From 9b60f748df1972528cdb00d5296fade8a106b538 Mon Sep 17 00:00:00 2001 From: Kuba <78603704+jakub-tldr@users.noreply.github.com> Date: Tue, 28 Jul 2026 16:37:31 +0200 Subject: [PATCH 01/14] remove absolute links --- README.md | 2 +- about/about-defguard.md | 2 +- about/features-overview.md | 4 ++-- deployment-strategies/amis-and-aws-cloudformation/README.md | 4 ++-- deployment-strategies/deploying-to-production.md | 2 +- .../high-availability-and-failover/gateway-with-carp.md | 2 +- deployment-strategies/overview.md | 2 +- deployment-strategies/programmatic-gateway-adoption.md | 4 ++-- deployment-strategies/running-gateway-on-vyos.md | 2 +- .../standalone-package-based-installation/README.md | 2 +- deployment-strategies/terraform.md | 2 +- deployment-strategies/upgrading.md | 4 ++-- features/firewall/troubleshooting.md | 2 +- in-depth/architecture-decision-records/1.4.md | 2 +- support-1/how-to-submit-an-issue.md | 2 +- .../core/unable-to-sign-in-with-correct-credentials.md | 2 +- support-1/troubleshooting/README.md | 2 +- 17 files changed, 21 insertions(+), 21 deletions(-) diff --git a/README.md b/README.md index b891b19c..d4fc8777 100644 --- a/README.md +++ b/README.md @@ -12,7 +12,7 @@ Welcome to the Defguard documentation. Here, you’ll learn how to explore the f Helps you, as a future Defguard administrator, get familiar with all of Defguard’s features and how to configure them to suit your needs. * [Deployment strategies](deployment-strategies/overview.md)\ Walks you through the most common deployment strategies to help you set up your Defguard instance as a production-grade solution. -* [License](https://app.gitbook.com/s/tIboBQe0Rz5YT3cHdNlh/enterprise)\ +* [License](enterprise/license.md)\ Outlines the scope, limits, and purchasing process for the Defguard Enterprise license. * [Using Defguard (for end users)](using-defguard-for-end-users/overwiew.md)\ Helps you, as a Defguard end user, get familiar with the client applications and their features so you can quickly connect to your Defguard instance. diff --git a/about/about-defguard.md b/about/about-defguard.md index b9f2c792..47a5fb64 100644 --- a/about/about-defguard.md +++ b/about/about-defguard.md @@ -16,7 +16,7 @@ Defguard helps organizations: * Automate device enrollment. * Simplify network segmentation and access control using policies. -For a detailed list of features go to the [Features overview](https://github.com/DefGuard/docs/blob/v1.6/about/broken-reference/README.md) section. +For a detailed list of features go to the [Features overview](features-overview.md) section. ## Why choose Defguard? diff --git a/about/features-overview.md b/about/features-overview.md index fc25c126..71239d37 100644 --- a/about/features-overview.md +++ b/about/features-overview.md @@ -47,8 +47,8 @@ _Defguard is not an official WireGuard project, and WireGuard is a registered tr ### Account Lifecycle Management: -* Secure remote (over the internet) [user enrollment](https://defguard.gitbook.io/defguard/help/remote-user-enrollment) -* User [onboarding after enrollment](https://defguard.gitbook.io/defguard/help/remote-user-enrollment/user-onboarding-after-enrollment) +* Secure remote (over the internet) [user enrollment](../features/remote-user-enrollment/) +* User [onboarding after enrollment](../features/remote-user-enrollment/user-onboarding-after-enrollment.md) * Self-service for password reset ### [Network devices](../features/network-devices.md) diff --git a/deployment-strategies/amis-and-aws-cloudformation/README.md b/deployment-strategies/amis-and-aws-cloudformation/README.md index af56fe28..839fc4b6 100644 --- a/deployment-strategies/amis-and-aws-cloudformation/README.md +++ b/deployment-strategies/amis-and-aws-cloudformation/README.md @@ -17,7 +17,7 @@ The template consists of the following main components: * **Defguard Edge** * **PostgreSQL Database** -We recommend reading the [Architecture documentation](https://docs.defguard.net/in-depth/architecture) to understand how these components interact. +We recommend reading the [Architecture documentation](../../in-depth/architecture/) to understand how these components interact.

Diagram showing how the components are deployed using the template

@@ -130,7 +130,7 @@ Use the token displayed in the `AdminFirstDeviceToken` CloudFormation output to
-Check this [guide](https://docs.defguard.net/using-defguard-for-end-users/desktop-client/instance-configuration#adding-instance) on adding a new instance in the Desktop client, to learn more about the process. As the instance URL, use the URL you defined in your Defguard Edge instance configuration section of the CloudFormation template (`ProxyUrl`). +Check this [guide](../../using-defguard-for-end-users/desktop-client/instance-configuration.md#manually-adding-instance) on adding a new instance in the Desktop client, to learn more about the process. As the instance URL, use the URL you defined in your Defguard Edge instance configuration section of the CloudFormation template (`ProxyUrl`). #### Accessing the dashboard diff --git a/deployment-strategies/deploying-to-production.md b/deployment-strategies/deploying-to-production.md index f90eb48e..1194f13f 100644 --- a/deployment-strategies/deploying-to-production.md +++ b/deployment-strategies/deploying-to-production.md @@ -39,7 +39,7 @@ Follow our [guide](production-deployment-verification-guide.md) to test if your {% step %} **Configure features** -Follow detailed descriptions of [Defguard’s features](https://github.com/DefGuard/docs/blob/v1.6/deployment-strategies/broken-reference/README.md). As you follow along, you can adjust the configuration directly within your instance. +Follow detailed descriptions of [Defguard’s features](../features/overview.md). As you follow along, you can adjust the configuration directly within your instance. For a detailed list of all configurable things through environmental variables, options or configuration files follow [this reference](configuration.md). {% endstep %} diff --git a/deployment-strategies/high-availability-and-failover/gateway-with-carp.md b/deployment-strategies/high-availability-and-failover/gateway-with-carp.md index 0520f348..adf28014 100644 --- a/deployment-strategies/high-availability-and-failover/gateway-with-carp.md +++ b/deployment-strategies/high-availability-and-failover/gateway-with-carp.md @@ -12,7 +12,7 @@ At least two OPNsense machines are required for high availability. These machine In this setup, one node normally owns the virtual IP address and handles traffic. If that node fails, the secondary node can take over the same IP address, which helps keep the gateway reachable without changing the VPN endpoint configured on clients. -To use CARP with Gateway on [OPNsense](https://opnsense.org/), first [install the Gateway package for OPNsense](https://github.com/DefGuard/docs/blob/v2.0/deployment-strategies/high-availability-and-failover/deployment-strategies/running-gateway-on-opnsense-firewall.md). +To use CARP with Gateway on [OPNsense](https://opnsense.org/), first [install the Gateway package for OPNsense](../running-gateway-on-opnsense-firewall.md). In the OPNsense user interface, go to **Interfaces → Virtual IPs → Settings**, click "+" (plus), and create a new CARP Virtual IP: diff --git a/deployment-strategies/overview.md b/deployment-strategies/overview.md index 87d1ce76..80510540 100644 --- a/deployment-strategies/overview.md +++ b/deployment-strategies/overview.md @@ -84,6 +84,6 @@ Losing the local cert directory does not cause permanent data loss - it requires ## Failover/High Availability/Clustering -[Defguard Gateway](https://github.com/DefGuard/docs/blob/v2.0/deployment-strategies/gateway.md) can be deployed on multiple servers, firewalls, or routers for failover and high availability (HA). Even if the connection to the Core is lost, a Gateway continues to operate using its local cache and data, ensuring that the VPN remains functional. Conversely, if a Gateway becomes unavailable, other Core features such as OpenID continue to work normally. +[Defguard Gateway](standalone-package-based-installation/gateway.md) can be deployed on multiple servers, firewalls, or routers for failover and high availability (HA). Even if the connection to the Core is lost, a Gateway continues to operate using its local cache and data, ensuring that the VPN remains functional. Conversely, if a Gateway becomes unavailable, other Core features such as OpenID continue to work normally. For details on deploying multiple Gateways, refer to the [High Availability and Failover](high-availability-and-failover/) documentation. diff --git a/deployment-strategies/programmatic-gateway-adoption.md b/deployment-strategies/programmatic-gateway-adoption.md index 404aec89..9eda397a 100644 --- a/deployment-strategies/programmatic-gateway-adoption.md +++ b/deployment-strategies/programmatic-gateway-adoption.md @@ -15,7 +15,7 @@ curl -X POST 'https://defguard.example.com/api/v1/network/42/gateways/adopt' \ }' ``` -Here, `ip_or_domain` is the address of the Gateway, and `grpc_port` is the Gateway gRPC port (`50066` by default). To authorize the request, first obtain an [API token](https://app.gitbook.com/s/qPYuWxfmxFk6sz1LLLwd/features/integrations/api-tokens#generating-api-token) and replace `` with it. +Here, `ip_or_domain` is the address of the Gateway, and `grpc_port` is the Gateway gRPC port (`50066` by default). To authorize the request, first obtain an [API token](../features/integrations/api-tokens.md#generating-api-token) and replace `` with it. -For more information about using the Defguard API, see [REST API documentation](https://docs.defguard.net/features/integrations/api-tokens#rest-api-documentation). +For more information about using the Defguard API, see [REST API documentation](../features/integrations/api-tokens.md#rest-api-documentation). diff --git a/deployment-strategies/running-gateway-on-vyos.md b/deployment-strategies/running-gateway-on-vyos.md index e4db32a1..3b2bd154 100644 --- a/deployment-strategies/running-gateway-on-vyos.md +++ b/deployment-strategies/running-gateway-on-vyos.md @@ -66,7 +66,7 @@ sudo podman ps -a At this point, the gateway container should be running on VyOS and ready to be adopted by Defguard Core service. -Adopt it by following [those steps](https://docs.defguard.net/tutorials/initial-setup-wizard-setting-up-from-scratch#adopt-the-gateway-component). +Adopt it by following [those steps](../tutorials/initial-setup-wizard-setting-up-from-scratch.md#adopt-the-gateway-component). {% hint style="warning" %} Gateway accepts adoption requests only for a limited time after startup. Start the adoption process in Defguard Core shortly after starting the container. diff --git a/deployment-strategies/standalone-package-based-installation/README.md b/deployment-strategies/standalone-package-based-installation/README.md index 5d73f4ae..8b0e6ff9 100644 --- a/deployment-strategies/standalone-package-based-installation/README.md +++ b/deployment-strategies/standalone-package-based-installation/README.md @@ -35,7 +35,7 @@ These prerequisites are meant to help you avoid the most common deployment issue * Administrative (sudo) privileges. * A server with a public IP address (and knowledge of what that IP address is and which interface it is assigned to) - in this example, we use `185.33.37.51`. * A domain name, and knowledge of how to assign IP addresses and manage subdomains. In our example, the main Defguard URL is _my-server.defguard.net_ (and the subdomain points to `185.33.37.51`). -* A Defguard [enrollment service](https://defguard.gitbook.io/defguard/help/enrollment) (run by the proxy) that enables [remote onboarding and enrollment](https://defguard.gitbook.io/defguard/help/enrollment), as well as [easy configuration for our Desktop Clients (by adding Defguard instances)](../../using-defguard-for-end-users/desktop-client/instance-configuration.md#adding-instance) using the instance URL and a simple token. In this tutorial, we use _enroll.defguard.net_ (this subdomain also points to `185.33.37.51`). +* A Defguard [enrollment service](../../features/remote-user-enrollment/) (run by the proxy) that enables [remote onboarding and enrollment](../../features/remote-user-enrollment/), as well as [easy configuration for our Desktop Clients (by adding Defguard instances)](../../using-defguard-for-end-users/desktop-client/instance-configuration.md#manually-adding-instance) using the instance URL and a simple token. In this tutorial, we use _enroll.defguard.net_ (this subdomain also points to `185.33.37.51`). * If you have a **firewall**, we assume you have **opened port 443** in order to expose both Defguard and the enrollment service, and to automatically issue SSL certificates for these domains. Port 444 (used for internal gRPC communication) **should not be publicly exposed**. * System clock is synchronized using [Network Time Protocol (NTP)](https://www.ntp.org/). This is important for time-based one-time password (TOTP) codes. * A PostgreSQL [database](database.md) diff --git a/deployment-strategies/terraform.md b/deployment-strategies/terraform.md index 79622247..b70a8741 100644 --- a/deployment-strategies/terraform.md +++ b/deployment-strategies/terraform.md @@ -14,7 +14,7 @@ To deploy Defguard using Terraform on AWS, you can use the Terraform configurati The terraform configuration includes the necessary resources to setup all components of Defguard. -We recommend reading on the architecture of Defguard before proceeding with the deployment. You can find the documentation on the [Defguard architecture page](https://docs.defguard.net/in-depth/architecture). When configuring the networking, the most important thing is to keep in mind the following rules: +We recommend reading on the architecture of Defguard before proceeding with the deployment. You can find the documentation on the [Defguard architecture page](../in-depth/architecture/). When configuring the networking, the most important thing is to keep in mind the following rules: * Defguard Core web UI should be accessible only from the internal network or through a secure VPN connection. * Defguard Proxy web UI should be publicly accessible, as it is used to securely pass messages to core from clients that are not connected to the VPN. diff --git a/deployment-strategies/upgrading.md b/deployment-strategies/upgrading.md index 952501fb..617b3746 100644 --- a/deployment-strategies/upgrading.md +++ b/deployment-strategies/upgrading.md @@ -109,7 +109,7 @@ To resolve this, before upgrading, we recommend first uninstalling the old Clien **Force all traffic** -1.6 introduces the ability to "Force all traffic" as a [Client traffic policy](https://app.gitbook.com/s/e86iamwJVSYnIRsyVEAV/features/wireguard/behavior-customization#client-traffic-policy-selection). However, this policy only works with desktop and mobile clients ≥ 1.6.0. Older clients (<1.6.0) will not respect the policy and will allow the users to select the "Predefined traffic" option. As an alternative, administrators can enforce all traffic by setting allowed ips: `0.0.0.0/0, ::/0`. +1.6 introduces the ability to "Force all traffic" as a [Client traffic policy](../features/wireguard/behavior-customization.md#client-traffic-rules). However, this policy only works with desktop and mobile clients ≥ 1.6.0. Older clients (<1.6.0) will not respect the policy and will allow the users to select the "Predefined traffic" option. As an alternative, administrators can enforce all traffic by setting allowed ips: `0.0.0.0/0, ::/0`. ## 1.4.x -> 1.5.0 @@ -240,7 +240,7 @@ You will need to change a duplicate email address before the upgrade by hand via ### Desktop Client Real Time Sync -From 1.0.0 we have introduced [Enterprise features](https://github.com/DefGuard/docs/blob/docs/deployment-strategies/broken-reference/README.md), and one of them is [automatic and real-time desktop client configuration synchronization](../features/remote-user-enrollment/automatic-real-time-desktop-client-configuration.md). +From 1.0.0 we have introduced [Enterprise features](../enterprise/license.md), and one of them is [automatic and real-time desktop client configuration synchronization](../features/remote-user-enrollment/automatic-real-time-desktop-client-configuration.md). To enable this on an **already configured desktop client,** one must perform one time instance update, which will generate necessary tokens on the client to perform from now on automatic updates. In details: diff --git a/features/firewall/troubleshooting.md b/features/firewall/troubleshooting.md index b4154418..1a825455 100644 --- a/features/firewall/troubleshooting.md +++ b/features/firewall/troubleshooting.md @@ -84,7 +84,7 @@ table ip filter { If you have a FORWARD chain (managed by Docker) that has a default policy of drop and filter priority, this chain will interfere with Defguard rules (accept policy shouldn't be a problem). -To fix this, set the [Defguard firewall priority](https://docs.defguard.net/features/access-control-list/firewall-internals#forward-chain-priority) to -1. This will make Defguard rules run before Docker rules. +To fix this, set the [Defguard firewall priority](firewall-internals.md#forward-chain-priority) to -1. This will make Defguard rules run before Docker rules. Running `nft list ruleset` on the machine should then result in the following: diff --git a/in-depth/architecture-decision-records/1.4.md b/in-depth/architecture-decision-records/1.4.md index 8de1ce16..da3a6d9b 100644 --- a/in-depth/architecture-decision-records/1.4.md +++ b/in-depth/architecture-decision-records/1.4.md @@ -2,4 +2,4 @@ ## 2025-06-01 Assign all IP addresses to clients -Up to this point, only the first network IP address was assigned to devices, as described in \[ADR]\([https://docs.defguard.net/in-depth/architecture-decision-records/pre-1.3#id-2025-01-03-multiple-ip-addresses](https://docs.defguard.net/in-depth/architecture-decision-records/pre-1.3#id-2025-01-03-multiple-ip-addresses)). This was an artificial limitation, and many customers were interested in being able to assign multiple addresses (IPv4 and IPv6) to user devices. v1.4 introduces changes to user device model as well as desktop client code that allows assignment of all network IPs. +Up to this point, only the first network IP address was assigned to devices, as described in [ADR](pre-1.3.md#id-2025-01-03-multiple-ip-addresses). This was an artificial limitation, and many customers were interested in being able to assign multiple addresses (IPv4 and IPv6) to user devices. v1.4 introduces changes to user device model as well as desktop client code that allows assignment of all network IPs. diff --git a/support-1/how-to-submit-an-issue.md b/support-1/how-to-submit-an-issue.md index fa315128..3f790d0b 100644 --- a/support-1/how-to-submit-an-issue.md +++ b/support-1/how-to-submit-an-issue.md @@ -5,7 +5,7 @@ To help us diagnose and resolve problems efficiently, please follow the process below when submitting an issue. {% hint style="info" %} -If you are using the OVA VM image, to access the VM and gather logs, please see this chapter: [https://docs.defguard.net/deployment-strategies/ova#accessing-the-vm](https://docs.defguard.net/deployment-strategies/ova#accessing-the-vm) +If you are using the OVA VM image, to access the VM and gather logs, please see this chapter: [Accessing the VM](../deployment-strategies/ova.md#accessing-the-vm) {% endhint %} ### 1. Enable debug logging diff --git a/support-1/troubleshooting-guides/core/unable-to-sign-in-with-correct-credentials.md b/support-1/troubleshooting-guides/core/unable-to-sign-in-with-correct-credentials.md index d34fdaf7..432cc89d 100644 --- a/support-1/troubleshooting-guides/core/unable-to-sign-in-with-correct-credentials.md +++ b/support-1/troubleshooting-guides/core/unable-to-sign-in-with-correct-credentials.md @@ -10,4 +10,4 @@ If the value is wrong, the server will set the session cookie with an incorrect ### HTTP (non-TLS) deployments -If you are accessing Defguard over plain `http://` (for example, in a local or development environment), you need to configure auth cookie settings to allow non-secure cookies. See the [Auth cookies configuration](https://docs.defguard.net/2.0/deployment-strategies/configuration#auth-cookies-configuration) documentation for the required settings. +If you are accessing Defguard over plain `http://` (for example, in a local or development environment), you need to configure auth cookie settings to allow non-secure cookies. See the [Core deployment parameters](../../../deployment-strategies/configuration.md#core-deployment-parameters) documentation for the required settings. diff --git a/support-1/troubleshooting/README.md b/support-1/troubleshooting/README.md index 31978d33..309306d9 100644 --- a/support-1/troubleshooting/README.md +++ b/support-1/troubleshooting/README.md @@ -139,7 +139,7 @@ If for any reason the Enrollment URL has changed (eg. the domain from: _enroll.c In order to do so: -* **The administrator** needs to send an update token to each person - [see this documentation page.](https://docs.defguard.net/features/remote-user-enrollment#restarting-enrollment-manually) +* **The administrator** needs to send an update token to each person - [see this documentation page.](../../features/remote-user-enrollment/#restarting-enrollment-manually) * **The user** needs to update manually the Enrollment URL providing also the received token - [see this documentation page](../../using-defguard-for-end-users/desktop-client/). ## How to check if the VPN is working / my VPN is not working From 2941c4ed975120f154ef4fc20089024d7b4f3b56 Mon Sep 17 00:00:00 2001 From: Kuba <78603704+jakub-tldr@users.noreply.github.com> Date: Wed, 29 Jul 2026 09:24:22 +0200 Subject: [PATCH 02/14] fix broken anchors --- deployment-strategies/health-check.md | 2 +- .../running-gateway-on-opnsense-firewall.md | 2 +- .../standalone-package-based-installation/README.md | 2 +- .../updating-and-version-compatibility.md | 2 +- deployment-strategies/upgrading.md | 4 ++-- .../entra-id-environments.md | 6 +++--- .../on-premise-active-directory-environments.md | 6 +++--- features/external-openid-providers/README.md | 12 ++++++------ features/external-openid-providers/custom.md | 2 +- features/external-openid-providers/jumpcloud.md | 2 +- features/forward-auth.md | 2 +- features/gateway.md | 2 +- .../configuration.md | 2 +- features/openid-connect/proxmox-1.md | 2 +- features/openid-connect/proxmox.md | 2 +- features/remote-user-enrollment/README.md | 2 +- .../internal-sso-based-mfa.md | 2 +- features/wireguard/remote-desktop-activation.md | 2 +- in-depth/architecture-decision-records/1.6.md | 4 ++-- in-depth/client-application-feature-compatibility.md | 2 +- .../using-multi-factor-authentication-mfa.md | 2 +- using-defguard-for-end-users/mobile-client/README.md | 2 +- .../mobile-client/instance-connect.md | 2 +- 23 files changed, 34 insertions(+), 34 deletions(-) diff --git a/deployment-strategies/health-check.md b/deployment-strategies/health-check.md index 0247849b..c48726e6 100644 --- a/deployment-strategies/health-check.md +++ b/deployment-strategies/health-check.md @@ -65,7 +65,7 @@ health_port = 55003 In this example, Gateway will open an additional HTTP port number 55003. Now we can use `GET /api/v1/health` endpoint to verify whether Gateway is working correctly. -If running in Docker you can also enable it by setting the `HEALTH_PORT` [environment variable](configuration.md#environmental-variables-arguments). +If running in Docker you can also enable it by setting the `HEALTH_PORT` [environment variable](configuration.md#gateway-deployment-parameters). By default the HTTP server will listen on all interfaces, but if you prefer to bind only a specific IP you can set it by using the `http_bind_address` config option (or `DEFGUARD_HTTP_BIND_ADDRESS` environment variable). For example: diff --git a/deployment-strategies/running-gateway-on-opnsense-firewall.md b/deployment-strategies/running-gateway-on-opnsense-firewall.md index a9509e71..f6bd133b 100644 --- a/deployment-strategies/running-gateway-on-opnsense-firewall.md +++ b/deployment-strategies/running-gateway-on-opnsense-firewall.md @@ -27,7 +27,7 @@ opnsense-patch 5. Fill out the form with appropriate values, click **Save**, and then click **Start/Restart.** {% hint style="info" %} -You can find detailed description of all fields [here](configuration.md#gateway-configuration). +You can find detailed description of all fields [here](configuration.md#gateway-deployment-parameters). {% endhint %} If everything went well, Defguard Gateway should be connected to Defguard Core and you can start [adding new devices to your network](../features/wireguard/remote-desktop-activation.md). diff --git a/deployment-strategies/standalone-package-based-installation/README.md b/deployment-strategies/standalone-package-based-installation/README.md index 8b0e6ff9..c810d87a 100644 --- a/deployment-strategies/standalone-package-based-installation/README.md +++ b/deployment-strategies/standalone-package-based-installation/README.md @@ -117,7 +117,7 @@ sudo rpm -Uvh defguard-X.Y.Z-x86_64-unknown-linux-gnu.rpm # or Proxy package pkg delete defguard-proxy ``` -2. Install a newer version (as described [above](./#installing-packages)). +2. Install a newer version (as described [above](./#defguard-packages)). 3. Restart the service. ```sh diff --git a/deployment-strategies/updating-and-version-compatibility.md b/deployment-strategies/updating-and-version-compatibility.md index 89b121c4..42268009 100644 --- a/deployment-strategies/updating-and-version-compatibility.md +++ b/deployment-strategies/updating-and-version-compatibility.md @@ -33,7 +33,7 @@ Choose the guide that matches how you deployed Defguard: * [Docker / Docker Compose](docker-compose.md#upgrading) * [Standalone packages (DEB, RPM)](standalone-package-based-installation/#upgrading-packages) -* [OVA / Virtual Appliance](ova.md#managing-and-updating-containers) +* [OVA / Virtual Appliance](ova.md#upgrading) ### Official GitHub Releases diff --git a/deployment-strategies/upgrading.md b/deployment-strategies/upgrading.md index 617b3746..ae84d35f 100644 --- a/deployment-strategies/upgrading.md +++ b/deployment-strategies/upgrading.md @@ -74,7 +74,7 @@ To work properly, this feature requires the Desktop Client to be in version 1.6. #### Force all traffic -1.6 introduces the ability to "Force all traffic" as a [Client traffic policy](../features/wireguard/behavior-customization.md#client-traffic-policy-selection). However, this policy only works with desktop and mobile clients ≥ 1.6.0. Older clients (<1.6.0) will not respect the policy and will allow the users to select the "Predefined traffic" option. As an alternative, administrators can enforce all traffic by setting allowed ips: `0.0.0.0/0, ::/0`. +1.6 introduces the ability to "Force all traffic" as a [Client traffic policy](../features/wireguard/behavior-customization.md#client-traffic-rules). However, this policy only works with desktop and mobile clients ≥ 1.6.0. Older clients (<1.6.0) will not respect the policy and will allow the users to select the "Predefined traffic" option. As an alternative, administrators can enforce all traffic by setting allowed ips: `0.0.0.0/0, ::/0`. #### macOS Client changes @@ -265,7 +265,7 @@ This change requires a few changes if you are upgrading: 2. Proxy is now the server to which Defguard Core connects, so you may want to: 1. Optional: configure non-default Proxy gRPC port with `DEFGUARD_PROXY_GRPC_PORT -` default value is **50051** 2. If you have a Proxy in a different network segment - eg. have a custom installation (not with one-line install/docker compose all on one server) - you may also consider exposing the gRPC port and reverse-proxy (nginx/treafik/...) the port with SSL/TLS. - 1. (Optional) If you want to use SSL with Proxy gRPC server without revers-proxy (nginx/etc) configure `DEFGUARD_PROXY_GRPC_CERT` and `DEFGUARD_PROXY_GRPC_KEY` following the [SSL setup guide](docker-compose.md#grpc-ssl-setup). + 1. (Optional) If you want to use SSL with Proxy gRPC server without revers-proxy (nginx/etc) configure `DEFGUARD_PROXY_GRPC_CERT` and `DEFGUARD_PROXY_GRPC_KEY` following the [SSL setup guide](configuration.md#deprecated-edge-deployment-parameters). 3. Also adjust your firewall config to open new Docker port mapping etc. Make sure Proxy gRPC server **can be reached from Core**. #### Core deployment configuration diff --git a/features/desktop-client-auto-provisioning/auto-provisioning-in-windows-environments/entra-id-environments.md b/features/desktop-client-auto-provisioning/auto-provisioning-in-windows-environments/entra-id-environments.md index 4158295b..140513eb 100644 --- a/features/desktop-client-auto-provisioning/auto-provisioning-in-windows-environments/entra-id-environments.md +++ b/features/desktop-client-auto-provisioning/auto-provisioning-in-windows-environments/entra-id-environments.md @@ -61,12 +61,12 @@ It will present an interactive propmt for selecting a user account. If this fail 3. **Token Generation** * Generate enrollment tokens for users using the [helper script](entra-id-environments.md#generating-enrollment-tokens) 4. **Client Installation** - * Install the `defguard-client` application on user machines using the [MSI installer](../#msi-installer-integration) + * Install the `defguard-client` application on user machines using the [MSI installer](./#msi-installer-integration) * Pass the `PROVISIONING=1` argument to execute provisioning script during installation * Example command: `msiexec /i defguard-client.msi PROVISIONING=1 ADAttribute="description"` 5. **Automatic Configuration** - * During installation, the bundled script fetches [provisioning configuration](../#active-directory-configuration) from Entra ID - * The configuration is written to the client's [data directory](../../../using-defguard-for-end-users/desktop-client/#storage) as explained [here](../#configuration-file-creation) + * During installation, the bundled script fetches [provisioning configuration](./#entra-id-configuration) from Entra ID + * The configuration is written to the client's [data directory](../../../using-defguard-for-end-users/desktop-client/#storage) as explained [here](./#configuration-file-creation) 6. **User Enrollment** * When the user launches the client for the first time, they are guided through the enrollment process * The enrollment uses the pre-configured token and URL from the provisioning file diff --git a/features/desktop-client-auto-provisioning/auto-provisioning-in-windows-environments/on-premise-active-directory-environments.md b/features/desktop-client-auto-provisioning/auto-provisioning-in-windows-environments/on-premise-active-directory-environments.md index bfe9a9af..0f6acdcd 100644 --- a/features/desktop-client-auto-provisioning/auto-provisioning-in-windows-environments/on-premise-active-directory-environments.md +++ b/features/desktop-client-auto-provisioning/auto-provisioning-in-windows-environments/on-premise-active-directory-environments.md @@ -53,12 +53,12 @@ Alternatively if you specify a username by the `ADUsername` parameter you'll be 3. **Token Generation** * Generate enrollment tokens for users using the [helper script](on-premise-active-directory-environments.md#generating-enrollment-tokens) 4. **Client Installation** - * Install the `defguard-client` application on user machines using the [MSI installer](../#msi-installer-integration) + * Install the `defguard-client` application on user machines using the [MSI installer](./#msi-installer-integration) * Pass the `PROVISIONING=1` argument to execute provisioning script during installation * Example command: `msiexec /i defguard-client.msi PROVISIONING=1 ADAttribute="description"` 5. **Automatic Configuration** - * During installation, the bundled script fetches [provisioning configuration](../#active-directory-configuration) from Active Directory - * The configuration is written to the client's [data directory](../../../using-defguard-for-end-users/desktop-client/#storage) as explained [here](../#configuration-file-creation) + * During installation, the bundled script fetches [provisioning configuration](./#active-directory-configuration) from Active Directory + * The configuration is written to the client's [data directory](../../../using-defguard-for-end-users/desktop-client/#storage) as explained [here](./#configuration-file-creation) 6. **User Enrollment** * When the user launches the client for the first time, they are guided through the enrollment process * The enrollment uses the pre-configured token and URL from the provisioning file diff --git a/features/external-openid-providers/README.md b/features/external-openid-providers/README.md index 2eeb8234..a0d3601f 100644 --- a/features/external-openid-providers/README.md +++ b/features/external-openid-providers/README.md @@ -27,7 +27,7 @@ In order to configure this feature, the following information is needed to be ob * (for custom provider) Your provider's base URL * (for Microsoft as provider) Tenant ID -If you don't know where to find those values, go to the [Examples](./#examples) section, where you will find an example setup for the built-in providers. +If you don't know where to find those values, go to the [Examples](./#configuration-and-setup) section, where you will find an example setup for the built-in providers. ### Base URL @@ -55,7 +55,7 @@ For example, if your Defguard main dashboard is accessible at `https://defguard. * `https://enrollment.my-domain.net/openid/callback` * `https://enrollment.my-domain.net/openid/mfa/callback` -These URIs will need to be provided in your provider's configuration. See [#examples](./#examples "mention") to learn more. +These URIs will need to be provided in your provider's configuration. See [#configuration-and-setup](./#configuration-and-setup "mention") to learn more. ## Configuration and setup @@ -69,10 +69,10 @@ In order to configure the external OpenID provider login, go to the settings in For a configuration guide for given provider, check one of the dedicated articles: -* [Google](google.md#directory-synchronization) +* [Google](google.md#obtaining-directory-synchronization-credentials) * [Microsoft](microsoft.md) -* [Okta](okta.md#directory-synchronization) -* [JumpCloud](jumpcloud.md#directory-synchronization) +* [Okta](okta.md#obtaining-directory-synchronization-credentials) +* [JumpCloud](jumpcloud.md#obtaining-directory-synchronization-credentials) * [Keycloak](keycloak.md) * [Zitadel](zitadel.md) * [Custom](custom.md) @@ -83,7 +83,7 @@ When you configure your provider, the proxy will automatically allow enrolling u For this to work, make sure you have the following two things set: -* Additional allowed redirect URI in your provider's configuration (see [#redirect-url](./#redirect-url "mention")) +* Additional allowed redirect URI in your provider's configuration (see [#redirect-uri](./#redirect-uri "mention")) * A `DEFGUARD_PROXY_URL` environment variable set correctly for your proxy (not core). This variable needs to be set for your proxy and should be equal to the URL where users perform the enrollment process. This should be set automatically if you are using the one-line deployment script version `1.2.1` or above. E.g. if your enrollment URL is `https://enrollment.my-domain.net`, set `DEFGUARD_PROXY_URL` to `https://enrollment.my-domain.net`. #### Disabling automatic account creation diff --git a/features/external-openid-providers/custom.md b/features/external-openid-providers/custom.md index 8717419a..2c6b79a9 100644 --- a/features/external-openid-providers/custom.md +++ b/features/external-openid-providers/custom.md @@ -6,7 +6,7 @@ Defguard supports custom providers that allow a **code** response type in the Op You can also configure a custom OpenID provider. The key thing here is setting up the **Base URL** correctly. This URL is used to discover all the endpoints required for the authorization flow. -The easiest way of obtaining the Base URL is to find out what is the OpenID `.well-known` URL of your provider. For example, for Google it's `https://accounts.google.com/.well-known/openid-configuration`, in this case, the Base URL would be `https://accounts.google.com` (note the lack of a trailing slash). The part starting with `/.well-known` is added automatically, so it should be omitted from the Base URL. This is explained in more detail in the [Base URL](custom.md#base-url) section. +The easiest way of obtaining the Base URL is to find out what is the OpenID `.well-known` URL of your provider. For example, for Google it's `https://accounts.google.com/.well-known/openid-configuration`, in this case, the Base URL would be `https://accounts.google.com` (note the lack of a trailing slash). The part starting with `/.well-known` is added automatically, so it should be omitted from the Base URL. This is explained in more detail in the [Base URL](./#base-url) section. In order to get the **Client ID** and **Client Secret** values, refer to the documentation of your custom provider of choice. diff --git a/features/external-openid-providers/jumpcloud.md b/features/external-openid-providers/jumpcloud.md index 86e15744..ca6c1a98 100644 --- a/features/external-openid-providers/jumpcloud.md +++ b/features/external-openid-providers/jumpcloud.md @@ -32,7 +32,7 @@ If you already have them, please skip to [#configuring-jumpcloud-as-external-oid Make sure to set the correct Redirect URI and Login URL that will reflect your Defguard's setup.\ If you access your Defguard dashboard at e.g., `https://defguard.example.net` your redirect URI will be `https://defguard.example.net/auth/callback` and the login URL `https://defguard.example.net/auth/login`.\ - Additionally, if you are using a Defguard proxy to enroll users, you can also add another redirect URI in the form of `/openid/callback` and `/openid/mfa/callback` if you wish to use the [External MFA feature](../wireguard/multi-factor-authentication-mfa-2fa/#external-mfa) (`` is the address at which your Proxy enrollment page is accessible). + Additionally, if you are using a Defguard proxy to enroll users, you can also add another redirect URI in the form of `/openid/callback` and `/openid/mfa/callback` if you wish to use the [External MFA feature](../wireguard/multi-factor-authentication-mfa-2fa/external-sso-based-mfa.md) (`` is the address at which your Proxy enrollment page is accessible). 9. Next, select the profile scope and add an `email` user attribute mapping by hand, like so:
diff --git a/features/forward-auth.md b/features/forward-auth.md index 95fd3e01..d0a07c6c 100644 --- a/features/forward-auth.md +++ b/features/forward-auth.md @@ -7,7 +7,7 @@ In order for forward auth to work the services you are trying to protect must be For example if you are serving your Defguard UI at `id.yourdomain.com`, then your services must use other subdomains of `yourdomain.com`, e.g. ``app1.yourdomain.com, `service.yourdomain.com` etc``. -Additionally you have to update your [Defguard config](../deployment-strategies/configuration.md#auth-cookies-configuration) to set the cookies domain to `yourdomain.com`. +Additionally you have to update your [Defguard config](../deployment-strategies/configuration.md#core-deployment-parameters) to set the cookies domain to `yourdomain.com`. {% endhint %} ## Example configurations diff --git a/features/gateway.md b/features/gateway.md index a454792b..e15bf68e 100644 --- a/features/gateway.md +++ b/features/gateway.md @@ -31,7 +31,7 @@ This instruction helps configure Defguard Gateway in OPNsense. This is based on ### Configure Defguard Gateway plugin 1. Go to **VPN → Defguard Gateway** -2. Fill out the appropriate values in the form. You can read more about the available configuration options here: [#gateway-configuration](../deployment-strategies/configuration.md#gateway-configuration "mention") +2. Fill out the appropriate values in the form. You can read more about the available configuration options here: [#gateway-configuration](../deployment-strategies/configuration.md#gateway-deployment-parameters "mention") 3. Eventually, **Start/Restart** the service. ### Assign a network interface to Defguard diff --git a/features/ldap-and-active-directory-integration/configuration.md b/features/ldap-and-active-directory-integration/configuration.md index 8fc5058b..5c1c7344 100644 --- a/features/ldap-and-active-directory-integration/configuration.md +++ b/features/ldap-and-active-directory-integration/configuration.md @@ -40,7 +40,7 @@ This section defines how Defguard connects to your LDAP server and authenticates
LDAP Connection settings
* **Use StartTLS**: Enable this option for an encrypted connection to LDAP. StartTLS is an LDAP extended operation that begins with an unencrypted TCP connection on port 389, then sends a StartTLS request to initiate a TLS handshake without changing ports. -* **LDAP server is Active Directory**: Enable this option for an Active Directory server. Active Directory (AD) is Microsoft’s directory service for managing users, computers, and resources in Windows networks. See [#example-active-directory-configuration](configuration.md#example-active-directory-configuration "mention") for a working example. +* **LDAP server is Active Directory**: Enable this option for an Active Directory server. Active Directory (AD) is Microsoft’s directory service for managing users, computers, and resources in Windows networks. See [#example-active-directory-configuration](examples.md#example-active-directory-configuration "mention") for a working example. * **Verify TLS certificate**: Enable this option to validate the TLS certificate. For custom self-signed certificates, it may be reasonable to leave this option disabled. * **URL**: The LDAP server's URL. Use the `ldap:` schema for unencrypted connections or connections with StartTLS (this defaults to TCP port 389), or the `ldaps:` schema for SSL-encrypted connections (this defaults to TCP port 636). * **Bind username** and **Bind password**: These refer to the credentials used in an LDAP "bind" operation to authenticate a client to the directory server. The username field should contain a Distinguished Name (DN) for a service account that is able to manage LDAP entries. diff --git a/features/openid-connect/proxmox-1.md b/features/openid-connect/proxmox-1.md index 1997aef9..26d3a7f3 100644 --- a/features/openid-connect/proxmox-1.md +++ b/features/openid-connect/proxmox-1.md @@ -5,7 +5,7 @@ hidden: true # Matrix / Synapse {% hint style="warning" %} -For Synapse OIDC to work you'll have to run Defguard with [RSA signing key](../../deployment-strategies/docker-compose.md#openid-rsa-setup). +For Synapse OIDC to work you'll have to run Defguard with [RSA signing key](../../deployment-strategies/configuration.md#deprecated-core-deployment-parameters). {% endhint %} ## Add Synapse app to Defguard diff --git a/features/openid-connect/proxmox.md b/features/openid-connect/proxmox.md index 6df5b10d..1cb863db 100644 --- a/features/openid-connect/proxmox.md +++ b/features/openid-connect/proxmox.md @@ -5,7 +5,7 @@ hidden: true # Proxmox {% hint style="warning" %} -For Proxmox OIDC to work you'll have to run Defguard with [RSA signing key](../../deployment-strategies/docker-compose.md#openid-rsa-setup). +For Proxmox OIDC to work you'll have to run Defguard with [RSA signing key](../../deployment-strategies/configuration.md#deprecated-core-deployment-parameters). {% endhint %} ## Add Proxmox app to Defguard diff --git a/features/remote-user-enrollment/README.md b/features/remote-user-enrollment/README.md index 149e1195..1187ab94 100644 --- a/features/remote-user-enrollment/README.md +++ b/features/remote-user-enrollment/README.md @@ -16,7 +16,7 @@ To avoid this issue you can deploy a **public** [Defguard Edge](https://github.c {% hint style="info" %} Edge is included when using the default [deployment instructions](../../deployment-strategies/overview.md). -Please also see the relevant configuration options for [core](../../deployment-strategies/configuration.md#enrollment-configuration) and the [edge itself](../../deployment-strategies/configuration.md#enrollment-service). +Please also see the relevant configuration options for [core](../../deployment-strategies/configuration.md#deprecated-core-deployment-parameters) and the [edge itself](../../deployment-strategies/configuration.md#edge-deployment-parameters). {% endhint %} ## How to initiate user secure enrollment diff --git a/features/wireguard/multi-factor-authentication-mfa-2fa/internal-sso-based-mfa.md b/features/wireguard/multi-factor-authentication-mfa-2fa/internal-sso-based-mfa.md index 71db7ce5..00312f78 100644 --- a/features/wireguard/multi-factor-authentication-mfa-2fa/internal-sso-based-mfa.md +++ b/features/wireguard/multi-factor-authentication-mfa-2fa/internal-sso-based-mfa.md @@ -5,7 +5,7 @@ Enabling Internal MFA for a desired VPN Location is done by: 1. Going into Defguard to **VPN Overview** 2. Selecting the VPN Location from the dropdown list, and pressing the **Edit Location** button in the top right corner of the page 3. Check the "**Internal MFA**" checkbox under the **MFA requirement** section -4. Set **peer disconnect threshold**, we recommend it to be min. 300 (5 min) - see chapter [below](internal-sso-based-mfa.md#peer-disconnect-threshold). +4. Set **peer disconnect threshold**, we recommend it to be min. 300 (5 min) - see chapter [below](internal-sso-based-mfa.md#client-disconnect-threshold). 5. And **save changes**.
diff --git a/features/wireguard/remote-desktop-activation.md b/features/wireguard/remote-desktop-activation.md index 108edfd9..09803c0b 100644 --- a/features/wireguard/remote-desktop-activation.md +++ b/features/wireguard/remote-desktop-activation.md @@ -26,7 +26,7 @@ You will be presented with a choice to send an activation token via email or you
-After receiving the token, the user will need to follow the activation process in the client. You can find out more about it in [#adding-instance](../../using-defguard-for-end-users/desktop-client/instance-configuration.md#adding-instance "mention"). +After receiving the token, the user will need to follow the activation process in the client. You can find out more about it in [#manually-adding-instance](../../using-defguard-for-end-users/desktop-client/instance-configuration.md#manually-adding-instance "mention"). This token also allows for updating information, read more about it in [#updating-instance](../../using-defguard-for-end-users/desktop-client/instance-configuration.md#updating-instance "mention"). diff --git a/in-depth/architecture-decision-records/1.6.md b/in-depth/architecture-decision-records/1.6.md index b5c8e0be..6ec32996 100644 --- a/in-depth/architecture-decision-records/1.6.md +++ b/in-depth/architecture-decision-records/1.6.md @@ -2,10 +2,10 @@ ## 2025-10-16 Desktop client auto-provisioning -In order to support client auto-provisioning of the desktop client we've introduced support for initializing the client from a provisioning file ([#627](https://github.com/DefGuard/client/pull/627)). If a client is "uninitialized" (has no instance configured) it can read required enrollment config from a file stored in app data directory. The process is explained further in the [docs](../../features/desktop-client-auto-provisioning/#client-side-implementation). +In order to support client auto-provisioning of the desktop client we've introduced support for initializing the client from a provisioning file ([#627](https://github.com/DefGuard/client/pull/627)). If a client is "uninitialized" (has no instance configured) it can read required enrollment config from a file stored in app data directory. The process is explained further in the [docs](../../features/desktop-client-auto-provisioning/#client-side-implementation-details). This file-based approach allows us to support provisioning on various platforms independent of the specific tooling used by system administrators. -Furthermore since the majority of users are on the Windows platform we also updated our MSI package to support provisioning scenarios in Active Directory and Entra ID environments as described [here](../../features/desktop-client-auto-provisioning/#windows-auto-provisioning). +Furthermore since the majority of users are on the Windows platform we also updated our MSI package to support provisioning scenarios in Active Directory and Entra ID environments as described [here](../../features/desktop-client-auto-provisioning/auto-provisioning-in-windows-environments/#windows-auto-provisioning). To enable this functionality we also needed to introduce a change to the OpenID directory sync functionality - when using Microsoft provider it is now possible to [create users in Defguard during sync](../../features/external-openid-providers/microsoft.md#creating-defguard-user), without waiting for the first login. diff --git a/in-depth/client-application-feature-compatibility.md b/in-depth/client-application-feature-compatibility.md index a083c3bc..425583b8 100644 --- a/in-depth/client-application-feature-compatibility.md +++ b/in-depth/client-application-feature-compatibility.md @@ -11,4 +11,4 @@ Use this page to quickly verify whether a given feature will work in your enviro ### Feature compatibility matrix -
FeatureIntroduced inMinimum Server versionMinimum Client version
Service Locations1.61.61.6
Setting MTU1.6Client-only feature1.6
Desktop Client Auto Provisioning1.61.61.6
Client Traffic Policy Selection1.61.61.6
+
FeatureIntroduced inMinimum Server versionMinimum Client version
Service Locations1.61.61.6
Setting MTU1.6Client-only feature1.6
Desktop Client Auto Provisioning1.61.61.6
Client Traffic Policy Selection1.61.61.6
diff --git a/using-defguard-for-end-users/desktop-client/using-multi-factor-authentication-mfa.md b/using-defguard-for-end-users/desktop-client/using-multi-factor-authentication-mfa.md index dff412d2..f50c1003 100644 --- a/using-defguard-for-end-users/desktop-client/using-multi-factor-authentication-mfa.md +++ b/using-defguard-for-end-users/desktop-client/using-multi-factor-authentication-mfa.md @@ -41,7 +41,7 @@ If you don't know how to set up or use your **Authenticator App,** please check
{% hint style="info" %} -If you need a guide explaining how to use Mobile Client as your MFA method, please [scroll down.](using-multi-factor-authentication-mfa.md#authenticating-via-biometry) +If you need a guide explaining how to use Mobile Client as your MFA method, please [scroll down.](using-multi-factor-authentication-mfa.md#multi-factor-authentication-via-mobile-biometry) {% endhint %} 3. After entering code, click **Verify** diff --git a/using-defguard-for-end-users/mobile-client/README.md b/using-defguard-for-end-users/mobile-client/README.md index 1e22da0a..192fa819 100644 --- a/using-defguard-for-end-users/mobile-client/README.md +++ b/using-defguard-for-end-users/mobile-client/README.md @@ -8,7 +8,7 @@ Mobile applications are available in the official app stores for [Android](https These guides explain how to use the Defguard Mobile to connect securely to VPN locations within your Defguard instance. It covers the entire process, from installation, adding new instances, connecting to locations, to managing your VPN connection settings. -* [Instance adding guide](instance-adding.md#adding-instance-during-enrollment) +* [Instance adding guide](instance-adding.md#adding-instance-in-defguard) * [Connecting to Instance guide](instance-connect.md#connecting-to-instance) * [Managing Instance guide](instance-manage.md#managing-your-instance) diff --git a/using-defguard-for-end-users/mobile-client/instance-connect.md b/using-defguard-for-end-users/mobile-client/instance-connect.md index 476f9b21..588f6494 100644 --- a/using-defguard-for-end-users/mobile-client/instance-connect.md +++ b/using-defguard-for-end-users/mobile-client/instance-connect.md @@ -1,6 +1,6 @@ # Connecting to Instance -In this guide, you will learn how to connect to location. If you haven't added an instance yet, follow [this guide](instance-adding.md#adding-instance-during-the-enrollment). +In this guide, you will learn how to connect to location. If you haven't added an instance yet, follow [this guide](instance-adding.md#adding-instance-in-defguard). ## Connecting to location without MFA From 529e7e639ee7ae1cfa107bb4c86ab91b2cb9e137 Mon Sep 17 00:00:00 2001 From: Kuba <78603704+jakub-tldr@users.noreply.github.com> Date: Wed, 29 Jul 2026 09:35:33 +0200 Subject: [PATCH 03/14] remove misleading anchors --- features/external-openid-providers/README.md | 6 +++--- features/gateway.md | 2 +- features/remote-user-enrollment/README.md | 2 +- using-defguard-for-end-users/mobile-client/README.md | 2 +- .../mobile-client/instance-connect.md | 2 +- 5 files changed, 7 insertions(+), 7 deletions(-) diff --git a/features/external-openid-providers/README.md b/features/external-openid-providers/README.md index a0d3601f..e1f71862 100644 --- a/features/external-openid-providers/README.md +++ b/features/external-openid-providers/README.md @@ -69,10 +69,10 @@ In order to configure the external OpenID provider login, go to the settings in For a configuration guide for given provider, check one of the dedicated articles: -* [Google](google.md#obtaining-directory-synchronization-credentials) +* [Google](google.md) * [Microsoft](microsoft.md) -* [Okta](okta.md#obtaining-directory-synchronization-credentials) -* [JumpCloud](jumpcloud.md#obtaining-directory-synchronization-credentials) +* [Okta](okta.md) +* [JumpCloud](jumpcloud.md) * [Keycloak](keycloak.md) * [Zitadel](zitadel.md) * [Custom](custom.md) diff --git a/features/gateway.md b/features/gateway.md index e15bf68e..f387cd85 100644 --- a/features/gateway.md +++ b/features/gateway.md @@ -31,7 +31,7 @@ This instruction helps configure Defguard Gateway in OPNsense. This is based on ### Configure Defguard Gateway plugin 1. Go to **VPN → Defguard Gateway** -2. Fill out the appropriate values in the form. You can read more about the available configuration options here: [#gateway-configuration](../deployment-strategies/configuration.md#gateway-deployment-parameters "mention") +2. Fill out the appropriate values in the form. You can read more about the available configuration options here: [#gateway-deployment-parameters](../deployment-strategies/configuration.md#gateway-deployment-parameters "mention") 3. Eventually, **Start/Restart** the service. ### Assign a network interface to Defguard diff --git a/features/remote-user-enrollment/README.md b/features/remote-user-enrollment/README.md index 1187ab94..92b5e4d4 100644 --- a/features/remote-user-enrollment/README.md +++ b/features/remote-user-enrollment/README.md @@ -16,7 +16,7 @@ To avoid this issue you can deploy a **public** [Defguard Edge](https://github.c {% hint style="info" %} Edge is included when using the default [deployment instructions](../../deployment-strategies/overview.md). -Please also see the relevant configuration options for [core](../../deployment-strategies/configuration.md#deprecated-core-deployment-parameters) and the [edge itself](../../deployment-strategies/configuration.md#edge-deployment-parameters). +Please also see the relevant configuration options for [core](../../deployment-strategies/configuration.md#settings) and the [edge itself](../../deployment-strategies/configuration.md#edge-deployment-parameters). {% endhint %} ## How to initiate user secure enrollment diff --git a/using-defguard-for-end-users/mobile-client/README.md b/using-defguard-for-end-users/mobile-client/README.md index 192fa819..1dc9667d 100644 --- a/using-defguard-for-end-users/mobile-client/README.md +++ b/using-defguard-for-end-users/mobile-client/README.md @@ -8,7 +8,7 @@ Mobile applications are available in the official app stores for [Android](https These guides explain how to use the Defguard Mobile to connect securely to VPN locations within your Defguard instance. It covers the entire process, from installation, adding new instances, connecting to locations, to managing your VPN connection settings. -* [Instance adding guide](instance-adding.md#adding-instance-in-defguard) +* [Instance adding guide](instance-adding.md#adding-new-instance) * [Connecting to Instance guide](instance-connect.md#connecting-to-instance) * [Managing Instance guide](instance-manage.md#managing-your-instance) diff --git a/using-defguard-for-end-users/mobile-client/instance-connect.md b/using-defguard-for-end-users/mobile-client/instance-connect.md index 588f6494..8635020e 100644 --- a/using-defguard-for-end-users/mobile-client/instance-connect.md +++ b/using-defguard-for-end-users/mobile-client/instance-connect.md @@ -1,6 +1,6 @@ # Connecting to Instance -In this guide, you will learn how to connect to location. If you haven't added an instance yet, follow [this guide](instance-adding.md#adding-instance-in-defguard). +In this guide, you will learn how to connect to location. If you haven't added an instance yet, follow [this guide](instance-adding.md). ## Connecting to location without MFA From fe7c01dbb33977ac8c2504e33b88e2f3603490c9 Mon Sep 17 00:00:00 2001 From: Kuba <78603704+jakub-tldr@users.noreply.github.com> Date: Wed, 29 Jul 2026 10:37:22 +0200 Subject: [PATCH 04/14] remove version specific headers, adjust business/enterprise features info --- deployment-strategies/ova.md | 4 ---- deployment-strategies/terraform.md | 4 ---- features/activity-log/activity-log-streaming/README.md | 2 +- features/external-openid-providers/README.md | 4 ---- .../external-oidc-secure-enrollment.md | 2 +- features/external-openid-providers/microsoft.md | 4 ---- features/firewall/README.md | 2 +- features/firewall/firewall-internals.md | 2 +- features/integrations/api-tokens.md | 9 +-------- .../ldap-and-active-directory-integration/README.md | 2 +- .../configuration.md | 6 ------ ...wo-way-ldap-and-active-directory-synchronization.md | 6 +----- ...automatic-real-time-desktop-client-configuration.md | 4 ++-- features/user-snat-bindings.md | 6 +----- features/wireguard/create-your-vpn-network/README.md | 4 ++-- features/wireguard/network-overview.md | 2 +- in-depth/architecture-decision-records/1.6.md | 2 +- ...can-access-vpn-but-not-local-network-or-internet.md | 2 -- support-1/troubleshooting/README.md | 10 +++++----- using-defguard-for-end-users/desktop-client/README.md | 2 +- .../desktop-client/instance-configuration.md | 2 +- .../using-multi-factor-authentication-mfa.md | 3 +-- 22 files changed, 22 insertions(+), 62 deletions(-) diff --git a/deployment-strategies/ova.md b/deployment-strategies/ova.md index 059a0682..2c236546 100644 --- a/deployment-strategies/ova.md +++ b/deployment-strategies/ova.md @@ -15,10 +15,6 @@ After importing the image, make sure to: Once booted, the virtual machine will have all Defguard components pre-configured. To complete the setup, simply visit the Defguard Core dashboard: http://\:8000. Follow the on-screen wizard to finalize your configuration. -{% hint style="info" %} -For example setup walkthrough [see this guide](/broken/pages/nNsN8zKGZVhPboFEtp8E#example-setup). -{% endhint %} - If you would like to setup a reverse-proxy beforhand (which enables automated SSL Certificates with Let's Encrypt), [go to this section for more details](ova.md#setting-up-a-reverse-proxy). ### Accessing the VM diff --git a/deployment-strategies/terraform.md b/deployment-strategies/terraform.md index b70a8741..0719f0a8 100644 --- a/deployment-strategies/terraform.md +++ b/deployment-strategies/terraform.md @@ -1,9 +1,5 @@ # Terraform -{% hint style="info" %} -Terraform deployment works with Defguard Core version 1.3.2-alpha2 and later. -{% endhint %} - {% hint style="info" %} We've recently introduced this deployment method and are still actively improving it. If you encounter any issues or have suggestions, please open an issue in the [Defguard deployment repository](https://github.com/DefGuard/deployment/issues). {% endhint %} diff --git a/features/activity-log/activity-log-streaming/README.md b/features/activity-log/activity-log-streaming/README.md index c165fa03..dcd4c72c 100644 --- a/features/activity-log/activity-log-streaming/README.md +++ b/features/activity-log/activity-log-streaming/README.md @@ -10,7 +10,7 @@ description: >- {% hint style="warning" %} **Availability** -This feature is available in all plans, with usage limits. See the [pricing page](https://defguard.net/pricing/) for details. +This feature is available in Business and Enterprise plans. See the [pricing page](https://defguard.net/pricing/) for details. {% endhint %} **Activity Log Streaming** allows you to forward real-time activity logs from your system to external SIEM (Security Information and Event Management) platforms. diff --git a/features/external-openid-providers/README.md b/features/external-openid-providers/README.md index e1f71862..f94d6339 100644 --- a/features/external-openid-providers/README.md +++ b/features/external-openid-providers/README.md @@ -102,10 +102,6 @@ If you choose not to enable this option, new users won't be able to automaticall ### Directory synchronization -{% hint style="info" %} -This feature is available only in Defguard v1.2.0 and above -{% endhint %} - Defguard supports synchronizing users' and groups' states based on the state of the external provider directory. The following things can be synchronized: * **User Groups**: Automatically create and assign user groups in Defguard to reflect them in Google Workspace. diff --git a/features/external-openid-providers/external-oidc-secure-enrollment.md b/features/external-openid-providers/external-oidc-secure-enrollment.md index 7741eee3..e3c6c985 100644 --- a/features/external-openid-providers/external-oidc-secure-enrollment.md +++ b/features/external-openid-providers/external-oidc-secure-enrollment.md @@ -3,7 +3,7 @@ {% hint style="warning" %} **Availability** -This feature is available Business and Enterprise plan. +This feature is available in Business and Enterprise plans. See the [pricing page](https://defguard.net/pricing/) for details. {% endhint %} When [External OIDC is enabled,](./) users have the possibility to [securely enroll (automatically create a Defguard account) and very easily configure their desktop client](../../using-defguard-for-end-users/enrollment/with-external-sso-google-microsoft-custom.md) just by logging in with the SSO provider. diff --git a/features/external-openid-providers/microsoft.md b/features/external-openid-providers/microsoft.md index 7c829a3a..27643cd5 100644 --- a/features/external-openid-providers/microsoft.md +++ b/features/external-openid-providers/microsoft.md @@ -46,10 +46,6 @@ Make sure the Redirect URL you insert here is correct. The full list of redirect ## Obtaining Directory Synchronization credentials -{% hint style="info" %} -This feature is available only in Defguard 1.2.1 and above -{% endhint %} - {% hint style="warning" %} This feature is currently technically limited to 10000 members or groups. High user or group counts may still trigger your provider API limits even below this threshold. If you have many users (200+), we recommend you test this feature first before you decide to turn on automatic user deletion. {% endhint %} diff --git a/features/firewall/README.md b/features/firewall/README.md index 85a78cfa..384248f1 100644 --- a/features/firewall/README.md +++ b/features/firewall/README.md @@ -3,7 +3,7 @@ {% hint style="warning" %} **Availability** -This feature requires a Business or Enterprise plan. See the [pricing page](https://defguard.net/pricing/) for details. +This feature is available in Business and Enterprise plans. See the [pricing page](https://defguard.net/pricing/) for details. {% endhint %} {% hint style="warning" %} diff --git a/features/firewall/firewall-internals.md b/features/firewall/firewall-internals.md index e3802ec9..5681ad86 100644 --- a/features/firewall/firewall-internals.md +++ b/features/firewall/firewall-internals.md @@ -125,7 +125,7 @@ If your hardware or environment is incompatible with Defguard's firewall managem ### Packet Filter (FreeBSD, NetBSD, macOS) {% hint style="info" %} -Defguard Gateway supports Packet Filter (PF) firewall since version 1.4.0. +Defguard Gateway supports the Packet Filter (PF) firewall. {% endhint %} Packet filter (PF) firewall, is a BSD-licensed stateful packet filtering software originally developed for OpenBSD and now ported to other BSD-based systems like FreeBSD, NetBSD, and macOS. diff --git a/features/integrations/api-tokens.md b/features/integrations/api-tokens.md index 14e8870d..6ee42257 100644 --- a/features/integrations/api-tokens.md +++ b/features/integrations/api-tokens.md @@ -3,14 +3,7 @@ {% hint style="warning" %} **Availability** -This feature is available in all plans, with usage limits. See the [pricing page](https://defguard.net/pricing/) for details. -{% endhint %} - -{% hint style="warning" %} -API functionality: - -1. requires Defguard version 1.2.4+ -2. is also **available without enterprise license**, if your instance does not exceed the limits [described here](../../enterprise/license.md#enterprise-is-free-up-to-certain-limits). +This feature is available in Business and Enterprise plans. See the [pricing page](https://defguard.net/pricing/) for details. {% endhint %} ## REST API documentation diff --git a/features/ldap-and-active-directory-integration/README.md b/features/ldap-and-active-directory-integration/README.md index e0fc702c..694a60e5 100644 --- a/features/ldap-and-active-directory-integration/README.md +++ b/features/ldap-and-active-directory-integration/README.md @@ -3,7 +3,7 @@ {% hint style="warning" %} **Availability** -This feature is available in all plans, with usage limits. See the [pricing page](https://defguard.net/pricing/) for details. +This feature is available in Business and Enterprise plans. See the [pricing page](https://defguard.net/pricing/) for details. {% endhint %} {% embed url="https://youtu.be/8lf9UIAt9Rw" %} diff --git a/features/ldap-and-active-directory-integration/configuration.md b/features/ldap-and-active-directory-integration/configuration.md index 5c1c7344..caf7ce28 100644 --- a/features/ldap-and-active-directory-integration/configuration.md +++ b/features/ldap-and-active-directory-integration/configuration.md @@ -17,10 +17,6 @@ The LDAP and Active Directory settings in Defguard control how the application: Before you begin, make sure you know your server URL, bind credentials, user and group search bases, username attribute, and whether your environment requires `ldaps` or StartTLS. If you are configuring Active Directory and expect Defguard to create users or set passwords, verify that encrypted LDAP communication is available. -{% hint style="warning" %} -Active Directory support is available since Defguard version 1.3.0. -{% endhint %} - {% hint style="warning" %} If you are using the integration across multiple nested organizational units, please read the [Multiple Nested OUs](configuration.md#multiple-nested-ous) section. {% endhint %} @@ -111,8 +107,6 @@ After enabling the LDAP integration, users will be able to log in to Defguard th ### Multiple nested OUs -Multiple nested organizational units are supported in Defguard 1.4.0 and above. - If you are using an older version of Defguard, using the integration with multiple nested organizational units may lead to unexpected behavior. The following issues are known to occur: * If you have duplicate user RDNs across multiple OUs, a database error may occur: `Duplicate key violates unique constraint 'unique_ldap_rdn'`, causing issues with two-way synchronization. This would happen in the following scenario: diff --git a/features/ldap-and-active-directory-integration/two-way-ldap-and-active-directory-synchronization.md b/features/ldap-and-active-directory-integration/two-way-ldap-and-active-directory-synchronization.md index 5744586e..dfe91517 100644 --- a/features/ldap-and-active-directory-integration/two-way-ldap-and-active-directory-synchronization.md +++ b/features/ldap-and-active-directory-integration/two-way-ldap-and-active-directory-synchronization.md @@ -3,11 +3,7 @@ {% hint style="warning" %} **Availability** -This feature is available in all plans, with usage limits. See the [pricing page](https://defguard.net/pricing/) for details. -{% endhint %} - -{% hint style="warning" %} -This feature is available since Defguard version 1.3.0. +This feature is available in Business and Enterprise plans. See the [pricing page](https://defguard.net/pricing/) for details. {% endhint %} {% hint style="danger" %} diff --git a/features/remote-user-enrollment/automatic-real-time-desktop-client-configuration.md b/features/remote-user-enrollment/automatic-real-time-desktop-client-configuration.md index 6ad7f070..1a36eed8 100644 --- a/features/remote-user-enrollment/automatic-real-time-desktop-client-configuration.md +++ b/features/remote-user-enrollment/automatic-real-time-desktop-client-configuration.md @@ -3,7 +3,7 @@ {% hint style="warning" %} **Availability** -This feature is available in all plans, with usage limits. See the [pricing page](https://defguard.net/pricing/) for details. +This feature is available in Business and Enterprise plans. See the [pricing page](https://defguard.net/pricing/) for details. {% endhint %} When initially configuring Defguard desktop client, all available locations for the user (with all location settings) are automatically configured (which is one of Defguard's unique functionalities). @@ -13,7 +13,7 @@ In the course of time: new locations can be added by administrators, existing on In order to reconfigure a user's desktop client, the administrator has two possibilities: 1. If using the **Open Source Open Core** - the administrator needs to send a new configuration token to each user affected, and the user needs to [update the instance](../../using-defguard-for-end-users/desktop-client/instance-configuration.md#updating-instance) in the desktop client with the new obtained token. -2. Obtain the **Enterprise License**, then each user desktop client (and all Locations) are **reconfigured automatically in real time** (propagation takes around 30 seconds to 1 minute) whenever any VPN Location is reconfigured or the user is assigned to a different group. +2. Obtain a **Business or Enterprise** license, then each user desktop client (and all Locations) are **reconfigured automatically in real time** (propagation takes around 30 seconds to 1 minute) whenever any VPN Location is reconfigured or the user is assigned to a different group. {% hint style="warning" %} If you have been using Defguard prior to version 1.0.0, upgraded and have Enterprise License, to take advantage of the real-time config sync on an already configured desktop client, [please refer to Upgrade notes documentation.](../../deployment-strategies/upgrading.md#desktop-client-real-time-sync) diff --git a/features/user-snat-bindings.md b/features/user-snat-bindings.md index f89eb4d9..8c9f21a7 100644 --- a/features/user-snat-bindings.md +++ b/features/user-snat-bindings.md @@ -3,11 +3,7 @@ {% hint style="warning" %} **Availability** -This feature is available in all plans, with usage limits. See the [pricing page](https://defguard.net/pricing/) for details. -{% endhint %} - -{% hint style="info" %} -This feature is available starting from version 1.5 +This feature is available in Business and Enterprise plans. See the [pricing page](https://defguard.net/pricing/) for details. {% endhint %} **User SNAT bindings** allow administrators to assign specific public IP addresses to users for outbound traffic from Defguard VPN gateways in a given location. This provides fine-grained control over how user traffic appears to external networks. diff --git a/features/wireguard/create-your-vpn-network/README.md b/features/wireguard/create-your-vpn-network/README.md index 78af2626..493d0854 100644 --- a/features/wireguard/create-your-vpn-network/README.md +++ b/features/wireguard/create-your-vpn-network/README.md @@ -1,6 +1,6 @@ # Create/Manage VPN Location -A VPN location is a VPN network to which users can connect to. Every location has a [dedicated gateway](/broken/pages/1KLINb5EeNCxbdWVydt1) (or [multiple gateways if you deploy a high-availability solution](../../../deployment-strategies/high-availability-and-failover/#gateway-high-availability)). +A VPN location is a VPN network to which users can connect to. Every location has a [dedicated gateway](../../../deployment-strategies/standalone-package-based-installation/gateway.md) (or [multiple gateways if you deploy a high-availability solution](../../../deployment-strategies/high-availability-and-failover/#gateway-high-availability)). {% hint style="success" %} Defguard supports **multiple locations**, for each location to work you need to configure it and deploy a dedicated gateway. @@ -82,7 +82,7 @@ It supports multiple networks separated with comma, e.g. 10.11.1.0/0, 192.168.1. {% hint style="danger" %} Right now Defguard only manages routing of Allowed IPs (adding to routing table the networks defined in Allowed IPs). -If you want the _All Traffic_ to work in the desktop client you need to also configure MASQUARED/NAT for the VPN interface. [Example of that here.](/broken/pages/MbleSplRWwmcWM2VEo3m#enabling-to-access-internet-through-your-vpn) +If you want the _All Traffic_ to work in the desktop client you need to also configure MASQUARED/NAT for the VPN interface. {% endhint %} {% hint style="info" %} diff --git a/features/wireguard/network-overview.md b/features/wireguard/network-overview.md index 38927ff5..697f4c89 100644 --- a/features/wireguard/network-overview.md +++ b/features/wireguard/network-overview.md @@ -4,7 +4,7 @@ Once your gateway service is up and users start connecting to the VPN, upload/do On the overview page, you'll see who is currently connected and how much data each connected user transferred. You'll also see overall network transfer charts. -Since **version 1.4**, Defguard dashboard allows administrators to see: +The Defguard dashboard allows administrators to see: * Current amount of active users / network devices * Active users / network devices during time period diff --git a/in-depth/architecture-decision-records/1.6.md b/in-depth/architecture-decision-records/1.6.md index 6ec32996..11f59eb5 100644 --- a/in-depth/architecture-decision-records/1.6.md +++ b/in-depth/architecture-decision-records/1.6.md @@ -8,4 +8,4 @@ This file-based approach allows us to support provisioning on various platforms Furthermore since the majority of users are on the Windows platform we also updated our MSI package to support provisioning scenarios in Active Directory and Entra ID environments as described [here](../../features/desktop-client-auto-provisioning/auto-provisioning-in-windows-environments/#windows-auto-provisioning). -To enable this functionality we also needed to introduce a change to the OpenID directory sync functionality - when using Microsoft provider it is now possible to [create users in Defguard during sync](../../features/external-openid-providers/microsoft.md#creating-defguard-user), without waiting for the first login. +To enable this functionality we also needed to introduce a change to the OpenID directory sync functionality - when using Microsoft provider it is now possible to create users in Defguard during sync, without waiting for the first login. diff --git a/support-1/troubleshooting-guides/can-access-vpn-but-not-local-network-or-internet.md b/support-1/troubleshooting-guides/can-access-vpn-but-not-local-network-or-internet.md index 8e18fc13..40c6bdf1 100644 --- a/support-1/troubleshooting-guides/can-access-vpn-but-not-local-network-or-internet.md +++ b/support-1/troubleshooting-guides/can-access-vpn-but-not-local-network-or-internet.md @@ -25,5 +25,3 @@ echo 1 > /proc/sys/net/ipv4/ip_forward ``` To persist across reboots, add `net.ipv4.ip_forward = 1` to `/etc/sysctl.conf`. - -A full step-by-step example for enabling internet access through the VPN is available in the [deployment tutorial](https://docs.defguard.net/2.0/tutorials/step-by-step-setting-up-a-vpn-server#enabling-to-access-internet-through-your-vpn). diff --git a/support-1/troubleshooting/README.md b/support-1/troubleshooting/README.md index 309306d9..3c9ac79a 100644 --- a/support-1/troubleshooting/README.md +++ b/support-1/troubleshooting/README.md @@ -127,7 +127,7 @@ You are probably looking for `DEFGUARD_ENROLLMENT_URL` which is the URL needed t
