_z_{Mf#`@5(Z~#@NgGwU4Ffmj@Zl5M-@NOoCb)-eUR1$Uj0!De zMA~ID8*kq<+l2D4t{LH2E5svf-z%)>(VdXeOwzVN$x>uXvfFtJNo?m`74lZgT(&DR$kT%K|rBM;nwmt~3rLEjqJ zF|2u%8>eTZo1BKJ%wm*+t;~;SefnyK8Wc@CfW**FYe2dYVJx!Ye>8H*4sWVrrVSjY z>J`MSkXDMZ$)b z`uV=b8p!i0&0Ue5WTo_OR1&ph3Yd-oUq2p(Xcgx}c*ZXi|Ef6m~!* zf+;=ZDh@XpL>E6H{wPHIW@Jr+8wtQd60N4kzm;qCr_pkdGeFS)s|)ehZnJ{(^V0$FibkV=@mx> zkg>K7IH=h_^b@9!W+IRFTw0chTfeO4;HJyP;jlu@GK8dg*3VVBUbJw!>A)7NE@sC* zmK=@gYYku0OjSt{n_~S(0@sc^K_@+6$`$zz(7S7do4LFD`+}N)EEw!;hkILKS6+MR zJIap^n$}H9m&+e@9I7W<36&nO;*a3a=Yi$}E>h1Nz^03;z~~dxZ*%*jd_?MYPx*mLtTMl+t6z~)`-XJARZQYR(7y;-O-Hm6f%h@ng?t~b2%yaTO z7J!hDCNM>eWcIcL^*Cd%V?v14uR`qMgUKmc{hg=pDHmUAH7+Wwn88?gPix_keiKcE zt~`fLadxep!h`R2C6NE7A4~H1^M>XSZj;1W|AgvDq3ZPozJ@3>ZuvccVICc5Qmqsr z&aL*MwK*hmI9<-HGdf_X)-A!OdL%R2TysuZCRRJV=EZrR`V?6%&mRZ5aIX>`F% z#_idrSN5u{&zz>mVV$;ybL~AwJbSz}5^%&~UDHx3n}h zHaY-tQ##koQ6<9~e4ZD)#zI#EVb4Vb_Ya5>= zUKImxFv$O9z;o1{j{&jLudde;kK`Y^5$1fp-ZB$=_H+0%NzmFe9-SYkhc)im#U z>M>9<1gimS5^A9K*P{;Bs?C|(Vsj~;o$q~^N^XF5qfi7w_Wb@ZPXc{?{Ux&}h&MiL z!_et9ZlJwoYLh7ff~4lPmmf*$bpx#b1%w7z{*)_&_T_%=G3n0HjrdV3ceo`My5$M< zDcC59RPcBYb1d8S~d{1+%8>Fu>PM-6fYjagvlgBOT%){UML;zZLvwW`E z^YyCj`44thEO~x?c#}R~`>C?9EIkjm z!Uu^Z=OU`LqHj`p5y@#{NnZcP1&zKdhI_C(pey5$*$V-MTe)U`__TWd7&*pz{-g5y1ISd!E0BL{MKE!8G*G3!ML&Y8 z3WzpSihKgK`kPJvIta3h~m-c5sE@wy{v*j@(w41&5KfRf*Cxc(;SFOd|qyjn{HRW?KHJPp9QVP0} z!TSxu1nZf6QM4CC;P*&is3|5hZVyW?HDZT)An+=$z_!ibbd5EucT%`O5 zd5$HG=6K&1m2Peke|XN-{6<*O6$V}e%rQ>v6he{2k+VEr?=agcUE)zES1*5Pk+lq% zy`9Dkx<1Lp`|QYYF>mJV4&{75%ZO;t28q=iJBJ%UKphOWIi>Uv%zz9DER~5>?JOLp z0TJA=+ItnKNANs<>#=)r2iE*6wC%L=jLkOZ>`X`zKts?Y{ylVm7Y!tgg~84(9PdDR zEB_Gj%qoJud;?g*7Y~Gh)7gO!x38b=ETk74Iv+O#EULpcAz@FZv!DcBFP1M*1CVu{ zTDK1zsg^ni;wxoH#NF>oJwFF+Vc(CJ{zW~u2gToSw>~R5XAPSNp6q$cBT(W%Rr&qQ zpH#sM#q!(pKs|hAUZ!RXKconr?Z_-N#gJl|0kuLJU)BQa)&o08pccou}gZ%nIUZU43wm?ALlOk2PqurSdBHepcTfLZmIEbzP-DzO;UE)xvXASx!IG7tH@$> zG$lQ9zSl+88(i_>Vo+uFt`$_)_U^nIU+yg*IMhZFPb~KWb61hu>B)Km+6#ZK_E}bE z91~r9!d&P(8M_y7=SisR9!+~MclVpXW9{;~qRHE_<&~MWMKXTBp61^^?jd`;bkM={ z(ZH9HO4A+zSzagDmpH!1Nj?K`?RE7)(j!-HT-6+(4H!Y_F-s#I{+=HKT;5eB7coTU zI{M8+MQNrO8UY8VyKAbJL8t|+i$PDKnx@MngR?hsUwhRd!JFb^PNfTbI zcgcsxwY3VI6yksw&Rtb2!>!eV#Lh3zJLjTsFXIXf#_asj$q`=2XF_7<`wh~R3+*e} zo)(3Eq2d!56=DNRDPqk7JMUOnrfV;`1)~MQPh9dL{@x!-X==z4EyFMBika6NMjs8_ zSLM0ko;w<=M@PP7m6}`RNw>V<7Xoa;)lyUIk531v6qImZW>{lP$b|$k$H1rg=1|i$ z&B^_b1;v6muokMAHF``a*24(sLv|ci*uidp>s@PTOQhuQKYMp1Bnmxi`X1On-gSHp z9jdjHdoxiLWJm+h>`e%o4O<71C6vz7E52ok=72*Likpf65ECJjnl4u0^pEg6Csbjv z8no;;QMo~Z6elDLZSppQmH!)UAhbx}Tn7@c;rnQ;7#}2}R?ug$Sfl5Q|LuconGo6+ z-r?(pWK8m-jd(N{V!E*W0YnAqwEG6hW&We0_$E5S(&S?b42v_q4Y)X`${@MFZ1&*O z8;D)5fd!VG-e%`R-#XfTQZ?Q$fblDA^2i1j6f_#*ezn_tMp|$f(gNI3OHZF0tf7BF z*@HE@$RY$%{njauvN`;lbx=_4ML+{Bs?ELXPfV^AC-Um1ZKS&`Gr{`)2jMOK#k0|0 zjq4L_ZZ~;H->%rXNVzKqil?@r;p2|e+>anZ-T_)*|LJ%pk{Ug4sRB(zoMgZMXal%T zK0m*6`F|cvm=QFnb!$cqlX2D^gP*57lo5Fj(*JTeH^Ls}L3`Kz)>!XqM=pl_(DdCWRO`p36F9%2KD_n>MtG# z2FFSGy9(1{CCZ6~jZ>ML217H$Tb@2K6%5mpxBbM8NX8e*FLIkLU4W8BDYNTBavpFr zO6IaHH}vRdLO5kx;?&?hiY|6s4?BW;wL2W}wd;=xI3sIO1HY3<>VQ@4J9^xY&mIFNk@_Ba;vdN{shRxu-_!vB5Rbi?8 zs6J+lT%H>Ov`XCDH7O;{sG#_!