-Please check [this article](../../deployment-strategies/configuration.md#enrollment-configuration). +Please check [this article](../../deployment-strategies/configuration.md#settings). ## Enrollment URL has changed @@ -152,7 +152,7 @@ After connecting to VPN you should be able to ping: 10.1.1.1. ### VPN Location settings changed -Check if the VPN location configuration has changed. If it did, and you do not have Enterprise license where real-time config sync is automatic, the user needs to [update their client configuration by updating that instance manually.](../../using-defguard-for-end-users/desktop-client/instance-configuration.md#updating-instance) +Check if the VPN location configuration has changed. If it did, and you do not have a Business or Enterprise plan where real-time config sync is automatic, the user needs to [update their client configuration by updating that instance manually.](../../using-defguard-for-end-users/desktop-client/instance-configuration.md#updating-instance) ### Conflicting networks @@ -199,15 +199,15 @@ Then when the client / user connects it actually establishes **a secure tunnel b From there, what happens to this traffic is the **administrator role.** The most common scenarios to do are: * add routing rules, so that the traffic from that interface/VPN IP network gets routed to your network - this approach gives the advantage that users VPN ip persists in the network and the user is visible with it's VPN ip in your local network -* Masquerade or NAT - a common use case is to masquerade or NAT the traffic - which is **actually required if you want users to access Internet from the VPN -** this process is [described in detailed in this tutorial](/broken/pages/MbleSplRWwmcWM2VEo3m#enabling-to-access-internet-through-your-vpn). +* Masquerade or NAT - a common use case is to masquerade or NAT the traffic - which is **actually required if you want users to access Internet from the VPN.** ## Unable to sign in to your Defguard instance with correct credentials The user tries to sign in to a Defguard instance but gets a 401 response with message "Session is required". -This issue is most likely caused by a misconfigured `DEFGUARD_URL` . Please have a look at the configuration options described in [General configuration](../../deployment-strategies/configuration.md#general-configuration) documentation. +This issue is most likely caused by a misconfigured `DEFGUARD_URL` . Please have a look at the configuration options described in [Core deployment parameters](../../deployment-strategies/configuration.md#core-deployment-parameters) documentation. -If you want to access your Defguard instance without TLS (using an `http://` URL), please also make sure you have everything configured according to [Auth cookies configuration](../../deployment-strategies/configuration.md#auth-cookies-configuration) documentation. +If you want to access your Defguard instance without TLS (using an `http://` URL), please also make sure you have everything configured according to [Core deployment parameters](../../deployment-strategies/configuration.md#core-deployment-parameters) documentation. ## User lost access to their 2FA methods diff --git a/using-defguard-for-end-users/desktop-client/README.md b/using-defguard-for-end-users/desktop-client/README.md index e8b83b3b..5fab2166 100644 --- a/using-defguard-for-end-users/desktop-client/README.md +++ b/using-defguard-for-end-users/desktop-client/README.md @@ -10,7 +10,7 @@ Key capabilities: * **Multi-Factor Authentication** – supports internal MFA (Authenticator App, email) as well as external OIDC/SSO providers and mobile biometry. The desktop client is required for MFA, as standard WireGuard clients do not support it. * **Command-line control** – the [`defguard-cli`](command-line-defguard-cli.md) tool ships with the client for headless machines, remote sessions, and scripting. * **Automatic updates** – the client checks for new releases and notifies you when one is available (this can be disabled in settings). -* **Real-time configuration sync** – with an Enterprise License, instances and locations stay [synchronized automatically](../../features/remote-user-enrollment/automatic-real-time-desktop-client-configuration.md). +* **Real-time configuration sync** – with a Business or Enterprise plan, instances and locations stay [synchronized automatically](../../features/remote-user-enrollment/automatic-real-time-desktop-client-configuration.md). Download the latest release here: [https://defguard.net/download/](https://defguard.net/download/) diff --git a/using-defguard-for-end-users/desktop-client/instance-configuration.md b/using-defguard-for-end-users/desktop-client/instance-configuration.md index b50b7ddb..9c4df8d0 100644 --- a/using-defguard-for-end-users/desktop-client/instance-configuration.md +++ b/using-defguard-for-end-users/desktop-client/instance-configuration.md @@ -91,7 +91,7 @@ Your Instance will update immediately. Defguard Desktop stores all information locally and doesn't communicate with Defguard outside the registration process. This means that the information about an instance is a snapshot of the moment you registered it in the desktop client, and you might want to update it, for example when locations are added or removed. {% hint style="success" %} -If you have an Enterprise License, all desktop clients and all instances are [synchronized automatically and in real-time.](../../features/remote-user-enrollment/automatic-real-time-desktop-client-configuration.md) +If you have a Business or Enterprise plan, all desktop clients and all instances are [synchronized automatically and in real-time.](../../features/remote-user-enrollment/automatic-real-time-desktop-client-configuration.md) {% endhint %} ### Removing Instance diff --git a/using-defguard-for-end-users/desktop-client/using-multi-factor-authentication-mfa.md b/using-defguard-for-end-users/desktop-client/using-multi-factor-authentication-mfa.md index f50c1003..a2504ae6 100644 --- a/using-defguard-for-end-users/desktop-client/using-multi-factor-authentication-mfa.md +++ b/using-defguard-for-end-users/desktop-client/using-multi-factor-authentication-mfa.md @@ -1,7 +1,6 @@ # Using Multi-Factor Authentication (MFA) -* Up to version 1.4, only internal MFA was supported, and a user could only use the MFA methods configured in their profile. -* Since version 1.5 (currently in alpha), MFA can be configured per location, and administrators can choose whether a location will use internal MFA or an external OIDC/SSO provider. +MFA is configured per location, and administrators choose whether a location uses internal MFA or an external OIDC/SSO provider. Depending on location settings, you may use: From c28cbd4ab5904aca8ccdf6b8fbb2d2adbab1a2ca Mon Sep 17 00:00:00 2001 From: Kuba <78603704+jakub-tldr@users.noreply.github.com> Date: Wed, 29 Jul 2026 11:06:26 +0200 Subject: [PATCH 05/14] fix texts --- .../amis-and-aws-cloudformation/README.md | 2 +- deployment-strategies/configuration.md | 28 ++++++++++--------- .../wireguard-udp-load-balancing.md | 6 ++-- .../defguard-apt-repository.md | 2 +- deployment-strategies/terraform.md | 16 +++++------ .../updating-and-version-compatibility.md | 2 +- ...ng-a-userspace-wireguard-implementation.md | 2 +- .../activity-log-streaming/README.md | 2 +- .../README.md | 2 +- features/external-openid-providers/README.md | 4 +-- features/firewall/README.md | 6 ++-- features/firewall/firewall-internals.md | 2 +- .../README.md | 2 +- .../configuration.md | 2 +- .../examples.md | 2 +- ...ap-and-active-directory-synchronization.md | 2 +- features/service-locations.md | 2 +- features/wireguard/behavior-customization.md | 20 +++++++++---- .../create-your-vpn-network/README.md | 2 +- getting-started/one-line-install.md | 2 +- in-depth/architecture-decision-records/2.0.md | 10 +++---- in-depth/secure-by-design.md | 2 +- support-1/how-to-submit-an-issue.md | 6 ++-- ...ble-to-sign-in-with-correct-credentials.md | 2 +- .../vpn-location-is-missing-from-client.md | 2 +- 25 files changed, 70 insertions(+), 60 deletions(-) diff --git a/deployment-strategies/amis-and-aws-cloudformation/README.md b/deployment-strategies/amis-and-aws-cloudformation/README.md index 839fc4b6..6d1321dd 100644 --- a/deployment-strategies/amis-and-aws-cloudformation/README.md +++ b/deployment-strategies/amis-and-aws-cloudformation/README.md @@ -88,7 +88,7 @@ Make sure to also check the rest of the pre-filled parameters, as you may want t #### Stack options -Next, select the behavior on deployment failure: +Next, select the behaviour on deployment failure:
diff --git a/deployment-strategies/configuration.md b/deployment-strategies/configuration.md index 9ac21db8..a08bb5ac 100644 --- a/deployment-strategies/configuration.md +++ b/deployment-strategies/configuration.md @@ -42,6 +42,8 @@ The following sections describe the supported deployment parameters for each Def * `--grpc-bind-address` / `DEFGUARD_GRPC_BIND_ADDRESS`: IP address the Core gRPC server binds to. * `--adopt-gateway` / `DEFGUARD_ADOPT_GATEWAY`: Gateway address used to launch the auto-adoption wizard. * `--adopt-edge` / `DEFGUARD_ADOPT_EDGE`: Edge address used to launch the auto-adoption wizard. +* `--rate-limit-per-second` / `DEFGUARD_RATELIMIT_PERSECOND`: Maximum number of requests per second per client IP before rate limiting kicks in. Set to `0` to disable rate limiting (default: `0`). +* `--rate-limit-burst` / `DEFGUARD_RATELIMIT_BURST`: Maximum burst size for the rate limiter (token bucket capacity per client IP). Set to `0` to disable rate limiting (default: `0`). #### Deprecated Core deployment parameters @@ -71,7 +73,7 @@ Since Defguard 2.0, much of the configuration that was previously provided throu * `--log-level` / `DEFGUARD_PROXY_LOG_LEVEL`: Sets the Edge log verbosity. * `--ratelimit-persecond` / `DEFGUARD_PROXY_RATELIMIT_PERSECOND`: Sets the per-second request rate limit for the HTTP API. * `--ratelimit-burst` / `DEFGUARD_PROXY_RATELIMIT_BURST`: Sets the allowed burst size for rate limiting. -* `--config:` Path `to` a TOML configuration file for Edge. +* `--config`: Path to a TOML configuration file for Edge. * `--http-bind-address` / `DEFGUARD_HTTP_BIND_ADDRESS`: IP address the Edge HTTP server binds to. * `--grpc-bind-address` / `DEFGUARD_GRPC_BIND_ADDRESS`: IP address the Edge gRPC server binds to. * `--cert-dir` / `DEFGUARD_PROXY_CERT_DIR`: Directory where Edge stores its certificate files. @@ -80,7 +82,7 @@ Since Defguard 2.0, much of the configuration that was previously provided throu #### Deprecated Edge deployment parameters -* \`--grpc-cert / DEFGUARD\_PROXY\_GRPC\_CERT: Deprecated. gRPC certificates are now automatically generated by the Core CA. +* `--grpc-cert` / `DEFGUARD_PROXY_GRPC_CERT`: Deprecated. gRPC certificates are now automatically generated by the Core CA. * `--grpc-key` / `DEFGUARD_PROXY_GRPC_KEY`: Deprecated. gRPC certificates are now automatically generated by the Core CA. * `--url` / `DEFGUARD_PROXY_URL`: Deprecated. The public Edge URL is now generated by Core instead. @@ -93,11 +95,11 @@ Since Defguard 2.0, much of the configuration that was previously provided throu * `--userspace` / `DEFGUARD_USERSPACE`: Enables a userspace WireGuard implementation. * `--stats-period` / `DEFGUARD_STATS_PERIOD`: Defines how often interface statistics are sent to Defguard Core. * `--ifname` / `DEFGUARD_IFNAME`: Sets the WireGuard interface name. -* `--pidfile:` Writes `the` Gateway process ID to the specified file. -* `--use-syslog:` Enables `logging` to syslog. -* `--syslog-facility:` Sets `the` syslog facility. -* `--syslog-socket:` Sets `the` syslog socket path. -* `--config:` Path `to` a TOML configuration file for Gateway. +* `--pidfile`: Writes the Gateway process ID to the specified file. +* `--use-syslog`: Enables logging to syslog. +* `--syslog-facility`: Sets the syslog facility. +* `--syslog-socket`: Sets the syslog socket path. +* `--config`: Path to a TOML configuration file for Gateway. {% hint style="danger" %} Defguard is built with highest security standards in mind, thus the pre/post options below **accept only a full path to one command and its arguments.** @@ -138,7 +140,7 @@ acme_staging = false ## Settings -This section describes the configuration that is managed from within the Defguard web interface after the system has been deployed. Unlike deployment parameters, which control how individual services are started, Settings are used to manage operational behavior directly from Core and can be updated by administrators through the UI. +This section describes the configuration that is managed from within the Defguard web interface after the system has been deployed. Unlike deployment parameters, which control how individual services are started, Settings are used to manage operational behaviour directly from Core and can be updated by administrators through the UI. This includes: @@ -151,7 +153,7 @@ This includes: * license and enterprise-related settings * SMTP and email delivery configuration * webhook configuration -* statistics retention and purge behavior +* statistics retention and purge behaviour * API tokens and integration-related settings * component adoption and setup workflows where managed through the UI @@ -162,8 +164,8 @@ Settings page is accessible only for admin users. It can be accessed with a navi The page is split into tabs that group related settings: * General: contains the main instance-level administration pages. - * Instance settings: configures the Core URL, instance name, public Edge URL, authentication period, statistics retention and purge behavior, and password reset timeouts. - * Client behavior: configures client-side permissions and policy controls, including device management, self-service client activation, and client traffic-routing policy. + * Instance settings: configures the Core URL, instance name, public Edge URL, authentication period, statistics retention and purge behaviour, and password reset timeouts. + * Client behaviour: configures client-side permissions and policy controls, including device management, self-service client activation, and client traffic-routing policy. * Notifications: contains outbound notification settings. * SMTP: configures the mail server connection used by Defguard, including server address, port, credentials, sender address, and encryption mode. * Gateway notifications: configures gateway disconnect and reconnect email notifications, including the inactivity threshold. @@ -214,6 +216,6 @@ The selected syslog socket may be wrong. See the `syslog_socket` configuration o `Cookie “defguard_session” has been rejected for invalid domain.` (browser console error) -This issue most often takes the form of not being able to login without any obvious cause. The login button doesn't redirect and no relevant error message is displayed in the Defguard Core logs. In this case we recommend checking the browser logs (usually right click > inspect should open the developer tools along with the browser console). If you can see the above error, this means that your `DEFGUARD_URL` configuration option doesn't match the URL you use to access the dashboard at the moment. +This issue most often takes the form of not being able to login without any obvious cause. The login button doesn't redirect and no relevant error message is displayed in the Defguard Core logs. In this case we recommend checking the browser logs (usually right click > inspect should open the developer tools along with the browser console). If you can see the above error, this means that the Core URL configured in Defguard (**Settings → General → Instance settings**) doesn't match the URL you use to access the dashboard at the moment. -For example, if your login screen is at `http://my.domain.com:8000/auth/login` set `DEFGUARD_URL` to `` http://my.domain.com:8000` `` . +For example, if your login screen is at `http://my.domain.com:8000/auth/login` set the Core URL to `http://my.domain.com:8000`. diff --git a/deployment-strategies/high-availability-and-failover/wireguard-udp-load-balancing.md b/deployment-strategies/high-availability-and-failover/wireguard-udp-load-balancing.md index 1b84b7d5..920a2570 100644 --- a/deployment-strategies/high-availability-and-failover/wireguard-udp-load-balancing.md +++ b/deployment-strategies/high-availability-and-failover/wireguard-udp-load-balancing.md @@ -74,7 +74,7 @@ Reasons: * Native UDP proxy support * Health checks with fine-grained timing controls * Proper backend ejection on failure -* Production-grade L4 behavior +* Production-grade L4 behaviour Recommended configuration characteristics: @@ -108,7 +108,7 @@ Envoy has multiple health-check timing parameters: * healthy\_edge\_interval * unhealthy\_edge\_interval -If only `interval` is configured, the effective behavior may differ depending on traffic state. +If only `interval` is configured, the effective behaviour may differ depending on traffic state. Symptoms: @@ -142,7 +142,7 @@ As a result: * Tunnel recovery may take up to the configured keepalive interval. * Shorter keepalive intervals result in faster failover recovery. -#### Expected failover behavior +#### Expected failover behaviour With proper configuration: diff --git a/deployment-strategies/standalone-package-based-installation/defguard-apt-repository.md b/deployment-strategies/standalone-package-based-installation/defguard-apt-repository.md index ea962b12..2613bd0e 100644 --- a/deployment-strategies/standalone-package-based-installation/defguard-apt-repository.md +++ b/deployment-strategies/standalone-package-based-installation/defguard-apt-repository.md @@ -57,7 +57,7 @@ Defguard Core: sudo apt install defguard ``` -Defguard Proxy: +Defguard Edge: ```sh sudo apt install defguard-proxy diff --git a/deployment-strategies/terraform.md b/deployment-strategies/terraform.md index 0719f0a8..c6ad7be2 100644 --- a/deployment-strategies/terraform.md +++ b/deployment-strategies/terraform.md @@ -13,7 +13,7 @@ The terraform configuration includes the necessary resources to setup all compon We recommend reading on the architecture of Defguard before proceeding with the deployment. You can find the documentation on the [Defguard architecture page](../in-depth/architecture/). When configuring the networking, the most important thing is to keep in mind the following rules: * Defguard Core web UI should be accessible only from the internal network or through a secure VPN connection. -* Defguard Proxy web UI should be publicly accessible, as it is used to securely pass messages to core from clients that are not connected to the VPN. +* Defguard Edge web UI should be publicly accessible, as it is used to securely pass messages to core from clients that are not connected to the VPN. * Defguard Gateway UDP port should be publicly accessible, as clients use it to connect to the VPN. * All gRPC traffic must stay internal. gRPC ports should only be available for the two parties that communicate with each other, e.g. core and proxy, or core and gateway. @@ -64,26 +64,26 @@ It accepts the following variables: * `cookie_insecure`: Set to `true` if you are using HTTP instead of HTTPS. This is not recommended for production environments. * `default_admin_password`: The default password for the admin user. This should be changed after the first login. * `proxy_grpc_port`: The gRPC port for Defguard Core to connect to the proxy. This must match the `grpc_port` variable in the proxy module. -* `proxy_url`: The URL at which Defguard Proxy will be accessible. This must match the `proxy_url` variable in the proxy module. This will be displayed to the user in the web UI when adding a new device. +* `proxy_url`: The URL at which Defguard Edge will be accessible. This must match the `proxy_url` variable in the proxy module. This will be displayed to the user in the web UI when adding a new device. * `vpn_networks`: A list of VPN networks that should be created. For every network, a new gateway will be created. See the [VPN networks configuration](terraform.md#vpn-networks-configuration) section for more details on how to configure the VPN networks. * `db_details`: A map containing the database configuration. It must contain the following: * `name`: The name of the PostgreSQL database to be created for Defguard. * `username`: The username for the PostgreSQL database. * `password`: The password for the PostgreSQL database user. * `port`: The port on which the PostgreSQL database will listen. -* `proxy_address`: The IP address of the Defguard Proxy instance. Ideally this should be a private address, as it will be used for internal communication between the core and proxy components. +* `proxy_address`: The IP address of the Defguard Edge instance. Ideally this should be a private address, as it will be used for internal communication between the core and proxy components. * `gateway_secret`: The secret used to authenticate the gateways with the core. This should be a random string of 64 characters. It is used to ensure that only authorized gateways can connect to the core instance. This secret must match the secret provided in the `gateway_secret` variable in the gateway module. * `network_interface_id`: The ID of the network interface that should be attached to the Defguard Core instance. This is used to ensure that the core instance has a private IP address in the same VPC as the proxy and gateways. #### Proxy module -The proxy module is responsible for setting up the Defguard Proxy. +The proxy module is responsible for setting up the Defguard Edge. It accepts the following variables: -* `url`: The URL at which Defguard Proxy will be accessible. -* `grpc_port`: The gRPC port for Defguard Proxy to communicate with core. This is used only for internal communication. -* `http_port`: The HTTP port on which the Defguard Proxy web server will listen. Note that setting port to `80` is not possible out of the box, as the Defguard service would require root privileges on the host machine, which it does not have by default. +* `url`: The URL at which Defguard Edge will be accessible. +* `grpc_port`: The gRPC port for Defguard Edge to communicate with core. This is used only for internal communication. +* `http_port`: The HTTP port on which the Defguard Edge web server will listen. Note that setting port to `80` is not possible out of the box, as the Defguard service would require root privileges on the host machine, which it does not have by default. #### Gateway module @@ -193,7 +193,7 @@ The `basic` example can be directly downloaded using the following link: [basic/ The example is a basic configuration that sets up all the components and a network that allows them to communicate with each other. It includes the following: * Defguard Core instance -* Defguard Proxy instance +* Defguard Edge instance * Defguard Gateway instance * A database instance (RDS) for Defguard Core. * A single VPC for all components. diff --git a/deployment-strategies/updating-and-version-compatibility.md b/deployment-strategies/updating-and-version-compatibility.md index 42268009..2a74ebb2 100644 --- a/deployment-strategies/updating-and-version-compatibility.md +++ b/deployment-strategies/updating-and-version-compatibility.md @@ -40,7 +40,7 @@ Choose the guide that matches how you deployed Defguard: Check the GitHub repositories for each service to find their newest releases and release notes: * [Defguard Core](https://github.com/DefGuard/defguard/releases) -* [Defguard Proxy](https://github.com/DefGuard/proxy/releases) +* [Defguard Edge](https://github.com/DefGuard/proxy/releases) * [Defguard Gateway](https://github.com/DefGuard/gateway/releases) * [Defguard YubiBridge](https://github.com/DefGuard/YubiKey-Provision/releases) diff --git a/deployment-strategies/using-a-userspace-wireguard-implementation.md b/deployment-strategies/using-a-userspace-wireguard-implementation.md index aae93f1a..e82544eb 100644 --- a/deployment-strategies/using-a-userspace-wireguard-implementation.md +++ b/deployment-strategies/using-a-userspace-wireguard-implementation.md @@ -4,7 +4,7 @@ Defguard Gateway supports a userspace WireGuard implementation based on BoringTu Using a userspace WireGuard implementation is useful on platforms where native kernel support is unavailable, limited, or impractical to use. It can also help in environments where running WireGuard entirely in user space better matches the operating model of the platform. -On platforms where native WireGuard support exists, such as Linux or FreeBSD, using the kernel implementation is generally recommended. The kernel implementation usually provides better performance, lower overhead, and behavior that is closer to the standard WireGuard deployment model. +On platforms where native WireGuard support exists, such as Linux or FreeBSD, using the kernel implementation is generally recommended. The kernel implementation usually provides better performance, lower overhead, and behaviour that is closer to the standard WireGuard deployment model. You can enable the userspace implementation in one of the following ways: diff --git a/features/activity-log/activity-log-streaming/README.md b/features/activity-log/activity-log-streaming/README.md index dcd4c72c..27cca832 100644 --- a/features/activity-log/activity-log-streaming/README.md +++ b/features/activity-log/activity-log-streaming/README.md @@ -1,7 +1,7 @@ --- description: >- This feature is designed to help teams centralize visibility into user - actions, security events, and system behavior by integrating with tools they + actions, security events, and system behaviour by integrating with tools they already use for monitoring and incident response. --- diff --git a/features/desktop-client-auto-provisioning/README.md b/features/desktop-client-auto-provisioning/README.md index 91be1264..22b31fcd 100644 --- a/features/desktop-client-auto-provisioning/README.md +++ b/features/desktop-client-auto-provisioning/README.md @@ -54,7 +54,7 @@ These values are analogous to those used in the standard user enrollment process 3. The user follows the standard enrollment process to finish setting up their account 4. Once enrollment is complete, the user can connect to VPN locations and access protected resources 5. If configured, the user receives a welcome email after completing enrollment.\ - This behavior is controlled by the **Send welcome email** option in the **Enrollment** settings page. + This behaviour is controlled by the **Send welcome email** option in the **Enrollment** settings page. ### Enrollment Settings diff --git a/features/external-openid-providers/README.md b/features/external-openid-providers/README.md index f94d6339..fae923b2 100644 --- a/features/external-openid-providers/README.md +++ b/features/external-openid-providers/README.md @@ -123,7 +123,7 @@ The following configuration options are currently available in the directory syn * **Synchronization interval (600s by default):** How often to synchronize with your provider. Very low values may cause issues with the provider API. The user state is also synchronized on login. {% hint style="danger" %} -If you want to delete your users based on the state of your provider we recommend trying out the "disable" behavior first to make sure everything works as expected. Always back up your database regularly. +If you want to delete your users based on the state of your provider we recommend trying out the "disable" behaviour first to make sure everything works as expected. Always back up your database regularly. {% endhint %} * **User behaviour (Keep, Disable, Delete):** What to do with Defguard users who are absent from your provider's directory. @@ -177,7 +177,7 @@ docker container ls ``` CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES -42986c3e772j postgres:15-alpine "docker-entrypoint.s…" 10 days ago Up 5 hours 0.0.0.0:5432->5432/tcp defguard-db-1 +42986c3e772j postgres:18-alpine "docker-entrypoint.s…" 10 days ago Up 5 hours 0.0.0.0:5432->5432/tcp defguard-db-1 c4000t32936a ghcr.io/defguard/defguard:main "./defguard" 4 weeks ago Up 19 minutes 0.0.0.0:8000->8000/tcp, 0.0.0.0:50055->50055/tcp defguard-core-1 ``` diff --git a/features/firewall/README.md b/features/firewall/README.md index 384248f1..3bea0376 100644 --- a/features/firewall/README.md +++ b/features/firewall/README.md @@ -7,10 +7,8 @@ This feature is available in Business and Enterprise plans. See the [pricing pag {% endhint %} {% hint style="warning" %} -Access Control List feature is available starting with Defguard Core v1.3.0 and Defguard Gateway v1.3.0. - -Defguard Gateway v1.3.0+ supports Linux machines with [NFTables](https://nftables.org/).\ -Defguard Gateway v1.4.0+ supports FreeBSD, NetBSD, and macOS machines with Packet Filter (PF). +Defguard Gateway supports Linux machines with [NFTables](https://nftables.org/).\ +On FreeBSD, NetBSD, and macOS machines, Defguard Gateway uses Packet Filter (PF). {% endhint %} {% embed url="https://www.youtube.com/watch?v=Go4C4LWcVS4" %} diff --git a/features/firewall/firewall-internals.md b/features/firewall/firewall-internals.md index 5681ad86..dbad5f1a 100644 --- a/features/firewall/firewall-internals.md +++ b/features/firewall/firewall-internals.md @@ -102,7 +102,7 @@ As a shortcut, Defguard Gateway offers the `--masquerade` flag (or the `DEFGUARD ``` {% hint style="warning" %} -The `--masquerade` option applies masquerading between **all** interfaces on the gateway, which may be more permissive than necessary in some environments. While convenient, this broad behavior might not align with more restrictive or segmented network designs. For greater control and tighter security, we recommend that administrators configure masquerading manually between only the interfaces that require it. +The `--masquerade` option applies masquerading between **all** interfaces on the gateway, which may be more permissive than necessary in some environments. While convenient, this broad behaviour might not align with more restrictive or segmented network designs. For greater control and tighter security, we recommend that administrators configure masquerading manually between only the interfaces that require it. {% endhint %} #### Forward chain priority diff --git a/features/ldap-and-active-directory-integration/README.md b/features/ldap-and-active-directory-integration/README.md index 694a60e5..9ef94c88 100644 --- a/features/ldap-and-active-directory-integration/README.md +++ b/features/ldap-and-active-directory-integration/README.md @@ -17,7 +17,7 @@ Depending on your setup, Defguard can be used in two main ways: * as an authentication layer that allows users to sign in with directory-backed credentials, * as a synchronization layer that exchanges user and group data between Defguard and your directory service. -You can start with a simple connection and one-way propagation from Defguard to LDAP, and then move to two-way synchronization if you need Defguard and the external directory to stay aligned over time. This makes it possible to adopt the integration gradually and validate the configuration before enabling more powerful synchronization behavior. +You can start with a simple connection and one-way propagation from Defguard to LDAP, and then move to two-way synchronization if you need Defguard and the external directory to stay aligned over time. This makes it possible to adopt the integration gradually and validate the configuration before enabling more powerful synchronization behaviour. This chapter covers all aspects of LDAP and AD integration, including: diff --git a/features/ldap-and-active-directory-integration/configuration.md b/features/ldap-and-active-directory-integration/configuration.md index caf7ce28..e01fd914 100644 --- a/features/ldap-and-active-directory-integration/configuration.md +++ b/features/ldap-and-active-directory-integration/configuration.md @@ -107,7 +107,7 @@ After enabling the LDAP integration, users will be able to log in to Defguard th ### Multiple nested OUs -If you are using an older version of Defguard, using the integration with multiple nested organizational units may lead to unexpected behavior. The following issues are known to occur: +If you are using an older version of Defguard, using the integration with multiple nested organizational units may lead to unexpected behaviour. The following issues are known to occur: * If you have duplicate user RDNs across multiple OUs, a database error may occur: `Duplicate key violates unique constraint 'unique_ldap_rdn'`, causing issues with two-way synchronization. This would happen in the following scenario: * `CN=user1,OU=ou1,OU=ou,DC=example` diff --git a/features/ldap-and-active-directory-integration/examples.md b/features/ldap-and-active-directory-integration/examples.md index 0a472f2e..e2563ee8 100644 --- a/features/ldap-and-active-directory-integration/examples.md +++ b/features/ldap-and-active-directory-integration/examples.md @@ -70,4 +70,4 @@ Use this example if your deployment is based on a more traditional LDAP schema a * Group member attribute: `uniqueMember` * Group search base: for example `cn=groups,dc=ldap,dc=server,dc=name` -After applying either example, save the settings and use the connection test in Defguard before enabling synchronization. A successful connection test confirms that Defguard can reach the directory and authenticate with the bind account, but you should still verify that user lookup, group lookup, and any intended synchronization behavior work as expected. +After applying either example, save the settings and use the connection test in Defguard before enabling synchronization. A successful connection test confirms that Defguard can reach the directory and authenticate with the bind account, but you should still verify that user lookup, group lookup, and any intended synchronization behaviour work as expected. diff --git a/features/ldap-and-active-directory-integration/two-way-ldap-and-active-directory-synchronization.md b/features/ldap-and-active-directory-integration/two-way-ldap-and-active-directory-synchronization.md index dfe91517..8b0297bb 100644 --- a/features/ldap-and-active-directory-integration/two-way-ldap-and-active-directory-synchronization.md +++ b/features/ldap-and-active-directory-integration/two-way-ldap-and-active-directory-synchronization.md @@ -142,7 +142,7 @@ Because some LDAP implementations require a password when a user is created, Def Defguard does not pull passwords from LDAP in any form. Instead, when a user tries to log in to Defguard and LDAP integration is enabled, a test login attempt is made against the LDAP server using the provided credentials. If the test login attempt succeeds, Defguard authenticates the user just as it would during a regular login. -## Known issues and other unexpected behavior +## Known issues and other unexpected behaviour ### General diff --git a/features/service-locations.md b/features/service-locations.md index ace066fe..e8b25a75 100644 --- a/features/service-locations.md +++ b/features/service-locations.md @@ -69,7 +69,7 @@ If you have enterprise features enabled, the Defguard Client periodically update ## Service location connection management in depth {% hint style="info" %} -This section describes the current behavior of the Defguard Client on Windows. +This section describes the current behaviour of the Defguard Client on Windows. {% endhint %} Service locations are managed by a background service (`defguard-service`) responsible for managing VPN connections. The background service is running independently from the Desktop Client and is always active. The service is responsible for establishing the connection on system boot and terminating/restarting it under specific circumstances (e.g. when user logs in if using the pre-logon mode). diff --git a/features/wireguard/behavior-customization.md b/features/wireguard/behavior-customization.md index 4f282a03..38f1790e 100644 --- a/features/wireguard/behavior-customization.md +++ b/features/wireguard/behavior-customization.md @@ -3,10 +3,10 @@ {% hint style="warning" %} **Availability** -This feature is available from Business license. See the [pricing page](https://defguard.net/pricing/) for details. +This feature is available in Business and Enterprise plans. See the [pricing page](https://defguard.net/pricing/) for details. {% endhint %} -Navigate to **Settings → Client behaviour.** +Navigate to **Settings → General → Client behaviour.**
@@ -32,17 +32,27 @@ One of the unique features of Defguard desktop client is the ability for users t
-However, in some cases administrators may want to enforce a specific behavior - allowing access only to predefined traffic or requiring all traffic to pass through the VPN. +However, in some cases administrators may want to enforce a specific behaviour - allowing access only to predefined traffic or requiring all traffic to pass through the VPN.
\ -The **Client Traffic Policy** setting enables administrators to control this behavior as needed. The available options are: +The **Client Traffic Policy** setting enables administrators to control this behaviour as needed. The available options are: -* **None** - Users can freely choose between routing predefined traffic or all traffic through the VPN. +* **No limitation** - Users can freely choose between routing predefined traffic or all traffic through the VPN. * **Disable all traffic** - Only predefined traffic is allowed, the "All traffic" option is disabled for users. * **Force all traffic** - All traffic is routed through the VPN, the "All traffic" option is enforced and cannot be changed by users. {% hint style="warning" %} Please note that this option is only client-side enforced, meaning the user may manually modify Wireguard interface to force all traffic to go through the VPN. {% endhint %} + +### Group-based policies + +In addition to the global **Client traffic policy**, you can define traffic rules for selected groups. Groups listed in this section use their own traffic rules instead of the global policy; any group that is not listed uses the global policy. + +The available options are the same as for the global policy - **No limitation**, **Disable all traffic** and **Force all traffic** - but they apply only to users in the selected groups. + +{% hint style="info" %} +Group-based policies are useful when most of your users should keep the default behaviour, while a specific group - for example contractors or a set of managed workstations - must have all traffic forced through the VPN. +{% endhint %} diff --git a/features/wireguard/create-your-vpn-network/README.md b/features/wireguard/create-your-vpn-network/README.md index 493d0854..670b6cfe 100644 --- a/features/wireguard/create-your-vpn-network/README.md +++ b/features/wireguard/create-your-vpn-network/README.md @@ -106,7 +106,7 @@ The Firewall must be **enabled** for the location for this option to have any ef {% endhint %} * **Sources included:** Addresses entered directly in Rule manual settings or Aliases and pre-defined Destinations attached to the rule. -* **Merge behavior:** Manual AllowedIPs are preserved. ACL-derived IPs are\ +* **Merge behaviour:** Manual AllowedIPs are preserved. ACL-derived IPs are\ appended, deduplicated, and sorted. * **Any Address destinations:** Destinations marked as "Any Address" in ACL\ rules are **not** added to Allowed IPs (the firewall still enforces them\ diff --git a/getting-started/one-line-install.md b/getting-started/one-line-install.md index f9e3da8e..603683bc 100644 --- a/getting-started/one-line-install.md +++ b/getting-started/one-line-install.md @@ -77,7 +77,7 @@ The script does the following: * Starts the compose stack {% hint style="info" %} -By default, the script enables masquerade on the Gateway container. This allows all traffic coming through the VPN to leave the container and reach any destination accessible from the host system. To disable this behavior, use the relevant [configuration](one-line-install.md#cli-options) option or set up proper [ACL](../features/firewall/)/firewall rules. +By default, the script enables masquerade on the Gateway container. This allows all traffic coming through the VPN to leave the container and reach any destination accessible from the host system. To disable this behaviour, use the relevant [configuration](one-line-install.md#cli-options) option or set up proper [ACL](../features/firewall/)/firewall rules. {% endhint %} ### Prerequisites diff --git a/in-depth/architecture-decision-records/2.0.md b/in-depth/architecture-decision-records/2.0.md index d7c36274..d616f13b 100644 --- a/in-depth/architecture-decision-records/2.0.md +++ b/in-depth/architecture-decision-records/2.0.md @@ -109,7 +109,7 @@ Both Aliases and Destinations are still stored in the same underlying database m ### Explicit destination configuration -In previous Defguard versions, the ACL rule logic regarding destinations broadly reflected how most firewalls, such as `nftables` and `packetfilter`, work. As a result, some behaviors were implicit. +In previous Defguard versions, the ACL rule logic regarding destinations broadly reflected how most firewalls, such as `nftables` and `packetfilter`, work. As a result, some behaviours were implicit. In particular, rules and aliases could omit destination addresses, ports, or protocols, which implicitly meant "match any". This matched firewall semantics, but it introduced ambiguity in the data model and in the UI: @@ -117,7 +117,7 @@ In particular, rules and aliases could omit destination addresses, ports, or pro * The logic for generating firewall rules had to assume user intent, especially for rules using aliases. * Validation and editing logic had to handle a number of edge cases. -As ACL functionality evolved, this approach became harder to maintain consistently. Defguard 2.0 introduces a more explicit ACL model to reduce ambiguity while preserving the effective firewall behavior of existing rules. +As ACL functionality evolved, this approach became harder to maintain consistently. Defguard 2.0 introduces a more explicit ACL model to reduce ambiguity while preserving the effective firewall behaviour of existing rules. #### Database model changes @@ -136,11 +136,11 @@ In addition, rules now include **use\_manual\_destination\_settings**, which def The rule model also adds **allow\_all\_groups** and **deny\_all\_groups** to align group handling with the already explicit "all" flags used for other source types. -Overall, the 2.0 schema preserves the effective firewall behavior of existing ACL rules while making the model clearer, easier to validate, and less dependent on implicit assumptions. +Overall, the 2.0 schema preserves the effective firewall behaviour of existing ACL rules while making the model clearer, easier to validate, and less dependent on implicit assumptions. #### Backfill logic -The Defguard 2.0 database migration includes SQL backfill logic that converts legacy implicit ACL behavior into the new explicit model while preserving the meaning of existing rules. +The Defguard 2.0 database migration includes SQL backfill logic that converts legacy implicit ACL behaviour into the new explicit model while preserving the meaning of existing rules. For **Destinations** (previously destination aliases), the migration backfills the new `any_*` flags from the legacy fields: @@ -162,7 +162,7 @@ The migration sets **use\_manual\_destination\_settings** to **false** only when * no linked component alias contributed any destination fragments, * at least one linked destination alias existed. -In every other case, **use\_manual\_destination\_settings** remains **true**, preserving the previous behavior of rules that relied on direct destination settings or component aliases. +In every other case, **use\_manual\_destination\_settings** remains **true**, preserving the previous behaviour of rules that relied on direct destination settings or component aliases. As a result, legacy empty destination fields become explicit "match any" flags, rules based only on destination aliases become explicit Destination-based rules, and mixed or manual rules continue to behave as they did before migration. diff --git a/in-depth/secure-by-design.md b/in-depth/secure-by-design.md index 08f0fe09..b127846d 100644 --- a/in-depth/secure-by-design.md +++ b/in-depth/secure-by-design.md @@ -30,7 +30,7 @@ The choice of programming language and frameworks/libraries is fundamental, as i * Exposure to vulnerabilities * The likelihood of implementation errors -* System behavior under failure conditions +* System behaviour under failure conditions * The ability to detect and mitigate attacks Defguard is built in [Rust](https://rust-lang.org/) language, which is recommended by leading security organizations worldwide due to its strong memory safety guarantees and modern security model: diff --git a/support-1/how-to-submit-an-issue.md b/support-1/how-to-submit-an-issue.md index 3f790d0b..5583110e 100644 --- a/support-1/how-to-submit-an-issue.md +++ b/support-1/how-to-submit-an-issue.md @@ -34,7 +34,7 @@ The logs will automatically include: After reproducing the issue, gather logs from **all relevant components**.\ Make sure to include **all of them** in your report. -For UI components, also take screenshots if the issue affects layout, design, or visual behavior. +For UI components, also take screenshots if the issue affects layout, design, or visual behaviour. {% hint style="warning" %} Please include only the log entries captured around the time the issue occurred and make sure the logs contain the actual error message.\ @@ -47,8 +47,8 @@ In addition to logs, clearly describe how the issue can be reproduced. Include: * Description of your deployment strategy * Exact steps you took -* Expected behavior -* Actual behavior +* Expected behaviour +* Actual behaviour ### 5. Submit your report diff --git a/support-1/troubleshooting-guides/core/unable-to-sign-in-with-correct-credentials.md b/support-1/troubleshooting-guides/core/unable-to-sign-in-with-correct-credentials.md index 432cc89d..db4803a3 100644 --- a/support-1/troubleshooting-guides/core/unable-to-sign-in-with-correct-credentials.md +++ b/support-1/troubleshooting-guides/core/unable-to-sign-in-with-correct-credentials.md @@ -2,7 +2,7 @@ This error appears when the browser's session cookie cannot be set. The most common cause is a misconfigured `DEFGUARD_URL`. -### In version 2.0 +### Instance URL setting `DEFGUARD_URL` is deprecated. The instance URL is now configured through the web UI. Go to **Settings** in the Defguard interface and verify the **Instance URL** field. It must match the URL you are accessing Defguard from, including the correct scheme (`https://` vs `http://`). diff --git a/support-1/troubleshooting-guides/desktop-client/vpn-location-is-missing-from-client.md b/support-1/troubleshooting-guides/desktop-client/vpn-location-is-missing-from-client.md index 092d7db7..99ec8ff3 100644 --- a/support-1/troubleshooting-guides/desktop-client/vpn-location-is-missing-from-client.md +++ b/support-1/troubleshooting-guides/desktop-client/vpn-location-is-missing-from-client.md @@ -24,7 +24,7 @@ Update the instance configuration. See [Instance configuration](../../../using-d Refresh the instance screen manually or restart the app. -See [Mobile Client](../../../using-defguard-for-end-users/mobile-client/) for mobile client behavior. +See [Mobile Client](../../../using-defguard-for-end-users/mobile-client/) for mobile client behaviour. ### You do not have access to the location From ae1241c9d70963a96fb97c9fe3cf50a6dcb04c64 Mon Sep 17 00:00:00 2001 From: Kuba <78603704+jakub-tldr@users.noreply.github.com> Date: Wed, 29 Jul 2026 11:19:20 +0200 Subject: [PATCH 06/14] add support and license pages --- enterprise/license.md | 30 +++++++++++++++++ support-1/sending-support-information/core.md | 32 ++++++++++++++++--- 2 files changed, 58 insertions(+), 4 deletions(-) diff --git a/enterprise/license.md b/enterprise/license.md index 78c58b00..5082f483 100644 --- a/enterprise/license.md +++ b/enterprise/license.md @@ -2,6 +2,26 @@ Defguard is available as an open-source solution with additional paid features. Some functionalities are available only with a valid license or are subject to usage limits, depending on the selected plan. Details about feature availability, limits, and pricing are provided on the [Pricing page](https://defguard.net/pricing/). +### Plans and limits + +Paid features are gated by two plan levels: + +* **Business** - unlocks the paid feature set, for example the REST API, LDAP and Active Directory integration, external OpenID providers, the firewall (ACL), activity log streaming and client behaviour customisation. +* **Enterprise** - everything from Business, plus features intended for larger deployments, such as Service Locations, device posture verification, generating Allowed IPs from firewall rules, and component high availability. + +Every feature page in this documentation states which plans include it, in an **Availability** note at the top. + +{% hint style="info" %} +Enterprise is a **higher** level than Business, so an Enterprise license also unlocks everything that a Business license unlocks. +{% endhint %} + +Your license also carries **usage limits** - the number of users and the number of VPN locations, and optionally device counts. +The current tier, expiry date, and how close you are to each limit are shown in **Settings → License**. + +{% hint style="success" %} +Small deployments can use a **free Business license**: [https://defguard.net/get-free-business/](https://defguard.net/get-free-business/). The exact limits of the free plan are listed on that page and on the [Pricing page](https://defguard.net/pricing/). +{% endhint %} + ### Purchasing the license If you would like to purchase a license, we offer two types of licenses: @@ -43,3 +63,13 @@ To configure Defguard with the received license, please go to **Settings** -> Li The license will be validated and detailed information about the license will be displayed.
+ +### License expiry + +A **subscription** license is renewed automatically, so under normal circumstances you do not need to do anything. If a renewal does not go through - for example because Core temporarily cannot reach our licensing server - the license keeps working for a grace period of **14 days** past its expiry date, which gives you time to resolve the problem without losing access to paid features. + +An **offline** license has no grace period: it stops being valid on its expiry date, because there is no licensing server to renew it against. + +{% hint style="warning" %} +If a license expires past the grace period paid features stop working. Your data, users, devices, and VPN locations are not removed. +{% endhint %} diff --git a/support-1/sending-support-information/core.md b/support-1/sending-support-information/core.md index 5c787c64..d5378878 100644 --- a/support-1/sending-support-information/core.md +++ b/support-1/sending-support-information/core.md @@ -1,7 +1,31 @@ # Core -When contacting support you can send us **anonymous** support data by: +Defguard Core has a dedicated **Support** page that gathers everything you need when reporting a problem or contacting our team. It is available to administrators in the main menu, under the **Admin** group. -1. In **Settings → Support** tab you'll be able to generate and send support data that can be used when debugging your issues. -2. To download configuration and logs use appropriate buttons. You can attach them to bug report in our GitHub repository or send them in Matrix. -3. The "Send email" button is active only if you [configured the SMTP server](../../features/notifications/setting-up-smtp-for-email-notifications.md). +The page is divided into sections: + +### Documentation + +Before submitting an issue, check the documentation - most configuration problems are covered there. The **Go to documentation** button opens it in a new tab. + +### Report a bug + +The **Report on Github** button opens a new issue in our GitHub repository. To give us more context, use the **Download** button next to it and pick **Download support data**. This saves a JSON file named `defguard-support-data-.json`, which you can attach to the issue. + +The support data contains your instance settings, VPN locations, and device assignments, so that we can reproduce your configuration. Secrets are removed before the file is generated - the SMTP password and the LDAP bind password are stripped - and user records are reduced to anonymous diagnostic fields (identifier, MFA method, whether MFA is enabled, whether the account is active and enrolled). No usernames, e-mail addresses, or password hashes are included. + +{% hint style="info" %} +Core logs are **not** part of the support data file. If we ask you for logs, collect them from the machine or container running Core. If Core was started with `--log-file` / `DEFGUARD_LOG_FILE` (see [Core deployment parameters](../../deployment-strategies/configuration.md#core-deployment-parameters)), an administrator can also fetch that file from the API endpoint `GET /api/v1/support/logs`. +{% endhint %} + +### Request feature + +The **Submit on Github** button opens a feature request in our GitHub repository. + +### Contact us by email + +Shown for instances with a basic or direct support plan. It points you at `support@defguard.net`. + +### Need direct support? + +Shown only for instances with a direct support plan. **Open a support ticket** opens a ticket pre-filled with your customer identifier, and **Schedule a call with our support team** opens our booking page. From 7e07c52ad121967a9acf85db481aa419021f9d0e Mon Sep 17 00:00:00 2001 From: Kuba <78603704+jakub-tldr@users.noreply.github.com> Date: Wed, 29 Jul 2026 11:49:49 +0200 Subject: [PATCH 07/14] remove symbols --- README.md | 8 +++++--- deployment-strategies/docker-compose.md | 4 ++-- deployment-strategies/overview.md | 2 +- deployment-strategies/running-gateway-on-vyos.md | 2 +- .../updating-and-version-compatibility.md | 2 +- deployment-strategies/upgrading.md | 4 ++-- features/firewall/troubleshooting.md | 2 +- features/managing-defguard-via-cli.md | 2 +- features/notifications/gateway-notifications.md | 4 ++-- features/wireguard/create-your-vpn-network/README.md | 2 +- support-1/troubleshooting-guides/README.md | 7 +++++++ .../desktop-client/instance-configuration.md | 2 +- .../resolving-posture-check-failures.md | 4 ++-- 13 files changed, 27 insertions(+), 18 deletions(-) diff --git a/README.md b/README.md index d4fc8777..c917e0f7 100644 --- a/README.md +++ b/README.md @@ -9,16 +9,18 @@ Welcome to the Defguard documentation. Here, you’ll learn how to explore the f * [Getting started](getting-started/one-line-install.md)\ Lets you quickly set up your own Defguard instance to explore its features an user interface. * [Features and configuration](features/overview.md)\ - Helps you, as a future Defguard administrator, get familiar with all of Defguard’s features and how to configure them to suit your needs. + Helps you, as a future Defguard administrator, get familiar with all of Defguard’s features and how to configure them to suit your needs, including integrations such as the REST API and webhooks. * [Deployment strategies](deployment-strategies/overview.md)\ Walks you through the most common deployment strategies to help you set up your Defguard instance as a production-grade solution. * [License](enterprise/license.md)\ Outlines the scope, limits, and purchasing process for the Defguard Enterprise license. * [Using Defguard (for end users)](using-defguard-for-end-users/overwiew.md)\ Helps you, as a Defguard end user, get familiar with the client applications and their features so you can quickly connect to your Defguard instance. +* [Support](support.md)\ + Shows you where to get help, how to report an issue, and where to find the troubleshooting guides for every component. +* [Compliance](compliance/defguard-compliance.md)\ + Describes how Defguard helps you meet the requirements of common security standards and regulations. * [In depth](in-depth/architecture-decision-records/)\ In-depth information about the platform and its development, reflecting our commitment to transparency. * [For developers](for-developers/contributing.md)\ All the information you need to become a Defguard contributor — join us in building a better solution. -* [Resources](support-1/troubleshooting/)\ - A collection of essential resources, including troubleshooting guides, API documentation, and more. diff --git a/deployment-strategies/docker-compose.md b/deployment-strategies/docker-compose.md index 22cffc37..a71a3956 100644 --- a/deployment-strategies/docker-compose.md +++ b/deployment-strategies/docker-compose.md @@ -75,7 +75,7 @@ docker compose up Depending on your infrastructure, you may choose to keep the setup simple and let Defguard handle SSL termination for you. Learn more about this functionality [here](../tutorials/initial-setup-wizard-setting-up-from-scratch.md#configure-ssl-for-core). In that case skip stis step. -Alternatively, you can place a reverse proxy in front of your Core service to manage SSL termination. +Alternatively, you can place a reverse proxy in front of your Core service to manage SSL termination. Here is an example [nginx](https://nginx.org/) configuration to provide SSL termination: @@ -130,7 +130,7 @@ services: Depending on your infrastructure, you may choose to keep the setup simple and let Defguard handle SSL termination for you. Learn more about this functionality [here](../tutorials/initial-setup-wizard-setting-up-from-scratch.md#configure-ssl-for-edge). In that case skip stis step. -Alternatively, you can place a reverse proxy in front of your Edge service to manage SSL termination. +Alternatively, you can place a reverse proxy in front of your Edge service to manage SSL termination. Here is an example [nginx](https://nginx.org/) configuration to provide SSL termination: diff --git a/deployment-strategies/overview.md b/deployment-strategies/overview.md index 80510540..efbea9e0 100644 --- a/deployment-strategies/overview.md +++ b/deployment-strategies/overview.md @@ -77,7 +77,7 @@ If this directory is missing or empty at startup, the component detects the abse Include the certificate directory in your server backup alongside your database if you want zero-downtime recovery - re-enrollment requires manual action in the admin UI for each affected Gateway and Edge instance. {% hint style="info" %} -Because the CA is stored in the database, a restored Core can always re-issue new component certificates. +Because the CA is stored in the database, a restored Core can always re-issue new component certificates. Losing the local cert directory does not cause permanent data loss - it requires re-running the [setup flow](../tutorials/adding-edge-component.md) for that component. {% endhint %} diff --git a/deployment-strategies/running-gateway-on-vyos.md b/deployment-strategies/running-gateway-on-vyos.md index 3b2bd154..b403f11e 100644 --- a/deployment-strategies/running-gateway-on-vyos.md +++ b/deployment-strategies/running-gateway-on-vyos.md @@ -64,7 +64,7 @@ show container sudo podman ps -a ``` -At this point, the gateway container should be running on VyOS and ready to be adopted by Defguard Core service. +At this point, the gateway container should be running on VyOS and ready to be adopted by Defguard Core service. Adopt it by following [those steps](../tutorials/initial-setup-wizard-setting-up-from-scratch.md#adopt-the-gateway-component). diff --git a/deployment-strategies/updating-and-version-compatibility.md b/deployment-strategies/updating-and-version-compatibility.md index 2a74ebb2..ed3f1e30 100644 --- a/deployment-strategies/updating-and-version-compatibility.md +++ b/deployment-strategies/updating-and-version-compatibility.md @@ -4,7 +4,7 @@ **Always back up your database before updating Core.** Core is the only component with persistent storage (PostgreSQL). See the [deployment overview](overview.md#backup) for backup instructions. {% endhint %} -Defguard is composed of multiple components (Core, Edge, Gateway) that communicate over gRPC. Each component can be updated independently, provided the components remain compatible. +Defguard is composed of multiple components (Core, Edge, Gateway) that communicate over gRPC. Each component can be updated independently, provided the components remain compatible. When components attempt to establish a connection, Defguard automatically performs a version check. If an incompatibility is detected, the connection is refused. diff --git a/deployment-strategies/upgrading.md b/deployment-strategies/upgrading.md index ae84d35f..8964cc9f 100644 --- a/deployment-strategies/upgrading.md +++ b/deployment-strategies/upgrading.md @@ -19,9 +19,9 @@ The good news is that we have raised the limits for the free tier, and it now su {% hint style="warning" %} **Upgrading from 1.5.x?** -We recommend upgrading to the latest **1.6.x** release before migrating to **2.x**. +We recommend upgrading to the latest **1.6.x** release before migrating to **2.x**. -This ensures that all intermediate migrations and configuration changes are applied in the expected order, reducing the risk of upgrade-related issues. +This ensures that all intermediate migrations and configuration changes are applied in the expected order, reducing the risk of upgrade-related issues. Recommended upgrade path: **any → latest 1.6.x → 2.x.** {% endhint %} diff --git a/features/firewall/troubleshooting.md b/features/firewall/troubleshooting.md index 1a825455..f43bcfc6 100644 --- a/features/firewall/troubleshooting.md +++ b/features/firewall/troubleshooting.md @@ -66,7 +66,7 @@ Additionally, if multiple rules cover overlapping destinations, their combined f ### Connection issues with Docker installed -If you have Docker installed on the same machine as your Gateway (or if you deployed Defguard using the one-line installation script) the firewall may not work properly due to Docker firewall rules interfering with your ACL rules. +If you have Docker installed on the same machine as your Gateway (or if you deployed Defguard using the one-line installation script) the firewall may not work properly due to Docker firewall rules interfering with your ACL rules. To verify this, execute `nft list ruleset` (may require sudo) on the machine on which your Gateway is installed: diff --git a/features/managing-defguard-via-cli.md b/features/managing-defguard-via-cli.md index 43cebbf4..efab615d 100644 --- a/features/managing-defguard-via-cli.md +++ b/features/managing-defguard-via-cli.md @@ -77,7 +77,7 @@ john | false peter | false ``` -### Check which group is admin +### Check which group is admin ```bash defguard manage list-groups diff --git a/features/notifications/gateway-notifications.md b/features/notifications/gateway-notifications.md index 5d1521b9..af5c5790 100644 --- a/features/notifications/gateway-notifications.md +++ b/features/notifications/gateway-notifications.md @@ -8,7 +8,7 @@ You can configure automatic e-mail notifications when one of your gateways disco ### Configuration -In order to configure the notifications, navigate **Settings → Notifications → Gateway notifications .** +In order to configure the notifications, navigate to **Settings → Notifications → Gateway notifications**.
@@ -16,4 +16,4 @@ The configuration options are as follows: * **Enable gateway disconnect notifications** - whether the notifications should be enabled * **Gateway inactivity time** - the time for which the gateway needs to stay disconnected in order to trigger the notification -* **Enable gateway reconnect notifications** - whether to send the notification when the gateway connects again after +* **Enable gateway reconnect notifications** - whether to send the notification when the gateway connects again after being disconnected diff --git a/features/wireguard/create-your-vpn-network/README.md b/features/wireguard/create-your-vpn-network/README.md index 670b6cfe..fc9447e8 100644 --- a/features/wireguard/create-your-vpn-network/README.md +++ b/features/wireguard/create-your-vpn-network/README.md @@ -96,7 +96,7 @@ To simplify this, you can use an **Allowed IPs calculator** to generate the corr #### Generate Allowed IPs from Firewall Rules {% hint style="info" %} -**Enterprise feature.** Requires an active Enterprise license. +**Enterprise feature.** Requires an active Enterprise license. {% endhint %} When enabled, IP addresses from [Firewall Rules](../../firewall/) that grant access to the given user are automatically added to the Allowed IPs list when a device config is generated. Manually entered Allowed IPs are always included. diff --git a/support-1/troubleshooting-guides/README.md b/support-1/troubleshooting-guides/README.md index 334dd3f1..299d1924 100644 --- a/support-1/troubleshooting-guides/README.md +++ b/support-1/troubleshooting-guides/README.md @@ -16,6 +16,9 @@ Issues are grouped by component. Each linked page covers one specific problem. * [unable-to-sign-in-with-correct-credentials.md](core/unable-to-sign-in-with-correct-credentials.md "mention") * [user-lost-access-to-their-2fa-methods.md](core/user-lost-access-to-their-2fa-methods.md "mention") * [enrollment-url-changed.md](core/enrollment-url-changed.md "mention") +* [failed-to-parse-duration.md](core/failed-to-parse-duration.md "mention") +* [core-cannot-connect-to-gateway-or-edge-after-restart-on-single-host-deployments.md](core/core-cannot-connect-to-gateway-or-edge-after-restart-on-single-host-deployments.md "mention") +* [lost-access.md](core/lost-access.md "mention") ### [desktop-client](desktop-client/ "mention") @@ -33,6 +36,9 @@ Issues are grouped by component. Each linked page covers one specific problem. * [high-disk-usage.md](desktop-client/high-disk-usage.md "mention") * [mfa-location-disconnected-after-x-time.md](desktop-client/mfa-location-disconnected-after-x-time.md "mention") * [unix-socket-permission-error-on-connect-linux.md](desktop-client/unix-socket-permission-error-on-connect-linux.md "mention") +* [could-not-start-mfa-process.md](desktop-client/could-not-start-mfa-process.md "mention") +* [vpn-location-is-missing-from-client.md](desktop-client/vpn-location-is-missing-from-client.md "mention") +* [client-crashes-immediately-on-launch-with-error-71-protocol-error-dispatching-to-wayland-display.md](desktop-client/client-crashes-immediately-on-launch-with-error-71-protocol-error-dispatching-to-wayland-display.md "mention") ### [mobile-client](mobile-client/ "mention") @@ -52,3 +58,4 @@ Issues are grouped by component. Each linked page covers one specific problem. * [webauthn-security-keys.md](webauthn-security-keys.md "mention") * [can-access-vpn-but-not-local-network-or-internet.md](can-access-vpn-but-not-local-network-or-internet.md "mention") * [how-to-verify-the-vpn-is-working.md](how-to-verify-the-vpn-is-working.md "mention") +* [testing-vpn-speed.md](testing-vpn-speed.md "mention") diff --git a/using-defguard-for-end-users/desktop-client/instance-configuration.md b/using-defguard-for-end-users/desktop-client/instance-configuration.md index 9c4df8d0..b132ece0 100644 --- a/using-defguard-for-end-users/desktop-client/instance-configuration.md +++ b/using-defguard-for-end-users/desktop-client/instance-configuration.md @@ -26,7 +26,7 @@ If you are looking for how to generate tokens for your users as an Administrator 4. Select **Client Activation** and click **Next**.
-5. Afterwards, use **One-Click Configuration** or click **Show advanced configuration** and copy **URL** and **Token** manually. +5. Afterwards, use **One-Click Configuration** or click **Show advanced configuration** and copy **URL** and **Token** manually.
diff --git a/using-defguard-for-end-users/resolving-posture-check-failures.md b/using-defguard-for-end-users/resolving-posture-check-failures.md index 6981f3d8..8f9841a1 100644 --- a/using-defguard-for-end-users/resolving-posture-check-failures.md +++ b/using-defguard-for-end-users/resolving-posture-check-failures.md @@ -86,7 +86,7 @@ The posture check requires Windows Active Directory domain membership, but the d **Fix:** Join active directory. {% hint style="warning" %} -To join a Windows device to Active Directory you'll need Windows Pro, +To join a Windows device to Active Directory you'll need Windows Pro, Enterprise or Education. Windows Home cannot join an AD domain. {% endhint %} @@ -107,7 +107,7 @@ Enterprise or Education. Windows Home cannot join an AD domain. **Configure the domain** -* Settings -> System -> About -> Domain or workgroup +* Settings -> System -> About -> Domain or workgroup * Click "Change" next to "Rename this computer or change its domain or workgroup"
From bfdcc0cc9fbc417155109136c46420f0cdaf4ef4 Mon Sep 17 00:00:00 2001 From: Kuba <78603704+jakub-tldr@users.noreply.github.com> Date: Wed, 29 Jul 2026 12:03:47 +0200 Subject: [PATCH 08/14] rename proxy to edge --- about/about-defguard.md | 2 +- .../amis-and-aws-cloudformation/README.md | 2 +- ...rdware-os-network-and-firewall-recommendations.md | 2 +- deployment-strategies/health-check.md | 12 ++++++------ features/external-openid-providers/README.md | 2 +- features/external-openid-providers/jumpcloud.md | 2 +- using-defguard-for-end-users/cli-client.md | 4 ++-- .../using-multi-factor-authentication-mfa.md | 2 +- 8 files changed, 14 insertions(+), 14 deletions(-) diff --git a/about/about-defguard.md b/about/about-defguard.md index 47a5fb64..53e4159c 100644 --- a/about/about-defguard.md +++ b/about/about-defguard.md @@ -60,7 +60,7 @@ End users enjoy one-click VPN access via the Defguard apps, while admins gain gr #### 🧩 Modular and Scalable -Each component (Core, Gateway, Proxy) can be deployed independently, allowing flexible scaling - from a single office setup to multi-region enterprise deployments. +Each component (Core, Gateway, Edge) can be deployed independently, allowing flexible scaling - from a single office setup to multi-region enterprise deployments. #### 🧱 Security Built into the Development Process diff --git a/deployment-strategies/amis-and-aws-cloudformation/README.md b/deployment-strategies/amis-and-aws-cloudformation/README.md index 6d1321dd..15f9e1b0 100644 --- a/deployment-strategies/amis-and-aws-cloudformation/README.md +++ b/deployment-strategies/amis-and-aws-cloudformation/README.md @@ -176,7 +176,7 @@ To login, use the default `admin` username and the password defined in `CoreDefa #### Edge Instance * `ProxyGrpcPort` (optional): The gRPC port for the Edge, default is `50051`. -* `ProxyHttpPort` (optional): The HTTP port for the Edge, default is `8000`. This is where the Defguard Edge web UI will be accessible. The proxy UI is used for user enrollment. +* `ProxyHttpPort` (optional): The HTTP port for the Edge, default is `8000`. This is where the Defguard Edge web UI will be accessible. The Edge UI is used for user enrollment. * `ProxyInstanceType` (optional): The instance type for the Edge, default is `t3.micro`. * `ProxyLogLevel` (optional): The log level for the Edge, default is `info`. You can also set it to `error`, `debug` or `trace`. * `ProxyUrl` (required): The URL where the Defguard Edge will be accessible (e.g., `https://proxy.defguard.example.com`). This should be the URL that users will use to access the Defguard Edge web UI. diff --git a/deployment-strategies/hardware-os-network-and-firewall-recommendations.md b/deployment-strategies/hardware-os-network-and-firewall-recommendations.md index 2c86b237..4b02bb45 100644 --- a/deployment-strategies/hardware-os-network-and-firewall-recommendations.md +++ b/deployment-strategies/hardware-os-network-and-firewall-recommendations.md @@ -69,7 +69,7 @@ The server on which the Edge is installed does not need to have the IP address a If this address is assigned for example to a firewall, a load balancer or a reverse proxy, rather than the server hosting the Edge, then just [forward proper ports acording to instruction below](hardware-os-network-and-firewall-recommendations.md#port-and-firewall-exposure-summary). {% hint style="warning" %} -If the Proxy is behind a reverse proxy or load balancer, preserve Defguard-specific headers. +If Edge is behind a reverse proxy or load balancer, preserve Defguard-specific headers. Forward request headers: `defguard-client-version`, `defguard-client-platform` diff --git a/deployment-strategies/health-check.md b/deployment-strategies/health-check.md index c48726e6..61177704 100644 --- a/deployment-strategies/health-check.md +++ b/deployment-strategies/health-check.md @@ -1,8 +1,8 @@ # Health check -## Proxy +## Edge -[Proxy](https://github.com/defguard/proxy) provides health endpoint at `GET /api/v1/health` which checks whether the application is running. +[Edge](https://github.com/defguard/proxy) provides health endpoint at `GET /api/v1/health` which checks whether the application is running. Example request: @@ -12,9 +12,9 @@ curl https://enroll.example.com/api/v1/health Response: -* `alive` with status code 200 – Proxy is working +* `alive` with status code 200 – Edge is working -To verify gRPC services for **Proxy** are alive, there is endpoint at `GET /api/v1/health-grpc` that verify it. +To verify gRPC services for **Edge** are alive, there is endpoint at `GET /api/v1/health-grpc` that verify it. Example request: @@ -24,8 +24,8 @@ curl https://enroll.example.com/api/v1/health-grpc Response: -* `alive` with status code 200 – Proxy is working and is connected to Core -* `Not connected to Defguard Core` with status code 503 – Proxy is working, but is not connected to Core +* `alive` with status code 200 – Edge is working and is connected to Core +* `Not connected to Defguard Core` with status code 503 – Edge is working, but is not connected to Core ## Core diff --git a/features/external-openid-providers/README.md b/features/external-openid-providers/README.md index fae923b2..dd9d9ac8 100644 --- a/features/external-openid-providers/README.md +++ b/features/external-openid-providers/README.md @@ -79,7 +79,7 @@ For a configuration guide for given provider, check one of the dedicated article ### OpenID enrollment -When you configure your provider, the proxy will automatically allow enrolling users through it. See [with-external-sso-google-microsoft-custom.md](../../using-defguard-for-end-users/enrollment/with-external-sso-google-microsoft-custom.md "mention") for the process from the user's point of view. +When you configure your provider, Edge will automatically allow enrolling users through it. See [with-external-sso-google-microsoft-custom.md](../../using-defguard-for-end-users/enrollment/with-external-sso-google-microsoft-custom.md "mention") for the process from the user's point of view. For this to work, make sure you have the following two things set: diff --git a/features/external-openid-providers/jumpcloud.md b/features/external-openid-providers/jumpcloud.md index ca6c1a98..32b859aa 100644 --- a/features/external-openid-providers/jumpcloud.md +++ b/features/external-openid-providers/jumpcloud.md @@ -32,7 +32,7 @@ If you already have them, please skip to [#configuring-jumpcloud-as-external-oid Make sure to set the correct Redirect URI and Login URL that will reflect your Defguard's setup.\ If you access your Defguard dashboard at e.g., `https://defguard.example.net` your redirect URI will be `https://defguard.example.net/auth/callback` and the login URL `https://defguard.example.net/auth/login`.\ - Additionally, if you are using a Defguard proxy to enroll users, you can also add another redirect URI in the form of `/openid/callback` and `/openid/mfa/callback` if you wish to use the [External MFA feature](../wireguard/multi-factor-authentication-mfa-2fa/external-sso-based-mfa.md) (`` is the address at which your Proxy enrollment page is accessible). + Additionally, if you are using Defguard Edge to enroll users, you can also add another redirect URI in the form of `/openid/callback` and `/openid/mfa/callback` if you wish to use the [External MFA feature](../wireguard/multi-factor-authentication-mfa-2fa/external-sso-based-mfa.md) (`` is the address at which your Edge enrollment page is accessible). 9. Next, select the profile scope and add an `email` user attribute mapping by hand, like so:
diff --git a/using-defguard-for-end-users/cli-client.md b/using-defguard-for-end-users/cli-client.md index 28aa24c2..a2ff6220 100644 --- a/using-defguard-for-end-users/cli-client.md +++ b/using-defguard-for-end-users/cli-client.md @@ -23,7 +23,7 @@ Binary: [https://github.com/DefGuard/client/releases/download/v1.2.0/dg-linux-aa ### Requirements * Root access on a given machine -* Defguard proxy running and accessible from the machine the CLI will be installed on +* Defguard Edge running and accessible from the machine the CLI will be installed on * `resolvconf` and `ip` commands available ### Installation @@ -68,7 +68,7 @@ Copy the command and proceed with [enrollment](cli-client.md#enrollment). #### Enrollment -Execute the command obtained in the previous step to configure Defguard CLI on the machine of your choice. The enrollment command will pull all the information required to establish a connection from your Defguard instance (through the Defguard proxy, so make sure it can be accessed) and will save it in a configuration file. Run the `enroll` command only when you need to retrieve your network configuration and apply it to the CLI Client. If you have access to the enterprise features, the CLI should automatically handle this when running. +Execute the command obtained in the previous step to configure Defguard CLI on the machine of your choice. The enrollment command will pull all the information required to establish a connection from your Defguard instance (through Defguard Edge, so make sure it can be accessed) and will save it in a configuration file. Run the `enroll` command only when you need to retrieve your network configuration and apply it to the CLI Client. If you have access to the enterprise features, the CLI should automatically handle this when running. #### Connecting diff --git a/using-defguard-for-end-users/desktop-client/using-multi-factor-authentication-mfa.md b/using-defguard-for-end-users/desktop-client/using-multi-factor-authentication-mfa.md index a2504ae6..6ff3526f 100644 --- a/using-defguard-for-end-users/desktop-client/using-multi-factor-authentication-mfa.md +++ b/using-defguard-for-end-users/desktop-client/using-multi-factor-authentication-mfa.md @@ -70,6 +70,6 @@ Here is a video showcasing this process: {% embed url="https://www.youtube.com/watch?v=b-XC76k4KVU" %} -And here you can see the whole flow done with multiple steps including the user, desktop (and mobile) the Proxy and Defguard Core and gateway in the final step: +And here you can see the whole flow done with multiple steps including the user, desktop (and mobile) the Edge and Defguard Core and gateway in the final step:
From e87b025828ca5f488e3e397bd953a8c6c7ddf1a3 Mon Sep 17 00:00:00 2001 From: Kuba <78603704+jakub-tldr@users.noreply.github.com> Date: Wed, 29 Jul 2026 13:00:28 +0200 Subject: [PATCH 09/14] update configuration variables --- deployment-strategies/configuration.md | 19 ++++++++----------- deployment-strategies/health-check.md | 4 ++-- .../running-gateway-on-opnsense-firewall.md | 8 +++++++- deployment-strategies/upgrading.md | 4 +--- features/external-openid-providers/README.md | 2 +- features/external-openid-providers/google.md | 2 +- features/external-openid-providers/okta.md | 2 +- features/external-openid-providers/zitadel.md | 2 +- 8 files changed, 22 insertions(+), 21 deletions(-) diff --git a/deployment-strategies/configuration.md b/deployment-strategies/configuration.md index a08bb5ac..703c78a3 100644 --- a/deployment-strategies/configuration.md +++ b/deployment-strategies/configuration.md @@ -71,27 +71,20 @@ Since Defguard 2.0, much of the configuration that was previously provided throu * `--http-port` / `DEFGUARD_PROXY_HTTP_PORT`: Port used by the Edge HTTP server. * `--grpc-port` / `DEFGUARD_PROXY_GRPC_PORT`: Port used by the Edge gRPC server. * `--log-level` / `DEFGUARD_PROXY_LOG_LEVEL`: Sets the Edge log verbosity. -* `--ratelimit-persecond` / `DEFGUARD_PROXY_RATELIMIT_PERSECOND`: Sets the per-second request rate limit for the HTTP API. -* `--ratelimit-burst` / `DEFGUARD_PROXY_RATELIMIT_BURST`: Sets the allowed burst size for rate limiting. +* `--rate-limit-per-second` / `DEFGUARD_PROXY_RATELIMIT_PERSECOND`: Sets the per-second request rate limit for the HTTP API. +* `--rate-limit-burst` / `DEFGUARD_PROXY_RATELIMIT_BURST`: Sets the allowed burst size for rate limiting. * `--config`: Path to a TOML configuration file for Edge. * `--http-bind-address` / `DEFGUARD_HTTP_BIND_ADDRESS`: IP address the Edge HTTP server binds to. * `--grpc-bind-address` / `DEFGUARD_GRPC_BIND_ADDRESS`: IP address the Edge gRPC server binds to. * `--cert-dir` / `DEFGUARD_PROXY_CERT_DIR`: Directory where Edge stores its certificate files. * `--https-port` / `DEFGUARD_PROXY_HTTPS_PORT`: Port used by the Edge HTTPS server when TLS certificates are installed. * `--acme-staging` / `DEFGUARD_PROXY_ACME_STAGING`: Enables the Let’s Encrypt staging environment for ACME certificate issuance. - -#### Deprecated Edge deployment parameters - -* `--grpc-cert` / `DEFGUARD_PROXY_GRPC_CERT`: Deprecated. gRPC certificates are now automatically generated by the Core CA. -* `--grpc-key` / `DEFGUARD_PROXY_GRPC_KEY`: Deprecated. gRPC certificates are now automatically generated by the Core CA. -* `--url` / `DEFGUARD_PROXY_URL`: Deprecated. The public Edge URL is now generated by Core instead. +* `--adoption-timeout` / `DEFGUARD_ADOPTION_TIMEOUT`: Time limit for the auto-adoption process, in minutes. ### Gateway deployment parameters * `--log-level` / `DEFGUARD_LOG_LEVEL`: Sets the Gateway log verbosity. * `--grpc-port` / `DEFGUARD_GRPC_PORT`: Port used by the Gateway gRPC server. -* `--grpc-cert` / `DEFGUARD_GATEWAY_GRPC_CERT`: gRPC TLS certificate used by Gateway. -* `--grpc-key` / `DEFGUARD_GATEWAY_GRPC_KEY`: gRPC TLS private key used by Gateway. * `--userspace` / `DEFGUARD_USERSPACE`: Enables a userspace WireGuard implementation. * `--stats-period` / `DEFGUARD_STATS_PERIOD`: Defines how often interface statistics are sent to Defguard Core. * `--ifname` / `DEFGUARD_IFNAME`: Sets the WireGuard interface name. @@ -118,11 +111,16 @@ To run multiple commands, create an appropriate shell script. * `--http-bind-address` / `DEFGUARD_HTTP_BIND_ADDRESS`: IP address used for the Gateway health endpoint bind. * `--cert-dir` / `DEFGUARD_GATEWAY_CERT_DIR`: Directory where Gateway stores its certificate files. * `--adoption-timeout` / `DEFGUARD_ADOPTION_TIMEOUT`: Time limit for the auto-adoption process, in minutes. +* `--clean-on-quit` / `DEFGUARD_CLEAN_ON_QUIT`: On quit, removes the network interface and the VPN configuration. ### Config file Edge and Gateway can be configured not only through command-line options and environment variables, but also through a TOML configuration file. This is useful when you want to keep component configuration in a single file instead of passing all parameters at startup. +{% hint style="warning" %} +When a configuration file is passed with `--config`, it becomes the only source of configuration for that component: command-line options and environment variables are ignored, and every option not present in the file falls back to its default value. Either keep the whole component configuration in the file, or don't use the file at all. +{% endhint %} + When using a TOML file, the available keys correspond to the same configuration options exposed by the component through CLI arguments and environment variables. In the TOML file, these options should be written in snake\_case, matching the internal option names used by the component configuration. This makes the file-based configuration equivalent in scope to the startup parameters, while providing a more convenient format for managing persistent configuration. Example Edge configuration parameters: ```toml @@ -134,7 +132,6 @@ grpc_port = 50051 log_level = "info" rate_limit_per_second = 0 rate_limit_burst = 0 -url = "http://localhost:8080" acme_staging = false ``` diff --git a/deployment-strategies/health-check.md b/deployment-strategies/health-check.md index 61177704..00761831 100644 --- a/deployment-strategies/health-check.md +++ b/deployment-strategies/health-check.md @@ -63,7 +63,7 @@ In Gateway configuration, a health check port can be enabled by adding the follo health_port = 55003 ``` -In this example, Gateway will open an additional HTTP port number 55003. Now we can use `GET /api/v1/health` endpoint to verify whether Gateway is working correctly. +In this example, Gateway will open an additional HTTP port number 55003. Now we can use `GET /health` endpoint to verify whether Gateway is working correctly. If running in Docker you can also enable it by setting the `HEALTH_PORT` [environment variable](configuration.md#gateway-deployment-parameters). @@ -76,7 +76,7 @@ http_bind_address = 10.0.10.20 Example request: ```sh -curl http://gateway.example.com:55003/api/v1/health +curl http://gateway.example.com:55003/health ``` Response: diff --git a/deployment-strategies/running-gateway-on-opnsense-firewall.md b/deployment-strategies/running-gateway-on-opnsense-firewall.md index f6bd133b..e0575fa3 100644 --- a/deployment-strategies/running-gateway-on-opnsense-firewall.md +++ b/deployment-strategies/running-gateway-on-opnsense-firewall.md @@ -45,4 +45,10 @@ sudo chmod +x gateway sudo mv gateway /usr/bin/ ``` -3. Start gateway `gateway -g -t ` +3. Start the gateway, pointing it at its configuration file: + +```sh +gateway --config /etc/defguard/gateway.toml +``` + +4. Adopt the gateway in Defguard Core, as described in [Adopt the Gateway component](../tutorials/initial-setup-wizard-setting-up-from-scratch.md#adopt-the-gateway-component). diff --git a/deployment-strategies/upgrading.md b/deployment-strategies/upgrading.md index 8964cc9f..1aaad0a0 100644 --- a/deployment-strategies/upgrading.md +++ b/deployment-strategies/upgrading.md @@ -264,14 +264,12 @@ This change requires a few changes if you are upgrading: 1. Remove `DEFGUARD_PROXY_UPSTREAM_GRPC_URL` variable - since Proxy does not connect to Defguard Core any more. 2. Proxy is now the server to which Defguard Core connects, so you may want to: 1. Optional: configure non-default Proxy gRPC port with `DEFGUARD_PROXY_GRPC_PORT -` default value is **50051** - 2. If you have a Proxy in a different network segment - eg. have a custom installation (not with one-line install/docker compose all on one server) - you may also consider exposing the gRPC port and reverse-proxy (nginx/treafik/...) the port with SSL/TLS. - 1. (Optional) If you want to use SSL with Proxy gRPC server without revers-proxy (nginx/etc) configure `DEFGUARD_PROXY_GRPC_CERT` and `DEFGUARD_PROXY_GRPC_KEY` following the [SSL setup guide](configuration.md#deprecated-edge-deployment-parameters). + 2. If you have a Proxy in a different network segment - eg. have a custom installation (not with one-line install/docker compose all on one server) - you may also consider exposing the gRPC port and reverse-proxy (nginx/traefik/...) the port with SSL/TLS. 3. Also adjust your firewall config to open new Docker port mapping etc. Make sure Proxy gRPC server **can be reached from Core**. #### Core deployment configuration 1. Add `DEFGUARD_PROXY_URL` variable to point to your Proxy gRPC server endpoint, for example `http://proxy:50051` when using Docker Compose - or any gRPC URL you have configured with your reverse proxy. -2. (Optional) If using SSL configure `DEFGUARD_PROXY_GRPC_CA` #### Upgrade process diff --git a/features/external-openid-providers/README.md b/features/external-openid-providers/README.md index dd9d9ac8..854c5463 100644 --- a/features/external-openid-providers/README.md +++ b/features/external-openid-providers/README.md @@ -84,7 +84,7 @@ When you configure your provider, Edge will automatically allow enrolling users For this to work, make sure you have the following two things set: * Additional allowed redirect URI in your provider's configuration (see [#redirect-uri](./#redirect-uri "mention")) -* A `DEFGUARD_PROXY_URL` environment variable set correctly for your proxy (not core). This variable needs to be set for your proxy and should be equal to the URL where users perform the enrollment process. This should be set automatically if you are using the one-line deployment script version `1.2.1` or above. E.g. if your enrollment URL is `https://enrollment.my-domain.net`, set `DEFGUARD_PROXY_URL` to `https://enrollment.my-domain.net`. +* The public Edge URL set correctly in **Settings → General → Instance settings**. It should be equal to the URL where users perform the enrollment process, for example `https://enrollment.my-domain.net`. #### Disabling automatic account creation diff --git a/features/external-openid-providers/google.md b/features/external-openid-providers/google.md index a3cb5f76..2c3ae02c 100644 --- a/features/external-openid-providers/google.md +++ b/features/external-openid-providers/google.md @@ -38,7 +38,7 @@ Here is [full Google documentation](https://developers.google.com/identity/openi
- Make sure to select "Web application" as the application type. The other thing to note here is the redirect URI. It is the URI to which the user will be redirected from the external provider's authorization. This URI is in the form of `/auth/callback`. Replace `` with the URL under which your dashboard is accessible, e.g., `https://defguard.example.com`. If you'd like to use OpenID enrollment through proxy (and MFA, make sure to enter an additional URIs here in the form of `/openid/callback`, and if you use External MFA please add also: `/openid/mfa/callback` + Make sure to select "Web application" as the application type. The other thing to note here is the redirect URI. It is the URI to which the user will be redirected from the external provider's authorization. This URI is in the form of `/auth/callback`. Replace `` with the URL under which your dashboard is accessible, e.g., `https://defguard.example.com`. If you'd like to use OpenID enrollment through Edge (and MFA, make sure to enter an additional URIs here in the form of `/openid/callback`, and if you use External MFA please add also: `/openid/mfa/callback` 11. After you proceed further, you will be presented with a popup containing your `Client ID` and `Client Secret`, copy them as you will need them in Defguard ## Obtaining Directory Synchronization credentials diff --git a/features/external-openid-providers/okta.md b/features/external-openid-providers/okta.md index fe5de56f..47a09e71 100644 --- a/features/external-openid-providers/okta.md +++ b/features/external-openid-providers/okta.md @@ -17,7 +17,7 @@ If you already have them, please skip to [#configuring-okta-as-external-oidc-in-
-3. On the next page, configure the application. Make sure to set the correct Sign-in URIs, those will take the form of `/auth/callback` (dashboard login) and `/openid/callback` (if you want to perform new user enrollment using Okta). Replace `` and `` with the URLs of your Defguard dashboard and enrollment page (proxy) accordingly. If you access your Defguard dashboard at e.g., `https://defguard.example.net` your redirect URI will be `https://defguard.example.net/auth/callback`. If you want to use Okta as the MFA provider, also add `/openid/mfa/callback` to the redirect URIs. +3. On the next page, configure the application. Make sure to set the correct Sign-in URIs, those will take the form of `/auth/callback` (dashboard login) and `/openid/callback` (if you want to perform new user enrollment using Okta). Replace `` and `` with the URLs of your Defguard dashboard and enrollment page (Edge) accordingly. If you access your Defguard dashboard at e.g., `https://defguard.example.net` your redirect URI will be `https://defguard.example.net/auth/callback`. If you want to use Okta as the MFA provider, also add `/openid/mfa/callback` to the redirect URIs.
diff --git a/features/external-openid-providers/zitadel.md b/features/external-openid-providers/zitadel.md index 9dbc836a..9fd83b67 100644 --- a/features/external-openid-providers/zitadel.md +++ b/features/external-openid-providers/zitadel.md @@ -13,7 +13,7 @@ Refer to [Zitadel's documentation](https://zitadel.com/docs) on how to install i 5. Choose **Code** for authorization method.
-6. Enter a redirect URI for your Defguard instance. The URI is in the form `/auth/callback`, for example `https://defguard.example.com/auth/callback`. (If Defguard has been launched on the _localhost_, select **Development Mode** and enter `http://localhost:8000/auth/callback`). If you'd like to use OpenID enrollment through proxy, make sure to enter an additional URI here in the form of `/openid/callback`. +6. Enter a redirect URI for your Defguard instance. The URI is in the form `/auth/callback`, for example `https://defguard.example.com/auth/callback`. (If Defguard has been launched on the _localhost_, select **Development Mode** and enter `http://localhost:8000/auth/callback`). If you'd like to use OpenID enrollment through Edge, make sure to enter an additional URI here in the form of `/openid/callback`.
7. **Create** the application. From 1e95c28083826b5e50a15892bb79d76920fc081a Mon Sep 17 00:00:00 2001 From: Kuba <78603704+jakub-tldr@users.noreply.github.com> Date: Wed, 29 Jul 2026 13:29:05 +0200 Subject: [PATCH 10/14] adr placeholder --- SUMMARY.md | 1 + in-depth/architecture-decision-records/2.1.md | 7 +++++++ 2 files changed, 8 insertions(+) create mode 100644 in-depth/architecture-decision-records/2.1.md diff --git a/SUMMARY.md b/SUMMARY.md index e51624c5..a5eeaed8 100644 --- a/SUMMARY.md +++ b/SUMMARY.md @@ -215,6 +215,7 @@ * [Security concepts](in-depth/architecture/security-concepts.md) * [MFA Architecture](in-depth/architecture/architecture.md) * [Architecture Decision Records](in-depth/architecture-decision-records/README.md) + * [2.1](in-depth/architecture-decision-records/2.1.md) * [2.0](in-depth/architecture-decision-records/2.0.md) * [1.6](in-depth/architecture-decision-records/1.6.md) * [1.5](in-depth/architecture-decision-records/1.5.md) diff --git a/in-depth/architecture-decision-records/2.1.md b/in-depth/architecture-decision-records/2.1.md new file mode 100644 index 00000000..f1b4d9f5 --- /dev/null +++ b/in-depth/architecture-decision-records/2.1.md @@ -0,0 +1,7 @@ +# 2.1 + +{% hint style="info" %} +The Architecture Decision Records for the 2.1 release are being prepared and will be published here. + +In the meantime, see [2.0](2.0.md) for the decisions behind the current component architecture. +{% endhint %} From 5dad34ea48ee326cf43784dd3b76c81bff826516 Mon Sep 17 00:00:00 2001 From: Kuba <78603704+jakub-tldr@users.noreply.github.com> Date: Wed, 29 Jul 2026 13:37:25 +0200 Subject: [PATCH 11/14] migration guide for 2.1 --- deployment-strategies/upgrading.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/deployment-strategies/upgrading.md b/deployment-strategies/upgrading.md index 1aaad0a0..a86f40b4 100644 --- a/deployment-strategies/upgrading.md +++ b/deployment-strategies/upgrading.md @@ -8,6 +8,10 @@ description: Notes on upgrading Defguard and its components Before doing any updates please remember to **backup your database.** {% endhint %} +## 2.0.x -> 2.1.0 + +No migration steps are required. Back up your database, then update Core, Edge and Gateway together as described in [updating-and-version-compatibility.md](updating-and-version-compatibility.md "mention"). + ## 1.6.x -> 2.0.0 {% hint style="danger" %} @@ -68,7 +72,7 @@ As mentioned in the Core migration section, this feature requires both Defguard #### Service locations -The [service-locations.md](../features/service-locations.md "mention") feature currently only works on the Windows Desktop Client. Locations in the service location mode won't be sent to clients that don't support them (either are older than 1.6.0 or are on a different platform than Windows). +When 1.6.0 was released, the [service-locations.md](../features/service-locations.md "mention") feature worked only on the Windows Desktop Client - see that page for the platforms supported today. Locations in the service location mode won't be sent to clients that don't support them (either are older than 1.6.0 or are on a platform without support). To work properly, this feature requires the Desktop Client to be in version 1.6. Service locations won't show up or work in older clients. From 1c6a24239fc70e5498c13e5403d0aaf582b31aad Mon Sep 17 00:00:00 2001 From: Kuba <78603704+jakub-tldr@users.noreply.github.com> Date: Wed, 29 Jul 2026 13:44:11 +0200 Subject: [PATCH 12/14] update service locations articles --- features/service-locations.md | 20 ++++++++++++------- .../create-your-vpn-network/README.md | 4 ++-- .../vpn-location-is-missing-from-client.md | 12 +++++------ 3 files changed, 21 insertions(+), 15 deletions(-) diff --git a/features/service-locations.md b/features/service-locations.md index e8b25a75..9791fc74 100644 --- a/features/service-locations.md +++ b/features/service-locations.md @@ -7,14 +7,16 @@ This feature is available in Enterprise plan. See the [pricing page](https://def {% endhint %} {% hint style="warning" %} -Service locations are currently only supported with Defguard Client for Windows. +Service locations are currently supported with Defguard Client for Windows and Linux. Windows supports both modes described below; Linux supports **Always on** only. {% endhint %} Service locations are a special kind of locations that allow establishing automatic VPN connections on system boot. +They are not operated by the user: a service location **never appears in the Defguard Client's location list**, and there is nothing for the user to connect to or disconnect from. The connection is established and maintained by a background service that runs independently of the Client, so an **Always on** location stays connected even when the Defguard Client has never been started or has been closed. + There are currently two modes of service locations: -* **Pre-logon**: the VPN connection to the location is established on system boot and is terminated when the user completes login to their system account. This may be used when your users need to authorize with some external identity provider (for example Active Directory) in order to successfully login and later don't require constant access to the VPN location. +* **Pre-logon** (Windows only): the VPN connection to the location is established on system boot and is terminated when the user completes login to their system account. This may be used when your users need to authorize with some external identity provider (for example Active Directory) in order to successfully login and later don't require constant access to the VPN location. * **Always on**: the VPN connection to the location is established on system boot and is never terminated, unless: * The network configuration of this location is changed (connection is re-established, to apply new changes) @@ -29,7 +31,7 @@ There are currently two modes of service locations:
-2. Select "**Service location (Windows only)**" +2. Select "**Service location (Windows, Linux)**"
@@ -50,22 +52,24 @@ If you want to edit your service location, click "**…**" and select "**Edit"**
-Scroll down, you will see "**Location type (Windows only)**" section +Scroll down, you will see the "**Location type**" section