*;-P8MWCHDFH5c!Kfn>WItk4vv?zO6yKbP zygBshCeSgFfYGt3Jc)ipaw#{Y&2j;_?NDYV@l{Qa#K<)!3ra7~h<^U?uZ&4y4)ml? z#^6@w0UW7~OgI>8L7>IgZUU1tAqL%dQNBRz7bsR7{y_SH62nDqqz7eHc#K8f;fnUf z^z&)zulG;DMv_z(EktECdh~1ZkwjpN90gR_n|qzgP`Q%b?z>@gAa<|{dHYEf-JrY4 zBrz{**IK=1M>67Bx`vqp+~cILhXJ-$JqZ*6Up_$WBmg9URO%h@d?;-nRzv^-EuM{D zrgjb};g%c^jDJ3WbX{Wvl$9xt$CnGfA_bPKn)UW!muSXaV0Zu=4E9`h2v9zxsU0ve zsw!u*Nv*1WFwY<54h>BnzK0#by6b!MgdJCKCOhUov?GwH&!C>Xu)yxT_z$OY`P|sq zTd_(8nKSIG?;v>VhP3UT5hHeCv*Svi>A!r7hciUXNE`mRn`btVS+vS(vGdRR zialRCM;sCs%PxDZahCTC<_D7ax`r3SH}qGDUXT;%JbPdN%MYW1)#{X7tFI*izKsf1 zKR1`QNPdOuWtiK`_!yn}7#*Md-Ttq>gUuV}?YtH~AF90F^Y7og6NmwL`i9Y{u$GfV zs}%icM)Z8Y19y`!PF!f|k-K9@f|>BgA|F#QX41DZkp97Bbt>j{^(=Vs0HN+R-r%FM zr~mvif9KW8@==C|K9w;F7TWW1O$p|w-#_HY#vkJ%wpnrL$jn8F>Sywf7a=uA8jrJ& zq{t6N167eDIu*eTIQre#&SM_8utB{XU^yf-9b+xgQ*1SLYHF*dc6cu-xF)9&#@-;6 zD7u>oYv<_MhC+#E78$^ZEzyI5g<%|k&J-7k@u*jiZD|+s(8FEu!v=9FEt7!m>4qy; z2i#3~GUKIECg@um0+oa0qI@q(MM#7c)HjtSx2XCxbSO%dIud(CuMTTBMbry)RmWd< zQJ7P^r#&%rqAh5_V#WAsJ}p{1u}fJ9}}2U4FNcT>-?n;7al`5t{t zfM27K7Oxb1%nAP7kV8k9n?ph)c9CT8mW@BCzGF$5Z-G^c`q~Q9l{)@gXGWl=6ghRt z171pyPHtl*Egca%4vy1nkllLm%$^X|Yil6Z0J2riA+axxa3pu5to*J0-o`gwKkx5% zz`k-}zE0y;mcMo}#n-~ljgH_Bp{PSZ^0`c+EI2i#=QJjzaT(S!aQ+xp_?pU!dZo!( z%FM81g)42C`AQhmiM?)kHmC(PS&#_So6p8YZi)}B9`qH_Ko6|F01pR;YwXG@QYpm> zW(28u^svre$9050#Z)w;td}-G)_3AnY<9@vq%(YKqA0kxCjn4gJ~2pO{#P59xWu$V z1M6F|_3=fi3!4ukgpF4Wnxa`3LqKXmvEg^0Ajo!y2Pr7o@)B8leM_ekl{!4o0J zrS3ya(JXl}VX5fWB_bo zm~!E6(0|Wf`^c4M00 zVQkiZCMsl?oMo=HYcug0B^>1gf+Ao$)Y9^7!=VKnft+W$hbbe?Dq_~Ls|tt$KG-3F zPS&sQ!NRP%zvBQHq`|8{PdyW4$D#wQ<8`BJ3c%OQ`Y~{yVj(Qb1kCQvc6$?{_h?N7 zr;4A!@$>5on%ZOHc1tujiO_8MA=4s7TKZmL34M^h-ORUfRHrV|6o?f!WB%w`en!UK zJm|)K=80{q1BSbVuTF(t85geEL^SjZ^J{WA38P17=wUm5YdwDHY;}LG@JX~5)#)UX zpE}M12U4Mk5L*Vc$as@gr2$4k4sYK^ILpov9^an1h>QiILlf>2U|a5d&4zKA>Hu;E z!ZEEhtEsV@FjLX7IiiHIEiN^jzLeD`N!1NyIwG~8FZd^eBN4{uHH6uDWtd`ys!sLV zTw041btGm^M#utbyzWa^_BLZ6qNrB$2Qpr`0g|%yW(}}nU;{#1MH3135){6u(Q*l6 z0nay9iTGu}YR1HxI-9RS$ zANi0DEcQSP1(ZWTYKW*bg-v*Vbb?IYeq(QGg$d`(aHZpu=LzS+TfA>$EwZDuTOXqU zxVw>V2zI+n?7a)3@e;tC?cu-K`5;^*vG<;@Lpdx$MXCGuLsw$odLSL1DR>Vq`d!_E zX+#zMAL=2>zv>}}|EP!b!DtClQe12W0|GKuv-)9P^tphq6j4c6gB$vid;h<>&NQg0 zdky1NE2splP1zb6P^XFzWC3}W`I4E;A)hz%07rDkA?(mV1Hulu5o;AQ(`x{0+OI^o zLO=~SU=Vod&hEsYkWu0yxd30y$;b*%H&oP=p3mN25&GhHuwu^g-^+wgs%PI-$PT78--AbA#9!ALRauLq(8h!Z>|SI+ z=FI$~!P%*Sr=myPd-1!`?(Zp6&-!Vj!xTZHt2IUIG#vSrloP9$ckMc|@k3O|{=i@o z`ac>$M-%3=K*M{oG-`oJ(~1R;!LaF^X<)^ao3Kop4=$Se>13zt%aq(nxLRJ>-KHOy zb^KZ8iwoQiOqVC&p6##<``l_G(f7PID{s5P*R@cu&#h1pmG;K9{yOkHi7Oc#gNx6$ zb-i7kTU$me+QcCHwNgO$@jw8jl-)D1gWnZ|bS#_G(1OaKouRYnEE3UBLn*@uf+rQ?lks4-XH~Sg$caLaliy zjl#~Pc}OPAx$jJ-t>%{J_JjhKhgKpllyp=8pra)x-6Y*0K&ij0E6H@UJ$~MZTuGi` z0Vvq)%GyxD)zwnYDyL4AFLaSRHx~te7YG6IoflsUWYUgn4{yz7N=nYft(V>#AD2`3 z{)5}rXHF&_H%?#g5$;FU+awiTDNFl0OvY#2@G=IFsK5n4+L@+{fu$A+%NjmqEpG~+ zV4VuGdUMF1b)~=m2Ei^3tS;$eMaS(XO!tpi)1p*he{=uRE{)&nz$}bul=2Zux&Rpc z>BfwS@HVG=AN#Vs6_$P7sXn{EuBch0igx=^Q&eZrnF;tkel2U2{)0c=Gg^=j#82enJG?S*C=1kJN)H#@R4vUwD6AMx>d z@T=yc`$zzuO?Ikn`9{yL)ceHGRm;_n*kjN!1RwF8B#haQ`87vS@JHp(im5_>NE*j zIZs3Dq2~~LX*lEZ4~4*c-Sy5;>$vm-OIJnVzSX7|Yq z+mYK|d>3nT4Y60;)>m)74lcBm|9Quo_~Tt)yIO-+QLbzp>a`(CX5lr=6yP!F)3%P{cXeQ#GVH)~XagyqgEx5P1KkVFmKxz>Yl&EMSiT;S;@XaGO_dfo z^Aa0kx6FEGtKS&;E00w6rHhEx1FG2TG-!j-z}%5?sv#%YC#CCZfwvI@yp8&0V0-lM zqxcDW6LCEa%Z!}08d%qzOjKp}X^^P61El*n5+hQGkJ^VUFncc*j7faRD6g`^B)TR_ zd@kQ?zyup#S4?-aF&U%RaE%x6Ul@|$-n$Lm(x>==OA8k9esPIySIBq1ooOTKxstpN ztVIs&KFVZXIC{y=0RU?2` zO-Y6$ez^9OBCsxEidbtCEP-K?!X2+kFHk>o#*GN}G`%I5RNBTzSA1LE^$WLi_2`EW zq9-~Ydh)>byvY18^clyA;4of!OBCCnEjZQc{(`-b_K8D(b%Jrh2Jw?lY#eJ!n5(GQ zmZb+4Kk+N<9mL9dpVAGSuf0Qstdqa0-B_rfaQ5+Zk@73~Svz4jG$y+8ZLyV{zO6=f zRZ@C1qf!}`>)mMFUtEI4NRsMGO9Bx-$XiUAa}I89Lce~=7SYkKb$m{&(d z;oc8<_BQW>K)z`EzNtl0@eL#uXZH)pAEaV4NX5PdPZsh1x6QF!cLB2q32=x>n0k~B z&O)El&&{WDu?Y?p&F^nUfc1CTymS~#lUq-H7y^PU2ZA{g!6CQ!r@Z!IEUi6 zFa2dm=S@OTlB6wIWiblqp!=XHRqU3Y;h=sRer$jr(c`EI2V`7VTW|Cr0FB_u=hkq4NTbLNt!