Here you can change service location mode, and confirm with "**Save changes**" button. {% hint style="warning" %} -If your location is MFA protected, you won't be able to set is as a service location. The location must have MFA disabled in order to use service location mode. +A location cannot be set as a service location if it is MFA protected or has posture checks assigned. Disable MFA and remove the posture checks from the location first. {% endhint %} -After the configuration of the Defguard client is updated for your instance, the location will be hidden in the client's UI. The connection to the location will be established in the background without any user input. +After the configuration of the Defguard Client is updated for your instance, the location disappears from the Client's UI and stays hidden for as long as it is a service location. The connection is established in the background without any user input. ## Network configuration updates If you have enterprise features enabled, the Defguard Client periodically updates its network configuration if it's changed in Defguard Core. This also applies to service locations, but in order for the configuration update to happen for a service location, the Defguard Client must be open. This means that the configuration won't be updated when the user hasn't logged in yet, since the Client is not running at that point. In other words, **the user must first log in and start the Client for a configuration update to automatically happen**. +This applies to configuration updates only. The connection itself does not depend on the Client running - see the section below. + ## Service location connection management in depth {% hint style="info" %} @@ -74,6 +78,8 @@ This section describes the current behaviour of the Defguard Client on Windows. Service locations are managed by a background service (`defguard-service`) responsible for managing VPN connections. The background service is running independently from the Desktop Client and is always active. The service is responsible for establishing the connection on system boot and terminating/restarting it under specific circumstances (e.g. when user logs in if using the pre-logon mode). +Because the connection belongs to the background service and not to the Desktop Client, it is neither visible nor controllable in the Client's UI, and closing or never opening the Client does not bring it down. + ### Pre-logon If you selected the pre-logon mode, the connection will be established on system boot. If the service detects a login event, the connection will be terminated. @@ -84,7 +90,7 @@ After login, the connection won't be established unless a system logoff event is If you selected the always-on mode, the connection will be established on system boot. -The connection won't be terminated or restarted unless the Desktop Client receives a network update or is uninstalled. +The connection won't be terminated or restarted unless the Desktop Client receives a network update or is uninstalled. It stays up across user logins and logoffs, and while the Desktop Client is closed. ## Troubleshooting diff --git a/features/wireguard/create-your-vpn-network/README.md b/features/wireguard/create-your-vpn-network/README.md index fc9447e8..1daf0d38 100644 --- a/features/wireguard/create-your-vpn-network/README.md +++ b/features/wireguard/create-your-vpn-network/README.md @@ -19,10 +19,10 @@ This is the default option that creates an typical VPN network. #### Service location {% hint style="info" %} -This feature is only for Windows platform. +This feature is supported on Windows and Linux. The **Pre-logon** mode is Windows-only. {% endhint %} -Service Location is a Windows-specific configuration that automates secure network connectivity for managed devices. It ensures that authorized clients establish a persistent VPN tunnel immediately upon system startup, rather than waiting for a user to log in. +Service Location automates secure network connectivity for managed devices. It ensures that authorized clients establish a persistent VPN tunnel immediately upon system startup, rather than waiting for a user to log in. The tunnel is handled by a background service, so the location is not shown in the Defguard Client and requires no action from the user. See [Service locations](../../service-locations.md) for details. ## VPN Location configuration diff --git a/support-1/troubleshooting-guides/desktop-client/vpn-location-is-missing-from-client.md b/support-1/troubleshooting-guides/desktop-client/vpn-location-is-missing-from-client.md index 99ec8ff3..b3a2ceeb 100644 --- a/support-1/troubleshooting-guides/desktop-client/vpn-location-is-missing-from-client.md +++ b/support-1/troubleshooting-guides/desktop-client/vpn-location-is-missing-from-client.md @@ -8,9 +8,7 @@ Locations protected by posture checks require Defguard Client `2.1` or later. If your organization enabled posture checks on a location, that location does not appear in clients older than `2.1`. -The same applies to service locations. They are hidden when the client does not support them, for example on non-Windows platforms or in older clients. - -**Fix:** Update Defguard to the latest version, then reopen the app. If the missing location is a service location, use Defguard Client for Windows. +**Fix:** Update Defguard to the latest version, then reopen the app. ### Client configuration is outdated @@ -32,8 +30,10 @@ Administrators can restrict a location to specific users or groups. If other users can see the location but you cannot, contact your administrator. -### The location is hidden by design +### The location is a service location + +[Service locations](../../../features/service-locations.md) are never shown in the Defguard Client. They are established and maintained by a background service, so there is no entry in the location list and nothing for the user to connect to. An **Always on** service location is connected even when the Client is closed. -Some location types are not shown in the regular client list. +**Fix:** nothing to fix in the Client. To confirm the connection is up, check the network adapters on the machine or the client status in the Defguard Core web interface - see [Checking if connection is established](../../../features/service-locations.md#checking-if-connection-is-established). -For example, Windows service locations run in the background and are hidden in the UI after configuration is applied. +Service locations require Defguard Client for Windows or Linux; the **Pre-logon** mode is Windows-only. If a location was made a service location and the machine runs macOS or a mobile client, it will not be available there at all. From ee1fe8b8762f7d784be73205ca110d4359979e19 Mon Sep 17 00:00:00 2001 From: Kuba <78603704+jakub-tldr@users.noreply.github.com> Date: Wed, 29 Jul 2026 14:11:06 +0200 Subject: [PATCH 13/14] remove duplicated opnsense gateway tutorial --- SUMMARY.md | 1 - .../running-gateway-on-opnsense-firewall.md | 47 +++++++++++- features/gateway.md | 72 ------------------- 3 files changed, 45 insertions(+), 75 deletions(-) delete mode 100644 features/gateway.md diff --git a/SUMMARY.md b/SUMMARY.md index a5eeaed8..5bab47bb 100644 --- a/SUMMARY.md +++ b/SUMMARY.md @@ -68,7 +68,6 @@ * [Integrations](features/integrations/README.md) * [Webhooks](features/integrations/webhooks.md) * [REST API](features/integrations/api-tokens.md) -* [OPNSense Configuration](features/gateway.md) * [SSH Authentication](features/ssh-authentication.md) * [Forward auth](features/forward-auth.md) * [User SNAT bindings](features/user-snat-bindings.md) diff --git a/deployment-strategies/running-gateway-on-opnsense-firewall.md b/deployment-strategies/running-gateway-on-opnsense-firewall.md index e0575fa3..a3b3df52 100644 --- a/deployment-strategies/running-gateway-on-opnsense-firewall.md +++ b/deployment-strategies/running-gateway-on-opnsense-firewall.md @@ -30,12 +30,55 @@ opnsense-patch You can find detailed description of all fields [here](configuration.md#gateway-deployment-parameters). {% endhint %} -If everything went well, Defguard Gateway should be connected to Defguard Core and you can start [adding new devices to your network](../features/wireguard/remote-desktop-activation.md). +At this point the Gateway should be connected to Defguard Core. Before users can reach anything through it, OPNsense itself still needs an interface, a NAT rule and a firewall rule - continue with [#opnsense-network-configuration](running-gateway-on-opnsense-firewall.md#opnsense-network-configuration "mention"). -See also: [how to configure Defguard in OPNsense](../features/gateway.md) +## OPNsense network configuration + +The steps below are based on the [WireGuard Road Warrior Setup](https://docs.opnsense.org/manual/how-tos/wireguard-client.html) from the OPNsense documentation. + +### Assign a network interface to Defguard + +1. Go to **Interfaces → Assignments** +2. Under **Assign a new interface**, select the Defguard Gateway network interface (e.g. _wg0_) +3. Add a description, for example _ParisOfficeVPN_ +4. Click **Add** + +
Interface Assignments
+ +5. Select the newly create interface by clicking on its name (in this example _\[ParisOfficeVPN]_). +6. Select **Enable Interface** +7. Select **Prevent interface removal** +8. Click **Save**, and then **Apply changes** + +### Create an outbound NAT rule + +1. Go to **Firewall → NAT → Outbound** +2. Make sure the selected **Mode** is **Hybrid outbound NAT rule generation**; if it wasn't selected, click **Save** and then **Apply changes** +3. Under **Manual rules**, add a new rule by clicking **+**. +4. Select **Interface** – this should be either WAN or LAN, depending on the needs. +5. Select **TCP/IP version** – either IPv4 or IPv6. +6. Select **Source address** – this should be interface name assigned above plus _net_, e.g. _ParisOfficeVPN net_. +7. Click **Save**, and then **Apply changes** + +
Outbound NAT rule
+ +### Add firewall rules to allow WireGuard traffic in + +1. Go to **Firewall → Rules → WAN** +2. Click **+** (plus) to add a new rule +3. The rule should _Pass_ the traffic _in_ with _quick_ option enabled +4. Select **WAN** interface +5. Choose **TCP/IP version** of your desire +6. Select **UDP** protocol. +7. Set **Destination** to **WAN address** and port to the port number provided in Defguard Core: _Location configuration → Gateway port_ +8. Click **Save**, and then **Apply changes** + +Once this is done you can start [adding new devices to your network](../features/wireguard/remote-desktop-activation.md). ## Binary Install +Use this method if you are not running the OPNsense plugin. + 1. Checkout Gateway releases [here](https://github.com/DefGuard/gateway/releases) and download compatible binary from GitHub page. 2. Decompress and move to bin directory diff --git a/features/gateway.md b/features/gateway.md deleted file mode 100644 index f387cd85..00000000 --- a/features/gateway.md +++ /dev/null @@ -1,72 +0,0 @@ -# OPNSense Configuration - -[OPNsense®](https://opnsense.org/) is an open source, feature rich firewall and routing platform, offering cutting-edge network protection. - -## Installing OPNsense plugin - -To start Defguard Gateway as OPNsense plugin: - -1. On the [release page](https://github.com/DefGuard/gateway/releases) find and download OPNsense package which will be named:\ - `defguard-gateway_VERSION_x86_64-unknown-opnsense.pkg` – this package **includes both Defguard Gateway and OPNsense plugin.** -2. Install the package: - -```sh -pkg add defguard-gateway_VERSION_x86_64-unknown-opnsense.pkg -``` - -3. Refresh OPNsense user interface by running command below: - -```sh -opnsense-patch -``` - -4. In a web-browser, open OPNsense user interface and navigate to **VPN → Defguard Gateway**. - -
- -## Defguard Gateway Configuration - -This instruction helps configure Defguard Gateway in OPNsense. This is based on [WireGuard Road Warrior Setup](https://docs.opnsense.org/manual/how-tos/wireguard-client.html) from OPNsense documentation. - -### Configure Defguard Gateway plugin - -1. Go to **VPN → Defguard Gateway** -2. Fill out the appropriate values in the form. You can read more about the available configuration options here: [#gateway-deployment-parameters](../deployment-strategies/configuration.md#gateway-deployment-parameters "mention") -3. Eventually, **Start/Restart** the service. - -### Assign a network interface to Defguard - -1. Go to **Interfaces → Assignments** -2. Under **Assign a new interface**, select the Defguard Gateway network interface (e.g. _wg0_) -3. Add a description, for example _ParisOfficeVPN_ -4. Click **Add** - -
Interface Assignments
- -5. Select the newly create interface by clicking on its name (in this example _\[ParisOfficeVPN]_). -6. Select **Enable Interface** -7. Select **Prevent interface removal** -8. Click **Save**, and then **Apply changes** - -### Create an outbound NAT rule - -1. Go to **Firewall → NAT → Outbound** -2. Make sure the selected **Mode** is **Hybrid outbound NAT rule generation**; if it wasn't selected, click **Save** and then **Apply changes** -3. Under **Manual rules**, add a new rule by clicking **+**. -4. Select **Interface** – this should be either WAN or LAN, depending on the needs. -5. Select **TCP/IP version** – either IPv4 or IPv6. -6. Select **Source address** – this should be interface name assigned above plus _net_, e.g. _ParisOfficeVPN net_. -7. Click **Save**, and then **Apply changes** - -
Outbound NAT rule
- -### Add firewall rules to allow WireGuard traffic in - -1. Go to **Firewall → Rules → WAN** -2. Click **+** (plus) to add a new rule -3. The rule should _Pass_ the traffic _in_ with _quick_ option enabled -4. Select **WAN** interface -5. Choose **TCP/IP version** of your desire -6. Select **UDP** protocol. -7. Set **Destination** to **WAN address** and port to the port number provided in Defguard Core: _Location configuration → Gateway port_ -8. Click **Save**, and then **Apply changes** From 4680d08ae224547e7ea34ddc33a66a792c0e4916 Mon Sep 17 00:00:00 2001 From: Kuba <78603704+jakub-tldr@users.noreply.github.com> Date: Wed, 29 Jul 2026 16:43:59 +0200 Subject: [PATCH 14/14] update posture check docs --- .../assets/location-wizard-posture-check.png | Bin 0 -> 68326 bytes .../posture-check-defguard-client-version.png | Bin 0 -> 93294 bytes .../posture-check-name-and-description.png | Bin 0 -> 87450 bytes .gitbook/assets/posture-check-summary.png | Bin 0 -> 98090 bytes SUMMARY.md | 1 + about/features-overview.md | 8 +++ features/device-posture-verification.md | 59 ++++++++++++++---- 7 files changed, 56 insertions(+), 12 deletions(-) create mode 100644 .gitbook/assets/location-wizard-posture-check.png create mode 100644 .gitbook/assets/posture-check-defguard-client-version.png create mode 100644 .gitbook/assets/posture-check-name-and-description.png create mode 100644 .gitbook/assets/posture-check-summary.png diff --git a/.gitbook/assets/location-wizard-posture-check.png b/.gitbook/assets/location-wizard-posture-check.png new file mode 100644 index 0000000000000000000000000000000000000000..421171c77cc106419812589bbe644a4377e1bd62 GIT binary patch literal 68326 zcmeEuWmsIj8f|H5aVZoiZiBnKyHi{ThvM#59E!VJi@UoNDDLj=u7k^+e#hE#zw`V4 zxjcKG2|GKolQ+qmwN@rXURDeN77O;(t5*mT;=&5AUO~pbdIfO>{SJI5q{*TK{Ew8W zkdVBDkPv~qowc#4h0&{5B>6O|}f%afVs z!%H`cF+L;TEH9-wH$hgAn{6$R%q%QyZ@#5)!6`>oS^&5E?0w@s%7KFj4+)=3$(v=y zQI{bJsX9C3_e}OE%_JQM(^XRJLK>U!ffw{(y8O-6jcFHj|MYT-N%7$@Z!cANNU83P zh8lbIF?pnOK(8gHiOPp`tr;&_@%gLl^V z{Nn?q!LpLl(WD|#X`j*48(I>!W?l+H9L-{;y+Wn?u)O~NH#2KzRQEkC`eg*)zbybYiB#dQbUQvR>(61nZOkY8QLlEE( z7Wnh()ti{WS5V+@6!1ql>-E24A!D=N{3{G`_3J?aMIi|Z@VBCYosp51{by?jY?!BD za8|RXN@@;jGSZv|)|Rw-hSvHUbf)gD6 zb(@Ze;IBs<%z22^WaJ5itnG{lSZV2L>4|t@2?z+d?F@}M6@*3qnH>Bd57B1_2OCa0 zI%j8RT4yF&YdaG<1`ZAmI(kMrMn)R&6Eya&Rt|bDG*n z5&X(mPv6?nfrp6bS3&>&`$s*ETulE{l9l~GUkm(#biZQg7-;F~{+%~CDfh3tobskF zMi%PArk3F50hhtcLQl{A*Yp2Z%zsM!Ev4FjQZg{GG5ntNx2XS4s%&p$CuD62F4KYc zKV9?B#J@-WGa)zKuUG%ADgM#Uf87N)G%qYS-M>4H7dDXaq3qQw{#O#h0!l6rN9k{M zag=8RG$;2T8OJWi z0hax5_?=94RvIscEK*!=((L`dexSjlV@4r>`1|Y3kG}%nQ7r&c{L9~8@DN`mTHgP! z*hf-+hJI_M67kmn{=dB#LT+BcME&jcWfhW~^e+4>n#BJonw<0;?|;@i^;I{Z{Zl2; z|HvF1yYl9L)akVsYF5$~8>I^1e>6%~(ogsQQ77>q)~`RrK8kjK{a=}Xh;>2w`xkx% zb1U;jKW4Q+E&A``mz#1F48@;~k zi~PM65d7+7sQ=%||LT_imz`{Q*-ZMcKIRui{xORK!*`B3zN&ov-v4p~hfj4LQI7a` zBk>s${i3g6+^mm7_iHd18oj6; zqe2bQ{ACe7)RF|um(UU!sz0E0IlZv{7*&th(DKsvY+6Pmf7$Kp^jF+5(o1StNX&QV z$>)=+Y_9y&gum6Oj}bhujgqDMLw=0|eo~UG7Zjs}F;*S_VeVVHVmfJRvfrQHg1jZO zCT;(M!~0kD-CnC7>wGI=&6M``v;AXEF_l?M;n><8j@3MAfAK0*EpLmX(^2{M{kzf4 z$#Rumm+0MkZ{}8CG_fgp)i%#z z?$IsLBxh~bco!Tgjz6K{{o)Ecr1!nAj3XvLx+zsms@u8j(lBFppCWdEp) zk2pbr`1l6q14g65?c=4~cHr|933;EpZ`kdv3ntG!o9p9wFNvf`9)JBtcc_$_niJEI zfmmdJ?qK2@&prsYHraH}f%5NS^P2~Ag`p)n?JFyz)Yxq&0r=jxvTj#8Xx$lXJ*YhWc3=GHh6iYxGjG`l<@pm zwx7|)PZ$U!R_7C~D!nHS^+x^1J4{xK&p#rQ-$>)XZo!xcqS7RRKyDbLloo#J9^kpD z+RAVi@l|5toFxh32)x*{qr9(~;xzqy=F7Rt5d^6%*scng9Uu=Wij&bF05avTFsI?B z68&Zb1U|)NQQ6+_y|31x6iPK%>c_2CT13$4fYgcQS_w{;ixS5RwMQ545U~1CBl$?J z+b{VZ)Uqu7A%h?nqS!Ocg@0ta>n+{#S&Y^uQGe`l4j-#t^oD?N!R??TUld3rQz%Pv zX`G{$-heF-Q|Qob)S{Y#mNK#KBhlm12Uu9f{ZvAXmvZB#RgLmLaOFrWfJVcmOT;!& zMatLR-2R|VttKe@Q=-i16N*RAbX@=w`nPCUHCN-JlpLUh0MsVQsgD|rLOJ<=4VzRL z!=xmoS~F!#cAKnWtZWM;p2y%YES3e{!0=S-Hi;E?wolw{Yd%m*KXVw32E=V_qJDOF z4?aIV3^z8~ZO0I$*h9G{lxazX(eSsjmTF45lxoBwdT1B7bM&2&){&=xA(QLYyqMEA8b<#MQ z%{yb=Ed7mKl|rthdUGIKgC;swii~6ewW(9bGSev9g+3a!QeP3R`^`yp{Y$^-<<4-f zZ2E#i7QfegqkSTE5}!_ltIhR{7ec!ECaFwLT!ib*iMV>Jarn_(WtXP%gPO)FoFb{* zxVvesDZXoGO!dKZv1BZ%%&-~~9w$I5k(TMEy#9X1{Jt&^MmG%;Y zI!e3Q$(1XgA&bctMN^O` zKE)_;thF-6Kr>CNBwt@K6(`30nj~ZpmwG%`2(YEpvNiXSCb3IsyCtw{TgW{^Cv{vz zSz_YpGTlA}nbTrd1A`_z73C$ppZOJs{2xoJxX^3N1g8CJIX)-USl$82ZnMoob>tL_heG*0w_T?K4RE~hZh7NH>7l!7}hnKkVZ9Cxry7+saOCm%0bH!B0( z_DQ%Bqa9I%ODYX|2U>5It#PYXg?#LOtT9nDKQ ziHSDh_Kqa#gvA|}9VP;%kbTEqc%Et=uO>%#(mMRC;v)H;`*^*7e8C2B4%Oe_d#ri6 zUeB8h@irvT`UxL|+(|y)8l=@&O%KEo7drJTG4E@zHOT!OO*BLJ@HAIxaIq$YG#G}-bZjsuUhWPdNCBz%@n?=g zu6E~ljx0LlmYzubU8fgKBjm%fQ$B)_0*9kLz2dJ9ClktE&--F%Xv_8tG&*g9@8Da; zp(CA)tfKh8AcHHQ;891=_|11Lo{|!_gHY*h&eDNQoTYP3a(6uEd^maB3)^hs+e8h2 z38hAhn49uYlpL&EG_Mq!?KTB*KIxcsm^X%ZAa^xprrl=A11MJX{z1KsO z1x7`};3?p@ykuNf%;S}BK-salqQ=N)TQ1h6T$&2RTt0Hx)EZn&Ut3b9xWY=XLuF`y zXAL>Kdo~?!npquhZ4^Qnv<^6ZvGNR_VOP}Wj6J94a5hr6gzPN2%oQh&1}A00E>i>+ z>G3L=gS)LOv#N-Phn4mh(8W5`sXJQC*gHWY4C*AhvphSE0N8EAo~wOe0AR}RGsi(< zW;jOVWy@6)MwN*i?<9Q>r~Qs}xgbi_ zoW*vjkc=1*PoN9~$GEMRC*Q5)Z2ggb_Qo-yW&(jawor!DgmHlx&qviY{C8Ri}I(>^E?d6C@npZ%2qz? z`f!a43x$5Yg}MxWJw#6eSW-?fe~CJl}_4Y?e)03=%=ZNuOIc; z-cEE-zZZspUJY8!YIiX++C_SLH9J`zTUrpnkD2;SeII0m zCWhv#Ida~1shyD(X^GDC-f`k=cmd5qf>5{&@XOV*eWlYmyH|p4J_@d-ecKpG=Q0|I zqp;dt_b+dI6#M~~ka6R?|6@?f&H(qN7vGA|ED0`VPSXHnQKZ}9+p}r9Go-$Q=aArh zGzaXWN9B1=Gg>0`;V1nfJZA#69Wxlt+)?*c653XX$VyGx_Ow&BuaP}=k$iP7)Hk!m z8#qzXAcf*Fv;FBqqGtRze{YD*3n7+?G;s`V9q}YwPngCvlw@C&wt|X?%k)2dl;>ke zMt}**#pMtC?yA;@YmL;GJ={jG49{y<%1^)+HHy7-KSa~ds=YcZEadTJV*2&=X`Jix}1~T9aWFYgtJ;|47wofSHW|9_qtsd zt9CyuB`)a_B`8*E{EC|p$SsY{TEYfYZ%~QkevDdT++e*k?}QX!$A%Zgf+T`=mce36 zkVlfMRH4yaIOe)ESYM-S533qfXg=SHm1|h$Q<)=P5Ln3*2}OtX2dK3+Im$p2U1%a; za`z3#?qj#o$~~=4=HUUo9zd%5bCs=DjVj13`+0hS25u{Gc}#S4UCjQYm~FcpDlQZ1 zRBt!1me_6hV;+Xg>P)NAop>vqUv47c@x7{*0mCUQvF$wEBS(V2=0_ChuU`|9L3m9H z9I5_kk%_tp452g1)4KDr4L`Gyp#_Sl2vrrv_SyT}bPnTSqCX;p!f||{!bml*vI>tH z&eyX}(6+)M&3@3|Qt$+QoHF)hnT?r@N`)z|*EYiwmX@FXbUuigrpS#)xZ z?hKHz!og{{lhT zV5-%*jO&|Ewx|}!ue1;!(NIgbPs>%Dwmqz%$Jju_l$ea97@-xLDDYH2J>7&@Zt|Z3 zTZhg&D5qSoT8s$TJKRj$NCy#3Uz?Kg9X7O|vY08=7k3WA-&Io!MdUS~Gz~7WoGv#z zGoAKz8Deq|XSnXDo6olJ-Hr+M2q9*eoY_!j+GtN+0&TFr7~~5DU0-L^SAq=`wP&-h zXsXg+W2wZzh0p1+fd-)GeNbcSQeB$2d8voL^$y1H_3Ja?&LVRR?9Ww4RvcSjcj#aj zacBs|P=4mTVK{L7K)1_fmi$#{-bqAiZsv2N8k^DxsE_cxh-W)FU(XE2?Y)X&C?)o{ zkosEb+MK0Jxf$`AvD)+a;O^>;mtWaOEJc8 z%tlU7E7eeL_NXe;b*g>mHGGXl-;r+4@4RZ=yaajp`goBno>H07WVZYi<$*g@FvcaH<^ma`nhR3IgvTnD zKMVDXvqA=DB7helzG44P;!H$20L7m$jAzfTWh*^t&(Yt2Lq#;1TS|N-{4yQA1W(pA z&(vK{Bd=4zF2O)1&c8I$2^3OMzg0{+3mF;vJC4JjKpa(2lCwE=MsVaYN0(S}uVJT6 zM12BwAjeyTcf+H6a)ONAiBL?u!v_P8_-W$^R@j(hIFQ$c)M zQ%VX6Yj(M+j{7j6Qq(oG&C~FFgT%_x`|{YCyovI1%lT}Lu>6>yuzA~6xl{v9G5?EO zoVt@>*NTF{zAatOR6CzRfcWR+>NZFCQ{=w1z$jrX7)VYZ0^F>2EE)L{(h(KHK5NA% zvXCeT^t-sR;)GlRfVyW+ot*06%=~{Fofv`8Pk^paL2PXr&&8seU;tYVvV$9G33=c} zR1|W#e#~y;;Y^t$7o;4b+$elKY}1?dH`ilANJUXs-o}e=9bFHB2-t=log#LAWu))q z@~0N~Fcr-nBnzLbwg+0!XYm=(nX@ixUhYe+l|z(=+_8xHGqygFA1c z7N7M`RADxlKQKh%yJ&bqFTVFs#!h~wSIJ|$dM zkg;#rpwyw(@sPFg#RqD+h}aofI2)BRXAJ@`Bt`F~^%U5Q=O5k1S(ht?s%qA(9?SG# z&_U_Jahw^}KR?2^oWWp_r-_P6CLgk-0hSw#SGiB=OND|YNhrkN1i(i9JyvcIgp>w}j zwfuSl7AYEx8AWyID>Ny7ONu)Qo`?9&hyGDZ5~a8LHWKG9V6h5BqgfNh_kvT-5r)!@ z!A<}2yjX6fXDm+M!o@gYEja^g!43hFMEFrHaC&KHB$>whnE{9n_FPlhEaSji*i?O~ zFP$T8o)63Z0BRYXIt%q;%uNcTW0$}Hb?c*fw#XGVGov?^-ZUka>UA-WIk=3~j^SY^U6QyYBKlp}ocy&wDI@~?A) zyJGwLkvROUaM;JJ5IN#`r=!I4)%7QiIP8zQp!XjRis_C#m*7rYA0k>K5zG-h(dr|Co|S@I*f8)PWkFwxh^317a_38)KyVYuugvhT0CL52F=kfKh0 zdAgkLCuxC5JR7Wp)Fj?#KfLBEyh`8GIh`&LS}xR79`cubv=RDdql=MKaSk@Alqf1C z0brIoQ~ux-MXcdt14EVhE~0xaLtOcE1v?-qkRu@BB4yHat8a8`#r-t;wEaP)C+u!` zsuCELx;s1meTbG@JF2|5Dgt+LFkv{=XuR_dykWpk>Qdz*Egr6Mds%&1sZI6Ot#Z8- z?K0}QDy*{WwqvW@m>lJ;KGffwU0uRln*-0m$7t(bciR{^c1$iVgpecnTrOu>nzfnU z_Z{@Y&qawqxBj-g0?6_@BdJ8_o>tdO(t2}F_iHWp?S@a^MUxG;RJx$k{lBnV9vIHo zJ4gQ7O;Mr*`+CdWE*|CYw(2_XRWfiUS8l9yKW$07cxkDwVDmjAMWQ!Iy-rT!4|^Vw z6`{=GPb- z;BhMv2zQKmfroLJ__o$QLbl=?D8#B%JT9xW*6?ub`pof4P=)iP=U*CXw-b%eU z0=GmanZ>;h9N!rLcVK2bougcwuyZ>d(O){wJa=~+E4O_)Dz-q=;Rn5eD~x8scoH0( zdjVb~=Rp+=vUh6IrM~UYDY}+sQ}j*;HiqdcXc7i^(WqGMz94_{w{{ zTZE4;-!)&*SS%1W>td|FtNVK)*!jN~7fCYc3Pi9xrTm}^quv zBb&w^pM&N9#^0F5VoF$+Lq*X2sFG}}e$~qvmD+}}B_e@NC)-yE)paXcEF3D-D^AOy(*Tdq5lz#pbvpzx86A=c zj>ad~AXtnJl=jEJCz?d>cyVTb17goNIhw~X;(T$|m^2;^J2O%iKXvao=)J@>u*?=5 zPoUA{4jtl+sQ)~_aNH*1li#-s+Vc1NCcA36Z87f z%+}?1ipf;sFT8n{x*`iap-wb>GALAOP0?y{keDd}5+BZ#q5`yKsi;)TN~WgJde-)< z+-I%kn=FfQQ?^TysKHxQDy^>=RJ6@b$8j_V44bBn_PdNhYj<`m2@4F`GWcyH0wY;i z)8^va1MvV>R#~1OtOF~p4>7^wZ3~U)+qqKljI-p-nguw#c4}P!wmF~(ML3!Fvxh>x zmG&@Nyc{AfF94g(>WZ>R-O})9t1f8!?gZyhU0WF`6VAnZ{BNkGH4W5;JpGB<4DN?N zoX+3OMjY1%9?4#6`AjYKk8R<9awCWWQxmW`#T}J@Pr31b0aJY+)-Zy*{-8|$U4{=o z5kCV(RN1>;!9TVp|898*SunTqMTY<}^6zW#I^me_r}`YV!X#z#kUyqdo2ic6mE# zZv>v~h5gwN-uW6+za{(8<$c*a@#s#4Dnpq5L^kWDn|L7ZQOJ_fN7`_;G@v$Mk+v+_ z5h0buGR1-i{dZF`^aA$};|t3c{IB*W7({_aK#2b)^0jY}u9bYV=Q*S7GEA*XZKhP4 z7!G4ZZq{p}`aCKs>dJz*yRNIVQ-Ruq@HfNYpCOE*Ig}1y`UhRs2Mf94dBgJy8s8et zl)Jw=CZ&Fmd#dLdWwiU}o9i;AE*%=EvY9 z*j19>8Ok7mx^DhRtJx%s=YI5Q)J&mSg=Q18&V1Kt67Rr(db(IuMq&2y)xsO8$4AgC zen$7w?~_TNKV(^miNd%(2|)Fv#qMB>fx~^rA;ka=5iusM(Qa^CDiP4!wA|a<-M>AU zIN6d}V@59)frEmNPp4X@btfjXv3Lc3u0J;vgG6@s$do)ZG(3K9kG!jwGBV<84Ed97 zO81ziIv8Ys>*;EcqGE3w(Y%(?s>oOZ+^B8Lnk8K^Z*R2QjV_={Bq1dg z{lN~HqRa@4(7{2FIQf2u^ld^fYRN=TsS;Q5+CJa)qXG`H>?hx zmYGh$YjQl&iuY(~Zk5sCK(MA&^gZZ6BC%{)2J-@6;0J$0n$cXDQen*F(~S<}=P~48 zOal!--H}=khR~^7Dz0Mia$Dwu)j$G;0Y1|3i5dR!#uBIFL0>*4b;oyD^qd#k=>iRz zJn4)rR`e@Rp_galp;C?7Xf?X_X4~gq2!0pRN^hR!t>)sBnx{rFQykGrY8^Xxo0}qlmTc~PX^4Jxc zxV+DvXfwxe^g6SgaQ-oTA8xU*tzNL0l?>nfB!EeO#HY|^$FjftLTWmjYyCs(8~xK} zyIpNc42|Zuh}qUt-R+>FURUzZlWVl(=%sVXZTJ=J&e}0M7RUMY;<^@qt z=e-%D@SXz2^YNaZtiCBsr^L*jzdF4MQB`Ls-F1)eS~G=#>@=T=>&4Ar1n)}Y7%4Z@ z1X29Y9!{Ed+-^>&7V9jTOs2sd19S(WRX^>dmM^x?wmqG=!yuKD(6!yhQ232q4pqw) zV@!R-q+b)&9OJX!37hY&q)^N!4Ffn@BS#U!iwRT5kMh1OK|dx_Ch{L_79{%wA(wH2@zrc-q&v0&B$|V`D0V1*6Rhh4` z$~})Lly3~2GN00F0^tHsdmi`1sM?D8sW~d>6cT9DOj|fNrs1{*wtrfid)7y_vB08J z5|wgYMSTxK>}zDc&f>7Y&q=lio!wXI4a3%lC>8IcP_UNk(1?6RXEVAqmS)bNM{bae zFC?fvV2$w&_&N|KVE|fmnB6C&bYn4F5lx^;Ih@I8QfNHY@oP1<50o-k;2ui=CVMNZi!*riam`F6+Qy%vHMkNP`tS@@l z%~P+=y8z?wNlj;Q$1C3x^(+z3eiy6}OrrK7Gr(lfh>9=NYVQoE8477u>sP`I`i_0d z;wR)N)fWeYK{-avWeNp03eaFMC7@kN8tT@Sg&rSJ06Ej4Erw}nKP zOghUY6H5u6-bF<1dq+l7PMZ%VPm*n|dCjslu$awaxX^9)B}>WT@fEqUB8smQkr)o> zv`Z3tR_v`nbnYAxu@Ms*_n}F`zg9pgPx$63gjNp#s>9vX}SU?_EW}4ehWw%|S@hEi3RG9&26<-{1_{J_Nuo^Eh*p+GP_MAAcC5ExV?k?tN zwVA8?94s;Edj*>DWiefm#iG0svCr?%SU%b8@W3{Ay_1~Q%8W$qHN2kU3m;2Dzhrr{ zCKZTcvyCMAA$sgCTPVozY%N>#*7hrH`%^+g=VE^>*;}9pG?O12(ouehc!Wt(M29R9qheF+MZ`TiCEIfzPEsFsNLhpI51O%y{Xwbp|ot;1r(E76A z>Aytr=%$)d;b=0axFUU#HHD$)XVddsZwtYPQjI$K)_^kcOV;$`OJuJ=+YA-Cc+1q; z!W;Sb`<`9Hl%E09uj{SsLXcSEQjK(@xa5Fnq$-+0Ep0+yd_V3m6CV}yjTL$7PiUGn zmLKEIB1AK8Qw}i5M8FZk2 z-`$2GB}vN{bGaw@cuLKcu=j!rjj-{@6^!O-G>Z<=%Uo=54H#6PBsBm_)~?L(<%*-v zI~l8mM#xzNq@2Sb%+JIflwYh?t42I}I3147S3V(SSe)5~Ml|U!^gbi!`6BW(MJs9-hAR)Yhi-IL&4gphm4R% zzx-?O=etDG+-JeRv@oEl7YS9FChdCQoB5oO5k@37}Uw zZPvaNLJ8!GhGW^ic-{;&)tVp4)7FbBEZ9Qt-=@c<2}s-R@YzLR8ug_cKWR0hCe zC$2r*$Q|_C2A_Z)2B1tlp_kSz8OK_h!S2K^aahKur5%#Lp6y>z)b8~H#K+S1u5mhM z8gt>N*51326?{{j7sgiHU!sYd&5?wcP<3z)))~5tGFvQ&UKb>WlN7OYmCRN&o;%$? z<(dMyojZgBs_ch#HyjpM8 zpT?>(J(gq}C3?)}vt5$gLAu`*Loz+d7VyR4KkM|#dN)expV@)jGh6uJsL&+c4FF;# zPH(>15LX8EX;d0!6zWt*NWssw%|E5C7Y$$|J#r{F@MnAklt(0;J`dYVOV?2AFwO>R zp8ep=27Y?RYB4?2MG}CWeHU2CY&kE``dw1Ie_}gU>vSYV3JPd}Jwu(SPa=gWmwQ)D znre@95~~`0YDj!rcKj6=8>L@$69AKI#ywf7Svh^`mX? z#RS9K2#jEHm8aHdmZ>)d`77S>;b;2=2}h)5%R~KT6&TREXA6|-c`aY{nqzo+7k4}R z`(24zHZL%!x6sjN6k2zRW=b|md94&qIiV9Ph$syc7+Xn-uxani~Ghr0|Yl-9A*Ii+>ifO2k@6Fr2ni z&CL68zG2DT@b2u)kGZ7?V8icCw(B#>?a$fgd5_zG@_prao_ zx}7qe+`ik*Wa`bA$t=ruBR=9pqf(Mzr!LV%1EN&%cdNaQC=)Y~oV(DV}$uh&6iT#Hcp2+_VPL^{7f{>=7q9TprTA{=c zvjhJ)AQawCUF*2%x`NK_9OQ;QA z54?H)w^xGYXMQ-s$i_H2x~ZHLt!eUfRM6)1F6TdBKag8+lb!v5xBY3>?qx9RC-(_N zer}w~R>E35hxQ4HPA%T7b~^O1!fWve<+#LtP4BH-Y7;^#<|#F_&0>8MoNPg}a_bl5 zlPOk0;Ze@jS@(0u_wV&g5{}2^#XdszY~&7*Hm)!!ljA%Ls^%d={+u4f!0afKDu+nP zX({Ib3XWbHwcXc^L@KS1GrH7t*gS!Sn8DLNkPy(>AWP6-mkXKhx5IwZiExd*xN`(66&pIP8b6&|R(?E8D{y01Be^8w348%zD`jLbJqE8bHIqfOulJU!^psof3fEP}PBUWngh zKqKj#5~KcOTw6{Wb<~|(yeUkJ+C%jV*Q`3w5;|UY0sUS6X`*5g4V~hp_8zTr88Jy} zk6=SZgBI7lok_J$N|QKL&T+fjPL$3dHeW)(VvgDwPAyLS9K7^>X?;C_TfWc7`02q2 zJ z>#L@H^@28C%Fgy#=OptUQe9QSR!Jhf-mJyf2}EWY)Mpl;A8KN&JU(2pg>{?pG^C-3 zxNJ=ZJHGaUEMo7EHtsIvT}8`ReK&=iK-l43UWxNz(xkuy{>*?urtV)2d>EQ;cKf3?+*Dg&*0eUyD|;yAw1eeM4Y z*1Wr(2_)7ZOhC`tmV98dod6I+uHP^~0;u}yJ-=mQ->lr|+)2JAsJZMyT21!mDp|$6 zZC$Nj1pzfLSakezd44HkM`cddnj8B&=H~v4luBXw4_Gi;D$s$G5GIwAipzKH}%{L!X1B&jRbQA54 zxVY7FWHC$HafKTS;cP4&m+fQ4xq_V=D6Vj=$#}$GDpBUDkN?7Di-gN{BS``nG3s{r zwQQ7TgdxK%B@?#)qS0kA<%8+X6eScEo0Y~?--^5 z&Pzh5mD}CpEIVi`2;ZBTP(=k3GMPrRPJB=$#r(MC@P;Fy%6mIr^|*o!kk#|#FT4!a zb|)-aH7|2&^FCcMska!0Jj+Ty#=O2^>TDn=P{ZS7hiFV5t1}w0FEPkC?RyJ4BaVdq zNt@)TlgZ^QYlUfR{&htp=@cwX-eT3MspL}V%HVRoNEXMrJga$lc5i>bP0yFalF`@4 zGg0h}|F9a^{*pnCv^U_8(Lca&vS`&Vv@?{vIbS1u*iM%KYS+uUbB2E4d%E&F|5Ejf z*8I;}7sUZ%7;J(vrpr?3qXIYM8 zY@|+xUDOxyx&w_<@tp9S@#P0ZR*uh6h96g$#epsMn)>3g%Bva_@Klpv9(bLD0`vJf zh#vA&>8HzTJ8@J>Hj5ci)eg$Mr5IRY70uMy@-f5NZDsi)+6QKw!AvOJ!=l}) zwZ)+#N44z1)DG--8w8yw3~Xl>W!wa^KiyzuKpXOuE#vIGu1uhpB&06oj@QnOLTKq3Jr~7lhx5NbCsWp*pe~ z3{>WXntg)xf$CiAc;gnM`Srz_?X;b1gEDrE$=8}0!q zGrR&gyo{)f-8(Lw(aVO+Ysd`u=eHelW=EC18OV`bSA<$iEw3d%S?!G#p~rK43)ynIfZ9Q8Kb0y0gh>Ua)Y_AR?#*)85I-Knc4 zcFCPAH8N8;YJ=qn0)W1w$el>-r`CaHt zaERQ8JPKI*I;F)Sg)z)ptW>){)&(skp44J6_)h!8GltMjvNd*RIO#Jtu{@Nkjw}w} zH<-}gWIOBCk`&($I#>Iw9ToQ&C?@4vO+NtK8RbuSvq5h8V^vCt(!E8-tyUk6V?+$l zDCF#CdXos_wrA4NaGO9Z#eM>h8jRk7yQaqYNH@sQ6(yW1%dm>0u+*!F*(4mPJRqb? z0_|oX>i)Ol@a>s%nlX~?XgW%cE=nNup`WEj{e*d~Fe5N@Sil4~*z#j@@elPF7haVm z!C-Y0?f39NIq%4)PXP&o#&5ZU>5vh~A|B@B)Q_Udp+ZWcxpD7YXG*`)BhXI9KNIW- zJesf6RhP-uEklQ%HTbd(xyc;iU|^H=E)bF?1izVl z93VKdoH5+krc#Oa@)H#=y$?6q_f;3IuvpUS=I!P2xzE@+_23!Z^wNFL-8-|Iz*i7DP4JqObVlET9NtAa7rGDFUH;1jt10F(47E8-H% z{VF4{mfu8krhy0ig=_T(g~F0EU}Xxlfd0XbKi1aY^FI=XB%)F)MN zha~loOCn4^D^O^Qz)7u?>(o;BQ!1XtG-kP)C>VTXiV4qG$vUe?f+k-J7c|Kf*h-q7-JCSNxixtPbf_o-_ZIv0H8vDP`1N%tJ5_EMgrKLsb^b9a; za-S?+E1#4co?gR(8pw;vuFqz^bUeJtAT?K|k(dxR3ji=j;Tbp~!gp#Ie~6)n((!%A zT^GYd$$L1&SRLZ(e;A;H!}GzmBHg8v=-`UjyVD*)&2)+tto)B zEFIl9a~`ql%sR-m?HFQ{lMf;}HOCA#no>yR9Y4}(#D4du|8ZV;O=3-lg49)T?XMG< zzti9U41e*4WTb|u_wLgB$8phr>nHvl03QbUC8Q`v?ESy9|Emy)Ux!q`Xd@&3j&Zsd8X$6upmnsV9M03=swn z&YmkUeQiy*KbWJdEZWEx&7C-d$kCfiZ^JM&W%e#HRS|zG%gF2<>8mO3Yo{P|J4Z{xB#Fy)i-tYw;n=jZ26?#mAd zF-0r~eKRuV#|EagpR#lbDOA4Iq;YsMmZn_IkBluo7u&Z1dLwWy)Ne9X3Y2Q|ehQ08 zC{3YFDitzr1C-u2OJUHZJjLV=N}gg{#k4lp{UXDkO`W+je}lyS)m6{Rkc>l2rrj~F zRodxRYJq@bPiVjqVRNQj+@Za4*=7Oxm!(R7JONZn3{&5+zKXLL#H-K);K_ z=cbk?heKRhS-F#Dhej!t9ypw16TQ)6ZZ`b2yUKK#QZZp-a3yVj@rZH~Ps(gzR78B{85UDo0iJ);h-cn<+8kc=2vhKVJT)Efb@O~~i ze>Ip)RWJQ)U&Dbq4Hk01c>7>Jp5?!RF!;ZZW{_}cmnyh8fecGD2 zR(?AujRwWQNb>V;)WmG%hZ9j~co;-5WLy*>jvkD`V$K#fnJ?Q{H+%@WBGqc$pk5WwbVXl- zvWVTN-JNzMD*kysFO>HYeE4ON)%3F}h3R-+wK+T`ZO!R|YHyqrYeBI6d8ex>7zjUk z7*R9~$e12u&`e;{@k0A}QKS~V7jGEPu}T>6gI3!vKugbky6P=T{%h6Z>*b2W$%}0& zf?8$|#Pu)cD%1+L)S_$Q2H`v;Dp1!a2}}dXgpRt+%H8pbWD&`S5Df3$ol^J*C>H`3 z@uarRY9Si~3068nVV}gzKVmj)Xk0Z|Rlu?~%6N{N>#@aDKx7xl`sG!b+&GmBDzrVm z%@Jv)CH?vSM$AGw>|BXTts(ea<#61(Vv9;%Ug*_q-&NXmCJNW98@%R(NzNsI+v^@*Y9O6m-C<8rR;gCopF@ z?DQV3LNbolq%N9m*WYbI`o%p=SWK+gWDo_@>ER6}*3`tK2$f9w7BI>L>b0~onkI4^ zRIz$53AN>F%gS-h#5Se*#=bm)5#02hGJ2SKJ1pmj7Ed2Ztw+C>X_+8Ki9O$4vP-(CXi0L+T7QidNFi3NNYv#GXbLQ21;XuWNm6=4i+t?*);O6a za?SdadTwbSH7s$qr*<&ceN`Yvr&p`Y0}U1ZHqouP;|)Bk?p(S;y`DYV#Y_r^fYw5_ zdnyc-Fo*C!tXpfzoyN_(0cxoTGC?LPrNXkCZP`sr|9h_gL)TY^Rn>fN3xX2T(%s$N z-Q5j>bV@f!NlAAj-QB6u-QC^Y{ce5KC*I%xy3U7T4rlL~H8X2g-mA_krqturoJ}xt z(FBvv_jLh5lWA^F%b2RIxHHPMD6vGzt+ z2hU8z5LD!SjU|qs+O?Ds1-=Fs)**0dy}Q3A8SJfg3!r3z+U%ax%yHi|n_h<{%_`Wf{}ir&OBgEn9|k+J zox_#q6f|lE`*`2xG(-%U%MkQOlN7}DtNkr2Mcvp@RU zx=7;QOL2YKYJP7NU6+^pi50&ZMo(|)j9Qo~fta(_if+&aGrcMud~X&s95s-mbznA* zm|_*nOWmcmO_uw6U%`%YzL-4Z)CZQ&4N9|6U6SOQ0ypzKmt)?jNCO(=gJ!Q&1eHfB z2H1J_)i(EPKJWO^Rhg|`S`6bCEx3y6l=OOij(UYrYhp`Upo-C)Me^|En~2*SxNzj_ z=LQ-y@IDi%tZp)m_ju@(!$kwfz~yYKD!CUYu6==Z3WP`{08Lf1lhxVz8)M%ty3yo1 z=l>7`4ZuOCrKHZFb$qTzcgIPkE`f-e-sZ&U0T!X?LgxJ)h4a^sW_?wN-!t({9H6Nh_?F@0$^jk#hAA7%-8j*l*J;*DnkToaezYLEgW8MPx8k%&(kh;H8T%-d0SRn)EqwLv!m2y5EO-vC9$h z-Uu|0hn=#?`@--at}=L7BVswHv;eR}@W~L<#!{cxf@&Dw7wB5Ek}fcAYYDbwr{%u& z=VIYI_b6_>jao5`Lvh?)6K>CH4Az}zRz(%6zN0{6FL4Ms+G_lU3AxAuco5CZzu!J2 zP45ouDh?Gcko*z5|1`X%WbxV&KjeLS3kHoQ=<)FP+lOz&+j%?fuFx}WKnz(& zd0*kZAT3tPvlHiLIAaNy5POZ6ua1KC)}n)cV^Bb+^t*6KGJ)TD&Ed@WhP^(6RS3$m z_*YKv@^U)z{I>8@MLz!-ue-z_nt`jr7UR-q|B!mmVV7g}_hI@VF9)cJ@K3$EF8XxD z@J=93s^Fcc{Rn?ymUtK8M|{zbBCch_?P!6)Si*xKEW**zb=6^20{2c~aNEPR6;Smk z(k=_K-{t1BHJ=&vQID1?B`$&~@;K=3>~4VN#JMYRbr#Ju@uU0lD8pUK+Urun011v#z#CS2g#__FaiIr>5BejHWN!^ccG!-gj)m9%) zj6<-9@pzow&?}s=SBD9kCfg~?3GAr(l9Uwd-+NpSS$^V2M)r$P!=h|ERHP-@ zh!ucXct}LLyxWe2UA&V3w0&uuLgI7dne8%-#;<`N)hCPCQR4tv7nj&DXovW92sI8?t8#QKG`xbv!o;JU0)dF1IDJ z*(!&3XIuBW;-g@Z)BWV=w)qONW=2;2rDq{NZ_o`;4zfiC=k7X#D6REu$ItU*Y`2a4 z*U`DXJW(pYYqzui)^kfmm9tH3^5PIqq)tLrt`77_0%SDapistj7NSONuKHQGr?T6P zWrmwiifB}wrM#XC*dFeLM&$|_v%rOHqt#+F@1PkLL6~zC2IrT|KBJN?@*tXmh3+S3 zBn@W-B|?lQJb-aYEhakKffir0GpSz|zAVm+d;ysq_7(e@iwK74;U*eR2lc^p zdUr%!^+Pd{S12Ym((}V&*(46y=f`nPz_o_*yq=C)Jo4+twV8DzmpeY)>8DKMosL{;=Ke7a{F~*_hyqd z7wt)xe=NDC&ZlLYbcB(U>wO)~`P!B61FWoau47DzQn)4m=?PdV2!N{N!T3C~#MeMcmhl*CU z(*xR^Rt1c@vQ`eK{j32E(}W9>-I<#BUB_=J=vL=I;!ev&t5w7&EmT#wIl;60d~3tS zBq8gSjjpSK{^Nucx1Of!Q`EMeC}BIpiE!NpY3c?J^1}94@1h^Lm^o{>Xty`t}&O;Jxg188kbb%30TZ zyA*%+#7S%Fe9L0@jLYk&bX<3)AW}A;bsYx3txv$V>y_?Kiu8P=-FUTQj)u+aD#YV@ zjSQpf`}TwDhDDBu0iMs{W24eT6Clg1WJG95e99Z!_hVa>J4ZVjiA z81^eiZ0mT)Rt6Zx4`NPXRDcLvPxN{fI@1k1BX6lxbZS^unp8yHjV#KxTb%c$zxNvL zcpSA2;DI3If(4?Vas|Faqewwaa>-K9SJ%O@n$N0?s4m`x4puZ{^g$07zJzqy`2e5U zGuC--@GWH*As7hZMOSTOoEc;3 zbTVY--=&)1bM_36x(nLG<+s>j7sV`9RfXk4~-8-0d;MTU}F{ZamQ z*=Cm?8g{3eQnhF1$uBp}7h3NqGF-ALR0~SkZ#eo5ke>*gj_A&9z+j6%$n=VUV z4_?`~#_5HG6 zVQ}1i%^C*07U#SM$!zIUjiL8B4)a4>Sk2WYi~KT0^&xJD1>4IpjW9_)GBA+= z5lT%uFI~2BoTQfPpKhcU?B}^LU_FIu_w{kp9Is!>icMmyGDrw(Ly4!^*USF${&`E{ zX|BMA5)yiUC3sOr=!yeA#k^`#$pgam@q6D+`vugX@Kk}h^*Z+H(>!g`I_8Dm)01d= z>|D*Ip3A1f`3qgOb42Mo^Uve~Xsf0@hSz;n;TUk?mYOU{0f&9c<~?(hlzk-kUDJD5fQl@9_W?p!5Lwawde5YjT0%SKB$s(nmmb|``48`E;`d)2Cwc7)4JAJn9C z4uDd{%}+~WrppZh!HHR10qYLDK+X(Kt8x7_!#+8)UiNuTukI16r=)wq}N;xvHl$LQRGjMst*$%c>2L^Z9RGMp$bwIiI_m#MWf0J?Js*c6r}v~vnbTmjBM0$H{-B5ocWG$ z=)cazvg$YsU@%$XTORKa#M)0v`@sXiC|_y1Kh3Mfh_Cxquu%>FrNIRqmbj4_%#3Pwhw9e{DoewR4wYuL3A~+cAcVgjFqSmUGRP$kRzaLvK zvnY<5ULO$VRuLQK9ki#*)K_OitM@0QTlPy;!*feO;W+-7>iM>QWOLeS(}u67o%&3IPT9g@En5r`qsx{6KLS3>L=B zk1sv#Cv_n=8Bo`5xWs`@$FQx4D;>r@oBM8I6i2E z(M@~WrbWRoM2NorqR_3}JX7NHf{E2HhJBDd4y{`)#lih@^SEAdkCJAH+n$nz#DR`HIM>fmhB%!#fg#Vy2E#5|_kBd$orM$e+ zDU{;Q?b?{gV%T@a-gx$7Y~#li3>1iViF|qaQnz9K-DZ-ZtKn4cqBKiVX*D7hTp>5b zXB=zWc>HvQEE4KaRuo&0&7R#x)YMy2T5ZS87j{c^OSU$EwWRzLo#@65hx5C1JG8&m zONb9Yl2ac*|H?!@u_pdVm%3WFY>s0TDTR3(`VL~3A5;$w=RvdXn1Hjc2~jrLSM}ER zX2jDjx9w0@g*JvTX`|jWq_(U7eKm6q_B<D>bg!Pv9T&c6{RqGn5p!xjU)a81M(x9Ii#-q%Ov+^-Zl!VUizM7{aHUhArP z)60bU{Pervg&;vFh9|Qm1vYr(9WhvRc!7b6Aq@8VPEKW(3MImm6_fa%&=awgsuz`V zT@4g5n9Nv`lnwEA`ob4Y)V5LSxAv0zerSrtxXMCMBZ)`sf(VDDbnl;@iK9vZa*Vch zT!uH~8`Y!rSk2}nkT9&p&ORPuY-0>kPAG}&>{*LBKa51vq74@^CmEBmkPO+YR_H4u zH&FBfii*MauJ04)Pz|XH?