+E(g-k}0lUScl_*(}vgUxn^? zM@X1garIN|T@32DR;(!iWw$DI>3Up3h4%ERq5cKypu(nj#afOEL^B$fx zVjYAS`~cccGGyq3CN80A;fYH9Aiwd4|NSZF!CXpMQX?jCqqU}W{+@4-$sxPSyleg zNnbFf>QSy6?b4Fg*y>Fp7`7+*_L=DNU{%orhbU3LeBUY0m34)7lEXF!T@5NucC$OI z&x&EbCo+7KWzkU@y~de>h{6s{P{~hx8?OdFnuu-^G>x2Tus{@HiLQ>9q-i->=^gTrag=Y4bA#(zlwH&^Yye{$LMXUTK%qKc0{g3nG@ LFPC4p2gLsmTJdCE literal 0 HcmV?d00001 From f2401d95b12dfcbcaf3b1505be2ddd8ce801844d Mon Sep 17 00:00:00 2001 From: Fabio Falzoi Date: Fri, 12 Dec 2025 18:58:21 +0100 Subject: [PATCH 2/7] CFP-43295: Add details about new IPAM mode Signed-off-by: Fabio Falzoi --- cilium/CFP-43295-cilium-network-driver-dra.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/cilium/CFP-43295-cilium-network-driver-dra.md b/cilium/CFP-43295-cilium-network-driver-dra.md index d1f08f24..c7f8b441 100644 --- a/cilium/CFP-43295-cilium-network-driver-dra.md +++ b/cilium/CFP-43295-cilium-network-driver-dra.md @@ -279,6 +279,20 @@ associate a SR-IOV device with a VLAN, among others. When the pod finally starts executes the last steps in the configuration within the pod namespace: configures the addresses on the interface, bring it up, add routes to the routing table, for example. +### Resources IP address management + +To manage the IP addresses for DRA resources a dedicated IPAM mode is added to the agent: Multi Pool Resource IPAM. +This mode works the same way as the [Multi pool IPAM](https://docs.cilium.io/en/v1.18/network/concepts/ipam/multi-pool/) for pods, +but it manages IP pools reserved for DRA resources. +Similarly to CiliumPodIPPool, the CiliumResourceIPPool contains cluster-wide IP pools reserved for DRA resources addresses +allocations. CIDRs from those pools are allocated by the operator to the agents on a per-need basis: whenever a resource needs an +IP address from a pool, the agent requests additional CIDRs in the CiliumNode `spec.ipam.resourcepools.requested` field and the operator +writes the allocated CIDRs in the CiliumNode `spec.ipam.resourcepools.allocated` field. + +This mode allows for great flexibility in defining multiple IP pools for different DRA resource types and it allows the reuse of most of +the implementation for the Multi Pool Pod IPAM. Using separate k8s resources to define IP pools ensures there is no interference between +the DRA Resources and Pod IPAM. + ### Restrictions Requires Kubernetes v1.34 From f9400f3bab89df70759a52e5f5a5560831ff2a46 Mon Sep 17 00:00:00 2001 From: Bernardo Soares <20172413+bersoare@users.noreply.github.com> Date: Thu, 18 Dec 2025 11:03:09 +0000 Subject: [PATCH 3/7] network driver: rewrite configuration update part we want to allow updating non-impactful configuration on the fly, without requiring a full agent restart. Signed-off-by: Bernardo Soares <20172413+bersoare@users.noreply.github.com> --- cilium/CFP-43295-cilium-network-driver-dra.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/cilium/CFP-43295-cilium-network-driver-dra.md b/cilium/CFP-43295-cilium-network-driver-dra.md index c7f8b441..a835a9d4 100644 --- a/cilium/CFP-43295-cilium-network-driver-dra.md +++ b/cilium/CFP-43295-cilium-network-driver-dra.md @@ -107,7 +107,13 @@ In this context, the device manager is an abstraction of a certain type of resou you can see that we’re working with the `sriov` devicemanager - implying that we must account for extending the feature set by introducing device managers. -Updating the configuration at runtime is out of scope for now, and we can revisit it if there’s a sensible use case for doing so. +Updating the configuration at runtime is possible for the most part. Some settings, for example, +the number of sr-iov VF to be spawned, might need a full device restart - causing existing +traffic to be affected. In such cases, we ideally want to avoid applying the configuration right away. +It is up to each configuration feature to know what is safe to be changed or not, and future +contributors should be mindful of that. +On the other hand, it should be straightforward to add or remove pools and change the +grouping criteria, and these kind of changes should be allowed. The resource pools to be advertised by the DRA component on the driver are explicitly set by configuration. The Network Driver receives a structured configuration that contains parameters to match devices and group them together or apart From de60b0277cbf197676a44250365e630c42cbc52d Mon Sep 17 00:00:00 2001 From: Bernardo Soares <20172413+bersoare@users.noreply.github.com> Date: Mon, 26 Jan 2026 12:58:59 +0000 Subject: [PATCH 4/7] network driver: write down configuration management writing down how the configuration flow looks like, mention cilium-operator's job of selecting a configuration for each node based on matching labels. rename mentions to the CRDs to match what came out from the discussions. Signed-off-by: Bernardo Soares <20172413+bersoare@users.noreply.github.com> --- cilium/CFP-43295-cilium-network-driver-dra.md | 90 +++++++++++++++---- 1 file changed, 73 insertions(+), 17 deletions(-) diff --git a/cilium/CFP-43295-cilium-network-driver-dra.md b/cilium/CFP-43295-cilium-network-driver-dra.md index a835a9d4..aa4e19f9 100644 --- a/cilium/CFP-43295-cilium-network-driver-dra.md +++ b/cilium/CFP-43295-cilium-network-driver-dra.md @@ -73,24 +73,49 @@ A simplified workflow can be seen below: ### Solution -The Network Driver functionality in the Cilium agent is an opt-in feature. -Enabling it can be done per-node (explicitly referencing a node name or through node labels). -Upon detecting a valid configuration, the Network Driver is initialized. -Only the nodes eligible to run the Network Driver should receive a valid configuration, -allowing the Driver to be initialized. To run the Network Driver, a CRD of the kind -CiliumNetworkDriverConfig must be present, as it is where the agent finds the Network Driver configuration. -The example below shows how a valid configuration looks like: +The Network Driver functionality in the Cilium agent is an opt-in feature. +In order to enable it, use the `networkDriver.enabled` helm flag. +Once enabled, each node that detects a configuration assigned to it +becomes a Cilium Network Driver agent. + +#### Deploying the configuration + +A resource of type `CiliumNetworkDriverClusterConfig` is introduced, +and the presence of an object of this type in the Kubernetes API +causes the cilium-operator pod to apply the desired configuration +to the cilium-agent pods for which a given configuration is suitable. + +Since the Network Driver configuration for each agent +depends on node specific hardware characteristics, +it is possible to specify `nodeSelector` to match a given +`CiliumNetworkDriverClusterConfig` to a node or subset of nodes +by matching on the node labels. +Alternatively, a configuration with an empty `nodeSelector` matches +all nodes. + +Since only one configuration is used at a time for +any given node, the cilium-operator is responsible