_2LA2J02a%ali+ z0Zh+I{t~g5It6*(#pH|B>zsx;R2lOU6`$h-=6Gyn2UFQ6tB=`RbCbXxU0Pb{%pJZ# zv>d_5e^_4kY?VLWtY!*Kj-T}1+0s0wPcQm}k@*R1r3cz!^Ne^rcKg8w9zSK)&M(nj zte;>j(X~IGib+T4#NC$-JY)i%tD4uMV{uGSaKG`gS;ng2v8`(z0#sAtYP>EzdGh7* z_=B+uqRmA2<6T_oC)CW|9@D>|5ApMUX^m0m`z&PYANqo}DpWShMWahLna zJi}I!_}YW$Yh7kg7y*NFSM(@LuiM@xTM5-TAN=&NriSD0?(PDzSTvDM9n}ui`?O0! z`%bnQc5RQrGcti8^qJhtqCrlbl@hR!@uwDa6?e>nCDsPpt+@GPml>k|u!R;uo`>cB zrNVtSUDOTF?-V9*JXg)?n+HY1OXG66WXLrrrlm>PM&KpJx-Qd1kk6<4veKL$rMMe* zRB70`6Y*s>_erd!q7t9ng{q9D7{rrsJ?;zvUxlw!`dNHxF?&wMm&M+s6AqDC-m{4i z2K$>-ou;$mb#s{|4E2)UtVm9%+L?;EJoNNWylWhbF3VYa^l`GS3T2ItZr2HoVie(E zi}lAgyw?u%uPEo{eFSy}HlVz+T)DKXYQ4Nr2z@sMvbg-^R#^H_JNryR3; zVfl(CGp93CY8S1PNcHslja0YqMZWfZcelm}mngJ&(uGO4fzn{V8Rgo^ZRST{J-vL6 z_ML8fFv;x5W#c=AYHKCJmXBa_$3vpd?VrqjcnC0`3r*eYw(6I9N?0#{=>ge%FTN|v zXqRH$YLB&#H9f|3eHNPSsd|b3H9pa1j{?YXBi{Tt*|>6ONdKMTl+JlTD>P>Ubxso4 z)$?t=x7lCZ^AK$jUDA%tEz&L@7q0>Q)hc7v;Uu3u;_KiPUaz6zw>z^uT>&G4MDMSS zT$moHB|6ERS90PvC+@*Ml{W)^qj0waACmq&K+pfn&S2mH@YTvE=B+n>(p$%Z_@;3l z4OT`Fy4LrBkp0>8V1tugCL$KezeCV=e_#(Ap#gxzLq?Lrsqgrw=id$W0D!#3 zcGT=h|9gI7PQduau<1GfOPIgN;9dMf44rC-OM(2oqW_p2K!a>fV0^n_3E2M!d42#A zjN~F>y(Qwm%c3Yg&7|KAxxyaS!ql7f;4Aty^1 zbp&w_|L{W}Hx+u}KEZwt4atcgQ%2Yj|Id0%M}1|sffSG-f)bxTtE{pHY>ej8FZ4c?F8jVYZkd|) zdHjzzCOeF;D@6Qm;cfA9-~6qR0;|r{54*cJmEeoE*QfV#iWL7JstEu*-1C7x2uD0| zYiWfKINJ;#KW=`B0nx62{_otykU-HXND>X^A71fD(_mo&fDph|*78C0VmC^q?ECj_ z=9?mku+fj=A+?#TE%sovar`l1*{=_t*=hEdFI-6eL!nOyJ>`=N0zM2fb$xWM2Z28h z_E^LVPuZ@n?i{@k^&;|(c&Pp~!OHC(d_WY7kFc24V$Z9bVq(Yq$1uIU*uCrP*@8lY zA`=qGf*Re`ONF#iu%LF9w4(`|S?=D)4>l-_dw(Yo;9>897B@pX*)72;b2Idy^+ zP#d^~eFwa?hxz;8X@e07M|^unaEpb7j3gaI9$Ju3mktGW)}vRaI!&j%CpyhmV;bs( zIBh2Y-vW{*uH2|-@&*)d1P`JD1fA9pCb8u?cJ8m0>T&u>8B^D#kxzO8?IXO1OMyha*p-TNn* zu>|=R?6TgkO+1%k*&%@cy~00N8w4`YDat*p^zZ{~pg4&2YpB0oWERb5VZnvGv57zH zXerRG_Rn7-$nr(m_HUcqa%m^OqAy@EeNXjs^xp3wb}n5n+sIXxVnJX1V=DnKg2w^5 z#iCvkKWk{L9Z=JJIoZWl%kru+2fZh)kkI(E42&t6eKdKy^j3=u!?EL37Zcs9zetS+ zmN|d|Y}S?7x33tL{yE_nAfX?fNqe_VZ?&`yN>W2D!l3EJfxVU{V%y~cMg)`JEScC` ze0X87!ckF#4Ik?cvWoVDhIoPv?xm&F^aWS$8D=|a zZ!a0-kN6b%@O!<)5Mr}StG)lC=>#08NLC`2quXP`8zYc^O%*|mk4LtDdvC5X5G7jZ zEya!zL~?Akcg9;57N#F-?2Uo{j;_+U07+jV^s8{*KL-Hg^U*ymZg{fBu!dEExlGKz zR#`x7EEnG=YBj%T4By%cDPZDuN3Btx72z2YU`Kzj5klUG z+b}Qxv6X;f=3{}}a)p8|;Fm{Zi7PYjW>tzeR1LF6Gk#IZMvy0=SQL&ckzp`WDjs?3 z#G>#`{FT{-gUwe%wy4V(?gc6G@euK0@s1L07$xVZNDOHh+Oohv716TKP;4R(){en* z>Ze*SnTK$UNcwe9h06*XS-qpI>(|9`$5ai$bMif?a*LhH-C#*?Wr!*r=_%xi3|~?D z;0F?{4oo+93x8_vgJ!ic$2I^mVe;uWl)oWmD2YNFql4^Y*lNFh4oJQD)?EFdF*~=X z?EF5f44>ro%Qy1B+14NaHNocH0|*xGYyARzF$O_d!+^8ED)kJ{5M?vgRByeNf|3Ls zYQcbO4Z-9yx=^mKRbTUj)RoZzvz?kO`*wNVphYq((_mkka2ObO=cCp65Pu((EM0`3 ztMIYDjhTO{JqQzyXmD6CX9ejbP58&P4NoXH^xi2gSyvSQOeeP9${_!e7nX)}9xA(9 zExz$sZ?BjOcsei(>yfX!SB-2au?*%^38utpsJfMP`uu( zs*CrV6t1{Iu1W$YFd|YhYF+TUa7-(Mu(6ymb%-NWBp>-VDk*gPtr2#Fu((=Zw}KSPLDiOOWg-m_p45<&KUxGM~7 z-lEQ-HINQ4&>>i6RcIT_ z$he0zc$Kad6s0ZYlxLqz-TVlhgrUNOSU)n2S{?LM z_3(j36Y~mQpP$^{?#=C|aq$H0w{8z$l?#m0DHct|aQ;>qEjk!A35CAu*>D#uRb$LSxr>Kq3XRHWG`f+YsH24nef>IkM6yKvoUyN^I z4#J$jP9RV3BpT%GZKFj9@fqwMu&cC7%OT^1D|mm$2l7AXSOd(Fo*W)L z!=3zGx?KWBC(+1)yza;iZ{C>SaxR#e!X^Wzo7k*^Bp3z?uT&xyPHnL}evg-2v@8xG zk{cNUG%F1(Cgt!!!K<;^zAeMx)fB@>xG%L(!kv&$ z?FXpvOmpwZ=VKcU=5#g4aD?;`)3(LNa2a*ab*^;Q%Gp&d-s#cJxGUw|{F?{=Vybe+ zU<3+M4CUA1Cd<|$B$RMcNVkL8nGXb0mec7spTUR zErE7Hm_jY5Zb`?rTG8eO`tlKbTsiIO0Hl$vwr-LmxmpdwrqNQ3G+4?zlBQ9YL1T$1 zLUF0%BIVOdK9^K`9=oyFVo6&}@T9WRY~B*D;~C=D-?r9u;kN(D>;JTCBs1Jm6XsGS zd$JN4+$UhuRlE*0B(rjPWuQf6a;8y2%jCqOa=+c3?Xuk9L(>rufFnj-bf&R$AW0&i z+ErS3*;U3z8o>^E6B+fuHuIFE1x0&?B#<-&GDSCwG;E8Q=1pE%kqrKxZ@iRV%i zM7GU(Ol_MS6ujHOlJMTz*EZK-FHC%X!S?zeNBGaV&bI?a*iFp#7X#0%v*1D1W%7Zf-fhUh831#c2DR2e7e2%PoFgiuj&^p@J{6Oa+plvCRDes$Pn z3-_-|`Ic4_%!hpMCa#q-6@Ki-eol|QQiHSBI>bQ!jmFT`!6*^F4- zh=YPuW$Q`4SVeuF*PVf^OPAYg3gwc$U1yb@ZJ=?hPZXMv-!~}x@@^j)rQ;mtEe2X2 zmfUMF3{a4OtSzCVyPh)jkSY5QUalS~7+YZfmXriDSa?-MvyGz`#81hBEwl4{tYVQ0 z^`DK7<1j8H&OGLPASpGly=+7%;Wo8Zqms#E8kI{3SDiox^VEWbHX)3WDCj1w8pp~AD|zmKN( zD^a{m?&#_!;#IS=C@zUwrkAsd4jZ3OH}Dxw!puly(5RbgCsovvS!kPq=K{jYge>T( zX}r8bw_AHsicDVChRn4cCidpxBTaE_KA^MxL+|TG@?IB^8nX%{p)lQc{>>7+K;yEb z)x{dS+t@bjOwDO$_@|0%@arOjAx}?Z#>mubY#J7-t&e$Z8~bJ(8H$&DJVpFw)a44+w8PE%WoRXNd)&K)+?_!`FL5vNXZ*cJxU%b4^OR%|GOKEg;(fo{z z@;Nu_F{0SxnvgIob_|u}IY!;3DnzpYqv#-wY6}^++v{8!7IKr>OmO7+;C3VUy*oL$ zUpt;4l&>S8K^Wu10P4@4j3bDh3;CF_OUSWZis#|@evBI&T#!-BKOO zXAS<>a7TIA^L3*ztXjA-teaEZ=L3w&&qySnucw;U!{!SB6t|`GLL4ox#Y?l#GYJVF zwSzw5?Kkc16@lvT;y@{4vSxA~V~JN(c%x5rVrrQ4YKMvJe)tc zRHvp}C#p(FNT^x9RK{U)j@T=D9{}r3qiU|6anG4Peg62ynMj4w#QrbU34Roe;@OlV zGd{HUuSH}M0*#AVGN@*PslUhud)aa)hw;eNTIJeu_6~!X^cBkI&v9GLFSXJ?K7vs) zpg!<xL^hfTq#(`9IyF8K}=DpT68_hH%lB%29o~bg1+Z)Y#-EzC7IZ-uT zfUrG?wDZ(@aYlLZs_gY2rEdlQ1wEuJ=udHi&lev)+EwIhO|S{mZKtFCmFek3VECqk zOuF;kgTLc}2jWe7-#ZU*tc>iDUHg#%b>6Xy-R04lin4Ljyz4J*Pa3_T<85N!W0>w& z9-U&R$MCOoG+N!!FOQdHn}qC)p2ch*r~RSDN{{CnQmxjn^f?_5|vAZQf&L15fJ9IV=bD-6Htvh$C}1khklYYNw3MgE5SV) z?Mksh;V!p}$bcG2kma(LEwekj+2g{t7B|OnuQcZc&Ewu@F8(%ZZ7Be295w(Xw`lst z2De~;+2gt-DY=dTSIf4y(@dM&HRV9FIIQluD)#CA0B!E#T7-EjX_9gmgV(y?j7>6s z>B740ON-l>>2oW0wex6MOhg19VQF&|Pa2ziXvK$b!)6b;(#cT+9*>R8hFcZ-x9LRs zX$e}o^(&~I8b`C`dVKL!LS?@Kf8kMAN5sR7@X-xq#9{irRXgAirFu9ze77k98%uk%o)$C6+9ES%X zb&r>S5j5SkZX1<7-!3{`a$kp0&hfavVzOBSGn*<-ObTh=%?6&;F|XC}sljebKAuL~ z1SqS9HC62^64u=Aw)o8Fmj@tkhpefq0i_OmV-gb!z`zol)PVAC1wff2dwgg$TkX51 zgG$L=09_=9STarl0K+QKoGx9mI>vAy-DQ`J`FvtzPiE1D=&ri?l%zo}Py-W&mM z4=B1%>9}^Dt2Q-Y!r0x-OV8A4adq8K18}Jpj%DtE0zBj#97#(q_tFm1wx-ltH_$*y zv}mB78G4CUP1N1xVZWA9!M?4R@j!wMP>WFUT3x8Os1$==mgg4NdU?(}kPi2pQC?1t z@7Z$)zhvgVHCp%!ve#qIke5NlRtRnG3HMmV%`Nn$QF!T~Cd+tNDCVRV3hh&@fz=sR z_lKDcpsZonYWnLPfX>%fs0SID_t!Mb=IXu=I3D+hbrb&SMdHu*Qjj7HxRCSvOD&up z*NbnM)4c)wQEApiwV_8#5o$@UQK5IS%j^xPybpBIYwXqMv-HCw$f{bUxtdGICgqnI zzvU}}&=(!qVomQ8X#Zk#IgmS97~mG1D>3ySHx-cxr>Pq4jOa-m?9A8kLL)xlnV{utmpYC?uU6bB{^Mk62) z5SF?d=e5|Ur_~Y|sX(C)`V2YwgGY2AD=`x9{#1r$}Y_RR*FmO>4GN`S_jtUcqz3qE#M? z<=p5_({YZXEVni!2i!dbN0U?D_z5(P(t!{Wf{obGX~BWRM5Upm>tW6GZXbebh3K>) zlhYCxaxlsF*ahRNS*h(bRweG2?L%!JRZ293Rc*9&qlqRM)w#$iDD=NrWlnx<2cN}@rxbi(D_Jvb_o7JjA`oNcrMEmtn*3rf5h5mh<+_Zg6>t_1w zdrE?2N7{|n8q;~13g-v#?`YxcMk%WlZac&9}^;s(I^cAlHAr|<$K}%vTOyM`|w&sMFrnC*$Cg(yM zL^=SR{n)Q|pTaZnnm$qM%i__`9?~!}CS$Og2@%Wy@W>>a!o<@wdf$ZATCSh&Z81hv zN^}mXhgVX2Y;A300_4e3SSy^SgGe2-h!42WSA3uIx)4;9>D7}-c1-QyzZu`Ad*x5J zhdXn5yt?sYHe1ihsZqc&o`d~pdpuXW&o^x=U_a=2w@Z2$!QBu?Ry#NoeK^4XQu&q{ zOFut!vW^I>)Vj@+3MVa>Yr&m+TIgbLZjkVU#QKg2H1%3UO+Fc;cHffH>H!Lya}OT# z(>8IMtu2G$-dkmsz)pohp%>7dOpf0?WkI!d>#VSuEvJ0C!qYR-wx1qfm(xvu;_fGj z^y8Dr*AIX_6hu$+Z>VOt7I0)f=ssuiWUj3HEz4c$I>JLKsV>|}8GwKKn=kzuSUxqg&; z;31O*LCQ7Z;Yt7H=Gv8+@}teC>Yrya;Ex+oWe_8r9vK^{!CGG|sVM%etjPf!jXl zpuYaW%R`OH@Zeymp!3^y+LZ^9bjsn9Zd|vRbCD7~+48*p3)Rt}K<(D8rrM4UX9sdx z+HlzNx_DP?Homs!)7JqSkB9S8*pgy;o}Mel@+w{}f-6&tN zHqXXWTN}BBP`8xYDaxTHE4VyXPE!DL5bb zvXRK{$w|jl*IA!8VwBntQ~q)@F&Ti?HV=ZtKR-AaF$5i;OosIE+t{B@t^khQc_D zCmk{rWcJ_|NX2CzV1ZJJqOdrCHRA7`Myr z#IKC{#;_Gi`aVi9xPxg^JUK=A_V%EUT} z`_*ix-_w$2(;%leBfrGz;f_8{cV4q`J!%^+eCqy;p7ov8OS_tkFXVj)Q&~~6Rbx=5 zS~lhJwb1*bN1WcOtHq1m;N^H-4`Ih-QMRM$va&|is1=>&QlU3o-d?Dni@M9`(p%YU z1aJFV;NvPK)17xcE+?m3CqMi)M|3lT1d4ZG9(Jz%Wz2Gid~5h54!aMsOmJ+25+WAf zS`j~l*`VBl<6=o`xXsZr?E!ZH&MAHeH7z6+wb2sJb4C}!EVv64GPhs6WE}x?;lsnd z?;$j~C7N}GwC9!YW88Z^0GOiP;mv+!>{ECfHc7#@W*A?r=3bAw6?X{&Fzx>NwAdf^35W)VVM#rEPmad@Sp@-!5$u zDXP7{I#$J^Y1q)Oi6beHHUUaSJ#HnGz$5vX?t8M zH@}?k#!{G0z;W52kL}Pf&ua=2Jma2T8D^xC07Pv@AP>Z?@Yu%^OXs{(F9lr9ryydlv*Rm~0nsQ3H zric*t(2bVssv6=^C4Ph3$$7HK?aDOlzugg3CVXID-b1#vv5lY53+uXuK!hVN_zEr; z5Tdl=n}rFu`l#LNgsEW@FCOauk;UMIe~2B=9%+7*osMO2J>hj*~l z6fvhy5FXJMr;3XuW|grrpdZfkZ)l=`@fg!4i~6Vxv$@Mb>H%vDiOu9H3uOLEk62d9pgf>(zs0fOQ&J*keEg>}4o2HsuMGQqptBEB$YXCjA~< zDK_CTGyv)Sfv!=HB}fn0KW5k3(7pxssfL(+lw`*;P;)3do=TF>%4I=<4G zr!CT(dNeN6?m9eo1^d&c$da$c4MtR)Z$6C_1L0sBt{4+9UY^EGzw3{x3#9_S`AcE~ zp7uctA%AdqvTHpU3+3f6J0w2*Ng%(K#GbQm501oIWK7i~H-tF;Nl5_(q7Jc+6gs{$ z6oK96=1AbV9V)B(VJJ zXMek-!2!PMz>od@pK&&SzWvDOhsah6#L5kPhG?PwKc6A{<8D^sjeM{2H*tUKB|mpT z10d`QAGNd({O@6AOaTi~=&*qX{|~DEaYX==hzBOo)8drC{(nq@1DHfj7}m@GV-g#P z9~0g-T*ET{HcI`cM3#DgfA!C0c>%hL5U4gxggl3mDXM@+v^HqKwpVE11Kc6_4ps!I zzFtB;z4lr5*_2zicha+#SAMVeEId)2wXJOK)@md;>mv7W*}TCI`W3zlcb(GL^~7<7 z4QbRa|`cve(~>TXRDU!zHNh~#dg?&x1VYwUehMk}h@fAE6rC}JiUk3? zg+Zc5GR>4wP-a)d5*sGQsW1pbmfi8q*v8UnyQcSXCHrpitFZ#%ybW`zeF~2<8o2p4mf-R~d>#Bjwv@|qoYnI%~KQ%?1 zqYuZ7Kvip2v>=1_JB0a~&KFrAAZU*e9y6YgJT!UiC{=TJr(m!_g_&+zqTiEr1R7FM8N4RO+7P3!7rn!Y%XRmt;b3f zak2+8n;B|y%KBVMO|jXLE@JG$g4W_W$)1%68!{av?1Qw;2(dZ0H(=xj^dN4I{JrccIt+d174JdfG4lp=U~rrnH`>b({})7$kujAvMS z%}{9}c>ZmJ`iM=0X?k9$-xqaRCOL#UWjnT&%zEAfB zM0!?nUK0IpxMbH6!n-5seF;}!8_CZV7-y4rdzvLR5IU`F75G)tyr5quUd7j5YIOpn z0zymNKymQNW3LY8aK;RX7A$q|V9h3LU)p@7LEeaetRu>nk%Rmf%LzjQHCz-YFp$5R z7?Uds&ZQCLtDZc(ebB;^TObiYZC9VKn6dYXq&k2h`W{KB zBYTULw7q7&hAae|nZi#pW{aclhE}j5l-4eT+Ifa0lwFzj)<>sD-kP3DAGvliy3bOn zQjRi2k^@IXV8$nL3qSWd=z$K)R(=8pb@OtwLauLfv6FPbIg?PM zoc6V$du(jX%)FihHxKZ_5w*EJ8L=da9aW8@EqQs~T`SI>Z)9h`a=@kNhdlgC_%0N| zBj_X|g=YO7=2ABGEH*so!TBy)?jCApri{)iHJXYFMYyacIuV=@a~mI#@pv^w;P#-? zZlZ)MTqvcYMsM{Kk^<>qMWmsx?;7fCPt0zv&yitg`UY+Yc@lv4o<`^hC2^CJAe0gO z92$#*^Sw7sf?$qqmXN|TF*S4AS%*LixfbpaCAsrHuqc={G9gexCGGv2ZNW3?8EPGQ z0%zo^I;Bxll0HLv$*rwp@3;5y+K?8VRAS$LvH%_gli5Z>L#!p;U2^QzT53(FeEWNl zmv`gAoBgJPNy-!THdzwa>+>fmcEewIJ#{61I&ZKLx*4_ssP9^xLFJ?2m)Fa>gmzGM z$9FxXXbC{|QST?ME4T9g%UrHluj8X;JA+uTcE1~EjoWFcM!-85raqnV&3EG1xf?e2 z*=;RB#`i6lMnB-$I$MZ)ZR)N6>vqb=0sTS_Gs&nDdZkaFV6ugst`O2eVwNI84=Evr z@w~0%>bBa=%uzel5Xl|L#AsOG<8t7oVjADOG(%V^c4iLg8yz40j5LwhQz#dtLIPQO zd21MLC^Gn2VDpjWi%GW5Qq{xj+)oV@sk7nLW>xDfC4){K9A=Xw@9rnVDaJSv)Lv{=tCCRoyT-MiRofOdFPI6*Yw*@`Mb4$l8x(} zQ;N4U`6o%fiwwhRJa>DHI5)GqX^!9G|62KEkl;`$$gpo6NFwajoiCG&Hd}-$4r2wI zX6)wXw z$$X3jhuxycZXIFWfdtkJ(m?mDPY9P|2b!E)X}LjGfame!8X+_W;wDIN2ASQgqT?u}vqxV90xMSG7 zku%xajGsTn>(z$cV%f9H&hwqcV(l6qVGZZ3ogLppqhTv?EJ#Dtrr0(3aKW+B-~>-p zHAgC`(E!b|&UuXNoEn0B^>e>wQEt82VD{J~Cpo_{Uf)f<#ytIU38K89Tt_?fsrItL zXow(x;ocP@sx{VfC(Qk(oMrz?z4oUO^CgUo%{K|cy-bT4Dd%;gsvtvBSFhI(UjgpA zK61r*zGnwF5{SDa8Hbc(gO~LWr|%EcVD%m)SeNWFYTUJ}PhKI446<0BtUawYuSyKR8j5s~2)b4k=H@H-^yA%pT z;8Gsi(S}HmZ~e7aQ)Aa1&KYcrNyhF+lg8Sx<+#H1H<>|j$tRlh9il7ydiXxQ`*NoO zXomoGTYMoaBqCw!Z~#V(vQW0|mv3KC9I3WCk-oEo*#9^J?ZopbC@^7QDsVeH@Vn8f zQiijdwEIzAA(#8ND71VcbU(>M1J&D6+@amOKU_Z1bnf_ryoqPAz#%0i9V?9E&7G%O z*Ay4^10ru)`Ufx+(ESW_(-hULw@X`ce@JpTICD9U+6DCxc!&skpppoORl+LXa?O~t zfVZ=-@<0*eUu#6$iBa+T4bcaZxqWw;(;OF_6S}rCPnhoNkFa(I76}q+%(H`WS>=Y3 zxlQPiF^QA?5ieSXc-HY4EVfR2BDPc9tH(O9v~%0@2;CDu!Af(G*33yp0NuY&waBdY z-Kt$X1;2ll$Q!n~R2vSYmMPYDn90f?5(>mBxIlJBVK^Xkr_P8fP?BqDc6BbUfGgho zw)|rP9HH_KZBRHPJlXAUo6 zk#cY^e#dYyQK(2I_0IX8Dr0eJWyRs? z#g8|P6v>~~lJQSpX|65#)YDccT4(C}aBh z57Dy+4)NQL^si&8=Ph%IQj4w;-g#dv#&cyAVB9s;{dFLV`E;s)1%b;E|KQTfv0ND4 z67imfbyk<2$zBR>u)hND`Xa3!K!9~3q`HY7 zPXZ^E(tOu#={Ve`jWsf*Etyp@eY)9K0{0*igouUD;h=N}N{()s5jW{))Z2pjn}T*D zFRVfhIDV)j8AdCj9T)I!`t}YE>L|(XWu2fl9j%D(T<;MY<pSz9MBY88x!IFVzuy1uNJqV=x<Da4l>+%-%aanP&Jplxxe|K z=zgBxqQbUY6w<+%RXZ&VwC9ccLC0>Fibh+^B^kP8thNtHGxD48HuHg9<|dWZyJp ziC2<_ZFX2(f`u9u6DS99LTZfWAQb+HHUopWk-23VH_U|J4Y zxFe5eH=^)ADCD!jC9A)olv^ZtCH-5oi3(drUn>xz(nn-PQ7G(mN}0fdvCqxtE32;B zx}2tuz&c|;5Vk2-=Y!|3;eY}xKd>V1qs3BXb9R)8xc5Y4;6O18)T0CT=tVl`sqSA# zw<6UG5kc{PzGA=Cxhgg4VlxsunzNkQL6T&wxQq#LOhxV!%fDg!oTnjm+{fkWGl50< zC{p8l4a4pzbnX{0^$D8WB*G{S0y=)Asn-zTaA+N8Z=|+eF{xq8Pf=#S?bl#t< zP0vjavw}!OD1bm;ZjJikpC3FG>NXSsK$vMdahZ(Y`bt|U=yt%Q9erBFOQSTbOA;i- z^#KQUmpoSPQS4zK`3DB^m}Ky^YzHPPZ-;ot3#>pYYD;c+m8OfAm6b|otdIr2Fn}Qy zYBtjcQ12rF?JQsI<&9IfG@!zlXAJXYp5u1(?J;RyCAc5XpSV}NS(Jnh_vdPitO&UW z;?FZ`^0^2*5)t+kF34UQMzkC`x%QmDc9C9L;nK0BQO`b}^^3kcZdhS?$Z_r++igd0 zD9f2qTEDY9?!YRrBt1J!u*%NUJC=hEv!MF9q%hluyZ0xu%OhnthT!A{91w7et-rk4 zDHz?9D}Y>Y=j7GLhXK|<`M%C6UXU8k&n=bN&rFAug3r}ZZg5+5b#O1Z;sw#7Dbmb| zdtWdF=Q#75Zpu&Tw;nhU?O;sCW$$+EM;y#@%CktT^G{^L!g-d}Rmk3iEe#z$CQrHE@8R0qKrZn{-!o3`a9&hnD!s zOZ{du6g$m!hNUZGd;O$fAi{xsfv4jiJMh@?{-Z#o$&}(&6K1BVOkg$jYi7B!IL0TpsMOjJ~a=mlq>uGSPos& z#jHxy)Mn7rXIoLqTIpuRP02qxF!R9}cW~0-ryW}9$s5C%{LlxOPw7zgDc#G-=4bwc$9_=JQb08awEWVsxBE501mY|NnJ;)-L7gyeEb z61SS9Y2U8`$iT_Vjg5`vcqm^M%Y)r*yJ0DQ1tG=jfQB{f%R{PR=TswNAW+&{S?rE) zs>-cRGjLK0@}`}oU~OjPAmxYb#c6h*;)TX8^5I{{x}V}iwSfUvu%wRE1VZKNDh86X zN`cC92Edv-$0u%X1X;0qy&aF}*q7hf%Zx9`PlVkt}w7ZOvv&BmT17%PYzVYAY&Xa}Se+8tk0I zRB~fbQgM^h4Vo?{?p9(CFC!B&-3eHZZxghk3gUvt83r>gA96`hX*hrrg}1=!Y%jEG zrP9LhjG}3m285U15uZ+5t5O@d^EPA9M!FlX?YS9BR5#gpQ=y;??GqC$=^}JjaE|rA z9M*8_Y!^5ARhri5`MLf?>m^gM7hiziX&drTfrdDt+ZIy8SxJN8fZBai(0Krhjpix& zNeR^^#)4;pRh{a&BWy`4XZ;DjK4M4d~LCRao88Yb=mkqfqx#0<2E*82zt>QDMTYt-1rkJSy z>bF`riu7%nE|i)L9MvTE4GKf$F#r5yxD;{CkdRcozf7C*N7iS5|E$El^5hTe=O2<^ zLyb0X4&7yzIZm<^wa`qf<9~Er+mc5E@-c_r^eB?B`vNXyl~DrGsW!O8)-_M@)vpsT z_G^D|LGJcbq)1|ZFK%*NeymDCyJ z9Ivexxf$$~4XawChNR2r9?K8iy9#1_kuSIiLyGf5O1n-ks3o)Cdxaa9!6ek4$F z5hxb##dJnK*K}wWHIBdIzT% zN1k3m<3EgeyK&gZA0kv5i6;upR26J^aJ}#s6JGRtPFd!BxXmha(yM>UE8lu0`T z6P@E5V{W#L7KR<>MfSO3qDupgFHq??doD@YQ{iTSDQ-KG>2A22#!w^UE$7XVZ_kmR zDQ@1%tS?zL44h(1bLHw^3WB6)%_2AV;4!}ohM`0JY(-zMEHO6mm&7JpcVe67a5!(c z-CqIgAJqvd=of+Hl&9`zBO(ebPDuPw8gkzyPE8xOvlGUPog>)$6}Y_CoFk0nZ7}_v z$eat?dm)CfnZk+vDxPjGoa9jE((%c|LTNa6F`TpiRdombUz|}SEDWLppc?BZfF!=R zz9BREL^K2d3#9{@E%h1-(O5xEG3A?w66~oDT;L zhxqdQ8P=;&mp)FXTu1J2^4ojgaDCy0%((PuyGW-VuL8+O@*2(55W^xq1qw!jVO6&j zv|Db=`J8v>Axn3r8b%~w%;{MDjE?nU-HL*QMw~j*1?XD8@?PdhoNVDtB z)`YV5GX6kzUipLMwT5*V{6vb&34I`1L7&8g`#qYE0|5{mEkid`uGtxuD5V@yJDY&j zQ{xHSv*%dlNGmTguku{WthZl%YdJF0Qj%j;Nxul_e3@f)+**Hlk1$=4OTSbRHZ>S}#3O%rqDKs@#vBnks4!fa0g!3wqFrNl!$g-w zXue&gqBk&ChiN$vRv^vL2uV3p<#vW~a_E)R0DP?EBsJGIPGb{?^ue zF_4Au&8Rp!o9~!rAItvsR@$>YBy_DeuF~>T!##Y{*j6LpWx* zT39kcelq-rf=U=+u2>WG?o5U6Nh;z7=-p0cM+U!xPeBl?aIRkJ;;{%{qZ7ag>gE3j z@$kn{%`}DiaW-)~`|;1P7+6#mGMx97^V-J#`q->p`nN_rl$>6pH1bf}btfAn z>{r48%SlV=>^e1TqO&y+NU%@!1bpN~!IYAC4dn8mDB5ip^n;kF&j0gYKKcZ%3-~CR z+H~#6|C6;5Ad=Ci$=p|;w1r!R50I9St&0TYKx5Z-D5^1KXb)$V64;XjVp;P4i{|D_ zf^qAxh+2BKKc-neSE8^k&Wax7->dcS5kdddwL?+n*`w9|=ig)BErb4!BmLJK#5kA$ zAWSxm_A$Jaf6(-ZFk3jG{LiMr{wYBA zgq}iQAs6v4(aGO7{QZU=Y3Ls}`)><%!ye5$=q1Mgrud&cJ~;NjTl`yk@c;GTPuc-o z&we-J-;Mi#4wF4FP%6OxzT3ZkGV z|9o2}7(T>|J`aaIjq3mCm8USHB8C3XAo53W;QzN~`$!;-Xm0UJUz{oKY|Z@Bs`Hx%vzsudY5g~tZVcDKcHX}uoF?zd=Vhr%68m}tzm&W`n_ zlpSZcC)^aV!GiqM@iby90Obi|WM}SgN!EXy049i#F@q;ol7Pa}f>h<7g}XM#g=k?5 zb>R2qGYrBvQ96?O_)KDS!AVw>yDHdgVpPRA`;ug0)G!W@m{CV^_e;!tlC(QhLso6@ z?phl3A93vhzQn3?V) z#S<@YA2FJ00o6!3hcN`6^fE;?_ctUN^a^m7?b*m$Q*o(vKuST0W%S=^eyr>>!ld>ZDsl2ki=ac-#W#4yGmvb*+zJFp?0=WS$cc! zM)ij_kaKhh3hl!pVq=S>Y&v(k?b?N86Y8Ed)4Bvs7xZEet;fyZvvOjeaA}OgAN|jT zg2)^$tC(1awW#66#rQC{hoERYw+&j+e9iLv4>@jUGXH-Wi zezBexAkUC%2UXj~r_=})*-EWA%PS>-!bgan9<>p0JCK|%zxxrU11SmhH@9#el&YbO z0LxOp@8MWgi5;cqL@!Ys492F#^m_lSMBWDI&%SbQs!2O|_^#$#myRpB(OZZ|9CxDP z$vOIKf?{d_MrjNzD@kLe4977W`T-{9p+1)pp6taJ%qqAgvZ2&pe@f(k%aQ&Xk1`)T z{LUn7qMfQ0DmhT08==W!5z0fUHCS$VrQlrG=jQ$1vJa(U-xr0R=fsiUPw6$ey_`1d zX%mo~KTI~u{$$z9GbAWAh^^1H1vvcxoMG1vb2|2;C`lR%UNg>DUI{&E)8!UvG!v{G zDRT^u;YR80JhtBR09owLN5P_v%Pr+;^P`1&0EqC$>&2+PzPj6;B zeT$hur~9%VZ)k23mDBSRlsiGxDIuoR{_Q z$$jEFZnxuV{GCM!s0Pf7UW=6mXl>V7>W3ByT_;lR!^sVvl?~?3Z zZqv|+=1^hmkwgW}?E_-$c`*!1($a&p^R~9~MKxb;y#74_$#lU(6E4#uEBPa1XFdDN z20%HXqT8vH6!n^Wd~#pD+AvJYZ7d2!+W-7@$K^23g^KCv-&|+UwQzNwQOUdckvRaA zT9?tBdh9Nhh14RMSLf?z@BfPzFVeQ!KV3C(^y zNs30qM z)B)6Us=qjXULeZnvp&MU#<}qQ))wS>s|$sZxOqoE@p>1Sy%Vcn*))XQK^R8gZ=bzj zh?Vbw&L^#?FYz506{qdFF9Ox?4@A{pZXo|{Y7ux{sG9s7fnx+cr3YTM#ytmF8cEcx zfU<~L?wrm-fU1Hyqv^yQis>SIj6;!Y%FBweT?aMhk6@6D?CUcPPfZ*+r)ZTV2e8Av zI@3)EXuLquG2U@X0sL?|MD-2|caCu|E{QPxgWU5|!!@L>r}Dzm6PVpA)1J&s{nmu8 z=P+Yart~xBKwWJ6ji>{st!<3q1vLYqU4#?GjJlI$oD;Jw=mE@|LyYQ|nKb1hh*?zl z^;0{*7dlQA{iTwKY*8F~3TpcScq4yi%9$lmk&h>Ml_;n#5!|6?yc^+o>;tto)iL9* zr>jxfyjd7Ti1ES-s7n`5C@AGi$x-D>MRTvBDx(f<>MW;amUnw7|E6VPh6j`SF~P&F z1dpGMhvpp(yKppK^Y`+8Ou?Jh#`Fb%O{S;3qduZLw8=D!Aj|7O8smnh4!c$3{k;?TF8+u1 zz#~730(nw7PV7TsJ8eb5t>8*sMqFBJ#!76tipuh>z)65s2Pl;tR2km)EzZl_UpXT9 zQ=PseqbrZE=l%v@b}uUv&8H$JI3!^=%l)22OClabOWG5mzrrQB9`|8MvS(?I+~?EL z$+dG^3)}?OA#o3PX4}3PrC+xm=9@g|t&k~ovH%lA#$=btb}P~U6e9}N>lWe2*y275 zBUwB*}xS>T1+l-4?PLPhQy(cgiup4FHcl{3wz76{71h8jcC8g}1PxlJ@d@e&k@Dw%5 zE3XuzvnwJh|1D}I<*Al-OjJ3#cC{XJ72a4v^X=|UIo7wts43+zvZsL^W+GnL$G?to z%(S3%d0&6D6(*9aH@ci4#48GzOX`oiuhUUP0(F96shI4eZf4$JE$zFS3$dyrLY^owP;_P#jZh(dDj$l-lMf#D;?dtoW{lI&!Ek!{x_(JFdK7x$fe?KzRG=k+|xW z%B}Brm?E*&T7XYruDrTYU~n?s!BzHanVU#^3y zZRu3l%NE@s9C{4mE>NBA;L0t}W@PP~lPq#cK}u&VdSM4EbVhO7G_=5b&zsG8{^vk! zQ3s6(4IzKznH!3lN~zYjQ)n*40Mh&3wpW{9C=I0v-N(u-qi&x8CpV4_rr2gsB?WO# zQ5SnGDN15sbZL6~a|av1Nr*|Kj|OHkHMNcEB)C`{|M(SjVG-b8z2;VKeuAi5ewz3) zgDNi6vDoII0)G3)l)fv-);xbHmPShKdSv7H8|8La8&Vrhzt9Gy-mKadd2&-1lTWkj zV=}^@zsOSC8rejkPCHD3^1B=7B=bcd7F`Rm|2k4rk`aASfhCt}H2%!|iEsMl>MF&& zBrNS_-UV~BVXk$Fa7Jj26mu}KddntCq1s+{G+%vuwt^+ACDOL;8vxQsK9c-hpQRNk zv0`x0he6&lFoqV8Se^)-j-;wHUNzfM6jZpsmIxwF+-CEIo&X0EBST!2qx(_$ND zpO?I-a{_uldz(uJhaz(BKR>~gg|naiSAa}#aJWsIr+%O6(&rAqQ{1Ur4F;e?PXB<_ z_B>=G~jAd_;W;YPL>mZ+VgLZm!0%B z>}})6861X*3VPmScDHiGdVAIKI ziEV_!TkQOU$@yVnpV;x?1GdROw-GWFa79w}-tmrg^%Ck3YZm-zhTsc}c(v?C24I=L zMc$3`s>wuuL2m7lu|Yi_?tg%cTzR-3L*{}tTCyk#O z!eKQf?y5dWpHFSBIf1t}n80TPNtGrdI#od)Qj{>@BTrX2_jeY$fUkZc>d{5Oro*H?p|YnnJPTz_&lR1PB2uvx1QyLVqmTREhr%3xhp^2Uz51Cvt*J z+JsQX{mmPUip{X;wK%0&_u5#3+BDMO_mf^^ZWSpjy06dnwyMXg4c>v!HZ}2HUiKq2 zMDhVFn(^kM+%ytFo9E)$UTmI}?v@%H77Lo9t0~)p6i8&}@fX6ZYFCcU`J9FBF9$TC zMeX@h1Uq~Pp|iP?r{ty!)M5h$C!yG9KiWt}xqHrU1%ScJ^c_(2ASN9NBk=hcccn{H z*WC8VoSN)mu{Gd>9YW~zR);^t_|mN)Ka`LFPP8=``1JQY%ioGN6{+U<5Mvr=|2YoK zs*aYoo2uMn4$?v0{zN%ACysx^#V;HIoRaIKRhHS67Y_G4CEi~+!tThq$Sn5M2KL0P zS?z-tL@0`0j1@B<@{6AMdfNW>E)TE}-%ziBOOS_>MepTH&@4RGZJgu-*c927mK)0A((|uUGDeZgy{%j(m4FEZ-b87qgs6X^L>m zt~{tIV;$9znA4Xpx;Bk(B+8Q6H0!di9n`Nu```L*1g^w!m4YT$ftGt4>rc< zN;;fpAA}aba!CD>ts`S5`KUUAqf^cl>TgIhn0~yM1#m##RH?t+>$K}dvaSr^4sK^C z-#^>Jys|}vL+z(IPxw;P%oX<#J$o9%%PB`7_ z2`|c<@<(ENsF7GQeHw~zA(4s?DLQMVA{aWhy(SxRovK+2YXZbqz&q108$W`hiBK`s zIP6)qz$6XmIrxGm2h7ew<1N#B)eaD9Kh4mM=ZUiZ4THaq z`??S>o>=8_8zh@^8vA18?0>~+gy-jBdSF_e^W{o=>V}_Sn zc+#O}3F*|_KPrCb0)UP)n|=Ra(|{K_-&o@KuBU8#w~cN(Vq3v#CVYW+WG8M))>`L9 z(#Ipx3-dPK2`x6ZzY+J`8u*aX)bR}4S5;=%nuZ~)TBAYnn#lzWgzYwA*WaK0ZqY(FY=$U-0Ol%qYP-0K|=uxS9)u=8~$Bj%V83**9k=cYd5${5ycO&U1>?3c9X#HO9$`D5jv#g!$ zk_1s&%%o~+=b)xU9>bCxT;m}h&<@Uj567chFYYrG;1t2lp#u{HM0Qt^0}Fc)PdiA` z9jCQIX49z-kI!uYKaW&r8 z%lNu-pKAM5NdBaxs@{G)DmG6-aDp0%`#z6L0JW!hKJ?4n9WF5hcVxMV!9&08c~Ti) z#$VKEus8d(%fjz+(h87t`;wbplU(l<@;f z-B+W>>5mVT5`e2CVwDjk!qY+aKKW*2wN2Y__H)9a#@nH$q^+}u_x5Bu3(jsAWep~DXK39-?RL`M{aZzI>FJ;ZctycwWk*j)zylqL+Yk9Yd)V`PChwIlfZ?}7}NNkp){nwpS zZcem-?;5UGP|CC~)@nXz!GFV74+u!g_yCaK)ievOHnWPV*`#aeV-A$YO2yo~mx_p^|-R_>|6N(g^7J}9KNp~^PchuTEgu1uaDm5Mm^DyE6S`xd31%=bVPjy3Tu<^yM~qy4;y@+ ze%~hhrT!>r^ZN(+no~Eo=X=Z4h707uAM<2+KnKqr@0ps*#{m}Py5Gyt4kQ?c$KAgl z@bGzbtVi#X!0-zth??H=&r5LT9fC77p9~(w;gHxlBe_h?wI^6>ytvo53 za2$SOG<%ou?Dg+QjinrR+=^K_uaREpzj4O=s8?YbDGa+d1@PCk3ZM7R(23(RD~rMM zBX_~gBXw3y?p`;?-e1{f?C5H#5-$wsT=Hc346@HP7Y_K+7!HC~>LHWFY z+-Pq614nafS?h{Omk>XNW6o`o73!j$D z&r8zzDsOBt#t({R3xqGSoXs0UQa zB{6y;rl-8c_mi*7_xhy+Ya7wn9dZP3Qlb@ZGkLPB?gun2Lr=#!sH*qJ{YJAaSV;Vd z^2+XAep>$7BPyaE!{z5TozGJ+tx`3i#~+Zqlt4s{0veV}0$SBN*MphpgAvDt)72BA z<&RhADe=qEJZMSAj(^lvw}gKRk0bQ;qscOFPxL`xX4WQ-iK;_dt!Du&R^#DeE4(KY zfX}_cRW%S`Ax~nm+#;g!r_*`}V{B>Ihual3sd0d5-?}?R`G6LMnpK{sph6Ua;o zvG10ChW}Cv1%Nf6FYE9yqyZ$&5!lCsV*c*#cXWEW_Zb@!zx(j_h>rdq{QxetLB71|@gmd9K4%bFm8ECC`dl0RnG|9Zhd9CwXnatN0eu8C6KZ4<~! zqjE(%a1if9_kS77_U^aa{$m8U!q1=g%YecZoKi4(X6pWSr~fqNiAOK|4hxK$sg7bN z$$RhrTx?RLie}XoM8@W-s#)9;URUba@Uj)D2W07FQ#XA?oCI*W6Ey7L_me>8(2$NqtSbYW77%KTG!_1w)%G zj|n9G%^G*p%{6_f zf0o&t@JuRo(%MnL1$-D)>4m9vnJC36?4Y%0UJ{hNiF&H-7j0=Tt`;K+4wVcV>s-1h zYgQNT&Op7%1Xh<84X!hT?_g(XJXz_#j~yX&JxK zb0MKdpcsPK!F`aEG{&1yT_Z36oUM$eNqhWiR|1$+wzi+Z#*(iy66?dh9VQNUGlu5E zL$P>Y`D(X6_m|DK;+vY5BuJ)4J<#IB&s#7# zypl(9h{WP@x61B9rVMk!?AmVrdkmDpB@Yv%ETCMCo0BrFs%7$U=HwrguoPn5@>j6UCRWf6Vn&@;JorVQOnfe3 zG)|H}iJh6Hd7L5Bk|q=gn2}%HOi@`4_Y3*XBZ8~m$9Nstc6_L`#*k8bULonQ!#rug z8#CE;*5Fus<_P4paTEE+D17Y3&xRhelIyX~uP_clXA=F>6!zuMLA-bEHS5Peh9r=o zd-Gz~@!+D?@8%!TruZnP3Z@3Yg3owOpyZd75g?OaqH*e=Bc(*$AZ2P8gXgvB=xFvP@Eq(p zrO(TEcwG5Q%D6Wtrfm1Q_MnflcgnGOw8LH6t_zxG0e@!llCIud{`Ukoo^_Y|o^=kY z9krCqwwc`=f!UP7{&J$xcvod%CI#^V^<6!j_)eiR(HCVXL z6@zmogE{CHhjLm1P++e=V7RK%{d4MCki{%-bc0~P&no4@K4dVq{E0}3tO;)2I2FNb z`^VQmZN(6}~Fq3nfmiK1dam_4ro=n^QX!3cjZnb!VB;(nO z6h`q*{GKgpyii6e3S~CP2U@N|MtyS@8J*pG;A@o8nV&tJ=^kCfk%DrLs;znz&eZT? z#>To8)`hA%7A0h{N^J8285$K|b8lEQ)mcAP@Dz52Z$Z3w8dV^OHGkSqJL-^m&qUODg<*L_D#AZBmoq^T`>ymbIV-9TFE zzVd+Dl+)RzV_zs1L^1VX9&K^CGb*GB$5zd6#(iE(T0CW6gBhZ~F~wqOq@?jQc;FUC zotHkL&(K75SRYnc^dmQZfAgjzd~`e?12$I45bzjYXH@RS{QaB1&By18IK7m!e>hQP zYL89k%v2et_LVbUtQ+g#I^gzfbtyX3<Hp`CQNb=oUNVS*rPZ$G)AN3*YGj-3rcys%>|P+RsBxx)vqk7H>hfl!`AJ^LM?dWR*_;@&#NkDG=WcJ&}HDH%M8V<*()B-8zcu zCz64NSS1QzsJDC3A^MMw-2?vz?d zo~t|F$istM9gy&@8SOxTpt@^j_Y8qaSsW9N%CsDDg1y`{wLXZhq7s;3oCy}sk_2zP z^6)=DxDCh=rY6IrKCA(?9n7T0LKi>F8 ze`QyvY~DnBHww$(#WkR2JXE+S@iqIZEag&Y?N=ch zp(!8qg#TX1RJfiN#JqduV_=-xV(3YJS8^BsI_nmBJy}h0FUa?D56YayWGni6T zqI-umhdGQ*Q(bAI@FO&AlD(IPj*_cdXqPD1Vsr+m#x)ZlKF3fD8h~-s^_AkD*h9a{ zKPK!)mOnA|kWg>tQqEc-EkJLhh-SZ{-%W= zSJ#Q8vZ8`a=?>g64#5nZ{O46Ex-U9>-pevR$kOZ; z!Dit+^@A81!phc;mxebMJ<%*wdr3QA`nGn-hCY|ODxLNiYR#bcn{NyjN*+$^kj|(S z$yB?Nktkm$t*ounN>|p4V4A8D#Zc`ewHQ+L?d@+F6wg-XDA8&=x$OmsU}XN4=k_k3Z+8NSqTK*C9`gy|6(=@ zklQ;xx>ze|b_@ySPr)(z9?A{sH)O8jdgqwz$C4jfSfe|RokTr$-zRv#NX=AngZB%= z6)g^Pw|YhdzeUveXQnjrSdPD{>~1TnYx=B{>@G-;>ZDWPJ#vk?>d*0LNRX=ra=iLN z=FvfBkg2Q<6{6*)Q{`8CoeE$zY5keMxtcLYS^3!%$L*I3t)g6*fk8!CmtGk!w6-xFMLn3)(JBzql!9%+yuuZyMh` zoccVP+=(@o^L?gD58QmU7SI}Vt{G>?+Q|R;__?r%FX{Ybr~CruL&j(LzYct`wZ|h*S9_)*Neg-%RectdIa|lYavsWc_?Ya2c}SV(ew5hC;g)0;HV2A7>gO4nK%AS) z1Lo0#chjRy$E4q`u#ML%hU!GGxaNs9slW0uu(O+MeHEwfp`GL4Xx~5S{>irl#Uu0- z_CpRRu+9EyZ2Q@vF#~ zJgnpKTD+3)TphiPdciWeDewa1pv^*+KWZIy^5uXTYa^1QHsG#8mE%(0$>Iht+XXX= zmfeI*G0$@*v=t4j^x^3l_zvx*cg!zQY=Xa+m?v<7bf4X=s#|!cI7G`iOXfcIyjVIB zOwZ@*`3B&O`2*i6t%U!7-F;U;Q(Mq3q9}-nf`Eu1Qk5=MIw}aE3rH_Yi}V_iE+Qb( z2}O|rQl$$aK{_Hx3B84mbV8LDI^4}UM-QIx--r9~KioVeS=no^H8X40eBaEoT+;T+2$|4e~Z{pECaFBW>s_-PI)sSS0^O( zXWnFTvs|2w{=#2yz2Q6)IT7`&=uK3q=4_-;tTaPP`*E^M%I9T^Tp@kq!HBiDw_&hm zu>kb#Qytp0FA|SAI#N^`J2MP))}(pIMKk@7q@1mVNaG1p8em2|AEe;DifsHVJ06`K z9h{A(`Vakgn4|OTNuE6gm;dYgq>@gZ0jLW0bITNR5xM>s#1&ctni?80%l=!7G zE9vx8R&*XM#i(WnUnEuF=T-dF{p<$Mrtk0dt*TaiKlRC{7FWwbZBx@nmP|^tOiw#C zE{`0s0YMy6@A$V*f7X#7v;RQOCX^R#gDTV zQnybXKy7c|#2)|h*HkA72%)Q2%8zjsfQLc|a07P-u{?;)w{nfJ+HU4Xm89k6*`t{AfJxFQ3 z3zxzKUB7|;TJSLjoEK?L`d;3#0@6pD>n|Cjr zF#4pTBN?XIB{H6LN4CoVk1QQzf_q0F7Aks0%T;c?;uAEZ!2swxkg}fP_b`4BO^HkD zUH7CBp6!2m4q$AbqycK0j5Ac`x8eMrXq-OK)L4Z#B!R0K)xejc;V9}n*2v4Fjlo-_X|+|7h;BQdm7BQ3QP8bMlxGOR+Zos0#EIRAh$9{vO+;&0 z2};Fbj1wY)U%N09MVsRri{cY<5c!x!{%{9*T)KdNT##?ickef+76f_lmgbg!ZmLQD zm%~e@x0c48%cXZZNqJT*kI9%Q$h5aiXF5-mJozWU#p(=bP6wwNGg02sx#46(ZJ-lN zRLV2~^9&r;&xg0q40i*Z7E7iU1kep< z6Yc1D^cdQ$jxQ>r)jO~SA}1gznc^@$OS4C2AStYMK@u7n!#V@LokSqjXjuFrEWK7B zK#k{{)^446OhoUwaRHa{S2%VXPVvs20ZtexnDR-ZVA0Xv%v0OQi71Kz>|RUTB9}GH zjL|IqBHKBo?*_VV0*~;|CzUHlGuwnQ)w(coVqPkceLy5_yV5z-@dC_}@JvBm%MSqw z%+5^F7yb*$IGU5%Ki>_0SA;B_vOvAcUCkx+(2;PQ2dCLtzv#@MKv!mwK-Fw)S*3Nc zc0|=8-9aCh7L?pI` z-K;IN&C0_CW=9pAD-n1AUDwKWWsswvtbbmUR|`PXiB2r0h9S31V75cWc-GQ0|5S8eFu>iCb%ZmoXPs5O#-t<37;AMk zg_E{7qZ3n*=lpPhPUWp0AIpbrsAXG%s54B33}w(+s&G1Sf||NQ%9mN(+frffPA|v$ z`+0MH}xv)h6unTNEclg%|5TFhnZ3-`ob?6CTJj)Gb6cQs+p z@X~JvAwFXlLrvGWqO`?t62I5CFt9}@qlZ7vEP+7Pc^?|iinf9Xs&wQgJE&z!`jrXF zSb7AniQ27d+r+4ky7S-aS}7WZ(I!4K?DlfO8j5A`@!F>tsfnmJz7iaj5TCwY!43JW zqu`edkVgjB-VK|7)ROXrBX0Scr$D$Yx|mM^a^A2F^$uA zu6?S7JdY%2fy|iiD{^!cKDkA8u|N1z^}XR(l;%2khP05NoKviTaxe$g_uYt9;8tPG zT>Hz1v9&sI9np`m>f=4SvdZBmG#fnGWBiVpDxH+pn4H8ISRiODoYuT0_taxy6!ad@%AfDmdYG%IIVh)*l#Y9}qJ78e@J`rYm@4cT25dx_i z{5u`_dtVCT4u_2wZcTi8c7~3GIvx3p?WWO}dG^(=FmFAsfzJkB2g`O)z2|#Xk@wVq zTnW}-p~CNB??Y$7mTDSL-cME5nYyOXvkKQ{wJVsc@~Bz5wckvD6st%@SzYq9V&AwH z`A6)Zk8j_(SE|^If3?kCH)kpQ@Lj8BC$;2hyA6dyrBkd!g;E)7vJONQNvNeFu8t%w z*ZJL^B=xq29WLtxbzOTsFlZ`I>r2~x4n0foDV2hPQfsnK=@@?D95ydKzhSV^ykoJ) zn&~%QpwPb08mq}t#{1cxFaN*0fz*?TGe=pD+!~+*xGPD&(fSw_oTzFm~&rg=cy~j$g~GLe?@FAq<&V;#ujowD|r97VNKK z&1W_IHqBK)#F8n9gjUo@7{E2BVWPyDTVsCuB{ZE?^fMuuEi8RUNmtCnU0n6K%{bpi zu{Y;Q34xhRVrzQ9>-C+>?3Q^qV4JCxy*fs{92)Rx`GH8GT%t6E0}hQ8+ixkBotNx3h4#6UWb6z2lfw^Fr;0jvcwL!STj0ihjxxIbz-U&g{<;oHn{$ z{rp&s;&96Di*xGD>9|xAv1G3NaC|jPp8nkweCC@xFNPDbHs2^m1F0rQ)W@bN^ zG81ZpN|;CYYiZ^TVwG$vO)%C**IxD`#&yp%##BIt5}VsD#qn#3x0)08tM_x9fm05q z-iuXsYig-3w24@Q*A*?o3+D%3$RcK6Xaq$S&$`}*DMf34obY;XtZG=XSwy)gNWNCM zqp~P+F`ug*Zm#fy;}blifuKGpPE>S@#OExz+&uJ}#joAjd)RU z?LxCtkd-#C^VHB=jP~7$QOV2Z&1;v|hRyip3e5Se-Xel~ISc#c>vS`na_tcmL#-55 zTnmik?elX2L4I<6^;3qTD!%X^VE=+X2Y848x=r7EfcJh!L7QM`iJ|Y>W$h;X#>tw) zlA@^P#De20tnQ?IH+uVlK)DvNPfclX_JH|JFN0j+3Xqpp51(8}WG=rA$%8lNy||c$ zs%s*Rw7!mX&e3?OZdtX#hc@SfTROl>LZNH_^%&0{`jnDD7rt4#GCX>mWO^?Wrf>{V z{tj?IDJF3d+f$7s``u6IvY_@1DV`-CIUk0&2GX4Qq{$a~KELG%rT+f?-|vzxpP7?T zEF}F}b92`W5;blm9y!|~+Z0d;c`LS~!JkN(gska(Ef?}LdWsI`;wN_qt}!S!otnO% zHstPg0^A^M&X+PkE5;d}cROjw|Ife_0B>Z*lDJsprIg`Ip4%#4iE$^2=c5K-%e2>h zCjch;Z~#p;ssH=~So|~Fq^Ki=1~U*(TS`0;K~oR{Fj>RrbihgTkGcs!v9n|Wzc;#L zc54dY)-9HkTB10Cs{|>|oz&wcmKECnD)C6CxAXvrX3ci-B*a6nI4+6{zJN*}Bv5eF zuW|j&zu5fuJE?cIF8{HWzdj~e1B^jo=80$)fc4A2J2-YjseXJCT9%DX7zfR(6XCNw z@sSL7u)-&5fDE{!e9>J>oapG%Ge@9_@b&PA{nov?Bps~0;;_Af{2$*QX7wp0>GH(oaIz^u;%fIBkE9kK6 z4jW6KsArZ~kC#?i4ljUia&G87@xUExbtL7H18d<}C#*1Rdu3R2KNTBtgIwjwMh+TO z7uwK1Vt0wHC978X%q4AWA5&gL--91Je{@qFj1RfN0LPNY1TiK4Tw z1Sn@|nII10{=#vnpr2=1mKC%%l<;y3pO%zsCGuY$;mPgu-8QFe zvm^NRh|dmn4r8Lf)sOShnR{yJMY#_mjG~_m?s$x1G!)N<4so*@?nhim^pdEm7@*39 zffYnx;SE1VEX&@Z*W84v3^Z-`1^PF*h1#sDdUZZcTe6WqoMSDC>IM@zg5^;1M*Z`gux3s4sFXpIk=((T}9sj-HxJ>_+UG=N; z-DdBuEL0jljH=ojhA4-xx2s>?UfK6uEg{`(O7wC==vO#tt7T$H^WaB-c|5{|w{!Cq zU(C~eVQ0r;>%-`(SfD&Do+mR65|Sf+NZwgF&H$3$o$RhmY>c3?bqXzJHehc%a4GcI zr(p*Eq=vzhyD=PtLnq?a;FGyA#atUKsH`m=xZ%-`7RfyOY59Y%^d(oduJTUh%nwdkH_QY%|d|Fea zUUYwSQG8d4T4Gz#>o5yG$|z1_cf|$ zWis|HG1$XZq73CH6obG4)<&j($W16V@kXQpcW5K{VDIHZp8&`5L0f*)u0*jGF9vfj z62hx)B*U$0oFdshfBkY${FVGFC8Xgdy0c&va;?jrW_Fuvm6IZRAlr1& z^+xp93DK#ae1}?lx!I6R^r$6V(bB3PTY%SFIURYI{?56u_%4b!U zzRH`2BQe7^UuNM91NGGr0dSKqSaz}{G1U8e0)mcmg5}eEofS)Qd&1=0`qzv-zY@9o zhe~Fh>QynToBm+>&F}E0_Zu{t1tl~>ACPze{AIYO+&7+F(KMg;2xMNaKgKH_x=~C*br9p6SE74y;Xvh<%I|8;OcQ3gbquW_->Ur?O{oqPUG{bFQD_Wo*v3sOX&Ab`fe5ee_ndCFoIx>|!q|X5TtJ#UZWQ0Pk|?TaZpuF81Z|!1@XBz zF6A0o$ycnZKDYK1X?-)f?0FOMV z=vth)`}EP%#nb~vQV?3ipqFy4qk8rftLnh>7Olx{pE74`2l?vwY40EF0JjHXc!G&hSLZQ>LtgVusKj}zdON}>7WWGBQeC2yzBz~Q zf7sw_>F9ExZHN>jZ&n%bo?gLwB>%BhNA}Hz14e-wk%*n zlhIx04jyC0uvF02_dDMOyuy&fF||rInC{xULnEKbXSHoI^idVaI9bYzQ*re)&W7n~ z9Yg6Bl3kdsR2z&l@8L+w=7%>M^VV5`RH^a(#L)vL|M)J5K3q z?_(z}V~I5P5u9+UT8vOpg>m|0m){bD#JYZm!h(1_i7Z)QAhnPTDM#O3bt8g+<}F^> zTL2fR`!b0>om^idBg`jDtP=OG>`^H+he!9?9DefWcnTKmY+W9`bq-RZx49!UpOZ$h zJprq)4XIN24p&Kmm&%p&R*sJkp^_zKRV3$MYXl_j$1HfSQqE{4wr)|29Bif1H!9OD zdiP^eDrWXPj8M+yGgTXdtD6Qb#JaZvw72&jkGr!@a8D=B#RI?n%{=xl=FKd zx!cFqZO{#f%F~A|D#P3Nz?n%DH@S02qecA_akiz;Uyi`HjLPz@tmj+W`ey^WR?|^~ zlMj}4xf1t!=t^GbHS}v*YyNVcU%&e>ipJxap&lPT5YaMVvnuv%zx{03L z*~Gk;R^s$?*lQ6%`8*c2ho`BnB0g4h_ButV_YK@wpk$x3*?6Z3+t2RotTc3M^N1za z6h7DX^8;r#{Q2}$BHB%k>aJgLvEeSdvsA2%KmTV@!w-p!Lq5Y@(Zc)l*L514zSmW8 z7K}aE&ZwuLlib(7?z7YAK(w~y5T{1dVUasMFl)03=f|7JgE z(mP$i%(x4bv4@OfkxKI$nOez?6Eq@|Z;5M^!}%$@@P`sdxlj9&D-=4irWwnc{+P<2 z9MN2dYb83HL%h$1DRp0ETcD@D(c2GdvwXB9G*8}X+x}!0UmSb6e{GgZKo5lK`;lE5 zWfhV$v}(xN>j`~<_=)|PaiHw4EI#FIf~s2xv||?#Tiwzvis@h^yCFO-rqqI;7B2D8 zX13O(RlSR&p#b^tG&_5>xL{G6tDVW!MR#Rl-O*Wnlm0nW+F^UePE=8q)At|OqYgP! zc9)=B2FA#};Nm%s%y~2EddDZ5oRQsAZn?VTnYrMy>+UPqJ!)~9Q8o}~skr_6*oswp ze7IFzda(kkP^ndY&=C=4y>~M=q#M5SaPg2cQaQM(lC=`3ZOP6_?>x_0>baNZ-I?ZX zQmSt&1!fMUWIs%jh+aB1<9U!=E|o-drjt+nP7)FDl&j;Lx=$MS58aV2y@R;VY|HiY zuov;3(FTg5xoIUPUEh4>x00VxD9$et#L<0S=z-S?9| z)}-pbbRanb2p^9Cg6_LN@>fr|@F50#7Fh|Kzbt2*Eg89I*DAZvi>l&S008i@3_c^T`6>V3zR&6K-3Q@DUtbbDGKf zZ;%C`$p61D`}@d{4#j!ayen(9@^t=(j!Nq-W9&*8^(|j#tS1CTMOw_?6Sv{lDh4--D1v zxkJ>TI=O|R7aY19k;N}tZJT<`*cK!+1>$l>HEE6bMOd(2cRsYuQ{|7cnnXMTU;SvG z9mkm0i0bxhw3t)d7QIb#4IBr;plbCV8RNj4yQOI!#L}p4)iG?o{8$ z(@^ZnSzKfLVu=vY>(kEJhR@eU z^~HDwko(4gp&_6u3Gt=)MXJU)2#uNPGu7UN0-dF*T~^1v*_*D5Q(7qM55;d)9^@W$ zu}=9I4c%sB^j%%r^w!6g@5PI4YYToF_>8eGS>HgTPHzs~mc6*>Chcc4^I)^->wZ3^ZBx}jBdKllM<0oq{TLf6xxC6q zo4aoIRr>qW#i%R4sBWzxIwSiokagRGW^ z9P;DE9BTW$yWAz1z_#KlSPMzq%#_p<34%FZMYeN4(u;@bt;qzVsSog|>@PXAKLi zpNP(&^VV*y+Ttbh8#IM+MZ=#zSw@kC)lbey?&akSzDU=voKotnFpe%ly2$ZdaSR<3 z!ZH7U#wE{8E&~w!HRZdsLUX~eJFd<%6Mi2uDv*^~Ho%G7sNJOl2b~NsFJ{j{B7fAC zHmI)1u*=?SclKxa1uQJ4px_Z089^XD)+-3gP-|5m12Saukik+Ca8tw2Byy&bVY=Lc z^*dlnXpff&Wc-UZR}b0wncXP@Tp!0{bc7;w2+2E>d*BF?c{GZ=?0MVsH}JNdEC|i@ z=2r7-v!ZD-2=6)l5&ZNPy|xza$D&`B&H6pCCCcxd_xdh_tgf1=gbjXPvBv0D-cRrr zp^5Bw*SqL4Lu%)Q)dLH8{~$+HGUo;0cpD`K)mVZrDG`DFVs#R%`CP=r0S^if+dmqY zvD&crpi_NkFd;pXg>E20)T}^k`8~}%9d5hw74wqWNOopn33bahRGVnsmsrR!%Q-GQ zyt88<>3bT_Q3vAOB3dI=o6I_u#%XYA+cx%oH#v+VHqd4mN}BSoXJDK040Et5`UtpDFF}-F?{05St0!#V#hU zTpfH0ROb-)aC|9<+0}UgGaA`=0A}exE>fX3>|A4CI|~o`ZXPHy>@W#g0ZGubd*KNE zd&~RohK?hw&O;^lN02R{6_Xoii~Y3C#yJSMfsu4*@p|!o4a#&`p-uQy55&$j1HRZp zmDuyd0v7K+HXpyahnsUJ)L=M@zCS35u?c6_m{b_5_<^G&hTdws#^*qSQO+XKq%X57sl_{D>VZ0e`TF}zuTo3iIC9|_ z+?Btov24?U{Vxlj892E0KN8hIWowOIk?JkFAbHst$CaoTH6ME9t}RF+n9P|dMo!~q zR@7z;sKPr7aMyvm2*+4~SO{&`cg+C*Jzvb5e1j$pk zU;K3>`#;yI$^*Hcs7t%Jap$QstM~#$P~P`@8-HKP6NKk&*!t=l*Kx0+O?LF7m|7Sw z;qkBkNh|pX6L+&Hj!PoiwtbUNpSkpm?9@TIbtGxr;4$o$gH1Hyp!RaNizkVUjCNC3e5Jx zsa>az1CP`{wY@>F+Qri-rG~lUqbBabca;&Cu{1pmQ<|kCC)cY#+*EUbRLeIey``Am zDcfe%xUjG=2_WoEAXsR-x4YJUp#R^V8B}+9KxVu<+_%hc^`Nv~I{>laec<^gO#O)g ze{NDq31=vo6&+u$kE&!wak-}4auN45y2=hf7~hxsC1CG^JB$`|JeWU{XqH?*aNp^soQbKz$2;L}Q%5Dlc6AZQ#P-jxq`H76 zfqgAJykl1W&$3AJ09O2J?p-q6i1e8o(3F079`8S^{pe#9H;@soq>#m-F!At}fTr$s lqf>at7v4WR&?>=!Wc`SGQ8TA$79Q{d$tX+b-GB1x{{RpD00jU5 literal 0 HcmV?d00001 diff --git a/.gitbook/assets/posture-check-defguard-client-version.png b/.gitbook/assets/posture-check-defguard-client-version.png new file mode 100644 index 0000000000000000000000000000000000000000..03d2bd37b8ce39f50785b813f576d500f1e3d900 GIT binary patch literal 93294 zcmeFZWmsHWwgpNE1Pc~Iu;3Ql-8HzoySqCfxVt;ST?=;$QnF#@^-#zc& z`*->FrdI9cHrJeE%w3^!GG7tlvEd;gAP~jHgcTqlpe7+8Ac|sswne zp~hZ!@+I0eaL^h{;%;JFAz7AZ%=JDmK7Ka7XTHbKWbq3uAAInIw@*oQSt8A);XB(0 z{>kBr5E%)nSTd2A46{#}O>Id#bFamr&K7Yqa>sgg;-QRDP9fnxise4)4D=Xf#n=T@ z_kC|X%H}$DZy=-Y=+gVKzZ<>br904eV8EXrz_)M?Qk;gi*0lOYwg$$uZq|0cvp{gWae{-^#!mVKZq`;dj+|~hME^>`2@d~$ zOh-iUuOv>EJVa{Jas)!Q4#otmwDh#}M7;0>1O(g;MkbsJ!lM7l4*teNWai{#$4N)$ z>gr1C%0z4HU`ofp!NEaC&q&9}NCQqm5VPi)_2Xi|ob6XpN z-{tBX*g8A$5E1>Z=#RgDx6|0o{Lh+f9RJfTa0lsr$Ivm*($oD>HaIKy@28w{=5EGT z>cZyM;Nbz+!OOzT#{IAK|F4)oYy3-2wLfz*FfuXyHS1rZ{yVF(qp^dKtu?q#C*D7& z=0BPL8u_1$+;qRY{+FTn_c;ISDR`iH;koJlm^5B^Rm)XP2nc=%abW=^w>QU`(0U)| zZw8P9`0ZR>VNXwKp~F5|mo&~if-H60y{|hu-~-{E-@tzi`{-(JpS;n%%Hy}=+mXI9 zbZip88c-j2mg(ZUGrV#SJdV4+$#9(B8A|8VFeBlI{HF`+4sDHZNzX>yI zL;a^%u`XnAybnZ8%0CwHCGQ-M;LV4BxcH#H=(Np8wpsCzPC!Js6a5 z@qbK0gbn(~%0HY5eIrW4=cgw7$0Xp+!~9?8|F_BgznTBPW&ck*ww)bEnZNque!i7(#4J-9=>i780goJfq?t->H>;>BU%Ew^t0>yOVarHW_^1(!t##4 zbHMSVQ#qD=%W!hY7adLfH!jo;!CgQ+1?7BV@q^>0ZD3SjAT zh#}&n)0mScCgh4t7Lw@ItL<{@GG`L8SxUuMTdt+*{9%xO?of2Xtn^!Fa*5~m1WG@n zQ>pwsoVA3s83|+K^($2_lkk6c4dh40=cPs?muVq{S?%!VqR?q;!dgC5E;H^QPGs9* z=lJqLOde7kB{Oe&u+OV7^bTkLWaeBXFh8+A+3DsRKT>+YrMP_5am3$-%SHjx{9*@) z|1*1u?cktbwEFf0F*zm%rKpZdwNflLj{)*~9TOZCamSNji}R6%hF0^3TyJ!Qrt1O3 zBNE@2r@|NT<9z3Imp6^=lT;?-S<CLC=-6fnxc*Qn?$WSuZUeEGsVTSJKut+$C%0pa8 zHEKsYiOglSm?Guz5@{mymy>H1jYN|Wlfs=1V2ZId9(Ytqw`-|NOG$b6m{CKM>k|If zMKOXX2;bl+!%fEu_31)9NNh^upD_YU_2wsaysl)~U17T;Mzh1{d)KRt>m;4T021&q zd1S3s!OuebW1E9#O!Y(FX zKDtp#l2&qQWb%WP(n#4m1gKW0N5#2qAYQ!W-%kG~bT~O-$(_<7NemK19M&uKA3p6K zA3kTu5D}yK@C&#vvsxDzn29Ww652ZMjm3v!&^;WFdzxl(Hy1dUsbC+fD}AEVA)-p6 zOSY8v*>Y&(nmlP+k{ysrl^QyjHr+X1tc&AiSJP;;p~+1Y1UBuBrITaOlJHhu?2bre zayl2tb$@p_n;=vNST$R%cdQPgZo3#yZL3u2NK>j5>j}!uS89`AVo-++LTr{`G3F;< z9c&vEOaRns@(SxLRjY>l{9%9|u|y&y)=Me$CE#u27Qyw!T7yE1giQA{B|e9PFbXY# zqa(ZXMScdCZ}%~sT+TOP5$*UNU!zm4A62UL-k47{g(iHF*NVdBBBNpf%?BakSlP!V z-(Tz|l1ZnDl_-$zE=+FM+B|EV*#6L(b-Xlf(vePMjkTC9g%fm3rqw>QU+Y*>tyB`X zn5`tezub*)_q-j>6A8x+>Ns5XMjuX&UvfT7IcoECZ7Nr9RdG39&<}sBV*-p*ci0== zof-7@eY%4)O{XG>(SU=(kBkdZV0f)BT=!P~9;F>$9&ga8d%YcX@e|UVbb3il+>uP8 z5?yY*-s6DO4a5Ss_=yywtmNk$i7+FuokTu$S|T6bNT4W>)JQR33kfmll7>-?^=kiN zpCA*DJiVh_AOY=JnkWR#mkWFPiMr@&kNs*8GW9r;@E80+>B95 zY(Q&FSt;*gk2*n}bkC2smm8*B3yrqf_15!isLDw+&q9o*V^-n7S`%OzSveXG`>oeK zLfW&X${=YqKC4$#+r#0J3Evt)2;t|Mr5M8K;glLfU}1W%+N$gQ1^U5iYcd>=$9^k8 zsaS1t#{Z7V`4FTa5XfgM)PB0!IKDg zs)_50>w5deT)ORobe(WzeQ+>0QRg%3q#++GSa?%*M!bkP?2lnpS%u4lOm+wjx)G64 zs+6k<_&hsjghje}D`XgEvi`^`u@s726hgCr`s@t0CUVG)3Pu!!N|uAoEk=npY7>B_tY4h3-$v z`DO1BKap{~C0{@HP~U}N3D!nl-G9sdM=st)wYJ4a1L2k&L-`MFiE!g!f%lhlksp#m zgg}N+q6AM-o)3A&x6_d|nNBxpvzIU4aes{C@w63$XS&)BSye&D`%0blEr?T^Wl$rT zwz0X)vs{R~)$>d{>YE7yVR8G_RQOmvq>HaY5{(9PGvKlE*<{a;)(@m% zLttUx4R2NqTVu4g!T|}QZ;X7pH+B5n2ysA5SGwkGsZymtS7mUz>bvZ*JrD`Ji&-AC zKD*PXHL8()gLq9K1i491DzK`#A_{Xvm)pWmNZ688;WpU{$sn^=74N zZ|eEswfQs^iZBahLT^&t@WoxmlW+;vY$5r^E#eVNP_+F-KH(Qh|#D@B#7WibWo7dSHnu z(O=9_t0J_mH`hCA)wE{E?UvhYy+4-8=r~8sVYl(k)3tW4qPW3yTxZ(U?G7*6$LDF& za|j*hd+;vNb(;T#A)+A`pZ@pbrG}AH#$CxzbO~0A2J8e@waR5lG8}D%6DD`2*+VbS zkD1SegoGClmQ|@I@;^jJwn!zJ%Nc2T4|)O-Oz>~~wIwtJ5XBolp`zyMX9olK+T0!c zw1ZHD-8}u0SSnq6j zi_f}!Uyo*l?m#`zm)rr%y}`&hH?W%xL1#1KXxrQiA6mwy3#F$Q<;NFHOyD-hbWEea zFCd1*glpeIy2z&UYPTYL6q6=pZjJ$b2=4&4JSnAJFe0GdMR$K z{AO$kEK^u+)r=3yalpCB9$2OzU9+%L;UPiM8i1W=>6z2 z2B<>cQF08gM(MG`UvZybRj5?zYY~uOsUcg@zV=-4-bh0obwzPG<{AQFI1xXiz3U0EvQ`Af-S$OMIGXEl!