for choosing +the right configuration for each node, and once it selects +a suitable configuration among the candidates, an object of type +`CiliumNetworkDriverNodeConfig` is created for each node, containing +the configuration specifics for the node. +If the operator detecs that more than one configuration suits a node +based on the node labels, it reports a conflict back to the +status field of the offending `CiliumNetworkDriverClusterConfig` object, +and proceeds to either using the oldest one found - and if there is a tie, +no configuration is selected and the status is reported for both. +The example below illustrates how a cluster configuration looks like: ``` --- apiVersion: cilium.io/v1 -kind: CiliumNetworkDriverConfig +kind: CiliumNetworkDriverClusterConfig metadata: - name: cilium-network-driver-config + name: sriov-nodes-cluster-config +nodeSelector: + matchLabels: + sriov: true spec: - selectors: - labels: - - cilium.io/network-driver driverName: "sriov.cilium.k8s.io" deviceManagerConfigs: sriov: @@ -102,6 +127,33 @@ spec: vfCount: 6 ``` +Which in turn, will lead to the creation of `CiliumNetworkDriverNodeConfig` +objects for each of the nodes, for example: + +``` +--- +apiVersion: cilium.io/v1 +kind: CiliumNetworkDriverNodeConfig +metadata: + name: mynode-network-driver-node-config +nodeName: mynode +spec: + driverName: "sriov.cilium.k8s.io" + deviceManagerConfigs: + sriov: + enabled: true + ifaces: + - ifName: enp2s0f0np0 + vfCount: 6 + - ifName: enp2s0f1np1 + vfCount: 6 +``` + +Note that an operator can also create `CiliumNetworkDriverNodeConfig` matching +for each of the nodes manually and skip the cilium-operator config selection. + +#### Agent configuration + Under the deviceManagerConfigs section, an operator is able to control how a specific device manager is set up. In this context, the device manager is an abstraction of a certain type of resource. In the example below, you can see that we’re working with the `sriov` devicemanager - implying that we must account for extending @@ -114,6 +166,11 @@ It is up to each configuration feature to know what is safe to be changed or not contributors should be mindful of that. On the other hand, it should be straightforward to add or remove pools and change the grouping criteria, and these kind of changes should be allowed. +Cilium agent listens for configuration updates, and if there is the need of +any changes considered impactful, it will log an error message to signal that +an action may need to be taken. + +#### Resource pools The resource pools to be advertised by the DRA component on the driver are explicitly set by configuration. The Network Driver receives a structured configuration that contains parameters to match devices and group them together or apart @@ -123,13 +180,10 @@ An example configuration structure with pools defined can be seen below: ``` --- apiVersion: cilium.io/v1 -kind: CiliumNetworkDriverConfig +kind: CiliumNetworkDriverClusterConfig metadata: - name: cilium-network-driver-config + name: cilium-network-driver-cluster-config spec: - selectors: - labels: - - cilium.io/network-driver driverName: "sriov.cilium.k8s.io" deviceManagerConfigs: sriov: @@ -153,6 +207,8 @@ spec: With these filters, all the SR-IOV VFs whose PF kernel ifname matches `enp2s0f0np0` will be assigned to `a-side` pool, whereas all the VFs under the PF named `enp2s0f1np1` are advertised as part of `b-side` pool. +#### Publishing and claiming resources + The Agent’s Network Driver then publishes a ResourceSlice pool named after Name, containing all the local devices that fulfill all the Filter conditions. Multiple pools can be defined. Here is an example of a device member of resource pool of name `a-side` advertised as a ResourceSlice: From 58357b3f378e2cf50ecd5ed6298b69a9c605917e Mon Sep 17 00:00:00 2001 From: Bernardo Soares <20172413+bersoare@users.noreply.github.com> Date: Fri, 30 Jan 2026 15:22:15 +0000 Subject: [PATCH 5/7] network driver: remove mention to nodeName field use metadata.name to match nodes instead Signed-off-by: Bernardo Soares <20172413+bersoare@users.noreply.github.com> --- cilium/CFP-43295-cilium-network-driver-dra.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/cilium/CFP-43295-cilium-network-driver-dra.md b/cilium/CFP-43295-cilium-network-driver-dra.md index aa4e19f9..77573d1a 100644 --- a/cilium/CFP-43295-cilium-network-driver-dra.md +++ b/cilium/CFP-43295-cilium-network-driver-dra.md @@ -135,8 +135,7 @@ objects for each of the nodes, for example: apiVersion: cilium.io/v1 kind: CiliumNetworkDriverNodeConfig metadata: - name: mynode-network-driver-node-config -nodeName: mynode + name: mynode-hostname spec: driverName: "sriov.cilium.k8s.io" deviceManagerConfigs: @@ -150,7 +149,9 @@ spec: ``` Note that an operator can also create `CiliumNetworkDriverNodeConfig` matching -for each of the nodes manually and skip the cilium-operator config selection. +for each of the nodes manually and skip the cilium-operator config selection. +To target a node, deploy a `CiliumNetworkDriverNodeConfig` named after the +node's hostname. #### Agent configuration From f876bc7e8c5b717975c3f071de8a8976dcd38cdc Mon Sep 17 00:00:00 2001 From: Bernardo Soares Date: Thu, 16 Apr 2026 15:14:52 +0100 Subject: [PATCH 6/7] network driver: add CiliumResourceNetworkConfig reference also adding some more detail on the operator strategy for managing conflicts, more details on the device managers, adjusted a couple of examples Signed-off-by: Bernardo Soares --- cilium/CFP-43295-cilium-network-driver-dra.md | 108 ++++++++++++++++-- 1 file changed, 99 insertions(+), 9 deletions(-) diff --git a/cilium/CFP-43295-cilium-network-driver-dra.md b/cilium/CFP-43295-cilium-network-driver-dra.md index 77573d1a..3a652c79 100644 --- a/cilium/CFP-43295-cilium-network-driver-dra.md +++ b/cilium/CFP-43295-cilium-network-driver-dra.md @@ -46,7 +46,7 @@ function (CNF/VNF) workloads, low latency data ingestion, and dpdk based applica the Kubernetes DRA plugin API, in a way that Pods that require a given network device can get scheduled on an appropriate node. - Cilium to be able to preconfigure such devices -- Support SR-IOV VF assignment +- Support SR-IOV VF assignment to pods ## Non-Goals @@ -153,8 +153,26 @@ for each of the nodes manually and skip the cilium-operator config selection. To target a node, deploy a `CiliumNetworkDriverNodeConfig` named after the node's hostname. +##### Conflict scenarios + +The dynamic aspect of the nodeLabel selector mechanism to match configuration +to nodes might lead to cases where conflicts may arise. A conflict happens +when more than exactly one `CiliumNetworkDriverClusterConfig` object matches +a given node based on the node's labels. The operator handles conflicts +with the ultimate goal of preventing unwanted configuration updates or changes +to the agents. +This means that the operator needs to be aware of any previous decision