{%z?@3^6ld@ zT*ngEDfmQFnIWkCC~ z)nRF1b;UAwK#mV3YjcJD57ATU=KZxtp148Zo5lUKkGy0h?O#P!i{;x}>Jac0#(8fu z>LL?^@v*mRGG`EXKH*$co8m7F_*gbDV_?0{&7O;CJqpCosZTe#AMJc8h^Opx=c>0_ zoH|~wU1ZW#3%)sFSy#`PpZn(LYJpcbzcW;nl>~!-^^t%F=?ue$fEgoi@8OzZ{$udr zL~i>aYW6MXI#>fUqit1`$xPD8t&$Nq4r?@B^uFcUu*dg$eMWW=BR6Yu*bPfPCR8Mo z4%q4KxN``o!^pC?iSDyntmQHWYR@Cg8!yn0qfDB%AMV-|7!@zcOU=!DX8xe($n9AWiw*rLkWtu8T$pBFi*I@y;_iG~W{v5HN4eR-SX0CWw1#eLA~z}#RxQkBGTH+tH02HZ&81K} z0kqaI{n;=)NjjTB(dTY6*lpVm>4vRb&jH%jaJIRi;0;pCm2F!(fw4bv3wN%cfEk*Z2p7TsPn6|xktw~7{4A|*S&Gfl;?>3(u4RTI#u<0MSN=O_j#b}g*7c^-5{41 zzrckdu1bmVOV-Qs1&VXv^J)JVsA>ZTc_n;lpK9CLo*vx}2WmM1j9vUPj82DdbvccT zBb7*TCK^!g20xEEBUw zSR<^AF-1(u9QU7bmiqeo3bjV!MfblZJK2vqRAe$DxO8=Q&syr9jYoeyrU``f@;K~W zQ6MIAQ=wL#sp)!?0g!vB$uPbVUVT6#A~BInreW&$(=r`p4X>VNDjF|^*=%;hi@RZG zuWa8ZOmR7yn+363Y0`>s6cRv0*LI#4k&j;7C#Q`Fozn3jas5po`Y8#5;oSMaa^d=PX))VNDSg&aGHL81tEliy7ufEy9LRV&Az0Jvg*G$e znRqxRej?-~mJqBV#9d+hGtM5X2y*Q#;{_K4m-I#})?m#>m&|&b)!}lX_dTQGHnA{< zj{Ac>!VvU3kY!rUaU7oZCBhzEjAD^2*L9O1 zBpZugr@HXth`K!ZAL=Ed@maz3cnl=rZABU+%NaJg89E}grMrOFRR^K^d(1O2A!nVnHUn@ zuDV9U8@?8ectWq4STEJHK8|N`k@p7sn#3KX<31!&scQZFaw8%-K(aRAfvzgUYNhEI z9tKQj!w7M#-q>)ODp54mq!}8)Vlr{7$6|5F?}dXtD^25c4jWD3l~$?HA|(F$vLnCl zY1lIM{gCy{|IF-Uh&7Aoi%QGGsj*Bhn6#BKr zJ$Sg4D<~x=iFkH|~>JhC~`o)~w*qZP6Ny=B8y2T9w*$lxqyJBky%=#U8SmOjp>) zOD2>{6wsUV_1#fkR4OzMym&jl^nAT#01iNZARo^@vtewhy&SpN5)3M52XJ4t+Eb&NdEXY&=^O=&_ zd`gL4(b9lbzo%*|s{;MDdms`A*if(E3h*wQvj$q_W+OcdKU^JHyKHAsDm4{X7$o%u zBPQy!d-PKcUTf5uH1PA+0X%PQ7HbTPHlyI^%Qv&AblL)j8iP_5=gW1_L7dxJz4>ol zzQfk{Uw_eVDL)sJir6oX<>S(cFuUE7q#MD|^$JzShRa8S#1_ZHz0~ZJcIP!etMb{A z=5Rtv`x`3wA`fYA0p#P1z}emaTTd4#h@!8IWRrf8pE-spf-z*-fCWKVEXx4PG96`m z*)Ld(M)Y;|8gCE{0_c`;@o15e&#wpsv&zy~wgsi))AR8Lg}#uy?@_PNXy6V&OK?7z z0>YXV`>S)|uv$>V4%G+Ml2e7U(M?dj^O*gn5Sb3R4Ww7VKJNK1b++K zzCQI1Rz#-i4eAfIT@dxDaM&F#f&ECH#&h0OR74O!6VPR%9L*debn|(Vw`A_*W;t@h zblDG$`+$J81-ia*&1bOcTM)0u)vuDgMY82g4+0bVr#9$%Rb6jzYh?P3$`_8n2eS|+ z?EvW01cAlPuf>tn>W!YjaNa7WQ;x=O?<#S*R`*b+(kJLa9gld#O^X-vx}M5Hw&4rX zVBx<Ej%dY0%YN4*)H%$~*!ZutW|K+m_(2Eoe&Z9IkX7zFy>4%SC= z6&Kwwua_uy6BrLZzcvYL?G-aN{GZS0Eps5TxEsB&ZrIEg*mcIJLcZ$ya0q_*@Pzc4 zo!~9ZDi+A?4BP)!O>nRmlYRhfPLZr}@Q)r%HI#{e16h`%usy3QDb?3otZIOb3Xo!i zzv3IPh!FqXtPuP3CdiQtL31OLp2_%tvB0<} zXx2SkDfId~98{@l6(KbIPV#PA%*#Y>Z>X|tHFa(^S45dzY!7xvi)?#ok5c{RN24~b zzR|2R*pVcb^b8)?IX4-7QE^|DJYk0G{4&y5R8$A4e((_mz_B0GzWxn_`s3iEkodNlK@k?8`Cpp-9}6&F6!Jh}Tl_p@3sx$NTjX%A!qA0U zqm88Uo8=#c{8!)&njX7pSFu{`-z3AIxc!C-X_wuY=JoJp+uwMdztG%}WMG3|PpMq& ze{VI3T^X1=cPZ0x&tm%Xru(AS&fH@`|k07!I%FW2naYRsc%FY|KIb$k9wlge!*?~zqgXW z?;Bh`LK7KP+#fY`AqwXRhZ@9jx#ERJMJ3Ia&9Cqix7Gy3QK`~WsMiKyDXFQYXf@eQ zmS6srNF*?a`W2eQtWz%iuZguoKy!PnU;_jGy?9kWz9J0)Dm0DeMh_GkEM|`ir@?ew zDvxJjj_zm6lQiY|)qTEMKjZ7maXy_}6f&6%J-5#sUK0mLt+t)<2h)Ya5eL&5-oCRE z-QS_1s@`Kwy($OajXZeY<-#D6S6i$!o$I=Mc9HsXMU`ZN=Xb^@(B0?XL+VT62R?1Z z#xghxJgyHJzxG$j2KzW@4?bG-!Il&ne0~VjZudB8d61-uWXgZt?<uLxdzTHy0X4xID+QSQNqC2Nh(quFaFx`2xi@ro zju!X6ROE6ms%Sc2Tye(_20tex3AP`6j*HJ(Es|0mS`alT0KR;&mK%1tW4pRJAH*N| zDgOf)dvmh<$o4rl_|FCAHzWQn%dF(G<)ZxGyY9sR5^R?zft8M7E>H)#c8g2A&od1B z*QbRMO$tqb)y1`{?$90(M_O#FGIM!%-rg`D+&7u@$seM_(O}Khs?mB`qX%G>q@Rt% z@(89P$$p5wPt9(w-3KnW=NaRMa!yoN+wgO`18(}LwT@{P|B$P z#16OKK7G~bKK<_g>2foQKXf<=ZS02$5WCjoT7v1uALa&5@av}cJ5R8xZPfeFV1jF_ z-RfemmM^(aQM~D)abva*C|74puhvcQy**)*nJla7u(~7my6t+wyusyivKy|cy&5Mi zTz6gbk(9$H?1(3qW_Gr-9(d)P(_*U@;@j|jeZJ-Jb~;^Iw1cF&<-yRX$&0|@5_LIU zFkuh0Ud+4QxK+sEe^XTPxYTGdtFQ;mB-RVq-oT?)E=^EOruuUc#Vo;1paGo&nM_7W z%>BKN!c>WgcZUea{`mS#Z9YBl z)T*2-=&qQg3mpUIDbla4)VGC;^F+efAN{9c(j7ur)_q?qrpZ-eE)n*tjm{0wHz|h} z9rs6hm-in*okh!7Qt1~SqXaxJ860&ix@rPN_~oyR9{F{d3lg0^-u;?ReeOc#7EAS^ zN>%cbv^rOru=rN=v}g4yxn3Nptk-(SI&R=@mEMn@T?YgcyC&NAVKculR z#1lMSO(RcLT5BFNCg}*NbmPrKZiax zl59KfWkk}FalvMXUgL7>2pD@OKt+uOh<}$15mMm~4+)6@+h{ENfZwdnyXHL|&yz%` zPIpxphbXBM8pmv3L5H-qtqd|xhugb$-ls=)~P0@3GzE1e;~UAG-~! z42z;pE&hVK`zc9wT~^g8d8YYgE{swbUSnLROhhD|v813V@;N7Su#!AX)x*g3akE71sz>J?`LuNh%3<1*38g$tppZW4>)Z> z)~FJvYIfUf8_i%GyGo4n*1g?W5a5QC)^Le2mfVwA7-+I9bxV9H#ATaOGjJRm`L3=Q z@ihkT!9b;c0oe#W$N%tD6B^LEEZn?kh)TLh&Tj+v1>K=EKw*mlMAZ%)OHnmkw z=betnQ|H5bjf0&Jx*hj>nrL|89%sKa8yo^rGbmL{kIPENyvpmbGs^g(W z9W>wB85DBLkSBj>0^DxMWZZRiKRUs*uP6wj?m309O6i`9c*><@>q91NJrOw($&4(AF516^W?0(Zfh0TW)( zZ)6Y*mT+BzEnx|kZQPJ+Jf0Rq{o||DX@{pf`&0(Q!nV6D$*DYJ1P<4mjEj(SwYuwS zDDtCr@L|vDz8%RXeJ+HI$k2l~yrQ2Cpb?&W#1Cm+w_ER8Mtlcq9*Qqou=uO&DJA7c z1v;BY7n>QMqy@=j@wtj#`W!d3<{PELEBufV8j53Sg`?8y^e8!AXc?k#t?Du?6>TR| zXcDup^R&G~QfGEe3sMtFJ;`Xk6zesyCRIK4a=4!oS!^ekQlZl&2@Fe0Fsa~5!SJ5b)DJO5f z+)>@6QJAZI5@M~=rD?!nj)zYyP3IeZMD!6J%jTnsA9&Hjqf7%FQbWU|Pxgw8_<4I8 zZ5~sMsb%`#sdZO9OKT3+OB0*#oaH_jRy?DB-j&vHj{6=Mo;K&{3Zmb4-}H+3qTV3N zL!p>k%Lp`Kr=Hkusq*I`5#%VFE2i7z0!Z9^ZqAo3$^!gU&tmscGLgbF94m5pHc@C( z;((je1ri30Wxk}Nj&)IJ-el}SzvF7OO*+xX$>?A>?Hi*|&1#!^0r1v34Sg8B*<95ppb&jZrYBlrWpsh!YhG0NCh|k0g&ew!kGI zW6zW?FKDepI~M-*Yu{8T^eR@WSnR6qZ?D-JhsL{&a757_Qq753TaE-?EH#wXT0VYK zZ!wE1nev?QuXQ+pTx_roUmSRzEq3?Bx?ZI(@)`-6g`}&XN~RmR67T%go-B*aY)#DJ zxUXClHd3n$UG4nfer|kbb>`e&dD!sH^-Fn_&UhMU2kE8h&#cvDZ|CjfOV{H7Ui@DW zYhN0!)JP?hlTi>s1N+u%5upwO{n7k`-^bMt9CAJIO;BL#B{4>)V3vtZyqaLfvN()+ z)AjI5_F?@{vVAetNUrPL?lyD~$J?xyJUf*ubu>X0OV}S$CcTjCyjR{K%eoaAkHk)U z@q)*LO1X4CesUd|E&FvRVsQ1fqDd#;40XTW^<=3)-*+)%MFWK_MsgUt!%`2nvn*e5 z^0$wYe4BCT2T~xf8=(My9jnI`-8^Yt`~BQ9nbO(hSNzE{U?AnMMEXrn!0YEjxIJsf zy*@9tg=bR9B>J+mjao=-moCGh?2x%y5y|OKww+Im1M0y!N?&f)5lu}YsBo7WT`gE_ zRu;%Xf`MB-GS<5_+Xg;L-8aLDWuH-L3=1Ow5?v#!o10|Z7=p@mg+Qs+*4d-cr3qQX z4lcqR4Szi|;7MTAXCoWblPhVX~WV6E{;f%B2do^4<$WnLC9?zVl|?ll^*Nqq`mzVsrrF2`Vg&FfHf;}V`6DP_i+}Fx5AA%kMYY(>-meS#4I+_HPVNufmTQ*xQRd(EVa)==lVW5jm2!14hr>V7 zk$y$SXN1IL=O_6lP+TnE7#rqmYBc?jh~0rrP4fX39T7>!7K#d1`b@OQ&4Ww(WP$M9w! z6d~+i49{4V`u)Q!x#5Qm>a?k|{!rzVN+pCxs&w(w9@dm9m4rWmFp}`u4(O#~iP+AO zT~Kc-7Wxyohp?2y=FIQm{c zl}&Y3D}{@He!iqEY%cgv7hba#h^1U^M_yNjsliZVBKIr9!E4ZC`7QE_ZCvj<&mApA zQI_M+;CHf25iEpU_>aUPG>v)D&#^yG`Mmccw59D*Su8&ljRwJRa>dnbozfAmZGdpe z+;2wJ_suY9we05NTQ7Q%`O*qE7Nss*2thdS`DPaEWJ6}=j(Pk@d-P7c^)HhbJ=X5U z#xpw!u5p+Xq|;f`E#C=z%8CR#BE|(G>{+_~ng)~%e#o+)lgZ{bR|QUad#`fKyQ%Oj zmut5(w~&i*t`8bV)nSw+4s26p$%T#tSj!vHb?>TA`#XPU7EF4(2H$0 ziD+X7r@ps0^u!+sn;Gylh6ncgml~YwKGLXb$P~|yj1CzBtEP`sUQ4#Uq<9P|OHyhj zpxeC%5Jo(pyXz=h_rx88M_81Q^J>w{#5jTd4zpi7Ft|R!GNQn32s8>nbE%1-2OP3m z<*unfM_^>Q-iM-njZ~H2qgE%;?G_w(Yr2_HQg|YO?z>camqO!-bUnvmeRJ>8T8zx@ z@}xIWF|OBKICO0){XF~RkR=}|>?YIwi1f*wMQ~WT*kZ1+WM18jMOvX^e(>gv?PtrE zv7tHtu38UwsSxR`C+LE2VdZ|9mGkxMqN%0bl){^7bg6vWJlJd_b2LXgQC#>*TLmMj z6aD=6A7>2N%;pBPG~Fz^EsBew>4e=FdRWUf$h<*5!q6E@wQg%pb>khzz@+IAD=L*S z*OYEUcmwqu7bVl{bXNQN5}gW@=afgyXhgq{b9JxYhv=%hJ**W>%QuMgbh$^+ICwPR)Vb{EK}`Up>wOwzBq~&74th=k-x;+he(6Z8)ZLsl7c+223&1$ANccxN%B!g2p zCX>rG<>>t;)c2uKG;*+mF)566hnG8Pc-R4KH^tKr7x z^jVZ(F_F*DFJJ?=3k_lJ$K#1f>caBV{iXCN!^}ZJ&-hn-Z>v(F9rY?EgDoyJ@jFkm zml}SnmLSHCrwhr#!-!NSS8KKGD-4u@0@^yl&o?7O;gzE?r$@>izWEbklj zUT7S!cQnf_)Lf$lW&vU{qOz>8Co;jH8pE|2x6f99N8NzCUv6ZhzRD!n=o$vYWXyc4 zY>?wMIy|1ktFFkb*`Qa?2lM+4|5tamcynxcD-P%51p!{HhZ04Y+Zq9!dB~1UKQT$D%bpe zstDAbWPm}TDD;VH+nf4xH7FxZ)=E|)4DNv*SL*y#LA`M;||765b z?Wi^t*2dY|{>ubO7r$R|ReGrCYZvJc&hs81OGGEb^d@qN6WocRF(V99Ne#dw!KNBW8^%Oa2&8#edvaLoCArD~mFD0}4ge zN40?2MA$5?=D*t+PMi-AG}xP4>>Lav-t-AH#q3e75NH#?ENRT-ah&>$p(EL(dV9KL zBIpp$c(ni0&Xs9nPoocH9-YVLuG)b1HT&>Dc;Urwbqz|5nLG6c zsn87o4>Oy!$s)tgztjwhnWd6SvR+OccCZl;i5~7VR>2RHxIV!Dw|pv-!%;QGmJZV<3jEQzcUmCzVn$f&0Zy(r@>Wprd@qW@qpI3u95Y z?>|jUyX#NdlY99dS3=AdUUj9vyn?-TBu-bFdAL`t(yJ@%*N0qJImA#d7TcPGD2~`y zRb)&}>+#z3HG6l!{ABtI?-bPIoS*@Z*9o9%R|BYPa_Q}Tvq;}uA*ssbNgD9km(}@@ z`Ky(Onqw=NHC5mVq#H@r_1WBE6~d!Ud0ydvvYx9i8E-RMZnR~~h6!K;*vv}MKmJmZ z?uoW!x!BK^;%maYJ{*J-F)7Ms^Wxj)`uLi~Y9^=au=i8nq*AIF%Y<1Z?^W*lV;>as z+{@!Sy8r^ma(T!Na9-D3?NrENbBk1<$9ILU`jp4RBfxRV=lH{IJfc2L4wFO2%hFM; z1`h$3lbJ199z@yk1E{=F|C2nGtwBx*>eXU6J z_Oa|}xcR1}5De@kf_2RITbV37HQx!n=&j}6%mtcC6V+xaSD+&}nouP~O4X zTR!aQewLMR#aYo@+vBC$pWE!B!RF0B?2hj64@$ne!uJUU_HbdK#xeYxY zUd{6o*qHBFG`9D^VmYVuxNa0a>hKf*7Yg=_4-kL9)M#m1x%h)Kv>OGT=p5JIF}Pdu zY{q;&YZaOME{4CYcbz(({P|O~;<}GLUr)-|-Cv#d2+q+71kc4cGJ-Ic#38K$dpO}B zJ^(y%E_?*|(=U!>FOGgzN!7l-ugp;RiVR}g#bPn))gaC^%FzV19-E9#1*_>(5n%be zxxN!XqTxP1mIo1H3hw1yM?X)dUE#*R+jz6AiuZYWT>iS!pRoJoDK&l+!5RsF;YTiM zXmG3=9Sbbo9DJD@G*_O!MaM7$htPU!Pzp-nVFL~pa!YpSeO~}%&kriOGP&j!k7Ff8 z+X@b{=ydDg6>XG>xe5)759__Xpi;@5y6daZUUlcHJM6m0j1}kC!)yM#E-r%=SzYXR zXAr_Z+?c2H#lODnr)@3aEwoDBlqKgiqEjm=nfjj;qhXJ-j1HK)=_bH?H5{_CC=*_E zQ%!2*5|JL4j+35Jz*w~gAmtD z`J(P70#u1RKVO8ZOPW!eGG`O=hWASjxRY*qLbxwQ;f3C3Eb@BMRPEROD&vDKT+6CW z`PsMB{k*xi*<3Dj{Kj9^tmcEURm~oQ)QhYCv^b@fJ;JY>E4x+Hu;4Z&u>KS4dD=ez zDb?8RPRAVViEzB!I4)HDjeKGd-*=0lESKx!WvS0ix$%sr`9;Ez!}>FFiaJSbJ^t1* zm}D|3`ze3@`Mdtb8(5NG>(~Kv(R^4IY>_EY`mo+z+ps34mVNFs#qyGuvI9G97dJ)@ z2;F9`3XT@na?un4;u`*Hf%JmZ`Yz@ptC9h+M8TK?C#(U1fGMb3z&h9=WNdWF{P6-W z*!pqV7Ht>oXFPYdnBv=eZ2GD0hrx~9(W1$bAy$b_*WAi{*JM7e;lC2Kvm=>~3b zp=O)AvO9&rkf&78%W|o_8BWz%mr6;a-Yk~;X#yqsp@WqkOXT&sW{1?ASp8~5k5f^&~XJW<$8Au(JNodC6Oe0JwKVM9F{_A zX9Pk%AFXOh|L3;==tt$6^??r47K|4KzZLSY11xMxhG&n=kZRK?a{|(J zv*bT{(+mgD5+%zAy~ipj97BN@vSD-^&fv5kb$d%_{(LY^9uX3V1sRKpug?Q}(o>!b zOVtMjzxK|S*|sr?R(oZKOcg?Zaq%sQp*OA3mJo6h1y{W11f zicl|+WFjI2BT~&IaLSXPdt?Y0M zAMY=OTYSOpPh)A+DI#?z*6opYIE8uWm@Jl#=`w}YGFS;r`ri@ivl_b%QK`WuzJA;) z42)?^4uM-lKetj(e3jY|qiD=f{(X9NR*Jshd#QxUjuBik+s|=_z1wz0YqzjPSH_{* zbZ&}-MfjD7yf`RGt9u>f&$!F$`^461^<4JS|#gF0~b30ZAVy^64);>@uJ)M^Zh_vW~X zQ7-g;zul$?L$y69OHa2$K&1$XI8Uf0^de;*B)f3zZvF5WgGWH93Giwjx($k%{f^zy zWAEgi96I`9x0WpG>5~KEHGb2YZgnxf&yl(!WK$n~fy zpPpEOO}-1`ok*^-jP@L!_qnxi{>!`5C6W9wL6{wBOEQ$CV?_=PoMgTzc%u5SY<&>{ zKONuMmV#edDxIj)nJd2|UfU#)*bu;Oj*Mx;siUWTHO%@r>5av#&ILs@8W-ww_PyyX z;rlH9yFlD6XyH=E2fGMf0+U2q42wPrSX6rMnS@C>-U#!1d`Dac*gS=yT6AeOBMNPu zIjq$)h-ky?8Fh@?lSRUQ$%MoUYzcLV_+mp9F%s*q+HMn@&N@75dot-cga*l5nK)3j zamK^xmqJ@Fc0j^FM|vX3*sZ;JPzhSh^j;h)Vy~+;i+68tfm=x}S)bG7N=YFI;XyAL z?qf^@?sjiJ0!l#GN4gR`{t@XfX*_dyKxt(a)0}{Bp&1S-=q&N@b_@GHgo}KA{M98n zIv(yU2d@s9P(;4DMA#4NGdqD?RcroY1ksl9(C$BGm?mxzZ6m>mc|3d;pb~MpcOfQSXi5P_?-`D}Avvb#6{*RD&sbp#QBjkDECI#eJt3Ow_JAp7eKSmyfUO5V z@-`%U8x-^Tiic?@W$j+P6ZY!2^DpH93T@t*mBzD$fZ+9>Ma5B`OP`h{yMQC$A|wgZW;cz^{H^73Y#%t=ccKhLKEA&t9k!P~ z*S5dgc;hIOV*Zh^6GoW;8chl-+|HsJScO-4w$tY-uQ1^6n0rqSp?@%uD>UFq#Xv^} z%KBu^ZdRqkBTZYm)gNxz^W=AUJtzK3Gi+7b%U4znTz~6-5q0ob8 zeWKQC+ECB$xF5y=cmQ0Mo$4imj&@ebT5xo^)Gi{x@s8IKW|nqBLN605dJc+8ha4Ki zAZdRYIHqyq2qpQX+vfy&)itf=c&Od8UV7LFlUb{Bv^=AGE#5MSDr>{BwzcK30SV64 zlY-;n^xerry_Sg#cO8RqFrcjn#wa8qK3T<<{Fbx;ciA8jm`SIyun-98isGrH3S5Gh z;NnXbl&q%%<&r?@E41Tz#2@1L*DC_{U01P2xLUCo(=3jG{gV+{r^vrE)=-2Av* zwxy~s|BcMp!OiPgMyomFg1+G+8PBfOBhAbRE>KAOGrW(TT`EnLBysIm44SCh&lXJWGjKjxQdq2Y3!&6t>@Pgi z986@7U^JUkwAmRWi>J{*#X(8Q&dQQt!fCf_lomwWH2kY@>d4kxiw(wc=Bqb3@!t4bvOL`V zzUlniwydrYVTNK^hl^RptzPb<98T$Y5c9woCd{#!|Vcz6Hml z2C9%r;e?cGN!siTk^w-+j6{;)o!uw3@RcgV`8v;tc#R`V)p}WP#-0j+0~;IB2mkN# z1;TX3Yjq(4;Ka#ty+tI4Gn}vr8tBIVjJ8XmHVK$(6f`Bc4Y%B|6ljcCR%fAV3fZy3 zR)z>{SgJ5+#9^(G8fOsfsZxT-lD?ZTLCyn~7fCPV&Zi z;p9T~nUeKujvpn#h+^D8aTNKD0(}?J;at%=xN4->95VlDlO4zreAGaZZ2C%@zS5dM zr9`8>5LL1BXdv^cO6uE0*Eca?Yuw>oVDYCgHm}t=T`-2O#q-fp$@)CSza(zXRDD4` zyQklQhhBe#2ywA4pfsNU0rU=XBng-#Z1h9bf85KhdGw-#)odDTF!oD`-SOJE)negZ z5~~<9XFBrRet)K6oXxS(fTRDuIN(9JWHpwFjHx$5ZMvKXg1f-)3u~sPj{PAEL(qol zj47qeAtCeOvJ{DGYh)Z%8pYF@v%JZiIpqWB)WIc*Nk1ip&Auzp)SL~7>cmE+#xWj? zL9Hk&8dtdQRIa^;4`;x(3^qJwz6Ipbc(nbCU2$wnj+MD`74kP{0NG%48hzg?EVi;@ za_LUBcXisc^alVCv8)JZ&Bn>wkU5k@Fd#v`D=@5$mdfUELg5UD8s|o?iObe7?j%(z zXUXmn$D}3+`$3WhjF~7^n$#A4h^V|iblWrEVH8L8Uhkn>A3TtwThlIOw_{1O#GWss z^`4m|4$xb&%od*pk~7=?jek%wKOkeXkf$h~)jBhfB{mt)B$wF$*}Q`gt4z~aS~dtV z>#R$^ST59r#g;1fZhyXFsWT@}`$4J3%UrHTGB;hKvx8+L4OOes9>MU0yMRGmdc6XN z@#PDcTFa7kltZ_k40w%Z(XLyuX+r)lM)KcY0$hXli@=h2i9xAT*Tuv!iRFtMk5kk3Viv z#n*o)G)!-|4mexco#|yNrnHBQdEEg(d|O!}-Y9B-t6fOzTT9B!EH`*G8ji7M{K2rH zxo~IpT+!*{PcYrk>j_bvzj(Wc{CAG_KRrT9_^U@UBgfyNXJ!VqQI`6D)|{LWuK%Xq zSdtlHeZ?TqzdOr^o2)y$%hJu|$XchZ#3V4ODj*>K(s|&mATGLeF%iH?IyZ^uMyxl9 zHAiFQ&R}|4sX{jzN1_i4fq-X;I0?2vTywrUiP2B{eu^ z{4>xfrq6wDKvkS+BOqQ4dI{^?cMPWfRfW;zx7Ds?-!x~p$T*ng7LVXrufHS3)385% z$97)WfQOzO<5X0`5X1Vf{%-V_Hr|mcE~{OK882j24Agfbulq2y!EI~q0oGA~qVkn( zBYb0h5Ff}AR} zrqQryqbVdIc1H}#CbQ<`(_~LStsAnFgun=ycQl0^E_1>@9C4_R)I@yr-Mm2o4CQN;WXm-MB$&ui*iZrRGXDgd7Js+ zy)MbAV3LNt)8RIq3hjfV+yo%zaHK zF73IZPhwvM=}SRsfXP5gZ?sw&pt3utCT$y;dv#t_eL|P`s!NpJ5&t`;5}30yRL~Fr zi?A{2|EM!?^i~^w{uK&DM@fb8gUA@Nc1A-Vd{WIEj@j%87_BQU*F19})nlxz+;npA zml`QaQX(T0&ep-|3kiawC46o0)67xLGIb>*F)^j{ofiy{QlTu1(Ri{`{QP_WhceEG z^?cT4lVy!xQ2a^2u%n$Cd&45D@pv1}DHQHuCw$``^t9T0rd+lE6v=8kB}aaH_*J-d@}xCb zzhYOl6;JH2QGLAfwXx|qjda~9m+fJMVL~DHTk6|ml6-u}^!odz*pvOQpm@Xb6L>;GVQV|aFb#6?!J5vQ6G^DqGgezrr=VRI7$6X*`NC;lU*KO(X1F%0|1igxKK#0Hks$CsGFbw#OO+0d)0TsZGR z0;{{nF!(gv<~mE6%IYS&<2kARIGJ6^^zR0{CF-T&H8Nv~z=)o2F5?8;xRbBdDd-!RqDGlHx%SLiXM<>D{Al=nm^9;72C`Ds-uS9a&{ax8%OQ@NzzrIczR{mw|^&QwdvU?rbl zuy9zCeatjt@AAr8aXbApdG7;!O*h#Ku*mg()~K67&g@jeQ4OX5h|Of%^E&qFsJDJ6 zvp>yNN$kc2xCBfApn;ChE&GNlkg}oFqsgD|+2i#PF4?f=CdP5bhVy<3iz=PLKdE}m zn3yIJaFcTZ&I_bqi{~qXf^7yL9&>swUJAKZ#NEQQH&zh_DJ(sXi$AZqMI22QnH$Qn zkZ_~4aoKV~#|AsB39kt6~G}ci1D-5H9*%?&lB4q821(O=sVCWSGBPy$ zS>yIyQM%I8C2`A{QHPQ+#0~rSqK?c}Kc5V$k_nqLOVBsya_v@w@GL6hO_NktZa#U7kwtutD zPsErjed5y2`A8!`2NP`JGZ3tVjy4||@j(ao-jmRG0nqZNf=ELrOu?2)&kn`qfske5 zxNBMq)U|d?Eywk3HT}iB4E;_$9Rz%X$W@&I^M1YNT|5q_i!lAZV}FCp`cX;y7kmr+ z2~XJq*%);59F^jm%kxz?*@FIU$E*IXMw|1Fwrxi%Tq-c>tq5g6K4y~JodisMoWvjI zc){hL_nWo7OM_02JW*pYeHV~`A5^v#d6A@}L%6WVzs~X!zB`mERwQ3ch1+}`8~mdf z_Oz9UGSU_{CmppM#nxqh^~4JdW>oK`z1nwSYXxQI>&+k#>z$Sq&QD7enZk`f@tBW{ zuMh1me4Ke>jw0OJe$Rk0fcbpN#xmu2x$bt#f%nVPJu3W?Y2=wxQ@$wMrOI%Qhpsxg z5p6EnOb%KE;*G2Eh#f1>s~KFSKut;M*c0YC!x?#9e>B4NnEzT?dB^s)?}#d+@kqN0 z0_-929!kj=xKIP4{^VG|o z{1+x2k$!5<95GNEDb8b|q1F#`HI~7%n7+b(O9Yh`t2*P5=MVT?pL>~v3==QWMjeL> z&e~&l#4y(9y~|MNXdm`8UDW(NF4MwUNr4@n&3F@$SACZ&D4?LH`n_BhuE;k4 z&_EVcwfL1wSd!?`jRqv1Jb=k?58AT*c)Oyc?BD~N!x0GyV*r^ue|qg!b53isx9ZYr;jWrP;D+=`^=X_wK`ILaE|< zOZ}iWbSmuGhlgQp`~+B4aI8Wo_42???|zLiB@*${pXCfr5z$OlpQXwQbstn0k}cz=- zBbZ+;ETK?iDWAuG(s371tFlUCG@e_s>bO05nyIk1JyrXy~T0-7ov zV7jKm@kQdh9IG(&4L3mdJyUYJAjE3pw^C`VF(-|8vp%t$H6x`bWfBMgQ(xS^;J3Xb z9WPamo}c8-ml~}4k8v^|`_!k5k9lxEDej7=n{fcoLBjycHUcyXg&*!dr!n9{6H^mE zxhj{P^wa6k`qMTp;bvO32V2`3_$pIn2g6oDia2U|&{wYVpj98(RkGX7v!{r5=GB`+ z7BFJ9sMUr`C*R*VgD09)2wFaIdpiUt#k~(xe2WA$e^M96VVPPfKDBN>qpFU1`Ll|n}L?b=fXDwX2YV*{sD@9;WV zpMYJ%GU;{V8!1<4CZid3dT`y=1ITYULJML3>{#P;cZ`jTyL6dYLR5yen7btc8<cY_jhudLh+mbqK-Pq&MQ7?oU7v)jXK{EKS5K@Hb zS4HEd=;F|k;?tM*@W(wq3E3O71?*o7&q@o?`CF+Li3o7(F+%tlkd;9 z@gp*R?KVAUJW{jHOx@7;9n9Hu{xhk^;TvTzuE&I-h;E4f6Rfl$y8J<7)`zM1k@?gx zM(a}3t>YVJLHo0W-$FfD!c3&Xe~iU!YGqNQTwBhzq^PnHGb$gZEBe6;&3mYd8+{BOg!y$kzTe_d$7t$#Z8~tPE{!aC{wglB88F z65=3uyxgSk14i(taTaX{LtgGWw(W*9ojYuLcN2Z~uO3a$K5ioH`N2A<)}4HEgI+zl z#?4BbL|lw}X_S7JM>wq_?}EpC%m5UOu|cLj$RGRg&}!k^bXuK1MTqQ}Fm2CVY*lgH zWMXD*ml(&SI5_N7xDb}B;1ZWTX7+cvS&41Km zEU(*4dN20LwU~r0<&g^nbs}(B%o!ej<+J0<5=wL7C1AT}!`LPQ+=U_JhOQl%$`35H zld0bq)55tUW_)k(xY`baljt+s{2YM6ZPu{?onw8)T;(uJf5#8iMFh^4oI&_Vd|az4 zCRozw%>$Rq4v}*TQjg-_-!jl(L%?@U%oazDaUL+*l*&&Gx*Y>M-5|V<#vbtKvZ{)c zRC?X~DhVS@2|(ZZK(H-m*0|d2^?r%=u6QeTyscB#2rM(GcyotEuijH5Hlj3_ORwWA zE$53!Wj2~%Gl#KD>T2{aV4Id{nZje$M^2O9Z#}!5?l|TY1#_|6Pm#bFHN8NKUX_KEVRrmJLoK;+fb@})7gx~tH4 z2S*tDsHA78wVd0Mj+XvZk#-F0)=~_-A;9&=PrONQP}C#U90y{?*|i@V+RnFo9jV&@ z*4kEFKp;Cd`oNRdS#4Ku@bKY|N5R*6qRBJ8=`UcRhhJsj(c%Oe(P|aE!ALv}pEMc& zNO*fCC%+QFRYr1i;=RSYyz5xr>IP{tJ+K^hUu8?RfBr#H%#+gvftO%wx<+?I2SM1q zOd$BQ*PFkiI>WSxUN;CMo(taHw4gr%Eg$#_9>Yu3uDu%K7X4C83CZm;&X#~!AEk1z zY7Z0X1I3&Qd`55Gyv3!@h?EyEe~j?s^r^PVqJax*`JeOCjL&r*G+N93-8coY7%hwi zN=lPigdu>aReSnuR;{Cntcx7t-QBQwBFcFPg9O!v;> z?+@76?fJVeV&8?WIb08Dy9K6w0b()7B+8M2sclW=52qT-GZZIO#LDLLN0|HeAg(mf zjS6tvn+*Q=X6;EL@DgsEL$5_2F`C1!=QA;->(vg~#aOO*wqn&>O~Fb>{W_!&RyUAwu?1d zv{~1Xul1md7B0k3n^2HvpHt-c{9&VCH$uCuk|9o7t@B@d#;259jm40K7r$~G8KxF?-6@m(p#@y zg=RO+y+qXhjF=B zB-<{XM^8S%D8#&C1rGUUppZ%=_}3YM zKG_dV&q><{+uti*WXs!zXXViFx+Je0M?1IBv-ZaE?&`ig-w)FaNImaG*mSmt0ii=Z zz7|JXqvR!lJRWDqB>)W$FHZn&dWJE4wuW{Y6%R{MCaqH+P$Se<@BJItOC3$?(Xg<- zoqD|6ESH~XgE3%k)%HruX&w#cSsf1umz|6DL;J$tcg#s z*ZZ%m?M5`c#iXK?2TsbM?V$IUOxz|Bv>RW)Zx|YX&9r=&D@R=izJ+! z#K-sCcl&NzBv9pHuyT3W5GOvMby;n*@In+F)y&;s$_Z#^imcN6YyN6@51UyAC~w5~ z2)pMN2}PMwhza*Vd_CWo%x)nU0SLK?as0p_r-5c^d}+cg4O&Mp*x8=@#lxt#-98uB zi?*XSWNs4ytoYk3mR12=+D}P8@UbH*@n0@Mq_H-w{$sp7mvx=wkcvu5&X9~|Lbq$u zXi%FPI;E4=6fZ&W{pR({^LVVS`tk3QnbXNQJnAf$b6)p;Rm&MH2QX=U_LalL?5wH= zU}cuF_Msi}(?1WzSd6paz;%JzvNeU~2)2RPv;%GC*KAJvFjwxYNeo*~x&Gz60&u+> zUU$Rk965XD2^R~#Lf9OH8f@5K4dkdOKhw^d*`(}&kiV z#&+%#d2-6hvBumwz==qWVpduoroin!6^T5m z4eE7L?KpE;Od$h}r(BXRJ=e|NXk3Wno!w*JUz?86}B<|0@ZXxdHYl_kOS`uEv zD&`>wJ1ACGYMRFJ~<^tzdKp90T>r9?yf{$fAf zodksu0}D@}l1ru=MtcC(SEWij4*%ZgW2*M-tl|9|-q#H3<62H(gCfvg9S0Cb4inrL zO_sS^2^DSfoT}dwI{K2X8j$Gs$8~fx`iT1)ah(|nZBmOBloXwdJa2WWR<0~SSME@7 z;&!&zf$S-${oXAGaZE$HcQv~;SNgqveg^h}f_Y?8ng)tWTHnS?3B@>T(6LZ!}!~G$A*>eM9(ma}I@6f*~ytv1-i)NMf5BI&a@_vw;?HkAl29|EkZc z_A;2hdcTD$OFp5>AK=N&e`}$lvUMd_X3wG^;G-O23i0zatlo8UYZJTtsgLcfGQ_=+ zQLk#qn(FS*l&|HXfiAgen%v%oa?g6%9LD(tT>srXX7%6U!Fb=TuEE1e^=%3r{i~! zBv8bkvv~Na6dHg=3R_@|=p31WC32ySNFDjcWW4NTPkd`(l0Pq8`bel?HAwRsIZqbhHg269cFHkyY&wIML3_jX z0I+B{@A7=xW}2gx{r6R>dXGVlSdZ&YKpspuR3qp)BSuP@|G6Xve$(0^)oryXbAZ-2 z;|Yjxh?~POOhnf{9US~F2N02#rqF$jqsssM6~?HX`Z>Sla;n+@xT=Oii*AJs6uf20USYX;gT>8$4q7$P zU0OQf7n;qaneq8()w0AkyqHH_W^Q@TM6*Q2mO5^PT0?)Yj;gO4DJ?uEZ2@4oZ!~_?kVh*(X)$mz>

EFlX1b2EF*T!@R{J zDRhp;e4|(#tXBO~zq99ebu}dnJJ$uaThTviTPCW&`J!4%t+_u5XcJ>FJ;k8c21X$= z7llIQYowIO&V97m$!_OfET~+ZK;bZ?3 zmqH4W4;6_TsvNn!qSl;)B!)z^ADS>wJ4ZwDsdRuuq_9}cest2zHsR$0?6Gx4u zdi{{?SQPsqX)5q??crs0n>(4&-XBTu<-GXCrpDdiBG#o)+n;wknopR3BRU1o_H!ej zGjSAmSxgLh!HU&zsv)_N^3Xx%UB4X;Aq|d!k{_V}=Fhs!Psuy_4(Ee7H&K+)10w3XuCUBod{_v@OKOQa@<#qL75Or>%@(yulK=Hq{q`r6|4 z9ez2V(6iyj;;yTeO-0cE-HyFY?ivlP1;K461>$nK{N{DeyCqB^%(Hx4O*zTD0#K2u zCG+F@w5k4cSMeJcV?_m}q;p4KMYX6gyOK==NS=|nAP)wbg#5HxgoKaLlOGPB=Roe{ zA?X0wsaba9JzVFtV@&Xl(p3wqu*mAU(CX@;}42Oz;sj=vZWNM1Lu7fd!J)5FNiGnj#_t zw{^LZKe^Z6EWbQOaTFk&!!Y!;>!iY8j<-Kq4$dc@e|Oq2GYeavpP&C2QQoIN)&i&a zk{EqT!XeEkz|UPmhHgVjxcHUtphSf(M{*gYACm4NdKDNJb;fagqsr#=y}ae_Fr=^e zeGKV$SwAQ^jE`Qg5LQ7R2k2U}1=3Y3BYgEgWAxKbX4xjkh}U28E{;3QB4}Z(+h1nK z#T)X=+q4zsIbzoe8q*1Kcw_nT39mgfnS8aMWH?LPZgb0%w@;K2CQp>wA2YxFEVgJa zFQ3;xYt?UArEYP`bamdhA|~Pu?Sh20Fm>f}oAtV?kR6AE{5s-(Kl;%2{ryvKcxWX^fKpvW2FS3=$woKY$02pky5^CFde?KWvZ+qU`UFh+jynjlrc7hQb{s$UwwgT7&{A-KFqiU0c5I1uW2f_;j$lrr11KJ<#8Ky~E$Pj8xGxMF zfpA*Pn=2bZdXFDd86;F5t?Au%2iuGK6}gG4K1?0G*&%!+mdc?4>;XLnQ`v?|#%3My zAA`T>jJJbY&z0J5GarA>M-0v5xeB{qPxxHsuRqG3HavhqZrVO5-wQJQht_g~k=F5t zq=%E2X92v&8)AC?ev0SJat|4VpZw4_=?c)d5l>FhBhpe5zTMfa5=q21cU6w!iyp1F z2(~LPH~8GN%d`(Aqnw5m>=oSeB|eC-rvq}(2qLC1oum6Ji-Ai8_$Y5%a$XZsF5I3Q z__^`5l4Vo=iRKe9zLwFbYP!36Xgl?%ZP z`oMTf%V7GV`C>E0lN1@^zt6PH#I%XZ&CLS{4Dmb=%)qfm5+tM)6N)1?c3xgd9q?Z@ z&Y|BwQ(3QBQzi^_&YNY8rERXf{A7uEXLH2)T)!@=!xz0`v)3xfal6FH!ZM`cZ?#U2 zOE$+pt%A@e-bC8aANpg?JB;`mX>cQo1tHD3lX6D)QbDRgcR~rbZLaqq=R*R)cIO$F zP8T-aoAP=nY$dM-mwB{P01gXZwwQf1swG@JS>KmFu?o7KRY|$EttRR()Lg?9^fOHp zN>20I-an+@Z&mP=1GKgf8PbWa=N{5-6{8(_Vf)LfFqwxmiY(hIIKMGrUOR4 z_E*&_Q4PJt#;@aQ`;&54^Xq^>s_q}P|1j`)nm^HMc7Hva;xIVR@g|&~y^`WC+VmM7 z0X$zwZA6Qe)2Er7cRWn;uU~(>Jod1(2-174C~);*y{3N~b@G_)|DMbV-eE4Sv1&*B zLs-lhMHx7l9NsP&zG8soP3HEzn&1@|h>lGu8N7!Z<3BRHbVarTbjG>x>9syYmu$UG zGtYF{a5)gCtJC=KU~M_P>MzBYBF!M-I-BCoIDJH`WB0 ze8}_Zm!RRGVT9Yi#HoLiHZ(#5H%t|Z0h{o*fBZ+94gxvw*WQ}w?zr;oug&#utc1VX z0cM-37JoM&{$Dpl{Sq|%l+JmR`p3@cZ^Fvo7a0n_wpM5(X1@R927+iXBQ<2Zy1(sz z^+nA)@X(ifCx-ne8TS7um;&_R8=_oq799TvA=OI}OrI%LpshywUpENj4iJjYQ^N>LtN~u_a}ky3+jDXTv1(xVd#xH%XVj9CA=}l?Ai^XMgZC|7u0b zbg_$yxO|Pkw`RX;D+hg*Uq3bqf#l$Rwg39r2Vmo-(K<6Xf54}9O!px0pRL&o0DmN6 zV}F4aI@;*|Jfd|aCfL>>Q92NysDotaN+nGcr2q2-CGd9ya*<8GM)3rx*oB5Iy;qM@ z`_%~cC8fo=N~-K^Ze<;r%#J~)r zbU7&mM(*zoV2$Jqe&h-~W8BLP=ZSv}F?c{Tz+-ra`PKj#!bSa-pj!d_|G0^sYQkHi zmBbMcc#NKzSP zWs)YQCOLU|qDAE7IaNh`6=j^*-x$lQvC$+j;AlR%iv9YEFqnh~y@zKrGrN||HtXI# zQ5&10Po%lR-@X;z5y@z(64lnu%Bm^hn=n!STa6Zp_f=tqj*br0y3bY&GD)i~#uplj zsHrKP!osrfKwX&nm|u?UBH8Utt&zkn3NF7?jTJP~FnH?PalE##wU<>Ik3azI%1uv) zIVq~DQ=;kjqK;Bx{J1X2j%fFD5n4NPSH5?GAMuYjP9&H%syg7k;IqDyr%)VlJ!f zRHWgYJ9#q1nnef1`OE))g;=8@p{AB(Gjy2NS`5yu*kFXJ*~s=M`F$#~y@JT0?*!?( zO7(&CT`etW1d&QxQ$+Bf{}^?iVkA#!)%-Dy+=BC(*dIUYRGZBL|FxzO`Mqi*+j^jH zW7&GJ1<(c?g;xvrzk_~H{mW(Xyn2oM1(MN8xNJyBk`+|fB%`Ngx&bdk-!^v1HjP6y#=t#!Twew%sr%jXCO*J? zuYz!m=mQ-HGylHSdMOek;^LaSa~4mi`2Xhtz?(=N;QU?oCcr)?i9(hgZ}6$?5QSKQ zQ#Xf=LewNCYb3KLc2>+xv$Y4e=tsj-ZIr9i@gFm+M(p*4HLR?Rj3`ZwgR_IP^zRLz zl6bXdbjuZXHoJos#mbBEttJkSB>bK*?MJw+hU4@{ z!yi(!dx<>ieBSa3@+o_o70$nz57-l`zy9NqQRG?Q$`CYs!xAqqDrFfd=JGvv-995u zOQSzb{5c#;Zy~_*)1;_)Su(H zbf$i?S`#0i1XyVp(8SzdS^eSH`@br^7WNG0`0!`S>Tg#MURuEql%$+sbimc2+2&za z;>X>iU*x&_93LBIC(^fLIL-0=-rYjPEk~p-~Zw z>K$f$>|uM(xJk}cJ2}afpQwnMBGv3iBB=O2k=CO}C->RBZz7vem9qGbc~3cEOwkQg zRR*L~$zbk_e|obt)@j1`e~;DQZzSo+e?i~Yn4R9bN0X&UMV8$@tA8wCxr^|KncnFQ zyW!Q?bjj|#Dv@uUh_0Uz{ke-JP+%Fzo**&jPi19_f^@QUJtPVm*`M+RKx#_Fl|vQE zoO?x0M!omtMSzx1{((&iXGULp-KP8Dy$((PfI(Wb!_qH+`H^154fM zsU#Vh;Z}!L=6oYwtbVl3@S6dMzK2Z>!!tR8*bwi!q^exNA|+qakSS*2`7)5&W^CWb zRq^@}&9=Rh-}YXB>V76UyihFlmenaM;wG0w8x8vroTi%oPAmxeD96qyRDQ3gphBK3 z2(U^dJvF9Utzn|zIn7qGr`c*^W-r1fc3>C(spvMYrdE;MMM$g{(-FU-)XF{OqJaM? zYZk3IG62~2T7Gj-iGGd*R!BZWHlltB^`!ls(|*W4q5OL;Vy8JW0g>F`kV$g8*}?(^ zMjss9pXr z+%5#ZL~Bt!C68DQZ_{C;%H{?XRZlP=%+Hrc?8R%_pA7d$ys+}Gs#pkP%KJq z0Dy!^i+mB8@{mw1aob&8^GN)R zF5HtsXOU6c4RjaDhvnj-qBS~Xh1?wi^}@#RLb3&AwAGnzDr=$AWnHOWMyJM1O3G87 zRO;q$UE650$faq<*5v!0V(>pzS2|U#;pHsp(TGc>RSI=*_~aQhix_uMYSNm9e@Z-A zf8Bj6rdGrd9a|8oQlOI-YyrEZ__~LODbR2K4aeIzKLYIc_kW2 zBq9n$`Px&$c8((x2Yt*`sOQbzkMUcyiKKVbL#2j6J-6srkt_I{zH=LiZ+VBXd~tob zx;C`^RlvodfgU8)GsNOhWH4%TKf{}P>01JLe1qT)6>`XxDvS1Y&>HBOjw_ST+7{Sa zv^21~jH#HV9^NR3!k@T+SlnMeMh$5kj;t%AwGddKQA-nAM!qu{B0b@(pFl$xXXSkF zG}uZ0wokalr9^uQY95v)!W+t3HZ!xb_CUsd}j=0YCx-a@oo@>6Mb$lXM zw z9Hi#=W!&Y+b8*C#beL?C+@oar_6FFT$=vpzJEcE%jy11;r4(RTna|9S;73ar>t#;e z4wkE~(+s!8LfR=_)URwNG&9PqsIb-~?>!QCUyG?tDGL+}e9d{sRTg7-_zjQ7S2)S{ zW=T1Bm%m#N0wyeU*5?u6B?1@6z*p zYl5|B>Ya*L5X&UJrD^)C869aW#*b>sxX4WkA-teOwx%7_Yil1jNX5jK=}B5Yk0?1J z02{JiN;Dm+{6&eTOc{7sG`FIc0L$>y%8;d+{oH8JP~PgCd6UNL*kxex0; z=+Tf~A++Kxwc>g3+#+8{esM+Knr# zPV>gM#*-t;4E*E<*YB6Tui209|BTN5(@J<^e&sHZ>n0q6m$fM9k`mV0bEZ#mi#*?U z{_2tqnIHE-!iB*GQ1K1lKEVixU=1bQ8gJc75L4$Km_?B{bz;NmBiAtp8j+{Wni?4# z2*=MLSd$${fhE^umsY+{^k6}LxkfqZ!w-)l+Ln~_saIOMG$H=1U?Qyl^WH>c?jwsB z<9I^oB<$-nCAvwK05x59Q}0)DiO+>f=G6M%ejs(5*b7b?ZKKwl(2|t|J*|a8>$=3#p8mrG_9GX{N4u&Y%T8%^d=`g5qi>iyDi^++y&bzzd#ZlpZ$~!#Z9bnSY#_6m z^z7j-G1qOv>T8oUs2yc*caN16(i!+<<&GpCDwc?s7;8Tq2lU+E8g_BClJouafD!$I zuaNkWBI;!%9#j9&Yd+orp%)SFo%Jw-wimqHdvnKjiH<9{E`^~bEZ((>r5Pi%V|BKz z0zlWRc6O5o;DzRsrE);fo1qz9>Z|la_uXudgh7;_$>rv4OU2M+;xilB)LJ`l%C2V5 zJlU;?VQV#}qxuSgSWC1AQ0-QV}o$XHj zeIxq!b&>!$yB1U7S1UG?sU9 z4tZh%14deg2`Mitb8AUIewW|0$kU%(I^Y5;q@$bVX%8Qqxp4SK&?@Jzr>7S@yc3<) z`jDs_5*{AC9g8~No{*5|%%Ub;S;@8;G&isK{z*hwnB#0!L|iob)(M|MgvEAz;zKxw z`6h>e@jzQWlc5$eGV<6#!}0CasjeCT9|Oa2t>0eOCb-dI87o=%D8hC`P)I2GD%jeI zYt-4odR$ao)Z*r}=7+BN%^TBfw7MDR_j^{$Lwj0Z-TE9OW921sPWs36akiSeT3e`A z#-DIB2a1Vzsu{N5=eoDxM?<5(Nh&udPfVneRMSkm*=f^WHo-%+Y3Dk& z?T!D?+UjzyRC}k*;w;PH`6S9n`{Y*s&_E>$2{SYGF^749$9;;JIOj6A8d+`a9(Vof z2psx=ud%HjSeuthoW%;Lr0JM^eabHFVE#gB)oHupa)k>T^duzC5h{15H@=5jS~Dmt zGvQd2vc1{4{FWY{=Js|VEmbXP=Bn)pdN`Nuxz0?L%HBR)#WzV_ZTN)Ie)k)_`Au(? z@zYS8=_lb)mUZWJdBr%fwToy24>B zsPFc!XxQ`PgX=|P6;+WXQARbHn}ui^AD705y;f4eJ9_H1CzGMCW2cj9qUdaJ zAbL8=8pM~$$~&o&78TT3j(?bjJ1V^HjGn*V%;t-Zmdh17d!{#8(HlHnRMYf0z$XNv z<5{q(y3dk{)t;u_SFF<`&=cDCsq8`wf9LRWxh78 zZMpd=C#$JQo=V>=yjDq^=};IJ2e-9dH%a`x-W8nd-%W;_{|o%!DMk@KnHj8MH91BV znTqt!BNw6oLu2!)SUSa3+uom$p*J7vowCeW)`dTU{_v4HyI+bS6TSBv zRMq`7!uG_o`ru(2)fI+j1d+Ga`sV1(@s>xV#UkfOd8;v&V6axbquDBf(Mx*7%bFAJ zs?~C9l|e6bbhB;pV!h)!1U)}zf7;!{*$BW_T|9+N=)Ry{wuCyJ>j&9cJCH_BX^&ck z{^b%|9`RmUFf3h%Lu9V}dBJHC9-nj4modv#znd=c9j?cQf)#kS3}1rQY5TvkXteF4 zcUHQcpB}kKVCe5rH!L|J7}$+Pk0q*H9;39!Q)^V~ujC{OwiK0?My+Tp>-7elB^Es( z;AOgfi3g*2NuUijizz#OSehQ9#TpC0O^YLH@)4!U>SQ69?ruU3Xl;?fL3-mQs6&W3 zt*q=Ug%wuPv(~$4`6K??+L z9+!>xD#mc^2P5!pNB0Q0NPU7NVl!pDZQtggY%LmizrN}7pnum~?%Xo-_NW1e*`+1N z@zAUVb?)$Xahlehw$vF4Oz2jXI*dA0MI-fOA$mDOdv*?zH6W)IzIGqYQt=T4vU zoC+Qn5ca3xxR#>5lMGL#7q9Nst*32R+v8prNw<#z)=vHU`?tj+7}Q=7@$*VYX(DSUo^%IRlZ1G`Eq%HxCZO;A2sY$H=;(NcVy8Ww1dayDqBt zH^b2$_p#OQY|F7&to=D&uG6o17pMfZ?7L4~)`~cZxVz#pR_)@~V&W2yK1;t~E8uNQ zWIXH6OZO8Gy=B8+z$=0>VOZcqGk-q;nB3UR9%Zt^(migS2d3@a_HK)bgbo7)zAHJo2_t*3Op`i90Bo`lHmG2hl&f7>M0 zE6_h+pWfa-!z$80?bHgL9rgskURRrNcUGy?vpX#U9iHYzu-Abz>7yGAFzI9sARSk8 z<*OjG)tWJ!`3WRlsHkt}H&kD~L@T9v@Nw4Z>d$?Ho2@R4H-70@TlEI$8V`Q7q*kBy z2?&q-yov!jkBDp2A98tt?IVkQ?hfIY*aK6P1IIa6VlEK+>ka1>RqiGqb^};EKnZb8 z?o#P&ne#*Pi}ip2b(=e&A#nKl)q=+c?H16Y9lPb~(3Xq)Y=ba;mP+mL=m<))pg~Ay zRFXsk3@Z}l)@=NNOyJKixWXR4(gZUM_k)b?uLV$S`qAfK5EY!5vA4)7t| zl4!W=@jyNf-oh)-|JlrE9uwwEDc=qt8Z5pAFqe~h$^Q7h=;B#xNDLl6umiysY28(%Kf35VNjxYizW1R z%4IZH`N-Tvm7CY|(58K}2jlbSRHM0m+g$lO&OMb#@ zRQo;=9L&a!mpjxvW^v8QHH^?la)D_e^&9~+{wJMV+<_P`T%Z9(A8IqQ?XZ6H=Ce^; z_p6hMy{;TJ4>?i=u@okiOv~cnN->F0))F}WG+{&9v6^tiUE$3o+dz}E4f;}U*sj{q z8IbJ(XJHCia2G<68fK|bU;wo2jor2VG%|!M#YwbGLK_6&6esZ4_DWSw0YyzOM@N*! zhrfss$v4k<?}y6%){OK%rU*Nr0CKQ zls*Q=Jj0lctjm1p=<0oCfRwIe_Hq_Vo6serxRuki7Da!V7EhU8qG#z@+~N4`?%3er zEBzE7S$D?c8?B`kE2MWPIYK5W3fNd#n7!P7!se_=UJmUU*tZk|QoOeJfekBXiTgm< zGZBdX1LhS3-waJu{99fet`O$Ys^PJ{&oL{bf^27cR%NXi3D#rpKkKH_^AwlDWaK9RV2=>b(7F@)rA;i~noqlB*& zPg>y`hmkxEn{<>c{Y{K1|gLX9q^Eb_?fvz?(U#Uz;H@04?8(4X%T;5>pHTyyk8GFJ>Uci zJbd4U@e{Eo;x;z<>A8Xbq}A%ucD7NK_Qgfr{iuhgM(@&2rtLz{X9hYw*SaY4{ zaaR~r5C{B8>e*PB%HWkFrSj-m|1whdy`N@&@=R0PoA)YRDt>DuYX|63R#Sqg`{gNiG?d;+ud- z{py&Y99IO}$8vOC|9U)=5gn|H1;>*&H`e8k0qn%SsS)h}Xq&ebuF=D37v#-@Wo}(I zda}5oH0K8YA;CtJguaPbn)uB+%kU~t(A{&qvu|EG)~MHYHlYYTroP;_Sl`?4ck5Fbxcnh#dJBg z94GM)FPsY@fhn#t_4niw-RpI<64H_{z{hP~Pl*OK-}$>O6gZ!l5~&UBp4>K`!D)l{ z5w9XUJuhdy0;O(b&aZ#T-v$_V7i+c%(8_x7&g}TX^S1<2Q(m32oJ}*k)OVfgba|RM zf>xAn(FqUsoAO|F=8A+k*3H)Qnx0~NV5*=60XkS9ac>qkIr6+v`-6S_)3WUmG6BM4bv*DhTjxD(FLZEdJ>xp z;6wr-g`64Rd<;>LqR+@2^7MdtUs|JpmNm0jCSWQmx;{Q83s32X{LZ|Ud8phNeLZ{T zRQkd8p@syO5DileDdd96$l#7E^&SQmy*c&NMo@ty4r@?72Xiy?^@-#|rzLvB4k=sb z3#KBiaLM3M7I7jvGvGR|W7p#F)eBH~K|F@QRB4;$7=M*<>7b zVu{dTu}9#C(#%~tJBZ-EmMNSRFZ2EA5V=(KMcN)^@wd=gL-sY(KZ;2ca*^pI^)w*B z4A-f0FN{~>t|BJ;vO-Q+yUCLxb5(?oA^;?9)UXeiZ5n|DKh9HbpK^G&BQfKSa?Y$p zCFZ30uVjASdu|bqLOQe7fP~3+hUTa8l%o4sm8jV0hm1dkAL@!lUD0QrY3e+iF57Yb2GbLsb<|n5<+HKb?p!L0z1#w#bW3LhO?F=Y^tG`%<{%mVW*Szzt z$DkGF)fd5NW#KA>w1h|)|8krA56@1g|Q3Yxv#?Q zDMGWgPfxF`%{b|RRQ_iN&=S)1U6!`c*k$GIbB1mKO+tE$h|oy)(WbyT?VlJBAL%oJ z406iy^7c1)FG_gDv5pPwb)F%|Vf*g@*C751WO?vOwZz*N33A7P!Bv{eGlPT?mJhqOQ0k%Mr?ed`LVg2(WU-{e_2QcV&&_y9Zj#cW zm`e<2eE9QSt|q~;BCr5o!~pIlTW7BQDxJhg<6ONrh!YMf*$fZn1yY_{B*hRanxm=sZf3Zbb zwK(+c(YDrjmRB$JXw%KtCjem5ED_!WD_ebJNsEcyq&V*{;DFUeCW^rK+q#*?>l?e#!T-%ePM^#Y7+|CCz2T@cj*QbNSl(bDtLmBNY{A z)URI}Eb^H65p}^{u4(sApqYM!KTzYb%p%^cF#|cSxF5a>3+r+@_rgSV zvP?2>+8OeAZt1!jVtIEpJzuAP*~j6>!GH2@?oaWa3ATC)wVKui?Ytx%y6@le<6D1kTg@`|`zeQ$7wSG=d z3Dm8)e>3VwdMXE}MY)RUAkfjPkWoQ0!Xx2H>(XcNULbIa#cxz2*>xQjmmz}SguP|j zj0en+`pPJ3z*t>9(mEtj4T-Q`kmg_u--UF!Xhmr4`RGgq-&F;A!?wQ9tu>0@4UPH} zE3bI|ChHgkse(UOy`1a$vXUh~)=f!#_GPZ9T$%8$lZV)Zqt`5TCn+oO529g|g@l{# z&)Z4-SnCTj7X3Uch)q}6#{|I;oV1iXs=Vx^F&lo7ccUxML+1iW=va_p#mh_`$>C)B zziFGDHiJ#M7-2m*e7GsmUi8XLkB+G6xpb~tdCnqk7&@a&J?W==k%ft92cqNsS$39f z<3&I9!e+R;h>-HZoUchX@fu`owfitYTLQPwWi#9*%b|6*Td;{Apk@k zFYK`8lnVF@@9Go&PQN|!2b(y_E9yNNH>5Jr4?q$0*y>E$MNU^<;>aECuit|STO3u} zT}^u53sBy%ZGGq}gCtC2Lt62cFWylM@&Y@n&{n9hS`iAdK7k*2fbIMl(I{^dY|-_^ z4a`>K$tclQo?)q;W zQiGfbP5_H>9?Px9EqUokj$(q0Hrs!Pi^ z@cRR6!Lw%S_8m6aC4f|qq|3`VbJ~}^$O0!U6venY=CCf`<{EulK5aZhQs{T}1HnXV zwpY4e@S3a9ym*aR`du&y6N{{2Mc3E#=+N{#ITvJ%w3jTMv@{5!wxn;8*E5vGk`h4N za+~b8>dujZi|`D0gTsYvH~GjqV-uOnA2#g4rq|WOSAs&cm6h1Uywhq)49gBh@eMmr zF3mGj*L@RiU24W2S2VJ2y-~n}PQDBzViMY3g|4fCRMb<0A+G`yRCrP>vmfg0!k&>A z6F1~gUi#eeTOB$Gj^%=vHq^0e!|wv?;LX`%-03>;ZPC$HeXc}hvoTNdf4ZHZ{*L(6 zuXf=b)P&u^m0D7|I}?@?Az_}9_uQm$ScaS0m)`>5pEIDd{AW2{@20U(vzLx+u5R|Iat(JSHztT}8a4=I4EZQD09e`F(@rFwkf zAv?FgBq`CG7l9G>&R)NrI14nqopdhUv{%jvMl^GP+?-Oq-HK21O?oSfqn8hqEr{zY z5!x{~*l3~$0;!bG@%D6a4h0Vm)ymz2s*20D_0v;Zuhtv;sjzZE9}SuX`%io?Thm4D+#5g=L9 z@eg?K7fkp}xTXEnT(Ftq6sAhiR7spng5@N$;kr1mRFE9!B*0dN!Y3+I1 zhp6-tOuo}782jp$uLI^EUvIp!n@P_mwqJS8iqVcOxkWz+94>a)qj?l*7xyewA!)NF zZtcieZ71smVQpp>7te+MfJVd%X(vNtzU^t=hsm{{?$uQPOkg=LGh;b4Sk)&Vx`~r1_7I1eliTqMEkw9$Sz%=n?zPInWONRfAAx>1= zRWreCYr+E9Ot0lG;PTGiIUz-W$0~3R>!aYqnk5C60e|;IYf=#gi1j%5;+BBLsQxXg z{Ck&PQcRN468%2kF)1%-TxAZEYh+yBoJa4Jx`*f8CkvPH;#;GF^$>+KPWt$wc*Af4 zFD%uyqk7w66pEEazLYX7w#X`^hDnP@_N@@#(*}*ch=$oc44>PG+Z02m61iNTGt?a{ zk<{yT{fEBLkj(Ht{oUt%R-=q?Z(U9|8oOJ@K6jM*2wyA9Onu{Hbt27JPt(d1r72~e zBHCNp&_wzbX;CalGdXrA6whVYG!A5Ka($4pFQc8gBeM$=Ipq|ZFneT;>8e4e8h$ zt+v+M1-%pmxsOD{-O(2AJ6|!8=S#wXPoR?r0`NmO-G|JMH-VfZ8g(zG;5G zG1Iu{0-fGnY;n~stnZhH%d;*rU7Hq3a=N}J*iDxbJV=9i(?qYT4AoTQk|V*wtL~x? z3>Z$#J`z?LhA3C_1ab-G#uF=gqr2A!_Qpgxyr>uE?C5aXrM+!dHF&szW=QB6zaUD& zl-T)agC#hU9@bKNO(5T%3V(&{+{4v{J5ptAb{hmXKl+VX?LZ9vsSxz6#S~YygaG9e zqf?i$LR#i&=5kXnOX2)?A3qjiD_OX!?-ms=V?^Kx(87a$GLjr}#%wyy_#l3Aq2&Q5 z^VIRjD=Dj+1<%4Bc=N#9_9t%kYdG68Z`Pl}yb5fwWPioJ)#uyie*h3f??dS7YGM{6 zf1LREba%Hv6XVE3Vr)#6X4tLn8{fGEKbtVSn|5RP^Gi88i01K?%k)*o+9tV2-ggIqQeC^dq4B*eQtHrM{Qbppx!VT0GEI+ZgeWLDSq{J3>3^^gKpV%IqG7&K#FT)yt+IH898Y)4BHo_N!Ka zDUj;UqjbiT2>JY9I(s&T_0=BnWYlb#@dTdk^JVF8%MzAPVh!4?|P>A(!hD+@o1*Cn6Z|XYH8QlzF`G zV0PV_LJ@x|+?oLq-O=lqc0;o}4y>SwbGHX%nT`dEgDabG`d93JoA8zTeLDbZ*lFAm zE+`3oMeSa0Q>c1_TuWT@@QxE$*Nf?d)l&?2Y)mdg@P?1rboHAph6AzK8%!+ely5<} zqZUGI@38lX^?{t*oC;53CCutiitmE73eq^P-r-rqj~NYz@<>XL<{f^DBa@J4ZRAL+72Nv1{z zMM|fK=Ie%E8Te)AHP;hF{(s);m>{&C%KZ5*=aYjj(H?x$pZ|^FAr)&iXmgcljpH@q z*m}I;u&5qt-Kz`)ar6HZ)PqF;r~PAG_A2TxFd-j;&!exz2jh1QuldT=_?!o#;MJCB z%~ijWzQ`N-vA1V7-{4VYv0Sgp)OxQeDGQ=B&Y`N@y2OW8SXAfTH>!{f)=RSY;1bc( zgunTLOTsjM1VLCsuUn>H%#=J{JeQwuKrM}n z+JN1Uie=Pkbei2JcYP}9nSiFt2n5}}iSM65yPc0$8`EPdliap`KFVu65uYSJa6cLD z*_oq}OQwLPF*rl5S~msX{*}#ZbQ)!4IMvkBqG)KUeH(FYVgL14-OhhrK9SIM%V?y` z@Zqn>9-};|?DvY8DThe~3yYNQ-kyQ%ef<8b(HZH-{b)9eEuMyR|HbV3as|P~a!s7* zC}SwdB5Y7T(e=km+-;ywOH+=!oP46!cG!Du(ai2{N+m(5tgZG|ot+0!+(EV`hv*hM z78T`~L@sE?MgiqqzGw`Ws!Jk_`*KshFxWUzV|nYQqAO~$s&1%W-)Fwoc#=@WYj>n= zFwjmt$dG``u6YV{ZVFP9w38}iP=02$mv4JuS@#hnWV|4nuHSJW)-b@nBlTDy;OsH* z)^1>XHqisKXiq)=a(Z?a7#C)4)E9^DHl)Y~O{YbTH-uOys^*=`^+&E78co$pnvgvH ztIp8J28ujoe67jwyC4ZFN4q{SaCyUYqVI~J1ftGfItQSG?PYE~Hh>Se=BVHU;U&t( z{DiYED+uF|=!@uU_e%m&D788pXf5?>2l&JRH0+g+eHAaQ>v??go}+6}y0l)mC%2;V z{AUhbv1PoEm;@nqDYQBY0iDG13b~BH~-9njD|rEOHI*T0I3{5U{Af>qKXh>uJ}&#LbU1i$G7a zpy-o}N=SIc>vrS)8epd|F~M$RD8^&qmN)W#POHTv@mEIp;@OI=?HRI3qSrscRv$=T zLuI)$v#0Vebz(z|^m?JLuNp-Jg)HF|w#w;#j%>e(JZ7?3-QO{QsFMX-?(-}O-&!f= zVw1^r%t8`jgtx!ro%2Z~w1$lCgJYCsdP%fM*Za?%kIyQZo#WA_Y$l=9RFW!=vHtER zg+f{}q|K9r0v%&-vgb@o^-1)`e4V=KH)RO++H2ce;(Yxlz{zi+*RAK1l-(wc%FpDN~}6 zPdFXtgeFiQe*QGf&TZ5LN8q|2blDZ`P*m+$6t#{lTc!T=2(+3JEhx*aUBHWXlK?=g zeBhPQnRx@vPP;*iUgg4pU!lQ8s*^cI3CZ7eR=<(Gzx1fE4fL6RWB-Kwm%s+n!g}1I zv%PqcG1(u4!0*~wXXYRZm~V6fs@gJ04gv>d<^}1vIy>DeqyySKfYa)<+fXT3DF;*r*7uprFvJ|dWMn6;#!-i zKz4{>hxkubfg$Vt0@Yz}a@6-v_`)m#4grlIb49I+qio)+VQqtc+P-9l-7xq1Z0C6C zOVpWO>mGQ*>y#yt%RTL4U+6>l8{TYPEi2}VH(Fd$%E~cllgJ3rG=Eu@b|YZ0)_R!~ z899h;cY~g?Ny55{*#si)Vytwi4eIiH-hVO!MS`$5Jfmi6H-ZNC!Xh$zG0hzR#DekGNKe zjXht{3d#AXS3;IOuKBpHbWm`aG?daLY@*{*py9!GlF)qD8&VtSZ;mG^Y5QY@Fv-L& zdmcRj?HAw>jhO4b7!_jT(ibhR63&K6g8$}2Mgun2F+3h);GQ%YY3pC$|VP(PgJiaFjhlBIwxOl(*A{=|B4fM z0F{7#HO=(98elAwnoI~Wes@(hl)6^tt6aO&7y5_~<11|+Wl%o^5kX~Ogd2)2Wp}L^ zan{rP`EbnJGR+SXHs_e$;%YR$j)YfRF+2B;jg8BfP|u=XVn%Lg?ansBU8WOAGa)<4 zhsUPV(8O`mf|`rRw^*ep2E+VMTIHTL|Ex6?2IBUGub-h`3<9BS0Bp*I!*4S(hj&Uxcid4g zUDU(>b;r$6n*mHc0ejMgJ(e=8H6A9K6pa%9N4)Q`+qa&L3SI7&_pp0i+Wu{#{bj4P z6TqgZuc3wDX^0}_;dUiWz+An1BU_U&XA~s6XY|;x@iAF5%(QLp#v#awlhL3$FUmxl zdeI2>;NWkt?%Gysvw{?q~;hchEKEXs6wU6sjf#k@d;FZCXaZs&>cz(+Gne zn?lJ%obaM{bbMZ$`4mg%N>?@^;8}m0#?F6S$A6USW%@dDPvqPa!e%>8#O83tOi4z? zKW1fWDZMWs4!X$;ZMk>d=R6NFwG<+uC-ut|D$p?Ov}#@SrZ?KUmjK+Y&oy48fn2?q zQ1z2%IPV2hrIR18hKZ{`yw|&pX&cu5Q!e>WlM8x`MecK|<04v|(9`V_2}u^uFm-Ac zfNZu##U0MDh5!$?xJS1JLQYZyQQsVRb89M@9x?DVehjzr(gc)zQV{@=EeEVH{M->@ z(pqU!8$_`i{W3Zmd@LqNQ=`&TX}SOKQAcB|=!1CKV$;s*odfSfq_F!OlS)CeWRn|DSr>T5-T z?3Czi6Q!RVD2aa-LG0(ycv=D^ba%uS^{2nhlcn5x~E=tMxf28Iiyz02P8>GzE({;wWp5{F@V3ohx z)ndC-(n%r6dx^8%X*1AVw;ID$7eAurtae)`B+0!|FI+K&|ETDo09be=%Yig03pYtO zVzw&AJ0rnWTlto%V4Ib8QyC|DkdliihXe~_ANa5M%%wVaai~5zw(&wcyf`%tTMU<+P`StiOl0VhvI1$r5&wChSAh|tMJW>iq zOT4tF5T37mp!SfKLUkJK2=kgSJYe)C9K=swGP*_Rz%D+&YV2WFN`(A`1P9xNKqcY_-^9k<$A!Q+nk$C5gY#&A+mZ5QfH7H|(~;Nr*YoH3FVodc zYwKdilqV(sZ9)Ipi+#Z2(2bZ8NszBJd33@2%fWUhzq3p2_SP%wqTcQ6qSGty zM5B(TX0V6zW#>1uddL0ejg7hy5Y9xKY5IwrRaoA7h;^>nSrB@q7a&|MLY;?7jhx9b2oB!pH_+J;)YennN+x# z8Z-)_<)dK=qcyJq_*YB%%W=+aM$O~pDf8E#-twGRy#5TOh$T&&aeU3iSvdk&cC_}q za{|Om4A(xRtL?Bq?yvQ789aWxFnCM9MBit>8W}V@6zNb>wAcN9)QRbz&iP-*!V=If zAV&h}m+n^mQSNw-tSvW?%|3WoEpv5;(8bM?(p=Gx9NIWDIVZ4}c8&cEeKd}oWk`$+ zjB}Q8N9k~v`XRw~1vFE6PO&jB582k!(r`ua&Zk2PX|1D;jO1fum?&gP6imOwD-vUu z>~(9(Gh&VF!}ra&%!n+3X|l*d$76&V7nB~SI&$d5884f!>tIgm^7md{8ri%5%zP~X z{K%Jn#xNvwpJ{qM0b55(_#&CoG4^}fId*8S_mgHa+UqZ~&C6@<~<4Ql;yhRmAL*PU>BY z#{6ksZDBV<4^^WW_Zf9>tdU=hKY3bwKEgU8eO6W$0Q4i-{H9rmu%b}Cr&<(uniP+> zq_uVdjJKXy-k4-J+Squ&Hd=Z84UoH_`6SbFU2$Tl9dr;BR|e@1pI13>yl(7cN26z? zQ4$6~I@xgZB14L$+oZ!xwM^0>gjW!R7`|cVcndgw(?usl}_f7Kwl4ll~@hVWFMaEWfCMfs3rm@02VB2QnVHi56EzECb(&;mQZC>BYGS7<=`HxPN7Hn=}RR0^{q$ep>8-GPVtwzCV3Zt zV&&*t3g-EBMlZFpijP$oybIcz2)dtE`~{$W1(vC3u9~x6VBG_^>WO$R-6zb4)JAZ| zS@xgX4fgcrAdirtMf0^=xa7HZ3H^^f_~-54R-u+6)HA^y-+>gL9-vNU%Q;qs@dLL| zXY0Fo6;E@hAW?cQwbz&jUka&muH!?~*eTzO@w}M41yRDxCKO&---Nj`&iY-cY`Z2g zAA)dxNn>Do2@VmP4ONN_E2+RraFCYYO`ey1T=2oP3TVzDn+Cek&4?k8F_WH*H=e5a+s z*3s~=t0S0C>5Mq1HCZ>_1Lpo397R$Q`&%%__x2;HSiM2>tgO7Sa03(H04D66^sMZ= z?VmA0#R>9>L2$S7kKwNuA;qL{GmBpegE?P1`R!B_(Iax*tD5pMa-@*SKpm1F^4WPK z`FuuK%*xsB$~4TcEU2}3JWf3*a^2#0{|1Qv*JFfkS3c~}z(A_O_@VT+E0C&W^+%N` z-{i+nln7@jU#@kX-wSu$Icfo+(+c&Vkf2kLW0qFobBl?vPW?1y$6LN1(WtFILuO=s zS6K$sPkpF-iaAMgOn6{(9%hyaBvYLNdCAc;3({(>J{4x~`@xmgzvRtv#7G4TX_n6@ z9k$=Dejvf!e6M@2M)7i+1fsAJ-I#pT=RiFmH?L&W-7J)N{jP6zPbS_=0ke>~h?WD5 zF8NMR%<{Bz;jF`#&8#;<+2xkI>Z*RmM?*w*-rw#Dp4jP>hlmZFmv;WWPj%2Itd0BK zxr)Ldv0K%MAH-baVS~y<2e6b5a_1Lg9qJk zqd%o;>zCJ}lUZ*P)$!D(X><>zVqwZ39Olljtapt>v|5_byf|E^%Es=<)4UYm8;vpq5(tAh!yHvUFVq(xx&rU}jzc3G?y z$^Rvn`s?B=XbH6@eX0i1XO$j)4v7UF)9nx7V_3Tk+@lBcqVG0tbtEHqUu2CUy#9x! z<w#nlcc}70RAJ@dkWBT zIp$9e`~EBP{r9k;=b8OtXOqqB_4v;?{^x-2CG>VxqPdO`r-vVi*k4*IWw`sDrssJ;BM^na2d{GuWgg9Z&|5agWS?-p~7p*sB!J=fnZ z@`rX3=wKiFZT=_9@gMUA2AKo;OTC%@s5=dY6W zo(_sFSLnk@_{qI)CrO&slCRyb4&x+9?vgbylt*?)wEy(39y39%U$7XRWBu#F?|H*P zZL6)Rg0GNaYfnai`&CR)X{(gy{Z9!>8X7HPD3)SZoRY8i+S(M;~c!5HJWyJ?^gJ`Z&aqzRmxP5TrgkJEKbhP!Oc@4LG-5ze(i3 zhIQSJjo*gs>P4=11q|pt-tWGL*&S^YCwAL&uk?Bngsfwd{Gds9(}dEY=M)#qfIMVW zOLQqBgwC83*-dLLCKV>ah`0x;KPzp2$4}$F+%hr+24Z(ny?y%*FsmD1s?(Hom3Wtj zZPE%&0tLdrLLd+}ug9LWv=!Gr{OtPrIWRFQFpeqK^Wk=2@uZo8)@xQrFQ)A4HZYA% z%pXnhWL@d}td9h^*5NxGfiahmmd2!Wfrw(=v>lhcU8DyIel6glkT!95((dzoID%kh z`>&8~h9wSEuDM20-T!7)C5CmG`-Z+Jq)^)S=thyh?EEylRo8aca=%3*q{3XGu2HVv z>iSBo!8F}Nx7BU+;k=(hhz-+I9g&FBE?eO2W_5dOK#9$Ig$mZ^_^dBIlH9{g!09kS z;NsyaW;mG}2yf5Cg6RTgN@I@KtySo$K4NnmeCbSu?v*E#O0L%oVuEy$JkcT(!hXO0 zt?L6RVVPU1=kBps4SO9nMY#0aVZfW-00fsk6BCnu_E7=)x)msP;0?D(VNubx)1`V9 z!noz&)V|$t7HCS$B^h$oX$8J?>%+I2b%*xQbX&AM7kaw$s&v?A+n+9qmoGEWyR(1u zTVu3Cpmg;|_s|sIUluY}3`{erzPp_>@Wys?_&i!(fC)5P@+1A>FmLDKC2j*$Y|~$r zRpRT~1biAv=9b4}evF?F7h1jPoehJjv!9iFTb6%X?94<-MYS(xoKmb&HB)svDKEr% zXKd=s4O**FRaZBPTXi)Ja(x5%5|bx@|7(4c;vfk;b)vo>Ydk5^<0LlO1DAO|n9I+u ze@AtfXc;Sh!{_k9UU_G(uF@E&I(l9>T_nR}R%f*=0BXjE=B3P!^NQ3;*sf1Qn3Bwc zWl~tin`l@6R4!GEK!eR0=xHyVg8te98J=y4G+oYU4g0Pf>$n?TA1@!gbNZp}35l(= ze)6>K>Hgr1TUYLRm{8HH)tLhUmbO6u+hq0wx#sK5I!VF-RxM=3{bazHPkI+Oo*AmE z+?TmFUB3$>Fb5fQ`Mb@8ee@}AZPf)|r?7yE$5b^msG_MGN$#(V?GgW- z%^!rTtZW>3uGggJ2?0Khu4uGN*aB?7mcuzi{}_*7#^Y%gqgcMhz0G5^Ea1mQ$x)ya z#-%-0&<<&8(z5wLdYZo4bhvHDD{Y4?c_S;>ujUlWU@q+hSRp|fs1Yg8`ys1Z&KFj=TO zNaC=~61Y;wG+ai=Su9j3DiK@yO`7svI+S3&g0mmM0fp$ZbZCIc75p8B>=0|8-qcE~W*&Rl8vto}` zSNFigt_m9vF`urN;;6(4{7lIuX}kU;0B@$Jcck z*S)R*&4!T|FH$UXL|%R+;Py;$*c+2P= zX3{#?Q#k4wDuv3DU%tHNsD3J>+a1G$HVyTL!@+r`J_i+5z2!Br&`+QyYzlG*5?hMJ zT65+nnKUEk)F*j-J?J>hufE!x9L|&!*>3t#F@O5W3ryh!XIn0EoeMEu4;J}mi#AkF zG}xQI*u-I-cDp>@oatFyknB_Cn)F2K6+HY(Pe3&*;0-|ZPe-Gm z?Vl;tpxWnXaY(fL_Udz)fo@-<9$s21@O3D16my-J2iFr#^ z^K7KOm3ER$CaaP!5y_0>b+%_io?_8SO9UT}Ww>nPBGCfh+mtJB@%s>}VWI0mzwm@=uzsoUWtXUf5 zX4_2prCB(-rW7~b#Onf^^k36Tj0USwxg9h0d14?|8h`6>;3t$L=3E~w<>&94rozI) zA}#os7kkJH9t;DiZFe?IR&;*1w=C8-&VdRqvbV7Ia1}DlyO_rQ@9sxK!{lhZQe? z^)r8oF3CXGCs0o|aU9eK3KW8~+ZreX*Y;O*-EE!cgeYh9q$_o$L1(!e``NvXHv|(* zx+69e@`yK5^GH2-`&(#z>Jv;~;9%W7iIf#9FwB*U)y9?+fo@z|@l1)3pAgeZ#5IOFR*L=6^L5RV{0@2mHQ zHkEjPzY^`B(eo%6Xt;tin!-mmZ?_forG{v5kjh@iM56tGZW@GKT=_A7f@yEVRijbA zu{WdM8atmX$0B^O z^TZ(TvcGY=;IqJ82No1g;KQzgoVTH?NJlm`y>0>|Z7XJB1&52WcL$JX{GWdjR+C+(rO24!P4BS2ED78sa zwRlKR7167`g>zKadck{#gbR-y_(V3#+YAD=W0pn;fCpeAaJ%Qo2Y$9EaasAIG{0syJGR9~bIxEqI5p91spb=M zxc<=OXgqEIu~6F>9D#89y~K}>jNN2}ybt4u+mVz}Hi6&Tn~qt@3`>Xhrc}3;658mL zMXEoygg<%CktX5|TZKqQjGw6e$p~Za>e`D0ww(Dg<(5)Ku9X=c^1bIHhF~ro8GT)& z)9wl7c4&mh=S~Wy$Y!P4;O=ar)yXgHml-WAK>25mpbAq4xl#c7$tS9{GFPsO^NxD6 zAiNM$?!;vM6NPpL-NvEnrKd!i?DsW=QS_!5kfSn5EBDP(raJf(3}Fb|cezvqMx)~k zA&S>M8?Xfv+1T~)$1AM^ubVt*#Pw~rY0Cw*TE4bQ4yMu9DWVJ~@W_=kloA!?^Pwl9 zep|{@*fv0@nb2%=D>$5QnBOYXs0-3eie;TqaXwyhDppm~8KerpJXE1?;H7@pI-{5n zk2O+I*J-gE$nMDcGT%vHLh`_<(;Ce5I&w+fI%kGiDS5Vx4TZ}nUlYoGQKa36M6X(y zQn8i93E^&V7%*voa)~ob#*_Ul;5XbUCcaB66IP72hIA&{sgw+641J42-3IS4TikNk zpTns*%`-?6a#=I?Ou1R~&0OX#>8NnYC7t@tJ73!!_KV!9N8rCL*e!0@8qoWI8+E6m z=%PJgt_20PI%>Sev)i3oHh|_!ht7_^bj;S8Ti1{>Fl)tNcfXOQg?kHCZP)QI3Tq3=X6#eSskLUt(>*ITea9~X+DrZ=Br7y z9PQyw(TICnWv;MPqEVr6P_Sq?vIL=2FPUWUq2KA$h^CYn5$L^Ta1USlq7kbSb#M@8 zv)t^u**M^Kzb8@@sLkW03j17%0G<$MG@bWzcn&afpfpnSzO=JPD)Ayl6BCXpJ}x;| zaxDHyl~M7#2Etpl3V)+XL8Ac^twU0Y(q<>Bg>m1z;zPUR>e?KsY8V|?jv~zrk#PTp zAD>8OtdC>NG_cFHV&BEVqC@0g3o%f!&&62HI~-y;dkE#Y(yNqFFfKZCGo_T{B?Gp( zm2wqB!gH;pef+z7z`03=GeGznIWTqk$Eq!H^4)s=fsOI6Lh3Bz4TIBEOg?0+wh z_t+%<|M2#fL3MQ9)@VYI03i?(+=IKjC&3};hK)M}ceh|6IKkcB-QC$(g1fVE2<~v3 zJo24;&U?P9`{!2eA6?XPc2o3Xl%+Jd!Yd162{y!3tEC=eW{clX0w?IP@;|#AS)5Ybmsyq!5)KlL#}H6N}0A8Ox>EJ=AO0JvF*61w!)fhEdw!wSa8QfrY5*xdZm$&Y$Ry7eTGfNfjc8nN{(L?Ui3)S!KS&dF zQcL$MDlPJc|KiS8?>kjI-3>N5n8$E&zdT%G43@EUcLl^O77 z%?m{)UrX<3d3P8B*iKIB&rM|2e`f(NP;Y8rb#9Mv<>JZrFDZ4PYu z)`MNnWAd}d`cjVS=jS3gl6RSMOC5>jdXsax3*Iff!?BG2bI5?d{2~>Ss@}FaEtmi* z&XY}a4F9C@yE4}HWc`4_=w$G_=*4D>)6&lw{eq44(Y8n(EKHsJ7Y^4_Q*_!obg|~= zi&5%zmi?&&NpMpd7CihEIfI}d4n>%FJ#sm?4hO>@B=iHjN+oRh;GG7z#~&hi3%~dz zK|hA7BWn;orm*&8Xckd~2G+U;s%oNJO#j3X2se{vEv{BgmtzKDlLsq#IZM;bQ~#JV8J(re+=G8>5X0?t5p51`l2#d$Ca-Y-4Z}17ywHnP=I-Y6`|rJ4 zA0IkZdo9p}- z8!4K^!Tj8Any2<5mM)$oHhAmDM>mIGKEws{<^HNa+i~OAr^rw923<6t!9aNF#J_@g zRTvVCm604q%v!eoDku6cx$xITJFhpHYSre;=@949w0t`W-24*$@Lp3DWDG{q zfQ!TLlN?~~Cl{B@0Olc{@?Ku-gHivV>OEg6VQiSidV4NSW%WY_m>cbS{Zdg4Ga@=^ zB28Eg920KO5~>)+OS;W)w;=KbhB@)oyHnR%Mb zFbC(kHfT@dsQPk>Dt9f$WNUhHmIKi{?_Z$w42I%*NjO|_xhDhjzx~<;VYf$ih{6cX z5F4$P(_aM_roVzH06wKPd&{i}m_#+i zUSQGe5w|;pIU#1m_%dREe(45Y>gm3rvl(CA2KwhtBA55s;@WDFXSUfzKhv4mbgVkC zSgYm(jS|(-;O~S#wAGqld!|3~kjCx!4AFXa%Z#N#hmQ-3#cuSB<+t-cmRlyV5V;zD zs%ZUV3ZLUos(#D-y-fN1jsV%mif}fn(TKjNA{~6k1ew3E3^HOEMil(~!v!aqaBb(+ zYuE|9Y0brY-K-F7ZiO&>8zRmL2Z>w&XX_^S4#8oSs^Ul?2hmK&s)CsclxBl$W^=%1 zv~CyXrvA!8KE59}G6HrbSTu12G6tXEuddb`o(xpqdrI$5GAqJ~#_P9%(pOcU?v(qP zUUCtdTyC9IgJA@7q*noJuS}Fu8=m!&{e@SQ!Tu&zX>z1jEw=_VO3rePjyt#+LlKm|A6CZyGhOoHgN+-|(Tu@*{n`Tq3?f&+vxU!C7-osmJtGJOAnI*ta zj_2{bT6N=g7gtde@KBg4)}rnS!l;_|(0SByd2Deq9Pd4^G~Ypw5)i`hboRO!qV700 zPIZ~f1`2h`rf$!xu;lN(gJn>%+Zu{o?=!zo6SN95fW-g8??Q&W#ytz#U#J+K@V98N z-Q4eM0FWOvUf6OjB}Yx-0+CxWQtC0u*wXZ(n&~*DL`vrV;1}@mx_rkQQIYROkalJ& zvOK`-rV~tds{mwfnD!!$QC)9AU@(r+D$LYAP5dwcZ;#*znqI$mTPujDs7Qr5b2g_|~_t?9H+hpQ?+{`9I* z2!sm87XJgIAL4m4X!0Z>G+MPjDEB^`RoQIO$-mcdiJ?_tpw?=xuQnN1>kUsMMtF@M z{hDA->hdrgaOyR{{Zk~5yzuhdfw_1;J*e~JcMfK zgyk;NRkUO7Z&CZ}kJrhwXl5v6Z+JgEUIWa3`y(tso4yCoj99jU@lSHu!rsbRTKcm! z7Fp&RRSSCM0g*iPtVOhm$E%3AuPPPV8 z`l3C+f}{cuSEQ_7pVI_Bj^#*E9=-Mu<8i2@M*dM3OasF_MdXQ1Pr_qNDoA%m1svfO zVo&Q)KRnaRG#7nX5MLGfZ#;5A1!h#>w%8^8*6Q9BN6@la6sew)vF*+_Ti|?mQXRhS z;TxOzO#g<-WMNJS4*%SK8`n=G-5-1|l}vDxwhpM1)%=7IqIBAJq!Bb zg1O2Dk5N1|dxf`9dFlcPyI6rjLy&yG$KySf$yjy*o7s{=tHNbgGPj-N0Z+|=YDTl! zd}&Mb&8``X%ZVUhyXAg*dp9p2e)#0gT0$F&mN6bg94xTs#YV~v> z64n4LDsX@G`OQj)GUlm^e3lWt%WX3S@GiW|VoYClYyhc8d zNFJ=w;;89(xIj*y$jNy5`%MPll178A$i?9ztz4^cVWi6&BlkzHxQkaZddIv~!1jNXbdM^&eYD^~q9}^wUj9bj)XL+j& zuV<&##m4gE)#CninHBFh&T`8tSWHK>QXb~)W$8Q?Ul^AO-PS#Ed6a%=Jy>utJP ziSW^v!uWsiK5ZA0#M^6d3GC;nsx|hl#j361SU-a%p=;GAvGnTk7b~sbU244qlgM$P z!eR{>mZ`CRu*nD_28IcU?!lB%8U0_S|>kc+@@^A0I{r>&WqOJAb z55=Oxb9(pFrHZ4)6Wl93Snj)+YrE|VC=4k8nHJk%x79!&5YJjYofts zd)tHd5T%NR=A;%UEH>8xJD=DRQKR7<*{!3MtP&C%EHprBLyX8vFU^>F`EvrxWPM^+ z%>q^emrdk#hyL$JE!NX*S;5EsTI@B+&c=Q6ny+2SX4DIxcf#Lhn4%aDSIsa?V4Jh% zj@qkY6-OSw=&>7ZBZfo5j5VDs!rR2sOW{V|Emdf+_1nN@FT|1BdKu^r7$?@+h-AGk z7p*X%AJzc`Ecz&a2Usx3A;4AZ2)lxwkGb$2=Ld2V}f z1ByFO;j&RkWVbL?4)O(ksxp$1X)W62*rnRWD_&oc%fVB=#OFD)xF;%PknE^5*iq;! zUiiZ@w!QsIOZHB6+2c~vui=8UM$-4ygv$ulHB^0mA;>wR$?-thtjc;%b?Zdizro&d z3`2<1YRO!K<;T{j;3LcP$BIJZJ!R95+dQ)$?1&^z(mMXty5&#|R%Kbw{R+a$t7Q?~Q~FTi5xhT~s<@D!B%2o8-|le4S46(Y zX8M`4->X0~ILzll=B!}z4#-fFJNG_q6r9Z{T3=t3yWlQ@-POYNDb#xma{IgMV91S+ z_~C3E?4SanDQn>XuRq||RAM6|?F}=wJrpvCN@a@#8=YKgdx@8&@()Wo0An1gTJiS! z13LxkJEu@wPWD3?@ZxF1!#(>!EX|_Y_bg<}V%DeQoNPrFMk0#hMH`4CyVmXCe-w++Q{y*Mb=h z$2JCbKd3Eid~6=xFRwk^Hud41=Xq*36p}$_Ntsey{5@FfyF4=z*KXK2D`3_ zMH-k&;`p$4%(6FGVcS2ut3+FyuP0nDrS!>@Ikg|eB^&Z5kT1_dF_yX2y>0x|07FmXbom*chd&2j=Mh+GeG<6ue1o%jmh{v7?{_zyZ)=UDu|@0o#Q=v6>8(9%Z-Tvhl}es>CcF6KTwPJqLdap?{e!Z3#?q zJiPNqu)V`)durCr;jP)^n2`QJDVrP_F~3^m*z4F-{D&|VZ})=D|8z zB~9r21^Ru!E1!uZ?_QZ2Txg-=EqWWD)5v7n(g~6mmW%rQZyV{85K!y!pSu=H$?-!HT~< zVJevEQmxoCoGP+>fvT!M(^3VNNl-5}q` z41gZo5r0MC9SV*ox+hOIyBCQ(2R;B9JWK`iCEK zjn$i#G7Qq<_Wl|PGwKx%t6hcnm3!q3CopbclCLXM@sCWXdIH_e+g1RzYn53Hh$M(f z-h2;s;UGEwT~jvTG2HL|?-#TYd!~&3eLjjq6Mi6-w=MhS%aEqtS@fs*uwV=W7JiHT zEScY9fsrBk@LN~I6ah}|la|5}#s*;XIKq@N$!l35$A3*5GF+JN^ZIL#KXtf&B`dxL zYCRJ_ya5=%#}P!gKQr<;=Gh|m`d)%=+kZ!E{sC{+P@dELS{p9V5&K_T&_1>J|KT2` zBQ8XrMG~ub$PIVx(Xp|q1|svA_+Pfzsr&f)Zcc?3+1}5^-2SBH_(zNS?~wj|vGOD; zIqdKLz!PnZ!(td?Kn?SLGOT*yN;YX^qXFMO6;dr89si#|Yv2Z#0Z)pQZhpns{YZ|F zMrmrkAL#8a7SPe+6?_!S&{)1M;8zB<-p!(O< zr0{Cea1NiGD!hwl?IgyhQpioltUY$F0ULjHUjiK$7k9k00^k_`>EnOB;6sD$WT!># zwqAFPC?~e7`To_8F<1IdW~u~CCWFUmFJQ0)?CNS+?3S~_hue^}$B`tOamoi8bUYn* zBl%pAW-A<8l6gG4Cji!7O(Kb*Wn)NPXa(wWxum%>aZf#4Z|RRe*EYB@ppsrb;hvu$ zjV}mk?mO0;=a4)e!yp6gve~XK;HdIB6;7CqiP~;JNS%(pK@vBSH~TwUenG-Ll?$|F zPcUd`sFifF?T?%3G?_FlHQI8SS1To=lv51Gy=ZeZdUkDfmOoP~6j$T(H*0egtD4Sr zN%fdIWXt`CWZ4|8xM2HFWEU{5U)x>+Oouj^=EPfU?CtmLd*W=`{Aq&;Pnf?7Lq)PTV|CRwTTrUu6|MdjEG{eUxy3ZrE@)dxaYe{*dCa_xdoFBWp!Bzk;dO@|o1_Iv-l5)%4>XgO*wtkpNY| z#X)39LZ$d7E^5LJj8eh3R;98m+aAOaChX zmicD`_^%hhCMCs2BrHOy&Qb$oNBNvuq2Ec{gM!m)F%nhqUP0jTir-09rZKOP4 z)5&Bavn9GrVf?Nu5x|Zg4IWbuQiDWz;PW_8V-A*wx_^m~E05nq4$YwcBVM zaM|LjcUxU$_5!XFAA3Xh02vc*jh{M0Q=Juyq17_tk4*CSGy@!ub&`&j>Q-UPQErjy z^gFg2BY8nB`n_r>nC5Pd<{W+3|I6}vpa3@Tw!jqA1yp!=|Nha-gO!>Hxl@)bc$&$h3&BMjt z7dHF--X4*ZUL@037!hM!(2bDy(h12^c}0mw-%qu#&)5$yjuX< zpoA>AARp|6@#fPO`ZybcchDsZc~I0K!kV)z4vEzY1+JP6PDiPL2*sk1&t)yY(Fqfi zYIH1r-dMolJj84ug1X9}KVAe0lb!?)35#`jYbZvWe%qXRD*5*9J9{n5#YXB)+G#X! zOUe}Ues9gLtZA{$S?471%m!|7-vADGBQs&snvY;e49j4@yS zw)C3WVfJliIjhx;_Lv+NCKWil{#xwUyxQ_z!rOzxaCOeoDJ}z4sdY?(5Zi;RUmpv_ zY4I~Ks21sLX4oad`Z`aqVjrhU@Qj4NuI12*Klq5qm{$P=p_C!$3{)tu63duuXhvGu zm%qPME1`l?LJtUI>Jm5qBasFmWBx*s#k014X1sbifqsf6=CD_?S+vSVBdNTiXbh?R zI2PoIlh$Ko667DDbbxje<<{rf6tfvJEjxZ2QAN+sHl;a%cj2+b!H+S zJ6?&CLM66O`r~dCZ(gTPebQc;;LEz0s?<3Dq^Ob?BNJ*HG0h^cV-_wYPFazBve_z(R~WO>peFk4DW*qpN-0Uf2&=f{%Ktd zX#R$gQi1enxiBa~fBe1wVHZ?L0-{WCk697lcBg99TaXCuyD!SKT-!!Irh2>Df`cjZ zb(AqrzS-{S`7|>n4k6q8%36i-St|5vSTA+mTD+w!Tcn zcmMey{Z0!wCp{P@76_8ecch=yfY<~wCMLN^a#>whG}oB=Id)SgvtUB&-y z3jNiS6=cA4bI;h=;)`V&9-XY@`SU36PoIb#E?grEW}Zo4MzE`8A)# z74aeeH#_GOSp?gfdh5R-c=gM$=|Y2QQ2s0-DfG~h^jFbV02eL)?+X0uLhmy$c=4$nKl2YBqPC*p^2MPt9hV!`{#%tE?bFM$l8( z&Dqw?CFhRd9TTLP5nL|k=kC6qDpVLvZP<15xG^f|>68{Imig(cbeGL=GPkDDa57FR zTKGje*HW!R)&64B{1BeY2{dq`DUsa_k}h2KGMY2CSgS>Hs#H_ICG^;_%XR+lo6GBa zZZ~MO`EsquE&xE~G$wIa0Ch+Rm>h~Vn|LG*^?6yHOEfCzAj4eCQt_w8Bk>fY{Er&Z zd$u5Au`qn-T`aB2$fRx*REn_9|Lv@IeLayLG7za`AN6p5+oOD590$AR_e?*t2hoV* zp958%bmfZ-W=-U3!@Ya}XkO|Cf?Cs9o-7d#^NHK-Et$k!#z~dRrO+YS@vj@Gx8K`g z;V2WXdaD30$^ylCI*~3#piB-F6D&5I!YK0(6!w|lYHE^d99=p*-SRZM+M^eo1AWo z%r0vPx7TL?+Qx4)hCksJ}T6k>YV>vRE01IZPn#bs(fhp}5XyYK*4c}O| z7zS^c` zf3Zp`lA?xss}NLTdh!$%;YMg?yc5||=`cvKR}#$tf^2vI+^7t$MwQN@KZlO0PjlGR z>nDViy+{R;FiyGIzv_FF&ZkA^R4FTX-<{o(K84xjbP&nddL_Nm$g|e8T4}cRT9K%C zBF~A@?RM((^~t78(lQD_P(*5bJ`7}oN;L+ub=|4j9EWM#QUUf5(&%6&z4%00F12*- zeU9S@l}_UTMT9*tXxEZ;g7;&#!-`rFvc+|KSuGbBFNzsoJ9nHFJbXOw=6M*N)=m=e zp7y?X+x%gvd2mhOl*nmi1ZllIlzqmco2An}csV+Zi8Bo~^RS z7u(zj)Q5sgHBuM1?m%&Qr=b-NM-TZG6CL2E0Lr%%A;BxHA!Z#sg7vwrkDh)6fo1EJ zrN3<29?ThoQw*izu#qY1Ke`nT5+KWZm`&G~*dL6|E@}BAZ5sBRI-hu9B zqRppVJS=_|U7R8f7I*q1&ku51E{J0?#2b$gjgVZ}cr>ERTCA$M?G{kVRD46h?GGSo zE-RW0_>>R5T&55QqF1DGi+9=yE^ElS!UR@Qu~}~rXlKpSw&(jSLEqf4^-st;Iyz2n z@T_oiRD)wna^$lpC~mjXJWLNgnvd-*bv8lG&Nhnhms8K~0{|p@YAHO0w+{IbCnU?E zNEupR=kh8+;O6%WeVhQZw|0~5-i(Qr&cfF{j|?n!Ljd@m4H}GvdiJ{XID~j@?G0q1+M*8^)%lqyU4omX=*FGm?f#kaBjb#gZm{rw0=(H+RtNNs%sVo z$NJlMzK}f3A|tFq@BzDne`@?3dQjCh?M732h~RXez_(*%ch5aC+v0l8wuLg4nc9mu zIAX3^wQKCA5Jhx~)IH8`IP7$_aBsD!X1Da4TPt5j`1(99ZQm~9Ji#i3)>49)$+|MZ#f{%B>+3t!$}^H} zq6y~fq=baN-men%0XvlW%~V#Cj5oNMntZfLYR4j9Ie>S~>&muIQvmK54y zJzcs;ajy>2YE+0Y7>pf`KA1jIl_)}rj-r&66for2z5M}w-d9+r*cYbIXiwb$uvIS3 zYKwV!;2`o9G=)?ehzpI>GBDj0v*lKgI+DNCAA5pB`Cj7*m0`x-^ zV6i4V2qgrYkvNquxGt7P{QN1mvrrJ#e0#_%dc3<=?^wt}DG`}H*6d=})QO3jog*0& zEfvQwaK1Mk6W}IV3RXJ*$!WiIEFi2=JX>WX8Hi54u|Hb{buH8^iltK)p?udgLjj}@Ho1BhtbGNsqO6Ef{@gV#Qc?hV46K>QcE2$kG zamb@SCr0P{?n;q0~M!U-$0uTpHE_Qj*$`iYa8o27Tvy{$s`t7nxMP zhUA}aRXH?Me2e;5KROfhn8WmXf)Jxk$)#qZeR4C(vG#BWB6~P4!|<6kj-pC)O90w2 zk=woV$_AP!`X;2zM~ksO%~~Mi%g(H2e(&r*xd2XW07;p{ZgoR%#1U{LLGK889bZ`; ztTBYw?G0)P&y0lYdq%|4t8Fj5H4s2ukp!Y;vF+a3?XUF&AK1~|JoA*pC3&51r@n0l z9E3Tr1Gap}7&di5d|66cZY|vVcXcFmZ;H z{G^31*SHQ+Xc46cy=GvQ9G@z&FxPcixjL$k5K-Ezy!l#Ece*G%O09u-d*<;$t;UiR zgJzBn{`PFgqOhWvQY;jgoPgKiM`F!xzdy3DLb=fM#j+g-joircIIl_5ms8j!6C!WM z821U2(iwbPr#AaL8&x#U>5C<9jaH->6Zdv6mmk@-($lr(<*?f;vm_1YJ-!dsPeD}j z4IXU5GGIF!@>R2PsZm9w<{b})T>{W~K!yEw;dQkuMvan05E5B|^XO`G!zOs?4>N-S zL>_d&0n2%GBY4@&X7x)l#%pU|mB(?HZaA?nI^(F-c>I**5FFw!0J51sXYtx@WuT)6&OzUBy?$jg5|O6GQrPCsPHQ^8!c8Wm<~xsGf@u zs4X%%b}9AHcswnUTXWt30(m3n&O$>~1u>mQeLkDXoQ9U0MR`Lj!sF_*#4QHEF zVV+FQAH`<}fDqZ;M(|yZ?ok0nmd;AJ8tV~P@)8NlT~ z?;@V}&_cmrRdqYMLo0VJoh3phov&(?qRm!J2qLEAtuwdu8zByIuB_TBZV=+5&xHY*>{ z^9;X^j~5srwKBKM!Sri#2mDub@+wCLz*( ziZ>>_S|voP>!dc7QE8Os_V$-JH=UHBcXswmdikJB08_BD(s>%ysH;|KFrZM?WWD;~ zdJjl{8tg84ub?gAd8Jz&)6<#)h@xhXG9m3^lQL*P96P3dU;x6`n{y%-R8qS$lCel2 zA;UllZwB;Wmud3@cMX$CCZ=sff~m0mW$D2!WG2o0zEHU(ksG?(Q*l%p)+Fg$6EYd# zU}iDp<#LW+A5~-aShe-I8K*5>TWKgYUv;$Hrd_JlWVys?sb_ag11|rX(y+Otrb3Up zy5#sl^A!JaYb1f7q;cQB)3G__sI2uy4Wl+RN1-RER{){iUyEp~7j)Dmx zx{R&0n_vo>+jueMQVqi(U{3d&2V>Q#W_H{lo)oDKuP)VMD)$#oDVEotg3yRiY&Ul? z(ndq|7ctIVeeO>7xT<>Yk&zejUwS$_Z~Qns5d=wgu-~vcum|XbRm0NhNWf96mln_R zj5NKaoO_1?{W^{ewN*K_f4GASg&CuE^Q)V}N6j^xD&{Cgc;&pbL9N(3h1x9q82gR- zqb>;9d(uLhjAj~3Krp@fQPPVIrzCi}oqoP?NuA9q!XHa3dcoxcQm(5# zE67-U3!hM=RFa#f-oQT8A)s#&z~=PNf%c^<alXPSB79qb7p^ma6kj-arsS9U0nN0A=C+*(61t_yXndiQfF` z29wOVSQS`8YCUPL#_Mj_2nY}R`(B(v^yyg#4t~0^{61Z0aT_3S<3!y;1@%g9T6ZT6JEr(7SeQ@%QlGM%hYiTOUBHyZN$v5&}0 z4J5Ln&upU-*CIC)R(BeTapbr^Q#ySvzZ12N3NQC?;jt#M9{EZ|6!yb%t3?rC z@l>Gv!CW*)uVtb^#-`<9$N%5@j&WUU4w$*augs%L48 zmU$|_&Qo?DKeV{ex?5IYA2zI+hVh2n=pT$*qYoc^Wavpu zQ{a#7Es|cjlROs$H1WfT+b!kVPAQSsf5EoIAf7F}WFo2z%W4ggdhi-f))Pr= zCUsorm<-$7u1{&YK<~3E^?ZjRgUc;@IW}g*%kI1y7^2!UkH^8BFcEH1=ekpThJ)YK z$==bcP1NhPW5DY*=n*sVXe_Mca_M$jL1)~KUbD{w0=ilA6m2wPVvHkMJe+R?1Vw5^hq*?Aq(>}rSw;OK5VPG>Vb`Wn|)bR`HA+su12%fw#Pz;1!Xt> zFy3;3F0jsUET^_-R=RJJoM33*8XeZ81zg1-B$nQI&ToG11E_nYgRrzX!YfzWfdP8b zVyHU?(RGjI%`ZYQRf&P!d%-+6QYPF%U!YzWR)cq7QKH5%NTH4rQ13Q51dyTjs3`&X=C zx1!XHkIR_#Bef={Uo_*nXAA;ma0~sbBh@Y%(Hw46+_o zH&zyJ){)01bvwRe>Rz6->BdScYpJMH5wENv1QRa2K$+A;FI8?~udlD_uBP9*fk}?u z80jNeCRI*4a2L>Po3gg*`fvtFoWoQX4@n(y*6uon@h}sAadQ?;kmH_oARGbl>^L&S zZi76-rZeMw-}vrtFF8Y`_VD33w?%kf%T~&-=L$1jg2#lsMt&DuwQNx}E?J;hr> zWfDcU3miJ)-{b_(k8}xau71ng4P6^v>~o)-jmr*%?2H@M^rG2m$hD=N*7VM3ib2C7dUNM&8;f7O)D*4hi#{r=Amj-|_GCrd~(sx*#{9?EKm?Namg z#pDj16yeqfWK6m-3?d@t0k3?R*UHG{0w3Fm!B_2A!qQar6MA&c*1j<4$QVM@9HJ`U zPep!mybJ1K|GW^cFDj)25xSN1X^nP@Lx>G5KlCNX@QM2<8d|AJ!xg8R31JC&ah&*& z!1oJWw9+W7v;Bs&&1vNDxTUU9r{tNy%a`GMo%7eNZ;aq(Dn7b}+9}DWdhVKx3q)6g zQ!aq~OB7!peBe%pVerZ|eA`XC)U~BW^WvfC2o_IJiq5tCJ)(pUy(GBI$>RTOugF9$_MfMdN&?HEkM;VI`tm7}!R& z(tyP!?O=M@Jj>3K$;nZP7Cgl4b~#5^Wv$5*l;`s5Iz8Q|vNemrK)x6(?{fBLJ{hJ5 z4QgWCac44I0QR=ssmw8bb6al5aq9-|(mRHux@3}-oql!F|5AsnVLdRTEcy(SSkc~_WCrypJP9S(Zn zdU`hdCdLivKJ?&er~j?$GpgQ=>VJ1Vy=)YWCA;2j;|^~)4u@B+w!h16HhJ%mye#lm zP7oHNEq;ODFa(4Uu2{iTf3l+}Of$K(*GvD468l7<1MU01d{1huCs~XZ-*OgtcKbWu zZ=u!r-51J{#n`?jE_^d2wpVK|HLrZ7k%A8lm;72nkb<9IBsbd8sa5y$l?x|~HOVs8 zDBxJW({>i>=yEJlwvZ-vp(_6^=QG3I7KUfM@VmNL#2VC~_U^U{tX zoXfWhNJ=%pxPAYatR|uB4Oj2UDiu2=3avsFe@dpA82mh{1kSkI3&B>-f5$i;u`W$C_Lwc0@gWV!LY>%s+> zq0w5_FA^!Z4Pci>Hr0z9D5AB%LYqBU2>E6PYN5|Biz;gENA`C4m6wxwtx^&3zS{W{ zaVGbGQu8&m%cFhHDWiXY9o`-PTuBV)#y}EsKV-9x*Jnm;Z!}+Nj~iyLKEFGCG34Qk zAs|mEh<~bFx^w>La)ET(iw&4xLD>C1S34O9~x-om}{g_EH>X8XKxt#l;i4y2ln zBe80IbKnLs1xoc~)EYZc@sY?qtfhT`sSx=ij@9sz3Ms*SE8cRoveFVK^ck}W5RIWx z!v5}RIEN$uj2mJcy74EElD!4W=20oss(!{IhCDbsa@wBRTcwqYLO8B#{dog@IzkwO z<@SzsGJ({O_YH`x`y+*P6a>Q3)b*cMNv31k)z(YZ(Z&Z9+CSxa)Hf3Hx-JloQt~)FCEU6;or&x1!JNTB zVOL6|-%@ZHQnMX!YGZYzi|BB;psHzc5>!`Aai}gmcQW@i;MGI@QcBU~`2t@d1iQYC zkjEXoGzFrT%72fB4BPICdYBM4-3D+KwE3Oni$QSy+>;8eJeQ-csN}e?koVfK4$%G| z8Knc96?$E=|V@p?Zm{fkEhHH%v&?O*hEPFYcHJ2sL2V2T;QjW8Ejt>0!x2z?;^IvJ?jf-pTlWij`~ z{TDr=#mjvwK4P@E<)V9j4VqtkX#O}@5tlsjMh{){f&bh>~Z0Tn;`Ev0O)d=ZfQ z_D=R0vOzn2>~zKBtbjN>ke%Pu%Wkt1hVc8EH?tBw^lB@d z=aA@mE&ehh@i#g1dT8&ZO_diJ8Uc(of>x`$h<#AyE5vSE7;A^Rg~fGH-wY1=cTzxI z+>ZCf!$UdLIbi8;jY}qgU*Vwc_f665DOo;ryYKH-7 zmbjk;0|wZI&kc{T4RO;bJU;b4>2VRGpTT_5Z|!OpYY>F>x$rQv!k#ja$LM1Ta}cQ^ zg#MMk>|c@4OG+RzhYR`0?S>Cg(VXryB**?Z9Z`ky?oVDCViNRnDASN}{4`Tr0>(C1 z+2ZuL%lf`8ciXy!z6fTDqBl#q&_{y&;D0FTzZC>%b}%7us3CG*h#taTFyngJT7=c#Ot3IAIQ%O?)2u6Y*s|ENy> zm7hFaJgF?m)nNEc_F4Y777I@gv2>|o|IaE9;-_SWlGU)zV>5<-w*Z76-rnAk3?4V) z!-oCw@(MYU1k@>r6(5NKO9+U;Gm?m%xR|83n5&KiaK0H6x*t)m?lwFtOZYRU#Uou>=KxFG%yvnV7WYjZ)r`iY;nS@Q}oG-?tEqUPZ0PTB>XZkd^KFQ)J~r>U)|zu?Z+4|@^#6EqTxz8pprI)?#jK)k zRh+W*NyPzdf^c#4BLJ5@?t_1@n#85We1;V2_1PZLk@{^a?gfWz?k^%M)2RX?VeiAy z(aa!_Sv)sxn!^>*_4p?oW~l7*s%(j@i@kul3gN=#({S8=6tVWO4&WXUaKotq0I()XSps(yK%j+wax2R z)zNZ!Kki0VVhB;^u)+O0a(|(g92(Q3fKpnT1vaHosCi=hqx!-j>#}EYmrL&4W5@N< z;F^7HZkIK%2FH$~dh1Y>%gII@Whw#H?ZtjH^493Jl9dt*`I~vHF!?UQI6NL%>J z2q>SXWX>^G!H~9J?5G*4=+GL{lNWTCGO%+S-Bx7mVFP5mtFG4{j{RHuLoEEZov}$I zC^o|F@^C=?$b*_S_ksR&OS&qYTIG=Mq?b2sApR&|U}_j|f5&(E`V&I|43c)pDU_C& zf6|BE%e&L|6pEr+XPR)A0YMRuf}%>j@VFv6QLFc#S0{3(#+xpQRUN0C-Rt`Ni1kRh z!)g>MyHum9-?4d?HQE-J6TCH$E!daPj6nm6p-l6T_}0q()1Bn##%5WFFloC=3yNQC^-y1OKe8M6K^uNe^w4Eh z>AH!2?XeL5^4=z{Z`_$wDcx!Xx?UPS;*zr5b-q*Zz$i7Kut_daNmgmR^%{qN4Y|Q# z@0fo!Geb=%44@>}T&8c6!(+tGo`We+2-?ZXSOc7a?)V)L=7;8tOdUXJNlp$8T< zI6ohDxsh6t@{uGMI$XWAcPGwRpjnoY{W(hc;&6^(JnxPgsLaUGN6_bW4lz_M+HwoJ zAU(6p=YHtdmla2;F>jv<#}^>ZYP;=xuvV`Af7<)XxTfE?Z9za02|+<5RZb0X@jXz6XN^j3=p*P5!c3J}FB%QzA(O`N zT6+fvR2)YSNp;5J5k@s(_cqCL`)wX6!iY9koGjzR78^n~+B2Kx!&+;QM)!>&C; z7(?f~GHY__8el2mwMA=#+a`cKxrVl`VIGKI;g)jQ*CJ#7XvY<<@^;V)Wx6bbUtFJM z%3`Kwo4+nSTr_(hR`tTjrQp+6Xj-1C|M4xb0pB%`T@mLY1^kp}%eM2h`ry&%lSA|A zd}HuXDk_X_Y!kmNnf*kU^u-|JUMxYg>^2=QZ@TaITnk)}Y#Zfk_Zh<1+0UZCxhTae z;y2BSHXh=DE!g7Ava#siv>3G!`_6o4*?9Z}q>wx?x9)A&+=jHbq*(9nT*K~{Yn0g3 z2ANW|DYe|?++DEcT0WfI!x@R6VEKA+tL22o5lX*>QpoLrvr#7EemmxKm zDB$2*W4hH+Tx*UoqGsual>gqldO59hNxO==Wd6IH-pQ0DqK_T3yqG+{S&YnpRd%U^)kuA(>zc0KTbXGoWHOG=BfBq_c2sMzdIQusJ?NPMk(aR((%(niR~BZr!ji1 zc|;&_{xG_p=ut|K1pG83*wGbi??{p1Vxqt-^zaJbeC(4fR8ik-e9+;+w{fyhMp7XAp#e1wvq-DqL64E=M>j2BX6&XI3R_SzcL>8-kf`XP^pg59Ov zVK7)W8ZqDPMGr)3BEG z`01%px=prIP;Q0iXP|M8*#_Rbae-Jc7TfqeHM-)yChoWwC3db}3(HB8U6!V$RkRt; z^rZH|=6WWz*NHg;ZJa+(JdeK+Dx3|s1Z*or()zSl<7#EEa}Wd)aO_Qn!CTlpx9Otlh0daH2UDyD*{IvS?_#)k z)iz!~5Wn?@k8vyH^}{N1#+?X>rG09*(wc`7?Tg;f zt=v=O;F;ht&P^E}Jo3gxl(;-(36TM*_wJf(f>Ldq(QS9aO2kU*_|5!IWU|KI40`tU zIu<@E;nCk|c>SW`!CjBJG?F6rLiwg=r^QbKygwMbpgO@Z6f6@qa<8yM%}6~$CDLBi zTwdewr`PGFd+4sm)*kfFgbZmtg5P%b(eVwvO0Xn5(P$IQC|fr>g*_put9h^u*@&?9 zycky-k=aVxxf09SBZ5wv$#_B*DA+w&|IA&+3zp7^rf^QbGP42DMn)|dmCYVRrxiYO zv{|z6Zr{JmSd1l%3oTtzMQ`V6r$%WqAd?pLfy`L-XCdp#WK(DR&sWo1+YsT&$eyXU zShBah&2~KWrwu+U_p-zRaJhF1(y3rWi@-)9zw7wW(8zn@QTh<(zB)SOL-9?B`lTl) zc$Cqag@2zfs1Lv2{SZ{xIlZqAExC$*f?pJ46?6w7h>^j4%cu<}B$s=NPw1HVYm}XI zm^;6cB2AFrCYp4Gr2K*LtXiZWu9XHgxTeYYPUI*NNmkmUT6J3=lKJkdJ}IvIZtggk z$R9(Z34{h`dYs~3rbv5EWw#3M%h=_w_`f?EXu|DUl>j@dFgy8iaHEl9K~VJrP?oq# zqHK`oGJYSU&^QBJWa^|S{c9}}eUg*iNo@$(9V1?u;e6v)OBv=+!7Z^^60)S290b(Y zC(wDcFtt3Qy!gqjtHWZY+aFd*DFa*H(IqIh>AlAXm6S(bxFOI3266^NL4SW9`liJaFTo z(}XJ)X9+-e26~i^o-bFB{s8A@t5ayHjuJ+S#rO7z{qRGS&7R6auwZ_4+NNh^E-VT7 zOzvp4@_p{wUI_#0wc#6;@rwAJL-E|MoZ)TstMWb9y{0?Z;tQ}){L$d3A-)6fC+*xd z?&dVL#Om;NwpYy`2A_3)swc!W;_sG!Z!5F>0T$JyVW3{+d6;pXslc?T)b#A8y$Cj* zyG8SwCun4XQegcVr2_rQQih*bPiXfeGU&X;>0Qb?x$x7`#o(MC^%F1HNlLwox8?j; z>vUmNPz6UGPz#8(H`Q-b7}!37XN4=#ZQ~vhKanA?p?Gb@t}n0nz!wWmk@9%3)R)E) z^u~vE+;veG@m3^yRR{`d@;N#wN6t}hGxrPwU1ro z$f(`#tC@FVcP7HL^Q$MX(Vt zNh_{k)~AfzQN78tw+*GE%yfzOR8SP^v>g|2m{FJ4n`_c|iio@X+a+7>@GnYOo9l_rMgsGX zpD;uT>d^KkzfZU6@s*^DKxVNVnLrfUnF*Rlbi7CWDANHaE1C4%DPoAxKG|YCboOd zOg68K1@qW<5~~}B)Vi)qqZI=~ywACI#Um0mnd<0Vm#6Hxk2Erq>CEKP=a=k_kx$=K z#(CR(Ki7CvI+B}gos<%A@qSt$wGMh*{|_?`+*dkBXa5?Vc5k#Ky`K)LISsuVxN@ z;JWt2js&Hw>P|M5aj+Ftrq%bJz3hQcjfV}EcB55?O(Jd6x#h(y<7fB|7a5qR?$bTq z9JMPl+GTq|f>~jAv_fflxEb7}pUGV&B^B_*tg~kxl zj;7!ZgxjF$o!!z3ooO{pkJ!a4Yb>z(`gM~Sfy(vAGj&(++bgZs5>euGG8K$B99znG zC#HIWbr$Qt(T`v*KL04aRengJRLY)&%(#yz;w$a_wmua|Uz)4|y$zJgV%}j2#k?uh zc}ZOocuMuENyT}p+gbv%@i?PtVK)TV(yQIlt&~4G-HckfaZir7eB(-c{f+eZwZp!2 z>A?cmcKTcfYOl88cOMf871hT2Jc_fu*v8^BV|}o+{#YvV0$){<9xw5Yhy^TJ`KZs8 zl=IrNH~GvOEDOh1ze6A9KYKojPFFl`bTk<)`c_)PuPLZ4{UakLEvK-?{5wy?#zv@f z`6CJ**d{;mKCoS=h-c{?w?FizdA%pE+8h`1GxIUw=P5y^$R~2ph6i=A0DF|K@iqC7 z`SY)@PYEOJ9axQWhzr%3Eiq@4jg)r_3M&H_Huq)%ay-gd_1A6@?j;yy#t^+@eONA* zIrcKNJd9l6(uq>^til^VUu_}z+!5ZdOAe$ zotTA>ojTn~-u9eg`(%%<-eYu$aBfQsd|PVLE>S=;KG$l>Ad;Z4HmUr>XtKhGU6vWJ zO$vTD3u%)FNwk_bct`v#HyU;&kF+;}IIiO=hd3s-e5)pNPNmOwVtd+_U3*a{%RFW+ zrHV|Ha6l&(=!r^wEyf7HLZ#2ApUNn^*8rKBDuY>cc!V ztKGvEh@>mcwD0*iSG$qh$)+rBRyMTxaL;c#!z-P^%oyoX<&zYMZU!#55|p9r-X%QU zF6Q)%_|f^1YTVYHZX+8zYYlDRGdql#CTP2{A#ML?eHFE0Itgp-OG{^0&5eg+b0S@- zn$K93g3l>bE$1t%1)d|k$QmFYe5L<+_Je*ybneKyD^o2NTs5ahr*0-S+800o7ynb-(xCbV39Rtpl?m-&rrS zeH^Li3Trp4D!GV*X$>@FW9?8wdHxtdp`TEUPA|aktb{G=Hx{(W6TO4dQ^e9KT$DlMSM- zKI$*XJ$i?}Pq&vL>vzzVh;|o$7AfPqHsTXaL0vLkb_^;)r+5^slN6QoRiUC*nVNDt&3qjz#y$-M~E63D&rgxyI2V8s0&S@fm^R z_bV@Wrs{gFKh9R~#BT8!oh)dLyS=ncnzn@FhV}hsJfPH@r}`DeJ?|&Z^n131e4<4!fb-|oCnLP(?i+FxA2`e^jA$=10+suTFd<9+}4^?f_ zor9J)TaV-#xpY8MM-q`{{ws%r4&7t7*YOgNX@hZED?kD$A03wR;vV zvUFnvSJq;anqWU;HYL%H7T6{toF#u?3hfa1q2+j0Uwc5n#AX^>^U2uBy2rI8{ABsW z!=WG5HtxE{I&T9FJi?ia%1TDC)dszq-kz;n9(?(x?e?NHzUkllBytuvG)2GoeU3>@8Do z8l-%^5E}%wdNdTg*=ltrFkBu*%kPEcJ6g=bt!uW_^!A?%gAbdNBx`GER0zRVEQy6m z8%LZ*Cy78+O5L?)fbx%W#%BUBhe?=)PY8H*Wi`3* zw6zOXQoVUaassvporB4^zKN1S3|RZ3A2b~y^!D~ZRw zL}bB}*mU2GuaGurGqh9ZC*N3A*( z<$V1r*haL)p()W9L5z9_$ioPGvh*P(On`fN2b5z5iej?|QPNFw#wK}bfUM(n@6SEB z30zI@mt^NsSE(3UYVwCahASv%Odn0)$eCU2Aw{fD>(~mjNn{_Os_lSl*88?c7i;Oq>zR0`RCVIl{fMAZCt@tX2Oo;PvK&>B%gwW;M9KM}8 z#{-{6jkCln67fZ%J?H64yH;|Fp zOH}9|>E?2Ab8&OC5(hc-8aOI#trSawcJFR>SFI$DzxD8OL{xOpsJv_9jkO@6l0Qd4 zL^TE?)a2N|!nHEIBN^*fqc}IrI#qifw9;~dH!>XiaK-OjcdERep7zfS; zkQgTT)QmY{q4Yv_ne=O>%_&NhwHi?|)9aT5st+7b~r!hm|* zv~`f#4aOms^_V*I8AkkZ&BdFp{0&{FS#U^i0M2!@ab)f20)xXyK+)*#aXl_nizH)Z zJde3DkeQs>b`Ud9N)t68eD=N(B{sxIEmO(?fD45*fcn=AvEWgm9~dc5N>?4Jm;v5B zut}=|*>J*0neb|Is#lsIdA%0$anL}(D;2YwznckYNhwcnO^h-r1K!wa&Hq}QG&o5$gERog4Z<0Tcws|_alL5RPM(cs+sRrir3Uzmo`a!-`4AE{?Z#!L~>~LS6L`soa zn-HYPoZKK=)N?t$*QVN!18}z_0FTYaTa2-Ns(rqxXvy592!(=Jf)$NeLy+{>Cb?vP zQ;A8*$d658yUvvy%^U7MUu{k+KKMCJyk0WQXb|<5OrB_efmIr~O*v!N!ZxP@iEUEdTr zqU$MBJ3S(u3!QrpVHtkQI3Z-`K})_Teiq=>Xor!LsXeWn=dq)k33XYIsI_Qfw2^9r z9|S)LQfi6WFahbKoCcQb!%uHtb$!NuX@#W5xBE;V3Hkoe@Pg^6rB1Xan^FR}>b^o?8=_hrvj_Y&9hZWfcl zt`(KaAf@`;b2oTO>pT4jc4`i&vw~L+eFE)POsft!aj*D$Ya}fdN)AlW(~dyo1uV`O zo4`uZ|#qIDW+EDelO7xk~_HQ`DXkk!$ z)gI!iqo)z1My*@vi7@z_e)mP&BCuolMmJ%}^h*}cIW3_FX+zZf)?AVr3bzkhV64F4 z`ga`{f06)Y+K@%Ly?M7016ql3PhA7kiKmFS&z9c0-VFG#LD#Q(-Hlf!HD_=|aGA$& zVpYY&VIK@YgIN-8;*nJ#k#NSW^PKsC-NIpp3I7Gj3m6lAs!rU zjI(3>aeBmKaU&O5sT2t(u8q+bH|IR9%|)21A5~J|CGwp;Ls4v*h?t8=lB2l@Bi7A@)wD>U8Gc9TqRT2*h6Q|=7qiExTZvTM9Kjb1yMD5FKapgBiX6?5Qq@-(MXBdS$V*Oem z%Ogc_jby+2Vxzqhhw;aY;Mja)QOKtO!HtfE#ZRsrH4Pg4(nmH0B}I0-d+XKj;a=k) zPdm8abH?AJE}v129}XbTSIDpKeaZi@(kg92!6cz)V6Jnl2~U8JMwi}8K42{!ZJ zTDj$U9Enp`R17+Dqv6zy|J=^P^PKeg_DD>h<;NxoT{E*y)6Ij${?Bb;HReOEj(4WG z`eaUC`Pl7kY1tfmg=&Z&-XGw5PbqUKHeQjV;?%I=(g`fNISA1AC%JAL5)XVA`*^`};zH>5CD{Hdnq9%Q!WD`Pa;(S?O-2eX*7 z1cLLpD7*`G2$G%gM2IZBbYC6(%GcY~n*eQXRc!FsbpX0eDYb1L1V}%{51m-L6^>7G3mR1I=P*0c*ZSKJ+fEbYIftgq-}q+*sJxK2AUE{<233Fm6uvc_QCY@hQ^6vJ1yV~_Ld<5YYT5m$gV zv!-iy+D?NdaL}1~Ht%c<^|=Zi9T)M-3YFk4Wfv55Cg`0H*OHuaiv^i{&uZFAvtLD+B*7%Fx&VztRvJk(~illu{)bF8_4EQj>F}EFL=MHIK13Nm+ z_@l|8?vv+TJ}6jN4g`~(EIpgL(jH2ZW({&JxO(lxvUbQopEK3vja|VW%)9l%W*R`Q z6!_%4iNDYGrl89X0Y^a17|}D+#2^YLPI&7fzXw6(EYH4(;0JolQ zyVfrjGFXn4`J%9WvNZ_d0MX4rsdZP!1NSM_Jg79sIISN0R};&bbTpzc9aVIQHLI5DwZv9XQW}l%_Xs47czb-5-q)!} zmRA0;h;vD9SvF1fV1}qg*cREW%{ zTToOa0$A9nobs5r@JqwMA4Cg zr}+!0bbe_^v7-Dj4k5lY`}EfRPqT}s%4sp_sge(cHv?Bu!$O>sqn?SH>Ad0Lnz>f< zgixt7V~O?d%KIig5}jtvQW($w3{>WaUJpMefy719pMIZ!=o4RmXVvJS`Or6|&HBFP z0k_R$S(F|y~EdJ(+EBs7g%^=%}PwMT@8+}JdDmG7pJLX$u zfFu+%CJm6y@}YMr>B)R)T8BPc%Az5olWzLETFqX2)gW1T<9IwB2oC5WxjgaNdx+M| ze{U;zW0yyROx*EGKA=%eEp!^O`!)egITXJ~iR-SM=BVab1t87F9T{VL@o6Lf^t7eBvG+(L zbJ(jt!Tgn804q?uT7vFZWV*r@1>FHL(M7REy+f=S+MUFo;woNI}2N-A&AGYhzjn zU%|XNT*4nx2iCQ>hfNm`68WUKF24jQC0m|Mh-@eh4-eO+dq-I12Hs;L;}sH87fsF> zjFc;;3jb(_RP1}CSDB@5XJz#ol!GpX!?9D{Zm%`sR#ywHJqLUoMHW)4+4a3s;H9Mp z64H^_gcU;I!-q~U9rC(5TleGFMKR-d`o>4id`E{z)zk`$O5IKJ9D4nLPLBFxuxu;b zOlx69g)we+uMmeX!#e(A+xY0eca=3{G!4c`_6rPfQFGz*nCG7yF}=ud#8{g;aYEhO z&u{O?d`tVMY_XT5JfdX)wq}`H*t}FRS{bHI2&gz*sUQs=SGe{ zO+IM-a73E8MZd}J<&`^ zy=r%aTF42?v7Rgbbn!Ho!5UIY<7Y`yf^^#@uMN|p&7isTSOUv2-cB?Kj1`{CTFGDV zw{BG6_`=yCj?XZr;`+p<0XPT9MMK%du2bt2Q6_P-3$^J#@?XyfB_IwJ)(l5426Sd^ z6Dh8j1@B!mq z5=J{~iFIcVzh&g?$nIceb?OEhlr9;zv}w~<9_-^kpS+>yv6|w{so6ib5?;AkiE#f! ztl6^qwRG$hQzB*>J-p*qe|RX@VM}A%WWNLum0#%|TdgmFqbJyRGZ8k2z^{UT;<|Y) zSwFR7tsw#Z&vcJ`#=@oU=1ozCs6k`lUFAkLz9cbadrdld%}r?Fp8L7eSS{Hh-pK)w z%Si*F=gxa?%hmeCj@O2d!9k9QmJ?vw;gEErnO-cc`8U|nRWAnabpRobpc$9iKgtCd84p>ZQFK*E>sR@%FQ>vI#W|HfRm6rT0B1# zgSiUz=_Q7kFd3ckN6PTpXg2m!r98xQ!~+E{PS# z>h&gB0$Tty>!#y9i|+XF_Ld~mt^W*Zc9i%cqF|{v&U1U^8|9C*Ni3E>?dAvvmj^y^ zvS#mpFcQCtb_?@4g>sf4zH|<0hz*M~i2H0Ev>v8JeH_h$#t#>0r=EKfXxCg@YOY*s z2#Bny8lqPbp~|D7;1#pzu-n$h2kQZIXiY$}`RdxsW?cC~x}DBe&smEDj`Gpw#45nb zTkL7$`PP37o`Q`E$=;ewza9U_(*a1`#Lnl^IdR$A#patPCM9v%*{$F~>*$h;JzcLO z3MHB`xRfdb=`Tkx`yHPxhLZVPm;`thyU0}^2m{`CAtuuL7UL`#K0M!Z=aBEGeXP}m zC%W1^cOF}0N+5h?CZ3OI;E>QQv~LdT+A>Pim*Ob$ z;%ezRSel+qvxDY2&02lV&2un5kC+6I&BkR>yK($UC)8^jYya>&Hx&Y4rhA9|O}(Eq zf=QD#rd0rAoA7aobLjF*7H6P|UE)1mTcWBF^Bg-XwdkG=spScsfmo>T)vUp?< z%>3G=uO@Njr|O41Bd|&6yU70_xYy6S`o>!SYc|*41S~*4immlQ={@eSg z;2RY_l{5UWF5-)VYZs~Rhov^;X8+s!C|shtPevUv{YR<)zWGySeAr$a7GeJ_`@h?$ zF6!bNqn@q3`8Ux?;d$cIyi#uNe|w)OeB;Yk7GnP_Aim+rSTFU zU}^t5l>Z&d|61jLt@6JP_Wy^2Rk`dU_b2=WQjul5GXv}n7T5tEabNQG;_B*NQKbv) z1UuW?N42ez>*`nBFASZDE(D|ppJt~J{EiQqx~%Ya+m&JOl*Pr!xW#wO)O6Y*St8e_ zhmH8FuQB9Q*%ml}aHUtB7yXJwoEpdtjlel$KQhMn=zf=!&1Nrl>LcCTFYIbo^I+YY zLp!^CKum7io4Y7hx4gGu+EK3-eN=lG_>6ry)eX|k)H=I@b0Cwj{?xeJzZ0SIk4Ur8 zd-12Y`D4DsITXMFu^aa7Mds^!@fN=T1J$d5 z8hMQ1F&{V3CC6cM{{fY9NE4_k1!xMWO-TQPLoe>r^wZjUGeH_3Ie<7MruT5Q^oU8W zj0F3_8hedxetD{%R&wy~ZWaYV=6Ovad5;o(=tr>|8?knt)l)TOn2p}c=%2L>{J2o? zWPrpGp$RJ1iSL<2BcovgBKjsG90zo)AxpDwM1CQQSDNyT&sVS8mJbs4FpMTl#?4B; zfG>*tL7PnhkcDBskScky>70xj`{GfySv(T(X)ODNXadVFE%T;GzLn?Y1hh&<{TAFg z0%wBM*Ls{+Sn;R3hL6A&O#)b9&U6XCrC|_QHT6&zbgXaGH$I@1i!!`G{ReW)0it5% zbae;4U+^!vOOfT517m&2*bYs*|6sO@dGbE?+Ia1{gyxo-s;@d;mB04~b2Smi2nh$! zvRB4?)0LiY*6Ligcd^LT<~+bdkfqqyuYY&gP(JU5v%SN`O;xF}@v37D?b(laUa$QE zk^Krp-@cKWy~?`t?OW`p=dci&3)2#}YgRkN|GeQ}2vEKb4=7)&!?1q=(0`im7vqs= zNQtCi#J^!JJ_5;W!T(%IMH2Yxi>0cHhDUlqd3mqK1+#g-<|6HH-)PvlCDd2#)p82n ze)RPii9Pv^u*`9!I~eGl&$#ZWm*gVbJ(Sl5`>7hdlj9a&tjw?*UlKJ)_RgO+wC-&J z<3|h96WRRh!et#o-#41k%-)&~33&}L>hZcYV&k)Ep`L^b*ju;rS})64xA>fHLv{7) z*^?B@DF1Z2%!F7=ys0w9RZUD)YeIm`%H1(`swP7|!KbwZv<(?sW-KUmjMHxAt8JIE zy`Ru6-dOwCbvAN)y08l(ap3}KD_$1glU*PDLXY?EWGGZxZGvq2-VeojtaxYdFm0I> z6c}+Plg*H=)Jyy$>;7os2$|wo4Y{mF2kw&CJkuFAo=b&RQ>PLxU9WltF)v#LQEyPX zK+{%)QW69x#yvSYN0A9QD%Umj@(6R_Dx5}HxCTsf%2PSw#$By{KmAs}kr@DGk}z(8 zvDkX^)n$&qP0g#9wX*x#eZ-37V3m;+$fc2m%e^{Bw`}JjH}FKx!_RBo{f!%wTMSzs z8Zqj=Ig#Kn8S4KG?veK8>(|b-;3-zS@e@>XE&T4ZG$KV``X8Raq%~I@+n{FUo~6-h zl{1`_@Dz4>=u+)4_ULw^_6EBRBT}E)+b_t{nysUUZZGk)S@-^hSTn~4pI%t)1WB7) zy3Ho@EjaJgop#0;&T%LyI3BXM1g8pJNtzb!AfK>k^%B8taR33oK+0!YTt#>iX#?V=k_?UE8#uu z8fjRE+4)+w-h^g?l*q)8U5=3@@gfX`>wCwS!q3r=y=sfk`qiucn?$-ojjFTrdXA={ zVtf^modpttmQ$dZl!;EFKIUlHw!7ed28KJhpBAkI!-A3VcCB(5a>!)z>@6qX!CV46oO9Gkf8@D5A#*?SJ-3XAsg_(rn8V$VMPfZIQ2H%F z%qKs{baI$_PHBs3q5Tb%f0+7W7C(Yb1~3C*(VUohUFGWZl2KN2lFuL2{Imc}1%=p) zt)yV=G1-_@v{(PDSK^KSHKZGMFoEjGcl7aqEb(@8r&IEpK(z`KQKP0}gii@c2*h z{K*OSa5Yo7q9(XXEC=`9E_ZkQp7Gwt9>@`3>7ZjF?QY5FUSh)?WNlVMW*%vcJHxT7 z@xhkk(hIXO$Ai~@e2d$oK$*kb$#dg4IfH}lZwb_fV!cm-gxKW7R8O1BjFyrO>|nV` z0>fHT6=Cltr1WIP00`l0@xz@Wt_I_1)wj|*vMQ^-1 z=dK_~&lOdTyIwoW36$bx3mK&dVf>YA42)pwA2V+eIQe!nIp@BRo{cG7V9<5bOx>!J zQnzY}X}n?Hf*WwCyY0n%%NX<~IsJWZym6)_Ix=eTQy-h`&95W_DT4aWJaLg`;vZYO zyBRE58h4=Pz#}5x(71KF}?x&;*#kkgT9Zx_k8`CtL1V`(ZZ6+aDHwfjD(xd1Ep@}41f!QwCQOy z0r%ps(*Pb-Fw*_PbQEklW@hZ%c)%0UKq;$qgTWpZOQ)USJX=4Zbt5V+28`4v!bUt01UF z^IvjY^9%g4=&&+%bT>Kr%c6!*!Z?8_mqFbzabs~ofhjfh5Zg!8=HC{{yKcGeB9Ay|UEf!hBpIc}Biw*aFT(m4=yEJ;*o)hR3v0gJR$%(+QkT7faNKiyN;&I<7 zL}>4K=2?-9Ey-9E$G8ByDlY^q-}N5IFr4r5pYU-u+IvY_$n-SGtRW-&JB@MW;*%Az z)muWc6I8~#os4*seY0~zaQyTUEj$XfIm=3(y9?BdEh@Sf8}SOPtJG<4jO&RV^j^Ly z6#;AE_$P(Oq;DR+vhf1*lCZw}@+beUE2-1t$DQ33o+z23?!;HOs&f%&{iOrPMDi$_ z_6A^vzJXZRE@f$geI#E>_~d5r)P=1V+wY){=Nj;Fs%^a4>Huc%xzU=uHu1pKL9?L< zJH_|?Fo!@kHQ#)jv~+Gf#wuRW9?mqa1FzpyX1L5)YZkE_*-O+g$MU+uPpe* zx#B`&Z)g~YkXu`%HD7_C^#}!5cTcXNjb|6FJjF$S`-7^;09^ON`t#xL9U}TMDa{rW z{do_K3I`!lg_kP{#*b?(e5&@uJ;0IpeGUhRI$+rq_U&UfX-6EKUsbgXGM8UCuj9{E zXuUm&eby6kZS`o?niGtstGW-i(V_U2mzB@HIE*w9Miknd(=-$o6;-jge%`i6@H5#T z|Ht};aPkhrA_4{QH#Vy2@%Vn{i?J(-nlut=r8h{hsw(nH{jNIUNd}h)r(FU*LJyJ#zvjU75^Hp z>b_+-sAFQ8%itWc-xU(3T~-;j%0>veEI#yF&m`lDeAs?r&bi-`(qxsXh3~LC&&(NZ;Rn3%h|?)5w#28xRqg3lgs;2G$YU&NsoGHob0zjLu{- zQvL{9tapeZ?JP%Cy;zKHPb9ogvvE#mc5w-f)!hjmSQO9BJpIpRWl$J{UM`56#hMVW#-bd$0Vc@9+=MVh~G@`L} zaEN=gUuVQ4iu&t08Ph~Ne!$J5+ag!)hYiDS&;ES*C)aHA;fb$aWtXMJ#{Ls0@KX~t z3BBY>a3j&Mi<$WOqS4Mj?_G9j7>QJSO07^;mg)LWLG@fpOBhcH`oAPIz?y*@@RIBK zLO7t49QP}~hF|G*?HVd3I$jA}bxy1J!JjdqlK-G5Z}NV{w`xXP*(H-5$cAM0{F%PF zSS0TYN$+bsb;o8M0ohhBeGAip#K<+WK94` z4>fhn{mr0QJw0|2kK#)IaRu&7qf6)my*7$9N@c;DzZu6{d@*_@(buP6W-*^9xI>fTD=K>a0eIePus;;T6oX%-){bQH2*&-?T54T6|CAiVx|`<&f))5m9*}c-ZOvse*iWo Bl8gWV literal 0 HcmV?d00001 diff --git a/.gitbook/assets/posture-check-name-and-description.png b/.gitbook/assets/posture-check-name-and-description.png new file mode 100644 index 0000000000000000000000000000000000000000..eab27f94e483d3e5a6e7b2aea2267e74ae043f23 GIT binary patch literal 87450 zcmeFZWmFu^+BJ*?3l<0xAh^4`LvVL@x4~UP@Swq+;4Z=4-FW*W*HHs_k;dbNTfly-~#Y-hecF#)yT;l zVv|Mc`LhcH1Q;i=rxz4k6=if5XDEvcasY~GY+_>0Hap4}JPNcG#c%gt{BQjyx$#ku zV2}!E1io8yH)Kh}XaE-iUnrksS!ELtddtf^DB_de3tT^1t>t=pvF=|#JinfPpneZ3 zJV+NCQ*D6O*5s-^riyV79<=))eK)nOoUFh<;eMYRA3q=81MD#|U!sB+L=3&~^(%=f zOQgRvfdxDWO^;NB$xF+Aqxck?VTqO5)Rwff@LC-1Y8^MHcw|^B70wdv5*CqHtoUAk zpvN>T)*-06?@J>noA=1Go`SBU%P?<$H)hkvV4w};$vVi?0%xHyQXN$_ZcT6CON#r; zi3m~@wepeg?F+Oer|xb2ua;wsU;e1c3%rZsdLoTN%w*u!RX5X=GMAHspaG}hAs|Do zAYi~LNbnaI{DpvkjthZ+1OK9fzhd8^{&f`Q1R1JBQy{Aox6Zz)3qZ7b7AMJ6n5a9uIz! zf1JSsPXFG`NJ8|FQ(SELNi^jYi9`WTW<(qeObkpU0*FLJM0`%B<~+(`;(uia|KlgI zba8RuVPtf7cV}>CWdJx?Ffwy%AOfP;mL?;q#?Uq}8^;~zOS|C5uMg@fhKtbZK(@2qOhW=^62 zJ8+#Y0{?k5e`Wsj;9nW}7=PdTA5HPkcK*j+a6=0q@-hDVp$Q<;mqIo}KnOudi3zKE zKpthjF?-%Cy%dE&8R!VH5dZHDTmb9;7Vy7q@W1^40^$F68<>(q{cAJ_ z&`Lu1leC^Cdc0wDE)jh+`V2D&EI=80`LDs8Ec>}oY8zw;EwT)L5fG#zfS%~u1Xxp7w4z1IlEo|teKN60Cda=x^@%f+z}m4r})Fn z4VA;-z&L-FOtG$NGk9Y{9tVeoyp;@~$nHg+waDLH93 z@-2Q(t=w0Kij16y@{zZw1t1Pc;RFy2r*l@N?v}p|Wfb z^!JxY>KxV>Y&#(}xsB6MI|>V-ynP#=RI#iZZNv?WU}^~!zT~68NLIlMI8MQwSbrGQ8D^lHYr2BPC~RZmE5A7Dj*)Fr z4f*#jB(#ihc6wlCu~#nvQm9FaE#qK`MY;yTh; z47y~rNsP&t2v)BUSmoQMlizxg{4aK>!y_XTY#||Mazx<}N(hYi*u5w4!@o*<>Z_Hi z#)Tl`Nu3+_?{sws*4QpNEj8Gs@7Jx}I3Kuz=1S=2OV!!8+HHU#Bdea5aZEx707FBL z;iO|@eB6g52ECC;cY&9-BSD8Q+hjT|E zg>Z9caQW%VXNR*4Mqts?ARz4T4t>ir-*`|j*Hp4v$}LEs*Ab5<;HRNwk6C%R235>j z`O)igX=*pvQtyr?$LC2zOC7Y-^Q^;$1HCWJG^>&-w55-i>)&im%Oo?nwgLdpHmX$& z*LZWuB*AY-v-rJDyT1f;hyso)Ow`I$lVFkY(p=Z;X>}LM^=MZb0gduS5A5!h8F8IL zkgfb#k0yg8N51y4UDwh?o04DplH8vWCmLwi!>pPq_3rLV0qz+wv}vE5%A+tkRS=*6 z&BX&tWQLQT2+L_i7B*$oKo&`-F#$>h?pjG*1pjlvZ&bo~+hp492NQM334Az{=OCg{ zt+nnP-Q^Bjb!T5es`ISfFEPC(7JA{mCoECQ^NQm@ z!`$$^)w|yeM2*j=MOk$mJiZtJRcW>EVK$$heDuwJx(0685B^YTb)&!E-8aZL?0%A( zuv^Hb(Q9#&A<4)!s<&3#jS=+I2&h$z^Fw1G^f}m4^-d89)2nxCHnKs!*$O2bwyEkg zI=)DRsnmg5+Lw^Q!rU;Xfo+1}!vr~%ChIQfIS#0x=sP-gYmtGXxq3HsRglx?IfQBF zN99>(Va+uF+{oT?SMJYG5_uV{lU74^xp&!eY$OIE_OE36?v`+X&I4SAm=4?4NtxUi zx*Hk87M<#xZ-0VlA#qX%CA$$z)={y`X3zxh@shZN#As1=bmDB0!ph)DlSxAR@#<&y z<^Aj^Ig;fZIok15V3~%3g>$1Fyc?;+s(FOlf>fBtq~L3YUP=#7RuZtmZiVdK@f0D+ z4y%G7x!p>GD_*7T(#*w%|EnkF@e~@=c*asKjJ|_>`q_5O9*_L=tY=4p*SkuscIoyd zXpKtM~ez=(eJ)rp1%jzFsQWI7jJNXv1>Nc8Q=cZ?Eucvetnf2NDjz7vI z3|C?63>f@WD*qz>cmF4r7!1`~`^*9$AaiE%xVm^3|3=C|{oOL@|BxW_ANO*p{`R?!h~65o(7fX3z?0e&Tk_Jz8y^rKzeY{y34E*wCCo$Q8<5BSWs+LZ-PEu4|k5Jl?iH2qbzt^$4HA7vt*Oxvb zDr!De?!qEi7qV7hO-g#6i$?he5Bsm)hCHN7plWrTPv< z&<0Y>hr%-GYjxQ7=MhF*NZY@y-J`uV*eAQqcTP)}Upt#acPf>1-{SNV(N8wqFUoS4 zk6=tzGq%>d)2b*U+B6#DLhdd2+fac(FqQpnEgkhv+CaIDA4482$0W@Am`w(nqWB)x zz1ME=to^E2X&$s1Y=8{o zhjSH-5y^B?Gn5r@MEPt}x~@32MtK9`nm-0UQw4K(g`hMqRivFXIU1xluet*HXPTr~ z@6QJj)Hz9wk#V`YjvB4kmIb1t7(1Snr}q1?4U$@}aht-0lR`IUC;4c>Pcxa-Vq(!3 zSgvIfy>%CxbCT2UmM63L8E3IWlyW>=LtDGi%BBsLxKF#mdY*<_rJ-%rabGV4SiRM# zT{QOK_G@No{k9-Z3NP-f4kMb2%bN}(vw#}fF}j(g;JA6jbcqLGy+?