and persist +that decision across reloads/reboots/restarts with a deterministic outcome. + #### Agent configuration +The feature introduces the concept of a Device Manager; which is the device +specific logic required to discover, select, publish and set-up devices using +the DRA and NRI frameworks. In other words, it provides extensibility by +abstracting the device specific logic from the assignment lifecycle. +Since our first use case is for assigning SR-IOV VFs to pods, +that one is the one focused throughout this document unless stated otherwise. + Under the deviceManagerConfigs section, an operator is able to control how a specific device manager is set up. In this context, the device manager is an abstraction of a certain type of resource. In the example below, you can see that we’re working with the `sriov` devicemanager - implying that we must account for extending @@ -221,7 +239,7 @@ devices: string: "0x1016" driver: string: mlx5_core - ifName: + kernelIfName: string: enp2s0f0v0 pfName: string: enp2s0f0np0 @@ -238,6 +256,8 @@ pool: resourceSliceCount: 1 ``` +Note: the set of attributes above are illustrative and may change in the upcoming iterations. + Devices can be assigned to Pods by creating pods with a ResourceClaim statement in the pod manifest. The ResourceClaim object can be seen as the set of resources a Pod needs - influencing the Kubernetes scheduler decision on which node to place the pod. Only nodes that fulfill the claim requirements are eligible for scheduling. @@ -313,17 +333,15 @@ spec: opaque: driver: sriov.cilium.k8s.io parameters: - vlan: 123 - ipam_pools: - - pool-a + vlanID: 123 + ipv4Address: 192.0.2.1/30 - requests: - b-side opaque: driver: sriov.cilium.k8s.io parameters: vlan: 321 - ipam_pools: - - pool-b + ipv6Address: fc00:100::1/64 requests: - name: a-side exactly: @@ -337,10 +355,82 @@ When processing a PrepareResourceClaim request, the agent performs all the neces the device and stores any information that will be needed when the pod finally starts and the device is ready to be configured in the pod sandbox. -Preparation steps may include contacting an IPAM to request addresses, reconfigure the interface mac address, +Preparation steps may include reconfigure the interface mac address, adjust interface / device flags, associate a SR-IOV device with a VLAN, among others. When the pod finally starts, the container runtime hook is called and it executes the last steps in the configuration within the pod namespace: configures the addresses on the interface, - bring it up, add routes to the routing table, for example. +bring it up, add routes to the routing table, for example. + +#### CiliumResourceNetworkConfig + +Alternatively, for the less trivial deployments, a requested device on a ResourceClaim may reference a CiliumResourceNetworkConfig object. +This method is suited for environments where node specific variables (such as VLAN IDs, routes, and IPAM details) are required. +`CiliumResourceNetworkConfig` allows for using a named object that abstracts away these details with the goal of making the +`ResourceClaim` objects more generic and impose less constraints in regards to the underlying network. +The example below shows a `ResourceClaimTemplate` object that references a `CiliumResourceNetworkConfig` object - and the attributes +used to set up the allocation differ between the nodes. + +``` +--- +apiVersion: v1 +kind: Pod +metadata: + name: mypod +spec: + containers: + ... + resourceClaims: + - name: attach-network-a + resourceClaimTemplateName: attach-network-a +--- +apiVersion: resource.k8s.io/v1 +kind: ResourceClaimTemplate +metadata: + name: attach-network-a +spec: + spec: + devices: + config: + - requests: + - a-side + opaque: + driver: sriov.cilium.k8s.io + parameters: + networkConfig: network-config-a + requests: + - name: a-side + exactly: + deviceClassName: a-side.sriov.cilium.k8s.io +--- +apiVersion: cilium.io/v2alpha1 +kind: CiliumResourceNetworkConfig +metadata: + name: network-config-a +spec: + - nodeSelector: + matchLabels: + kubernetes.io/hostname: kind-worker + ipv4: + ipv4Address: 10.10.0.10/24 + staticRoutes: + - destination: 10.0.0.0/8 + gateway: 10.10.0.1 + - nodeSelector: + matchLabels: + kubernetes.io/hostname: kind-control-plane + ipv4: + ipv4Address: 10.20.0.10/24 + staticRoutes: + - destination: 10.0.0.0/8 + gateway: 10.20.0.1 +``` + +The configuration set above results in the Pod being able to be scheduled on both kind-worker and +kind-control-plane. Depending on the node where it gets scheduled, it receives a certain ip +and with certain routes. + +Note: in the example, we use static addresses for illustration purposes only. The long term plan is +to be able to reference an IPAM pool - as static addresses brings an increase in the +management overhead. ### Resources IP address management From 4c0e3de5a5ca7e443b5b2e7b750573a5533bfaaf Mon Sep 17 00:00:00 2001 From: Bernardo Soares Date: Mon, 20 Apr 2026 10:21:15 +0100 Subject: [PATCH 7/7] network driver: remove ipam part as we discussed in the comments, skipping the IPAM strategy for now until we have more clarity. it will likely be a separate piece of work Signed-off-by: Bernardo Soares --- cilium/CFP-43295-cilium-network-driver-dra.md | 14 -------------- 1 file changed, 14 deletions(-) diff --git a/cilium/CFP-43295-cilium-network-driver-dra.md b/cilium/CFP-43295-cilium-network-driver-dra.md index 3a652c79..3ad7c745 100644 --- a/cilium/CFP-43295-cilium-network-driver-dra.md +++ b/cilium/CFP-43295-cilium-network-driver-dra.md @@ -432,20 +432,6 @@ Note: in the example, we use static addresses for illustration purposes only. Th to be able to reference an IPAM pool - as static addresses brings an increase in the management overhead. -### Resources IP address management - -To manage the IP addresses for DRA resources a dedicated IPAM mode is added to the agent: Multi Pool Resource IPAM. -This mode works the same way as the [Multi pool IPAM](https://docs.cilium.io/en/v1.18/network/concepts/ipam/multi-pool/) for pods, -but it manages IP pools reserved for DRA resources. -Similarly to CiliumPodIPPool, the CiliumResourceIPPool contains cluster-wide IP pools reserved for DRA resources addresses -allocations. CIDRs from those pools are allocated by the operator to the agents on a per-need basis: whenever a resource needs an -IP address from a pool, the agent requests additional CIDRs in the CiliumNode `spec.ipam.resourcepools.requested` field and the operator -writes the allocated CIDRs in the CiliumNode `spec.ipam.resourcepools.allocated` field. - -This mode allows for great flexibility in defining multiple IP pools for different DRA resource types and it allows the reuse of most of -the implementation for the Multi Pool Pod IPAM. Using separate k8s resources to define IP pools ensures there is no interference between -the DRA Resources and Pod IPAM. - ### Restrictions Requires Kubernetes v1.34