#-VkK6R>Y#}bO7#=Yi8&M zj|h!=DG3;3upgfxf4QV@M5@2d#DkB?Vz((wKMUV?y*pdU7;ln;0xRW+p` zroGmsc`aeiSy#F0e$iflPeu!M(C}C!ZqyTr#j05>BCZJVL$AuI4^Nvtu>}!v2h!A` zMA)NI?MK{?az_^Qnoh5J*cT3>k>IJ2rek%TB{!8)S#MFkgz5oZY(_u+%K`c)YzjaU z{_Wo|^g2ioaC!I#hg7nXhS)6~QV1X`1&mtJr*XQUj1;e&y3h(SxgA*yq>oih2WPgp z9xjG%A>8b!C@eiLHr-}T+k=@&;mW4z+m@IBU;M`Mj=iKn;_?NS9b@mCrTucf%ZED* z1xq6ojc5vdOJHRtcZX-Z_X~K`v{=5hM66piBDJbr&a~5^3SJbi`Zl&6Siv?SZlK*D z5xcJO0MmZP>9x8!wqCFj-16EjyNt_u^w`f%kd`kBI2!fN2A)Loo;Z1DaQ_oY1uV zyo$bRm^e%7bz};J(@&i#SR44^_Hy^k*@(7{jK@)Wwmiu*u7TcU1mD$*GH)=sFfW3h z87S)t>>77$2-~ZALt0~rxyX8am4WD}c*Dk$Jbz9ZpLWNCZEk|tL7)wx| zmpc9@Gqo_Pi8Hk_Uu*psLP0AHmHOqpmct(=gGYRBNy(Z~xa{Q=H8#KrGE6%qIc(zW zg$yNrtdJgLw2u{tKe#$=_EDUp#=Y#9uRgH&J>8LARx`R`awvZ9on3CQ+IF+N5R6~F z`4PD4l*B&uwSroUH^#vT@P^)cUj6}zYcS|LkMn@+J~1hg4)>di!xl?LezHFMP|p*T z4YO1470W6S+OLUs+7>}8Np!n<<+TIX>O*-NRr5o*2Q9pgCOcd6rO&`D9?cVR&8ird; zm`of?W700Su2))Q%Nmgi2nd85dfnJ2014z@EH}B`k9fz?qcfl5bSx}7=j{C-k2y>1 zM%>6^t>Bwj#tQ6P{Pr=(M?a_?;pggo<*(O6pJreYeqs#jr=VTthEs!NqzB55K65el z+WoC_5e3Ll3dOX_7%nyfve~XrmTE&+U%LVeCnrAg7U(Y3nB%>{Y149WAO?g+Et-+P zGP(#0UE1Qj-{H@nsm*NkofN@UPv`Sw4ACVJ@ae-BzBP*Alv%#L$PMIFw^zi0P2$blm_c=5To+dd)ASimXqL>@Y15XYQvbNW?ZUCl(T zQJJy!yr1p=qp{si48PN(bA6(>bqbf!+wIf__8fI`s3e|}4T)XZ_+!rC`he^&oIb<% z#h;1GF+Z^@*A$ErE;X@uE zD-1!hs`gZiQ#z}!BvVoB@rkm#Tk7953plYkKqj=skO|W7^y6>*iC*%70*wD>@})4e zT3kxX=W=1y*O^ou?UrhS)rs{iQ3KBgN@=V;S%U@_nq&7XbG>YHoTx9-v|u60+l^{) zpx4!kNxW9KghPFcB%7=*DV&?9>T|#zrFShdBqFA0W)J$_-k5ucF*?(ZTbWW`OEZ=e zG}u`H;!7m1>#zYfBN+Jr8mq@kc^Wl6nb|d9C`K3zM_6t;jBYO%vU-#Sm^#jn$xPKQ z&n?TV0Xa_!0{Yl28bgqAi{Vy1F>bt%G)H35T4ZX-|+7rKvbDUI8_pA&q&l&qcWb~mqn93Rl_kJya?z0ZEMikrq<4AK4ldgY%rXTO5B(qy}F!{2>n5GAOq;~6&PDWWk7$1GbSt2Z3uweGfA7%DaEGoqd!FnrPMWSgfs zS@u=;9QHpH;%69pNhrVIFAy-w|mKP7ZJyx;b~N8|8gU6 zUTWvnjc`nGZxzI^+W4OHZvNr+w1{N7=tdVzLz-UhF@3a2oGVqEy`d6=h8H0A;vd}` z&m<)##%_Q2&a2sCl7QR&B*QoR^_f%D8dz%P%8cpQog)&AD0LS};M@81umUKoh==Ym z)@iUdi7~R1eRyQFTCNMPw<#T})NPg?WB~N&(<=zFSuWKie(!OR=5YK;__LfPa^DaP z?9AyaVlB)3A5k)86IcGl4u+n~Vlpa?SR3mLKAT1&;d3z!dzJ&!*vsDJW}3CS9mgH7 zxZ|8qV@CaSyf<@EVrwC+TSR;N<1j+#B9)BQsq;W%jx=> zT=Cs~vVlt5K@fuA(*9P(oP_gs4!Uj8MCP3L(a)mXt}Y>!PYdYBM4vrs^|rR0PA%OP zsCVegG)|50?7iN8-1LHH4HhmhGwAF{*9>%S_qt{Vd#T@-ZEN@FVYVuhj2I5~-;)#H zu-h!G-UK~v#|WC8$C0aJlZvQU5s>tTqB>(7JG2W2+SjZYZO1DxAo?vzbkvO`(w3dM zC>47j2)oBfhFQTgPE=&Mqve--i@nxqXLtBU4Ow18Q+gnYY`T1P13aC+`h0c6$@71O zq?xm;3sF%R73!T-sq_9-kQ`-c!6`c!Qm-!`BNoJE@*+QtB4Ygt34NT4t)yhpUdfup zU1SMYxz=*)@-|uCK8;i&nuR3W^#$zt%~bEjEif2J5nWbUrvlY{;Vn*>%?k< z{@c7bln>?+3rx1`JD-hH2wVJbmMo~FSr)dRiocP{J@R|sj7;f-w1(?*K{B6WV?qn! zvQjKL68p4Y->g6d^jo1l5==qiP#9mWRN6az^O!@suklUv9;%=19Z{5d^c)?0K2= zWxqGQJMV|m_CSr_v)7}GG~d<_&&QAM%XVAB52KS9|6uuCg^Be0d3}Dx97dk_gx;rm z9{Rj7_^+U8fQ|g;oEo4Hf-Z*8r+Gw7+94EVt*iF~%4sBD73WG+G`?cdlZ@6EcXtPd zDqCkAHSdVvGFPFK%UD{T>0cAPRmqvsgSo&*!?fDEPoi`u2Qc;==@hU>SL3|(Uv^#Q`B&n&HBK9eh zeI(-z#3Xi>J zQt)wX)(ZDg+`7$b+pE_Klr(PDaXgX9yA%oNuyROyG^jwiU3YGjP3P(NskfXa(Mui& zQ;hFv)m6W|#dHDra}T)T#q$0+Kr}KxKT?L5`FZNc{#AP=0E*jrFTo<)|Ky=#7|FwZ zsm5&db8QQY%EQy;q^aJ4_EMeIc49Mx#Gm1vCUbEA^&X$P?D;E(i5M__sCK;tM>tfX z@{MzZ{!&0iYO@zrFabgE*;e~>t(7vdT^V>J4Q8r7RAc_pVY>>@zYnezpqu*tW%SR4 zi6TNq{5agoW7J8^Mw62KDW2&cZ;zRcvO-Zm#@5@YORaF&tv)d5)krn~R!9{1?}H)< zUn{Kq4PW(BnSD!lhT|oc8vzy%#JcX;UxiQGAEQl&f9`V(d=G#&n>f-cJpI-SXLesh zez9m0(^7xl5Kk(Ba_=!FQRA-AluG(w%z!H3(5d5W6Rp7alH&7nui5$>eXLVp5p!a1 z$ILm#Y@A-B_+I{T)r%c%RQS-H)_v1+aRHw-RuUxszA$mDGpChUBr z!K77pvDv5=hVJG!{z$sqvXErh1IEu^`Emgnt56!lgyI;Q+* zHvChM_r}wuVhH%hT8xg%xw%#vZI?un7!7DPBkMEn_D_}byj)p17NAVPOyELCl4~Z= zzG2ihdlZ3MMRA2>+36HLEW!^dVVJNj?Qq}yV||AZjLiC7>1*e zn9xPX!=OJuKi9Zm`QT@}?;N*9>HUEcUKr*S0pNCGn?OcJ_Kb;!hDP-AqD9X0kkM$* zmxKs4@LpNDN7U&I7y<&; zMfo1D35nif(Xsj79IsUzL%BYqtHwIN`qr5YqEM@qCU}H=?RdW7y-4!wwr_WBYP-DA zF<-e{0n?hJDhh(zo{LA@p4uI@sR`67%OFn+1Dog{KYmEd=KG(-9 zgP;^H4=@#8qFay#yd;-NV#_7XTG=@YfFnrA_IvqM13E2KD^r(raBzq#yj#=j6ejKV zBDT=gT%-A6v>tamQE{_>v3 zfjJcHpjEA;(5lss^f+05G`HHQ-yokPHh6(jZYgiQ71oA5o&ix<&6c=px8%20Txx&% zni%^cYM=aczlPybWN~KPFC*pfErM`>VSn*gs)E-e(%gQ%lVrt}+a%lbh(;+zv-7@` zTgSvc*^+qjub`@C-NMm)>y#NYTJpzB8i|Qj{Xxs+n!GDqm$KhsYd5Ih9OJzxte4;8 zF>n~=tdn!S`ctb^JcW!X=B>WhFSFL?*28amR%pjqj9MhO8?T?m#9LkrmB1n51MZ8l z+R0(}?ZFj2`_}RL!UCD(noq4@^fdxT!PKH5>m=T{C+v0-QMl9GKw>cGLdf`-Ovze?7);aC(@sbi5H+DKHc-`>(-3HJ@vSbb98 z*Yx$}*=;3(!|&yngpQ$3wPAqE;i?vqvR5tGn*?9-2UZK|cOXnbO1S7eoH$R+H{uh1i7vJ-8q~NL^>y+!v(Y;D)3|(>HAB=z*Ea#;&J71 zv5W9sgZ&zffiJs!QkCYO+r$b=CEUA8g$+OPFj2g*>&Mg1S;RUe7Q-$gm8gZo2wxxm z+lha{bU;JfaPXV~&FX3}js?$57gdbe?GbTTrv`6kDUgS?nxs!W})*fO{e2tNu8HeQ_c`A?-w zlh@)E`0NKVxg2wS?sqlJz0bZ2i_?vORV7OjmW5_jZ5O4#!_DT{ml>RZ=%o-LPQVLP zS?aUb!IaUqaEQY!=Z2Tg&GAYRK~TEs{Nemexs}THhY*L2von4-LR%NLfTIkrG&2Cxp`jA*WAxOgr?D`(rKVB2W5Jbc(2z;b98%>-a zspxJfGK5Ah3f@|VhDBjnp;fO;C{-(y97Op@Cf|MrS}3uJ*4ZeO&!p)Ed^9?K@IeMk zYIN*B*e_onuIY%T-{MZx+sw0o1OP8SdZEu=O7rH18FlPLqR z)Y1B$R%ztubg6!A)ne{LGMaXoy-A5?eF)3A3D?*xhzHp1G6R4|C|7F?4+3nEcwS=0 zMz6tX799b@Oe9Pn1Uu6nt)}wp6Q~Wepyo(nppK5L{6G9a$+*}V2Y~h3gAH;u^tSE% z9DA8F{FqayZhBrQNd*z+Qh9}T<9CB>66j(Ee5}+T`ZigM6r^)Djg^ZXlrE9RvpAGS zG|DN6>klKcy%uek-qVa?Hwze=l+RrVuXsgir(9=p+SD9vU@%~o1xZ$T$sz0T;n60I zIeVK=4c7F0iU8HFiJW=8__Q6ZHfSX=q?pO0;`%j~>+&eL*{|8&ocpi?WS+`_mV|Au zS?3OyZKq(19TzT)VRq%4XZBE60%i0T(~5pHiN0&O&VV>WxGs=hzim-K!1a*L+k1aP z?~vJTnzvPNrQxQTlP&*tUc=zWZABE=3)D`xuY%9%!*;6nz1n(IuFwv9Pp8>MpHN#Y zP%FQ6ve_LdUe_yx))yy0QT=`8Hq{RS#jw*T zJ>u5APOUf1OH5p)!}Y|=iBxLpEoEHhp3qx9B`mwULpg!sF3@oB7))WLu6XPk-RB9m zx{b=c(NOtzEJjU`kV}!0u#Ru_-BUWR>wQ76&M3s<)fDu+ILv6qzfdsMx4PkBt1HqM z5H2u9=svyrwz?m{jYpW|$w}Xu*4q^t4_1CmAAb=3Y*h-pGSlp}WcmC%v;Z4?q~-U1S{;8vKN@IiHpyDvD9cYwIZ!F!msXcTX8+HgE7H( z#_cObS$p^(j|Z%b4a<|rmzK2qIC%|8c-hTrqt(zwG+bC-!9L&_7J_Df8w6mzJY9aI zAcYl%|EgRy%|qj%QK7$r+jGp`e9e>XuwMQSm(-JY;ccWc%NTiqP0`g$S5x9V9_DEU zcvOv0V3HE!+#a|`kRA9p3D6ZZ&jDtXOUvN#u<=Z?kommz9#`{EWs)TWEg<&ap>(?K zl90yrM4+Bd%J?#-4Rd!S&S!I8<2AAn->&p5lx${h@L{XRuXApEBRiUXxZKyuWsujGR~E2sqi;9;8r#BxE|sd!REv+5OTFK z2f&-Bs-#3I1B^z0{?zp+`f)>lj`)~@eSxoSz|8!ECU=m6Hc6ODL@6{z;6d@XsxBB2 zbMC&s1n7RDKe0d2ye}Puv(L7pTZ`0ul(9$4X~95`Wb{Fkd)!%m;xVKs*LBjP{sgb8 zVBXnrZ|pU)$vPM$k`W@Y@|<^?=$d0ANA<&*Z_#}^&Nnn=pY zJK_A&FM!zxwp_eH#tbS|<#{xk-4E+*Jv*d<7RY^&{^JI>w^bXZXpXBHr{C{Eo5+pA z!SNLj#I3por8U$pi63cfaP{sQY;;oI6>e61MwL!v*x_DjHj7W7(GVt?Yqb~Yw&Ko&{) zT(s$hiC{FZ8U$wTD!dXg+1LHD_DM;iaZXDza4S_cdwaV~UdpKpPa!cgcuF=?DFFi4 z(oU~JCb+tHZt8-4T9F0j9bL8jG~&lKIN*Fha+zq)!IQK z)<8~>Nfcxi>8Q_I{5(qT1Q-U4+vkw<=NBWkmN1tC=Q{mZNd`8Ox3L?6H0a~gCDw~_m7uk__HzeO zCUz&{H{iW#)hFsxyIGN-^sJA=)O|7@ZYK*pkGN>N#u|#QTRbO44K` z#~;KOYZpA$(#&Q~_mq^`^DE2sx4iU;=wx5Ey-68_j!p{iX#*pYVyUh_%T0PaZdSL- zk$6W?H_1(9tJEKIIzFb>`%LRz)^=HkK80<*f?^DYxW_|bdnc(q@_RPvQ?u?G?t`A|7&f$MhU9Ue;s{s_o3cgV zclYl8_;%wsN3>Keew!xiW6T+Y--i2!FD{MtP+fMxx&_!13&ZF0kfe}*>ILyHK^Im3 zFdx_c(ZdN)R_JhF_XO634CYiluGd;r-9Lv|)QLx>*=tx8CAwyYc#6REr@VVNSdg|? zQCse?Wr!RzUXkT8C|lVD=BiTp9EP4b?3UTK!$ZChWb(SQtbYNtUl+33&y2zQo#B^j z)rPPqc>3;VHkxjJhTOXaZKm71@g^^1o~*SFH&t~qubsiYFT0>aRNcInj0k}2lL9!O z%obJgzYmhZ{d33-{3c9Usze1aw>PH?vzzUB^Rrye`Y!7*4l&uxe#R&l>XMhNwiIHC zP*whv6ljGq{r0mUlFKmM?cjA|PLMxT%FX{WWL{h|&_efa!cJM~6L*l!KA=6 zfNb_vnNXzY5XqjV(3>zi?9v&E^hZ$7_l}cai_@ZoyOqb4)k;VBDgdT1yOJMad6ltJ zb-{~ow(K|Tlg}cU#KY|1--Hx|C-)egdC*ZqmwSJ1fOr;&{z*bJ)VJ$BG~ioDSX7(tA> z=8>d9A-O{LyfkENJIla|UZm1#uzeRa9*xi4gHOmg;cd3Gp7uCVv!CVP9p>f=THv@p zF5hl;Zp~7%*#Oeg>}q3roHjo)(6^igBH9e9c3tXUFF3b>=>eQ?$i{OfG5pp+f~vj#2um*Bj9@bLa1wNQ^}U!*i75cH94tpkI%ALcf(pPY9Y7mK=B4B)$3Uyz+Ylcx zw7ckum`rz^_TQHWp2FCYCd}6u_1ZHdRrpS7Fcqs;l&)lysg{tT(bA{$x>wc@Yy8Op z+5BE9W2XO^PP-1u|BbtL`QC}hL19t1s9~&Ew@^7(p3#@V=mWtvwQ8Xh0=lxjRjCN7 zpWH9u+wb2Wr3ZAa^A_200s1!OAxng{Z0`DTJbV<+a)SW)$V z2KyyVePKQ`nyQ&QD^V1z7wV)OGO}LP z+V_(48{TR_%$Q49ZWgfaW-A9VVxCE>XiE!0ae9V@l2)dxxB03A8(6$w#F{YEg5t-q zrJn)&ZW{e0m)(Lw*=()~(oTfyrwQ`II#3Sq6c1No^(Ba*x zZ`XYXeYUtovxF2{%@&y&xwi!>9z|BL^?im{t1JXh{)}VZnk6?B9)fD#IxmA5;?O7d9Qrz`%>@xmd6q+vB|p6M?wTYhN3wVIL;M)_ z1O9TSPVd)MXLQeKBhPK&qaWo#i00M3xKIbje26})J}Z_OEviMr&fC;?+d#rpCK->) zf`!tB;=C-W`gvNrq~TGEYf%P{Ft?ntq_m$1XQq+v@Db{~&uk_D9?rJ$B~OKk1`RJ> zcAw3H+ecIb9N04#u?|t3EMQO{jJMp6hR55Z1mDA`UsnBdy+1y!*lWKxX)wBJ4UwlP zF4pW+qMd!;L(;}bPpe;3UjOSFbMn0a9YdyIZ^w)JxND=v<%Z{1w-P~@DK zV7+g6=RU;6$w%%ZuWT(7 z5AXJb+uX);q8TqQm^_?lGq{^zJjjwbtk8h&$9k8guM1Y!@N%z{u->sChhDw9828p* zZ#8_Uy~0|tW#K>o%Nw*apRT~SUy#2NvDvIE6Ww*k?lZAtRh+FE zm$(ESIxV*cR^HxT(dTos3U9?|Jqm?2gDgV@)z`dFeJ|=moVB5doXROIEVr#Pd0c;- zuJJT_45PPh2EDXMFYFb&p_3F6qi7DUu$)*;@4p7@$$Lb zlDL=@jF-zs6~r}p5bX;RPJzw?YukrAU*(l1`;_*$L|j+gEdenWD2JTzHrYN8C4BdD zvkSzJ?DG7D@vMOTF3fGM5R0E#-V%8F3(S0k24#{s?;Ou>e^6T3*p4;ZwcgZt-x6@b ze*5FRxiclA-7u%vgf~ocfWn+%{YXq?UT57EvRS>j#1|*pc$L$?_bO@ zF{96NeAdzmPLN$EFY-k+NqR7qnBPOac@d689i);B&^0-G3Mj(AXwRuRd|)3P*F=Lb z1QR={hglP6(#|5CcGJ2>?1yY~8BW)#bqI~LX%vT{I6=WAoN9)KZY4#Dc1A<&a53L8 zw2d(J6{vh1E=+^oO(-s*_hX&~pc^?CyG6vxz27=x^Vl__+sWx|n`#XA8t(=%Dh1~* zU#H`uR+Hl9!nJx3VDc!~6ilNyiTA>7MZGaXc#c(hYvjG48<9vws>4~uN$`20KI0Oe zL0cA=6JXJX{H=%JH6_@4FkovQ!woOA5Eh+b7H=)8rG z-qym=ie`#SL535vZdtICvegGu6`j;6;209s%gb4$voCz`pz$v!%qaK-QRh!ayyT)v znD2Fdfnyi(aA?6FHno~Xv%P~#y=oH{-s+nSO^4NYd-v9|lwPJ@x!M_=#?bj`$rf`8 z43W|;Ur5%rk*K7-Wqa$fFU%E!296;TTpPQzzs8jb9GeE9E!VYSS9D;O&N1~fmHW2k zP9cf-ej`K^tnI0jly|LQdMiA@!iVjlf9?mEYpZy7SMey84z~ZeuU@{sFTvPv4AzgX zQmK5i6QrFGi6e*7li15T=PLEUvZp(ml`8lop!G%Deq0sHqpU} ztkAKSKvaIRI~wh};sk0v?Vg695~jqtm4&4b{d5mkzbsIQ3D?8pDP^1JP>3|vStt2y z{J?i`$stiktJXrNzlx-9-{cN&3jaae!%CZPe!%A`e6tL!BGq1`6fQ4qfY-Zb3)2Ow z?CZEC#Iuqz56|~Me2MJ1qfsv}R$cJ%wpj>Cdved(2FoeOBSV??cw9k4;TV+H53Q?x zlc)lBif6my$~>Vr{x96q@Smylo$k(vxt(^38;$BNj!SEJH2(E20F}Mb%lt-=Jy?5+ z%VujTQe^`yvEw6Xukh7gn7V9P{pTv%e<~xI_+Xyc=`IUKS?8j-rK6US+FaxS>sqk?8&F{fg2GZ%ii>%cJF zPCQqs+fTFiqWDCt>-=SlAhKGeCh~kLg~joUx*fko(8yV)&e-DF4z)^09KwbkllRvT zyoXoRDnZZ)&)u-WG(;kabSm=vnMvtPf*|cycAzGCMF!&Zdu}MDan8`Meq4J`BHi%t zv4$#Y?e7BX9r~Q;$&~Xwq>#(#%`ToYl^CVo6L&4|h!8Mcf36z{v5=6yO%VO0URHsL z9^Op)O)yBKTF7k8S9@+V!SBo!HzhE;J_O8Gv$ZK1Eg&|2@?#DwD~33VKy4emDZ%~- zgLNfH;Mlh_7RVJyLMglyh~!-@G{LLNC9Z_55GaXWRra+DwC_kzeqZ?=Gcog=;JHGhGkF##I3A82qRA^)% zx_h87al%)?qq?VEruIED7uY;{`PXx3SXYR#y>_JTejUNQ4 z3hpV-+f3-OCQ=#T)TRPG1)#ai?|$7$xPF|y&>u7S{=Gz14<9(|>gY!-MlksyOD1D5 z?WaY54)o(Ve~t)4PYG%<)msWG*GNUzYWm!)wlmHC$=tdzxLXmKR0xs0Z?#DC+L^Em zN$y#fcLny@)9>Mnvkp`Dx`9m+^|8ya zDioA9_ut<+CS%(=Wje&1$zS%v-9|U(u`s|q$T08J+Z3pI8(~m9nJ&OJKjr4ms7Lky z@pYZWyAf|4JPn@zwnTjM@ZH(0*lY6L&NnFcYq?{cP;-z7 z*^$3&K4;eC+e<+cFAsw9lp%@HwU=T&a=?#naWNafiX-me?asy~%1C}3q1K2wtvltu(Z z+vy>jrTGP(eud2i4_T}}R8(3$b5?>n0o%?|M&3P|g5|ElpH#s=rB+>uq+r5eIFVF<95N6xf}+Zmw*j{lm%o zQ&|=uEC0DikHSDmKKs8f@-I$*^8u`#KY7sASpQRd^JgtW6u%{N@r;J%DIJ}iojW6$ zl&rGsqT|dmSc1c;v>G9482|70t2kVPU#-&WRbI71yE|$iB%NH5a`cQztuFF_+N^i6 z&zNGH4muVyRE$+E)|IO1 zF}~9(@Mtg*5eaEGoHF!FC$NwnE!FF(Ga3*nSxlrnJ7JbduZ4`WiLq5>aDSu*6ZVP6 zIvi=vU_>UhbfHG}bJ3_ox4y8izkj&qQ|&dodRpTzx_|&-r>i02RPKAu|3lh0#@D$u z@itatTWxIHY~0vxY`d}5*i9PSwr$&Xx?|jZczfRSzQ6n7e%eoV_Omc+X4b61e}zUz zW7g8EW*6f{bC94@1xn<+HrU+Bs&km60&{8j<`%d;O|z6rbQWqiaO!mu=~E5sugVM( zkcyNmieSum@!dYF(4?4@`#PL8|BM|}B+u2$Ci&cGY8M(F$$GO^$19D)VnwT5vJgw7 zUOgCtd^eQB9LsdnaCP`a^A?XYPi2h^rQIvM*IYM3p+O(+=GPEkgNyYpy_!U7-T4Oy zSd7F&2NQ?|@PmK=k(u`k74n=S)y8mW&;e2hWATQ==!w&u`6a%UN6ZNhQS1<2R?V@j@YBp3(Tc zvd999awLE3TjhH8A;C;mMH6xx^mCUj1Ol_PHE`-o$=$B^lN?Nb7|GqUIizp=8hiTt z*;*R(mD7IT{iwecAk}h0@M41;@Rfk8Qa6f#i)fEZIc}4rPdR->4?GzdKE-9U&|HM1 zEFBn8kn*_S0ge)Gp5nQ%l?ZITZJ~TAI`Mt258` zVc=~-o~6kSbABjUG{nRj*%%d`XmOwbVEt5(VL;BY3P{ z?>%PE>1kWBULeI$11%g7(U~`PImF1<4oVwgOkq9K4Jm zHZRDvFC1s9&63;OJ4$+`*1giTWgEG9vxRG&AzDw}E{9(6Q*H|k7Vj8Y^4x@xtR{04 z;^kw{F1x&{RRb4L@`gWQXN=@KmGsJGthwJ3k_CpLDfh1^#qgAEb)q{)N+q*?a-c6D`0}w$PXtFk5PKf4b2!qJ@~=!&V-P$7wIw;4S<<3E#Z}7}uJ5 zqO`Cr)vX!DfXna%7Eb=Eod0~b^+NqVpv^VU?&Is{CokdZU8Y;p9f6d+ZVR7Q%hm^e z%w|mta}09_430?UxNFjCa%cucHR~R;niD_Wo>o_II9y-YZ;J#V|KxHeB)UA*sJD&c z)Xj0^q*Sd+JYTrBNIIzBh& z)>lFSS;4UQs64W}AA2Y11Q798C8SZXF}fz)DES&s5v+80Jpc3shE7B1wph>kvQua0 zBSx`KU^|UV<}(UXjEqWYdI{)~`3zpB-O}vHO47AC09j4%Gq_E4px;aA3pC zcIR5X?)}J(7K7^cJ!@3(^MElKvV-)BCM)Hx@;?JUY6MQe$YBB))%Mu)oeT5&Yunbe z&PAKZko{+1&=lF7{N*vjjcoG!g$(I?)tTh~Ax#`WeL7vW3(V?bY3pYFIl~mfo!A*C z7tVmkSGy77JpTX;2VzffSP*U{0?W+@SZFZn<=T#D!Y3JkSQ*zEE&EOtJD&GZv|^1T zx(sTcJ$M5)x{1g#Be_Tgak^oJefVE0#5=OT5N;5;cA-u(jZVSJMK&_XMxBZ*qO&YIFbzVb}BWv$Qe3_KYYV z<5p1raP)@ghg6sQs4{2GQgwJU3JMw!dPyws=CFj4G^>E;ZX~Ak=~ZdcXq$P@tw0lp zAk8d|${>WEG?Y7YUQ`Z*SoYj6-j>sUYn5LgtOb6j$>E?JWcXaAoK2!=55FPH>8x25 z;}i~tdliPnb|8X0rMzLPJu# zStd(yvv#hLbcY&no)aw%9b%mB8pLkxA|`aYfFZKMS|9JJm>qv>VdFU-zjbh4mTIap z4ZPAQQ$(^v;0&K1!lhB?q^7Iijio?wmvF-Eup$zUZaeVN=~QGruSy$6+YE+6het-$ z4|MTeA9tM~3S~Q#t7x|VkGcI;NIqS49*lU--bTcu4nZy-ks}#?dp&Wnvsb%cMVXs8-Z z;~Wau+8<4jdVEhn48X1XW)|md*RqN{2B+F6!8nvj8oXb{Z86TeAcQ{n@&3+c1E->s zX^(1Tyo|1b+jTfQ%;G+Zp}}st#zCa*LXVr}fC$#0^Ln3JFDzC>EOXM+b79{#NE z%ujV~D30!87huMoglJIqr3W()WZ90qjb@>!RCsDl0$y8S75D8ku0eSuM zyP!>n!)9IZ0e<;L$;@H;j)(Ibtr)O$`J8*z&2Fd~FA6cB#4Ws!YX(>gg);(F#ot46 zurF7I+c|cR{F8%O1sGwHfiOTjxd-UP^=do$wA`k$ZOdQqTL4Y!3oTVJ12SgTjhV_R z80fzKb)A7(u&&AUVY=T7A*lwP&p9RFjB42+_-L+>^=tR2RpSz^T2e`f=U2O&fI&?b zC|$4diUJD6($ZDzU z`ZIp!i|VcrUi>en)Mhd2ciSX{U1+msaX3~Y=^C9MiPObi?25F`uQW;I%8UK-OS$NZ zTY_`>igJ`WqIkd(v_32%F<`iz@BjtCUqD>TN_AYzVpe3JpCN{0;P&au^G%xBxA_y! zfxh~oi2?)C;(X_0Mgi*8ph2;+Qk?QRCH-V60|URM+gn=C0}Rf*K2i;*Lpp7bwfI~~ zzd6;5r`4vKYR@aYp$zt{??h1dBAHyo;rp^u(-*y0&~a~cY2KX>hLvLL4NfIVsr3%| zZ^mI(0;4@{(2+MLGO;@YQK>iW`;lVfG5Rw{-Rz}TyZk;35BE4F0^x3%+?XFJDE#(r zSlL~n&w;5@5c6EqWfMpln$9V_Ryjo!nm?R{j|$Tr_Qy%#ex?Yv3+@tXRT-5Rjl)eL z1kz4!B+OnFSoZQ>&x`NuR+;EZF@-kpKWa4J5hU+& zAZqD=DwoVn@>3``xBBaJoAN%sPkd{;d-xa;w>{^8udXwhI#OzOf2hsDg8s_2#BoD>iN$7G;b>hAAWBh^MAr22!U zVr7mYptHM#wu#4iob$Vt^iR&VyWD7M9(bbVjL0y1=O)XQ!~tphQN`4>21&hkq-`Pt z_Zls#L*kC_!R;qyl+i%o3L|;YhK-vT7VG)t(epKSotVn8ld}}>+p`O%myJ-Ss|La| z!_~%Ta2+p)hzHUU4`9~o1C-oA2$*%V^0L!0*lXuQh7MM602XJmbi*iTo{A>@OpInST{aoQvC&InzpU^;;_f$2WH;b`u zr~0Y32jEp^_sOAV|H8A+GY%C9!~#KW3N%VmvIOGYXEH-0;#b7^NuoFSyJaH8?^})6 z+yO}#sn*%@TO|D+PdCvUiB_6g1Pyom*Aec!1oKqe3Avtu!y19lm7dS*C)0)M)JL;r z4U}{&HuEeGM^6={Tf6z1Vv;-iWisOvz~uYg@aT;x&q6vmqY`AgH=he1;u2MwSY7Yu zelD69$h90lLu$9{Z0kir;C zfZ6GY2ZCRTd1qZl(rEJ#uH{ALw=|xWL+x&P1f>AF9@J-EW66dQI}kVAU(^9&^yEEa z>(qIll9+u$(wH5>o}U^=Upm@BST?Q{c~!g6J@)IOIG zJZGJY3!MV-225ZaDw*KVIl`r*9VmCOwEjnINgMQiLR)j|j8omDvea%g3?_eko&}OK z$?s?7#$#~4w_U5Dk|Gd|x}#mdGCU4@QahLps2MDH^~*BhYJ=+jL}s~xqPp8_ z-Q5Sx?;hp6u0IJD8{{+^E^;_I&PF6x5VXg%7}lBTJ3boMAx&5J-AGrFXdUctHKg?m z;=B^(W=;+&n5%<~^{MBY+C6#7q9<8nyG3Jca?-4@m=po)pVKXoNHy!vK4h1u4!(kU zP`E1v|v8msjC8|=UWzfh6=zfz_Xsc*?lVOF(eteHbVzum27gVX+g=}R} zgw^P!nM|WwFL0AwAHyxiZ{7gJZ_9tMTN&K#@K)}!szIh<)Kz00E8yBLhZhn! zI0%CQ;B>Fy+^DjzVk!2XTCEs1Asq_VNq3UJoi7&PecM`kjD-))v3V@xX>>RSZa>sm zBN0c9B#kD~^LuUJ39X1{DacWx=SAW18AWwT-Hk0|vJvQW)?PcVM6K5+U9-9R8UZ8stD&d8PG7J5ksoqxIo&$!4`!anZ!tfE-B)E) zk*PjD-HtH!lOkH3H(w~2eTPUUVtGszUVD@ot<3VePlQ3tVBE8Ddv02gX1#{Ed1WRD z9TZPZchRzUSgtpYYXvOV>^mX?FdXe%I}rrE6nW9@JkLvutcAZH%EO>q+b;#VSJR;ywRZTHopYGfx*9A4Q?~i2V zDlV+|Q&;?GKbOB~e)E|7cuJSft*GO3%A6YN6Xt|G2DQiY|p|+CG;mrqt_gZuzpDz?T+SuCCvpUga2z zeEunsih9%c;Ujx6Jk=+J#s?KQL0(wmuyTdi}3KNKB4BWw~1AsAx|@W{uP}o zrU?kmHL`j#u=FSSY(WR@5jL_*;3*0o-F_I{e0vuP6 znmzoY3D1F%peDE45bBgzqcg)HXJTJKXV@oDFc58}3oVzaKq! zK)C$kxzjfwQ)o9*k1sQLS)@q5w^u+IKSQ|-3qT!6XZ*_;clOQS_`5lK1?I$+Y{ z&FVO0a4YRrHQztEWwyGVS;OP7vaUegp3k+Kk&il4(rW3e2M*I!&|C1=Rm>GHRHw~b z9K!mn)p!I?a1z}S+W*YPf~2Zz2P`v_W$DdeSe;$Pl#H7p@r@)pxUp`#0yLb`3*szo z7D$LMHJ)Ej%u z{lhn&694t7!<6|*#&-EH(#67bhMy!|3>3*LEtDm{6C%Ia8?y=Hsx_Zcu*SA)Xo`$U zt()=WhSBH*eK?c9H0YG+saq7Jbvs>JFuI(KB}<=Q`3fw;jGfVltaEuICZl1soZ*_W z9O`Zoqi}znyUPt#Nx{#*DXwt)S#P>b?QZxj)>)tBSB<1f;zh=n2d2JSH*L1%gsPsmzuA?2(wt%F07N}WL#Qt-mnST9 z1+UZ+LD{47{oD-)r5~v)(GFy1n7`AFo^y(byIXf33P~2WZtKz7zV#qL+1>vUbMRsO z7Z9I8JRnkmag@_G%^$@xOq{+C4kpk-ocb`S8}He+Rwk4$he_!>IK_e@n^ot{Guc86 zDJGG=XUBzx!Ytn!aO4p%ynK7Qy?Uxh!839+Yk z?fULQ!|t}#-c>T_y$g(*&kLjAczP&{rFGkjx1fidRBI(0M--pAj^lzO$1_|XK!3tdIE?I{x-Mp5cYHWlB{ z=nbD9R}(gyH9-Q;QwT+;+Yz~qxWz@axHKd~%~qGQMY5YOGR!AIcy4(kN(|_sHKqu> zzlL)J_DMEXDH6)O!pvfqGD9$p-i9Za6KO;bzhsMYdas`!8@riNo&2S4fO_9{ z|EHPe2Zzj?)$#H!yqFB6UrC{yZLUKKgFRf9SoScj1agsd?KXe=t$G zDrjbQd=kmBFS32p1IpRtd0BKnOaPHRiE{KvY9~nHjDUEJDGm==XGm|K(*6l);eSc)wS9EB#mh z+ON;nuAnrsc0K%{;J-w_ex3P;806o!#E_D1&R>szzea{uFM++RT}HnH`SsghpN&L- zUN5HYVq4jNH2q7L>^#6?Huh&yfxm#nfBD}Z?_kFQLvj&~ROzVyB`oz@XPxkJz>pmL z8#L0tqE>&7ML_H~uqx7W*aMMYOr~FZvh4x-Q(XRk$kF*$1H}8Y!;@?_{SJ?_jsyQhZ2}PD^X6wHq<7#Tf&xfL;Q#f5 ziv(0?)u~q}mJ0^d?<)}zH1vP_aC8F?Xgs+V7I^nRn)$u$!w_g_y9Hzq(c=&Qy_w(J zp4>x5+AbeK1OfSStgeHf_s?g zA040h3p|TMdHcTUmE%W>P~t^ihTj$e3pV~e!_JwguShOst35hoC(}IJzN^EPVO+p* z9Daq~9DpHoOX&=kPnP6C{%?!nJ1;5_(lXzTs^UygaT{VqTb3jK+miVrM8EScy}ZW3 ziVEm^EbqBXRFePKQgWe!8sN;swgqB23oX}y#^eYAf5JrzYMU2X=8r=1ea1OQN$cNl z;Q?1ZZ~0@ZIH0mllIK;i`0+!>@3hW911a@aL*xX{4Eb-g7oa8rE=?FwSe|y+yHC!* z>9`gnO(wd?DgVf2{4YFIi~3tf?^?M+glMEb3&>Z)g8FsNga|~m#`Rs9oobr>dxd$_ zf&6Acx!y{iFk`3*o4Jb$Bt-!}NF5)n%U!KYO|9I&rn8I%!l_&z_|9V{;Kq{J@tX|r z7tPS1YUDjr5}0OI*JC0)odWKVc_v0N6G^fyN4&FqnG1B}G(Y_??zcUg8(f4`D2Oc&e6py2uCrWPaB&Hhs z!t!zrFSnwy@*GIZJ}@S9vole2BooOimaCAz7cnBhzSnycx~tfL&cw>Y~MZ?b((7qAfxa`g{~t1H4hC4klrhb!+C$IVX310{AOjxFqB`118i^8Oz7Q4+?5yh zM%vYjdM+oh3D$w0Ic`QGJBYXsD8IGzwfWH<=1#4#e|~O$(DdIL3>Wf%+%s9=8IIY zqM?6%|EGqXgh2W_hu zq%u;cFZw+}xrcuc;D6#u?T5Anes^bT?v5;q3>IQjGL z?y)S13khvvgM3@~T}{+7gC1dH&&sPVjMv3%|C7pzl48eiI!r<6MmYP(T9YBJVZ|uG%z2LRt`5Aq6^> zqp!%c$#;>j>C6^C`2W5tR(@X>1~6vyiO-k8wG{rT*(X0Db>5kIR$w4+m-j?~>=CSh zPRp{t+r@XR4GOs7K|9{cGli-fh=81?IQChMY-C-ge3` z&I2gRu4tmd`i^#s_T0TTVyKMdXnYC>e;i-XhVxW0zEO!9Yjd(c6{zHTQEni&ppxqxFzqVT(VzS#gD5v>F z;61KcyoGx|9{A)=FAsll`%bN1!mYNbTvMlgTf|_T3EcN`00A6K0#ra3pb}Tkc;DW%c8^Xosz?= zCn76a0p&M_^s(lCyG$|FjZ!JCXkkHEbdMqfLCcUt-Vs5{rNfHLa7b7LqZ3xXN@T9B zdCm4&xuz#!CDt+V*ijbP)iC*6x_T5#7Hc@C8>A5C_yhXz&;1Wb%5s+q4bdkFQyuWGAKUv=P^ zvUgPkmc0NY4M&q@anZ5Pld%zW+GNllLSj8^N2~P}}sBgpq zipAY17Y9a+R05bPdP53IZ}b7_-O`U$2v*rx#ya%h`U+0QuN25oz10hPl-N6kolp&( zI%}@ckB04$9z*ApncPC2RK`0h)k;%$e?+WEhgBKtas;1Dl=23MwoicKUb8&L4(< zzzzfnGQMcI;CD>uqo4xlOkRkXd^K;E80H+f{o4$W&Wbl&7`>~U1NJ27ENTo=j}#k=Wh-?(jfKE{@~$DsTGI|chJZo3~Fc? zUcHHCh4gVoKxAY-BB?3MxZxlWolh2)-?@tJrdl-K`DJ#l2oCDV$NItK z@fg!)MsDM+j?QQsX!BDq%QybYqX2 zbGfmyr5J-AH3B|GCYSiU2XybiCV+@32gDxGzQsb%bS^85Cr8>g5KFRJtF zw-9@Wu_wMSFF|VdAsxYB6vazI48!N0>tPh=mIhM%^_$F6Xqm06N~E%ntRZqA``JVd zxgr+b?g_H$O1_a5yZm5l`j>6;=gCum9B62_AWZ7NLPevx6wY^*3>+>HzPK#kj<_7E z622imj&#Z4Tfk`#g+ZxkKl{KBIFGDMr#F@amr%w@w|^sR3mJjDQ*@#L#Z;NNI*n~pkB)!W^cB{2wC>hD#dPjn0 zoCELlb%e@bW$yjlXfmVmsneMeACLdeW7jZ3x*C2BG(O2 zMd^s4g=#3@X?o=i?L%+I8QDOuU@eLa1e@$_anFua(0s! z9jn=FZsABW%%bi=TDuj2R$Z#;%_TOF7D|-5JFAZIpyXQeQPzj;^iPTK8Et!!F+_41 zw5}TlOH&v>lMj39jjuzBb_PCt&_XomdzfB?pBFdds*oLBcuz*!bNZ=dkejT>c2bNE zA>EV*3vAvFgzUmL$3j4J+K#W5^r<%39B0i4o$i#R^a(83ah5qW6pU<>E4`2FrUQ;? zX~6ZSs6_&igkdKczQj~PRk#lS#7dgF;yTBf%p8L7_HL_2)7}zd9|2X2^q@w|ZWU z>;zy0Xgp8Cov9qtwOAon+JdPkI#7s&fMJdU7$gsO;_MBBWf#BfUjG15e8Iigx(vms ze^2uWm$sxni%34{cUj~9MOg=pW2+JoPFv*&b-kw8rThK0Jd&vgxKMWD%lAnj3UV5X zI{;h2#YWc#cP~fzKMcx466nFZV>R*cK5Z!M%gWJVI)jF3Mp{w`{e=9omd{owrNfS^ zbt28R=&9N`4Y~N&J z{8}zjK4{?`NiAtNE3;EDnA!pDsUuT&nvQjaF5y2V$o^kEXj&|=zlD_&PvZtPEqh=! zJxM_A$Slb;n4e=^Kd-{%YtPWh1S8I2c^_ zP;#y2AWLf(O{g9WXdfRPu6NyjRr#WV0Rf6pFw~+tWu|BlVSwP#Mtf6lJ9AljnjYXV z9~o7i3VBmp)=xHnp>!b2^kP6aVMZ$_)}XjN&H_2c!C6<9H^F!?1x51vS*%gCb0qwT zze$GX$N*YTaWZk6Hv04a62pML;WwJ@tNr^^KZ*e#FuUEo9$e6docKN!BhIJf%^j9M zUUxJCCy6bulil0hS5*E8HEn5_(qalRrd|83Upl$?RVJA!4iW)d)=U~QezjwTEU)7_ zt|MEXLgMaXy?VA|Yc5OCTadlkdoO42hTN`3yn?UxJh0(#`e9~P{^DHZmRzC2XjlSc zz-WeCF-gR%U`$8iCd(}`if}!RLj76&YiNuhj~MmH2n9-LhEkpNP8y5eBtx_9tr3s5 zsw<=ZwX{b47t+WKj!2+CWa>xoM@sgV@0GZK!?~p4kxx6#Ixj~XpS`?jc^h5Gy@4@% zEGAEuKtK4|$w|ijvsCyB#SUL#H(JiQ;~1F~#%K(^bG)U6ZMh55}?nLG)MrgdL>(Hpwpm}RZx13oXc*!XDNJfAqeT)P#QlzgOKT`snqT44gu zjn)X#wAgk3yiub0qui?K$C*#2&B!wUUNdq{dENFr@1DHm&F{v@p*{3v66H-s%nSTD#kvij9T_5HqsIN{O52cXBnT#L;DNi|$1e zG^?mCmT`}1wuYT=G>Il8pi^yZd2zeq4anxZlpRt^aM&$dHaqQ5ovi?9=jN3fK7|KG zX9|!$Y!Lc9Rg~piNK&V~jZ!T)JaL6Cv4nagdQkf7o&lMM+&j3@Z7)#qF$`GsRt3O-&@uWV`@);Xv`- zLWNFl#)cPu!zj}iKkk|5k0mfFa7b$R`0E{U#U-hwJP}7GquRa65ybp0&WVYus%LY( z$g8{sV;Y0=VWb8VgnZvG*t}30u-vZ3bZ1gfgJI?c08UP|M>Q^yKqx(sh%VQ9SDNE> z#n>Wo#8-iWXhM~VNhowng+P-^$oEX+MC9dKJSCYeT~lh`(|(37hjU41^2yD8#6y_c zgEKL`7%#gb$sf}Y5EhRzPC9tEwo~O>zuMuE*6c)|k8Yup+w-H}I3+Rs#8XP(aY zv|3WT(^8Qd8Ow^RLmH8B(ed()@l>z|ljesI!3Y50on1z>os_@>FXYJ)uAV8$s1B_F;IrPF#9}-5lf}8Lm08Qocf9Cblx9WJ1^=~ z$LbjMw7v-C9~`-T#Tv{Qyk{3!-QPM0P7iMALN!s>B`p3~>`UVDja3?d-tq9K<@-l^ z<*wH0>eCe8fEts3BU_Gh8UcvveCfom|mF>}d0_Im6e>(0@f3OM1CZXOqf z>!5B>EJEwif~9tf0rVxeVkG*@9Uhv@CzB!$v?)%o)-@$QKdI*CRc4Y1U)1&WpW~=* z#k5_mv_`Jh&DYs4-S21?hIq)cyw1_d(u)tDXtPKyv=~%xuHokRBf6w8WtkaYGTbvw z-!G5#@$vAN&cBb)|Dk7{&gC2<7M)hQ8m(^^#n^88;11vn_FieTa(HGQF6Sv>w3(w1 zeOxv3ngax_!^D|P&4nMBKBQvO*x@po^F(Gch^klp7z=jgZFYQ(P(kj9+G6n!j>?%1 zzB4<#WaJ6|VGh4mXN4Nrqt7Z=nfZ}9y0V^pI>CB z`Wc7K9M6{`00O%*mCr*#3w`N@`ZZD8T0g`JW*+>qwW!EtfX6{B&#Co3d< zI`25RDj)3^OWQKNyD?lD76mh)hETJ$t3WntUGq}1$FYoL5yn01Whe)5AGC5lX*RkZjnYLz^ z5xEsisP}^3Ba;}L90(@f9`Vb^ZV;Ub2+^z83G%YP z3F<~-@hTt}VkQp;fd1@?LH?mU&F2Mm$>XUKYkwe1sAvJ9^;oqoAdmR-0w|n^EOA?% zNauyfuZSE1=QUFFI)?4X-V)3Kg+t@xiXWh+H6n+M=J88aOPXGY=IEJ`;UgGc1#itM z&zCeK1ACraC>K0RF*Q)eSaa=KWc6t^TCU((qnsH8tv(hR*vyAAmMmDbxaoEUa0=1C zL!}KFf|mYtzBb>my>L?yT~p#9kNo|xCvCyt1|R0MpD1%_Otgg+%q_yN{yV(Oy*SM? z63F#wAiHobYCB}fc!VQl4GTV_6`tM6{NkxR^vX_tO zUrLOgtdPz1dzr zVFy-lM$!z_K(Qb?k{6Uzt3EEPDAQ%W9PVXJLX*MQ8K=tXE|wiuvGEv5fvFwqDVkwe zl38!G%4)VpG+B4?+QDcd0M6KxtuOnT;$ZOARLtO-^a_2&BFtrVy0=eHk@qWfD_>C%-yP?b*Uy)dOe z5!yejnh_Kz4vy@+C=$pKArM!Rq%jz)tZvJ#u{={6c3Z8mXBBZ1`Se%yQP30$_%&kN z3?N?YxK(HIST^1D)4%%WNPGG`0mMHMmYzStTax5{E5h9;fF8F<8fS)aleX$d9UFm) zWTZxo6pq1gNk;PTi<<&PNPuvIq5cdFE%}p~fo`)Ye!}i5;=ITqc@~$?y_JMks4HgJ z@D=Q2MWeocrDjLd{iv)X$BY@1;mRq9_R9hCe45Ma$wo+UYjwT*nTbyU^mv*y4Z;^G zJtQRVdha}?b%PVlm>(%AOU2_vAQjr2gf0nVgQpgB%hzpo(&g)y#V1ZsM&FJb?z{_t zxmvozxgTjT1;>RV92$0C@im&xKOQf&&};r!|11)?w*0vZBYvN+PNM*gvFijxqPBwX z)xp!Uq?`7&7R>`r`ARc%pO?l0U6#j2uZ`7n*EIoge(j5|@^Nyg;@qk|H{^|5D{z+_ z%gQj8TIjV1DhDe))yso9T58E6Ipgy_cq_Ei=)=e$inqfG$l{+k9cK2PUj#@|os^W9 zJeUWrG)gj7J91a(s$Iz9bARtAxU3Eje(1T|sGRc}ZFVBooI}Ln@^fZ?6)>ioIc~Ef zII3HdEtp&FI^ZuYyE|JJ1A|0V6jht^>Fm@mU$9qGCD-_2?{JNJYm(!h%T=GzE_dX# z0&CGk4qXclbSY{0rSAUikmPy?T3MdPX(QQ6MkG_|<{O@xh~f-CHyt-b0=?=`tJUHu zi0lGw?(^77Tz5sl>i&&nQmonu9y(t0nYvv;PcX32T$L^(a-)3!Lv3-_oKlYoLB-rQ zYufLi@;$={X?^*_@ecn~XIGC|Z}*ku)KoCL4#Y6YKsrVmQ%DtjNNC=UL6^Ifl&owf z3B@G@w+`azpjy}x6_|Bb8o!5}Rjfz>%Fx&IP50unB`gEZ^+{pk`iuf`@timtx$<1h>1iMZ^JR^5Ah1XoxK?wK z4P_77y3b`bh8I7bBX&HP05FUoddKI~d3X66Y_wUqRDK^G9L*)*fh1ZC0JDJZ=LJ_WB`O#N#S>UI z^UWh1G=kpeVPLxL)2`19{73+P0#TaH)_Sd2Z_PWV;*EJ&gZTPAGw*tUgDg(n#r^iE zB1A;Z!+ff@)cftStL=Vu4$2b^4UO_nCnn3;0uI6S>tdOr##^`XiJCYgzW%qCfRRrh ziu7y>7R=U@7-A7!?z^Pdb$9vvotS7)PvUs)2dv*WXM{Tg7VfS{BQSnqhsg8F60&GO zbw9$2l%!4Ilz306Edkte0LlwvXXrPuCqFgn5jqAjhS@pr0%o)r4Qvz2HmmsbEt}AH zc&6P>9Sz37U~JO47w$bE5NzL#haPuWI*oo>9@9AgeZL4j_O(kNUUY7;wxHRgg3b*C zrqC3TP(1wQ*Yb51dS_?6?)CJhoJSfJZP!y;0uF~oTUqb>6?zKA03WGwhUm?SjM|p# zY}`t>gj!2t%w7Ko%50OvP(wf(JCr+mpky`Q(UK~+=fpg!%^1V-tFGtHLYNZB5%dVg z{&|7A6D+L#?4uSnBV>#SA0OA8%z{^9ebT1t^W!=$@3*}-XvJ2PL z%p!*2+E0s}tzdF(hu}-CpQ=SNFjHW{F&X50}DHQ`~;l8gI)856BWq>Jx^> zZSzo^$H_BSxGK$>M2UEOF8GTd5ow8uvoZ&LbLP^x2YIq50d2A-?KpNJmtQo)v(~;4 zvnnf}*5kEQT*0rXtz`2@PEX1g^z*HPGaifuAoTk?J3%x>xv@os3geA~z;XZROI4`2 zs=K;GFB`dE4Uu9xiHaVGpXs9LKS-w5NZ(H-JCCp^8!xHAY5-eef=TYiK_iBUu$nsh z$%=kjhj61D{Jt{n4&4)!g=SXlIz52e$yt^T-wts4}7?h53kx- zjW=1Km-Wgt^$LXWVDhU&!bq;vQe|9Tw8s3@MJ<|L54S~muO$#>-XMhK?|P-7aXHq#G+^yUiWL6 z`zF;7V-8J=!+VcMg7T07u#+NszULn#mbQp=t||s|kiE-keTl(YK9|llG{(k=b5G)V zh_hReuKqG$rOkSQASLf(oCgrjl!F;IIkk$vAvc=)^}5|5zGWla3s`ciF*G5wbKn3t zep67T#Qk<1-W_|)d(E&5+Xp(2FfticU)h-5g0EO?FQNBtL+p_|Y+m4Orq;DJ-EIiD z@jBHAOBR49*{F>mO)47limEyZX0uv%OK0H18x(Yryr(lOL^NO)Iy7Q$aXFJvy zo5)(=)^zj<9;=Ft{A1A7M~I9y<#R%b}X*d<{PDd^p5prG2G!>Um4LIBnf zgw<7;KWXJqP$%esv|bTZq|Y~X7o>tJsA$R<%Q{v@>h2~_d5BU4ezyx3vAXCs=Tr+2 z9ZjPCx_R@A<+mQT=AMAX$0YAj#vzrf)#vT1>YtHHl?z;>s-={`O}HNdfhdK?kgi2d zPQeVI#&{CeA;-|MV}_&Km>Dj4$daV*c~Q?(;%#?)BXR=7vJvZdFIos<1GT`T%9A?? z>|pq3ZESJGGjQd%f&fi>BN;G= zW>p*Y6_<9^0@(p37l$q07IBVoET-NK*OtlnBNTydF|?o>+*S-Uv}~_G1RRZfWp*-G ziI7!Hfi2RFwI^56loNH9_A_j9B~~~2wLa;)qp@=@Xvgyp3VchL<#i!FsL)0zKZTJt zK55o09@+Z;V60Gd52Duh&_{-@wm7PpDDh`{e*Ib<~8DbXf8jzaY?~6h7Q>EM^W#{zF z;4`CUQz)ryELrpz@OA<2NcI*_=R3tR%^OB5Ui!0PwsmnDZs3GwRbt*dS5-O^G!h%~ zCXYeUf!}W;$Eb4Xqu&rz-JKeZMeC@Fu!m5L%HboPpB9l8%Ly=iy(Hwc{zkGJO}JE| zwDr@hcLtm@7$6)?X@&mYf~PkKoB)fO=tQ1h?ZEevurslf=w4V^CQ)>si>&5+QvkMi zwHE}t@)SH4URA!A)e(hP_jDdZ4S~I^F1kW-5>d5>nLMg6=W?g3x2Wb2rJ^X+v#MBF zs%n6zn=9}knpGj(I(V&By!pn&pm(h?bY_lnSBzSuOk8(l>8z1G$=6;WN29NL*38Z+ zHC)94a=t4uOwnyJtxy-mEAxYfZpN`ie_3J~p4}ia4UAyv-4VM)5j1w`-WV6=r9N8l z{pSiS?6K1i`|VqXxJE;U?9OV}(3UN3U>={=&J=&>u}^5(^ji6ztVO({4_PtP za`Nz^b(xc%|^q3kl;Mz;)}T?lH?0PC*kM zW$&e99zl;14WjSjsImjxR4C~31=>$U(NbZDi2f*KyA(vUh4AY`pxLeL+Nc6ZC6opr zhIM{H>?Pg)KXjdSR9o-bri)XcNGa~6g%)>rr&uZO58I&b#mDy07=vtML#}K$JFStQ~EM{=Fk^y8F4bqCyo5%~ma- zZ&)22xx;2(Ra{%174uiiD9HU_o(mb?-Iiw`YCQk(XRhiJ$uAI&X~Zl0`mhu`iYMb= zDMyp$pV&`H08IMrX+u1Ey;6C!wRW$#ADvd$)HJ_|As?*#9&h9Yq}~uYHHFcbpXjyC zd69TvK8805A6y3x&wcr^f8a+pV}h10cVu0TKaaN?AI zL8&vj-`!Ks1Cw$I9cG)FA0xFQU~28r104S_q%V%VBuUGG2b8g;>rgvSf{RVkGNx!p%x-x5VL6?_WH4NDZe>} zMW6b!`Bk$F@-@Xt@{UMe2E^kJh7UF)79^%590e#Pl~#uCrB3r06AMnb+-zVRA%*ol zi3U3l&g>olX%@Db-eT4y-)Y`7NwJ;(!o{s1ymRmzvj50!XGGQ-FA3#=9)gMJTj-v3 z^)mKyXH#>o2`eR@4>x5MtW zH8h%u1OPrLRmr$;!v>6NU zEEw!^5lOL~uU5hZRj*C2_s@%aWQDE_t}Q-u%W5CHy6x@T7LN~%{Mc!JNLlr01cosC zu(&ai83Je?tbR>vD=oBW7e;_NJFMwXB6&tD%lEu2twwT+Yw=hp1S4K}poBe$~g*3u5@RUv<-Wj=G#`tb++? z=19+jb$xQs11s)LGL2d}>fg3$YoDK?hy*Dwm*S1j17r~lTMix@^{1t={3zF|+3u3d zSjm@e(7yI$PBM^Oq98$5Q;+^kX+4jbH)eG8DHTH^L$xwvPqSu0Gr^!O3FTITe{Wv( znv|Ia3kkc%=FY`RWJ%aXYef8@K2CYq;pkc!6xTc^|7=yqG;=99%5&q<=D1la z6;HHl@G3X_&*cm|p54X9w=Zck)a&)9f&68etWcCZYV|~^-q!1?$SLyu=$uLUPU!cyZ zFZ4F;^i9i$um3-K<)4RfQIPj$V2fP+&+@_lPUeL$&5-^Q9Y_-eQvbhs`#(5d*Iync z9W!?S|M`mk>z6{jf6EEHz6|2fmchSXED4rhLkv6$ce)A1|`T!Ct$->05k4 zhNwW+_*acmzVVTvTp{ueO|_as9a?#23Q%-433s#GSA*n)3_0CO&H~Mp<=#Vws}VAVA{QyKDG8_X zWwV)ZrPLa_r7Gz-pLtcYW{5?Icv&mT7bO+GshPeC+~(UJecOeWXA<1Cmi_}Ee-hGP z4Hx{Ka-H}|YVt}FItnuD$~K@^+xWQuH&NLJc7Dndbm~40ocEEY1j*VeS{zBMmiq)I zmMvkbu^HW)4ao^@B~SOWHe81%9P9oTAD-_AUOtry7EW##_O4T3!>0A(>AvEC$+*~3 zETaq9=MSslNp>X0*Sy}k;^5*I6KaemQFBvi5#g5J=CcUI7VFuKuUY5}j7iHzXdYUk zj(FT1D)jMtXyBN7*xWuD*PZn>T4puQ!d*8xDn+?Hr}6;S4nU5Q5 zxj)Df1k4l#2LDqmY7!==r*{kg!0G)=|u;L(aw`S#AehaPNAWUh;HWmP`B{(w(OQXQj^3m)XM!u&c7BNU$rhvYJ|nyFkjr)ed>J zg@PIh8FcoXGdR8f8OfWM-fGY8@b}an_;{*W2|5C{vaV_P64~5_`<2%N)tqGV`rvR>>Fy=Ec0 zl&4095-jTY&`q$^>Od=()*d4fnUTNZtNT2-{zF9t!Rz*Ad5GR+sVtDqb^!URmRIGl z2kB<@w*r(s2>UzmO#tfUwzoD;MJ$HTUdKMV9Hud@nXVeB1Vbk#6A^CX-*vqyp!5A{ za48-sFreddi>NaiV%_pgaJ!Ck&)|T7r^>p9y7{u;m14hg+@R#Dr@uOHW2X`R1WsnI6~nB$O>l`oz}(_cU;Kzr+x{6l3e zHSEgah~{v!fhy+e4uY)`81(qCv#_l}#B?$G&+%&Ci$I6X(~{;-`6)L^ z>#wax9y%rljUWAucW&vkCQsAmXHOSV6ED(<#mSxy1;65>m3RO-JA|WMSF%jBp-(2R z#+aG+){@zXT`z`WGFchrozMGC{|7C_myocQyH6u(`qj{HF~{94jewxvN!GTtM7++| z>wE$+)(0WXZ4B_PBk>b!=Z)W`2l-XrMzn7S-(IwE$blVjqSMOtd`1AZ%KX6vTRSP& z#WtOON6*l=)_mVZkMlV0_Z*u~;B9~uYo!*C%Eu7{f);&qOA@I(wib{5--Pq;BA^4l zFm}c%C<$Wz6rbXF_+);x>=UC|S!H5C-{!c<2BkqV7-+mnIL%WnXjcH$40H3deOa60 zig%=J9)DP9cIq2DI-i}Yw-Ej_Is=DrsDGA9j8vD%DZ;t>(iBDK*@=tPs=VO zAtP-V2omENJ|wpW{m6CF`?@LUynDE>ZX*$qDr9~_6KU5DT&8*sSvG1nS%{o<1%dFK zvmzl5#?X1mWQJC?n_zh85{%`$mqU-vyykG#r7cqixO43CMOW)|QEP$gRZrD?|56f$ zqEd~B?Kj)VUO(ACy$>zP51k7TJ5JIeqk@d+-gT#0ynBL7cNW!Ly4Br2a2`G_ZqF2+ z3#mEGS<4C=)Km3XnBlDztFKf4YBs|A$%hH)>iR9Y9v&4kKOkPwVuthy z4-E|&xRkB2K}Qrkc1D5;d`*&h{c=&QrDGaR{#AZ(n@+n^+~6gA(PHS}+9D3-xiE@s z=bq#6W+V)3F%9LZ$sj1LPKCh8{PihQ&Z4`*WJfpX#CWMJGK(+6n)#3N7*Veo+qc3f zlAXvk#iDGD>m-_PgfvTaV<9|_bj53TN91GtEH z%*eHhk?;lI^dWF8m^)F429*6@pPMWQhTsV=CRqH-;j7IBoNX}>l4ZLj2w;19p?mKp zKyJvS<}0<8^H<+c3DvijDy`Ogd(Cam#i9RfJD3utLbi=F-AwX4rQ&*40_BoFp(#1mW(_FOJ7Tm(^ZGG^g2 z>J?V()m)Gsf|I*VEN+^VG^e z@M9)QX=x}{fQrZW_j%Zxj|o|`1xlOOg;aG6el$l(i$`pxT;rA+$v+3(GU#3Ve~g+y zjNsnzv$JT366%D~)LRpqfNd3gK1;R&)<5X>_^_5j?n(SKq0uhTFytD+?F95Glc4V{ zUPMkc_U|9Q+wV#Fo3yY_tEz;xKi4+(jar{9)c11<{2oiKJi@jtQga{y{wdklHSy=t zQb95|9r2R*l};UfQfNsPl~lQiUwKqh&-fh*IvtJ-QaT3rPmq)1-3xa~Gu@ud(PwaC z?UiPF1VY~7%VM~8_}9TPH@f!#Eh4*IMSOZRk+!b|UPJ6(ZtPH)%~5kbFg&K#fQePe)6c&l-~4Sv6Z4~Y?b$AIpkps>DgVA7E2O>dzU$Y>gyARG*2ya8lL~hc%nttl9MEsq~2jkrble2v=#vou$ zJ(*+l#5FeEFL|2C8X{KyM)u{6Pf!K>H;#LpHgqtx)1YWO$WCJv`1zA zFapb$+`P_)5oHpDg<$eYi1BQ&eAXh;ou%3}ypu1T#sekkqj$IFw#gV3q0&TBQHSf< zjTf3ZwCYgZ6vzA@e4DQixoZj*7q371q=3`=(#LM3ilU98wTOQwgy+A+CWn;sc$Lp!8C0H+I8jfJ- zY6BfxhJ3M31(_ovrR_nW>F&`LqF*GeAyqUI=~LA_qiVmJvT)c(q=39NF5C~z)iX)i zW3>d`AE-+rKxLy0Rb|~lxMB!&((whv*r8sKcRvpGg@fd73$6>d9`xTLpb8-mq%g}m zW{<$G?d&;>2&jL7&NcA{h^fFq(WL8i9ho|-Dv05NRiEGm7LfH??FA~9Kbk+`4v?!C zoi0EUT3n8oj8n%F148x@YJ|eI+JwcrHR0`_kG|9oN~UvLf#<*LDV(=IlN~*5KDQq3 zHol}{Dh-*9=8~qq_>u?gE+#Sxepj$wZ5m3;+g}i|V4AH$P;i#7I5LeH!BijiJ#dI6 zZGZeC^KSKJdA_p5E_l)Wg|RhOr&2#ugb08r~o0s?fV^X|zQrJl?9)?G_=- z@}iDDEu8mx!H`{x{M?jCl}Z%4m&vevSZgc^NrN-?uXmK>#N~WTwGWAPB#-_Xn zUGSM$tr6J3jG?>iwb%MwX7;s0z6t->oE<&UK3z?nuxDv$)IG-RnWd7m%3JOxC32jq ztVe0l0x$m~okpY8ON72LiUL9*cbb{(;dqW1I4}^Hdk&B|*>Rfx+m^3bzMHcD*P{Aw z6W4OD+RjfOE@ae7Lbc%|mOh2!?$ja|tZi{0o(w(0i92FxIJ+f(F2eXGX+gnH`n)>j z_#~QK45&+w|8c^pfzS8YEJXS9|02x@8DU06)L7vl2(UzoFOSYZ<(Ji*! zmBUO+7~@J_#%3POW=lfC+VP#*#<|^ov+UzpRWW_Dk0chCB*s&=6iZXzjSU~yHjNgU zgAVUc{$aZpW%Okfk8p-`{-;V_o*tXm+Av9Ba|ryn${%cBk0}6y+%rOU&t3`N)+~lA{J0sZDcF2DFoa)3`T!2w>{x~sSJ6c6T!_q_fC4TK~e2p zRSxLX(YW1TZ=wEYxA1f9M?~1EaqHTc)DjvLJ37G-&{tx#UyYZ_TCFXmXyrFZxISGr z#Bp!UP|Ls(iB=%Pl?^Lm>=vsKm%_e#;ye9>!`%+4Pqy6t**E!VMl0+ zL>?oR(bnVJ&E37%F^~)4w)zm0oZ8gm*{!*1$-rJQUG-&k$WESGE~9isO_+3Z{ZBh@ zJdj}y>>g(g;C4M#)*ErlV`H27x&>q19}2>{Y9f(wc9>AN&YgG8@*3DSvHmo5x>u{n z>U2QOni+b*nsjV3%CRRsb7mw!8^IG31O=1wr>4Ng=22OBty66C=SEH0v0%| zZ6yrVAgMZ6H3*NeH(`EcNEA?peOTFgcPFRLAhIEkrYIKTE>7G7wB4qSqU@XdRb|-% znzIYdFQdaPJXbt~6X4pCN%*h>ryWjKW&A73hh2Zdb~o`S{4-MTR@djLaMQToqq~q* zNNWg9NP^Q^W-QCr{46fPr@eft=y76&H5ovf3w{D69VX6XAuhdTNkz*q1G7 z(P=j%zAc9FWa{|=?!zTAq7`QHwj@mwcx-ENW;`pWtHul=@#j*kLWHT# z4fwh3Ezr7y%XAosty~QgoXtl)N#xn2`;iIaDL^rguQo&@s4cxIAJnA0goAn}x&R+g z*GqwC4KIczzu7BHa9=?3v#*vo-*((kHMeJk$NO)szJ)rI@RHZ7Ieg&Dx5)7<`XED1LPulJ%`I?W_hj54fB z=&ASDNlS$OSJb7=F|IZ^03yJBBWCkR2#xYEn?>`9+Xs@&qYX#YHt&7w zLW7t#4Z1~XRrG%&&f^t=Y8V0|c=OBIm=n*GQ*Y!DI)2|YOd3Dx&{}yPnIU#Mxh+~L z$;BoaO)nRsF)Onk&Y`*0UC_$gTEgfWgrT=lkLp0OLsOv)cZ-DZ*ks=4 zE$nz=P;W_9y$r&(4mQ2t2=xmHo^)@x#~;>PxjS7c;b@;Wp(ppmQZ<}L$0S9%wNxvl z^soC11c&W^7{(s9cnP2WCX6X;%?7HRyet)JI@IfM5;)Z?TZf{Qx*hii(L-_{tW(Ws z<=?~qE~xVa<@WpmryP`=P6JozsSCTVh3Ji1t^?Ce4C zd}M2rLqsD4XONh8g{JV2Z;Eaxw0?T$pi}%w7LMo+{(LvHN7#}Mp^ucFI$igahh{;0 z(?XSB?t0=PRa4#9grXH0YE`J0h*@r|D5ZT#9_ARw%lN)syuPfHVapsv z!Ak<^z_#Ym$*ta=$%J-v6hBdMoL99W7(~KJev=_J16z3ZuH)-!Z>q=RYvI?HX8A~ugsG_$DC|S-ZRTvvK(AXZpV1J`T)7-!3I^As zNP2BdIHT8LaC;mjYr0$l5YXZ9yN(&rfBJnc!UcGgFZnh>x42M@Yyt1rzd;%$-eQ*t zcY9_TdskR(q>?!YbdgieR3R;FHsDmPuMo?MjDxy+Q65_5vS`A^Jmvjnhy{&9|}OYfOKPMYRdM4vHIjzLl`k8W#4_N8&5QHfawq@>u9!z<+cOGbgv&P5lu z5K^SBeW2D9TD~^eC~7sXM}YBduNF?h2_?n1PLtmznyxB3&;; zCcBBcK?`6ut7`yi>BrNCcuTi?aRR;XSWL_E8@HOHmn$nM+E@mmh7n3eNqBa@YHIAc zb(OFucc@fj70I?D{O{ZX^bs z2`v5a&$She-r(pkx;_&YYED7#T;trUk#V8lej#uMhM)0yt8Tg^hQA!^d4>zUC&Un9 z5*Rm-=}Jv4X==@!#`o8v7_e~QmdMzfw`JCDfw+k~rUSy2F=~ zZjU^?Z%4xAf~TBZ3V$gw{h=PmDd8pW^vzi(_-sF!9I1nRY4d#;8C`6OCoa%Rg&1^%V4N0Y$Vi3rE#$bxj5lZ=`hr-#a~4%9y{Z6sYBGQpodrCf(^? zz+}Fn@ZlxyMR!%P`o?J{%xTtrR{l~6jPKG*9?~B6;621}^?h$sUoB8}iT>{>SSU$C zsGrN?E3!3mp%{^5seQfiuUXb>eoKLfe3DG+RtjMu$nAU1d;ZWCgKcZ7rLv*=o@KLg zzev}QI^-g@N2W6HE$r2X3F{Uo> zo_-ESf3xmZ6C7Mos+5uL2;_HGyKb>c8awmOZCTzmAAKxm=KS$zg5KL1=qyuh`=~Mb z<9Q$njUjYThvwK%=Q(39P)C6CPKiXxN`sRVoWw>#1Wo>c!mo7+eL5`p8O=+Jg*_r` zDZ;<*pf__96qwN19)0rNkGI0)6tGoC0|O)SQVaD-foNq6m|B(oaK|q2FskCj3g!NQ zg!SV!K-%tyF_sjd#+^Kjq z$(hS-CTkam7zW)>eJN*{i;|-149eUi<*RUX+7VN2?-v*MBzr@nAi?zVU6x?xPP)}W|2U`KLtF(-@XFZTsOSv$D!Ei6zCn^Vl1 zq-?7)0*@x)d4;74PvA8gGdOwUn-69|I=}FhaQ_Xla&W7Ku%O=9Z ztu4U!suMN#)!9Bm>lv9$CHnfuqzAaf<69QS_p>!}1O}?Y{t_EXZql%-*4lIHqn5H8 zYKKbex+DwGL(u`rBfi?;L0sLxU;F>~5yJypTq|BYpEC^ft)@2aZ==XD&Nk(ckBgW57=7 zcr2f;2ofg68Lv8MzokB#vJo55T73Cby6hd}_&=WfpL|$IP3RxV$?&`9y6BSDp$|qo z6X&{*dNBcHV8 zH!MTSpZJtJ;=w+%m@d<0fZn%L4TmAHt@_h91Sgaej2tlFfB?P~Aj)^%% ziOevT))~)r-rg%u5BZw=UpP_za<4_%mz2TfO{4VuPx{VA>xN; zqb#Ts{M;Bj?Rs?5nVt2IZFSZOZR`SH}PD+WSwQj|^K(i3y#$fVM&%2;$b5e^n5(J2jw!(3X|O}#}b2&Uyk3$X~{0lqFw)( zJ#j3c>B^4|2K;fOO{N3H_Vb>Anz!#&U+9d z$GKH?7h{u;twLg46mFgUYpGB~qmSR+4y)^x7OC8mlDwAW#s6rQ3Fw8x~b@|LfMIr1i9Mj-` ze8d=uc|8bWb;;5iMLO` zMSKbnC!*`Gx%(AHwqJhrD=U=O_@QsKgfyi>D!0swnN#)^%tVoysUHr7VMrJ+8LxfI_*L8ambL7 z2+8tOj3(75VdcGAEv8Rhy*oWga5GFZGAWXViQ$KL$yF<4K;D5tnueGjoW#h(yY3Hk zSD^Bp5piQ%;`SB_ZxkH&_)?Y%tO_MiA7-mq?JRLzQXtuETp`srf^_aHOCfMzLux=r zH{%1h*1fRB!Vz;9L-mqB#wnU+jMY0?cM+FH1$~l%v+49k3u_(~J3(M6@4@i$n5w6- zC3mq@7usAO_~gwc=J$Gs$Nt;2l#QPJ zbNE_$tz*KhxouzqnH1NCuaC<0A|z@SK0NIRw`tBudY?8F%WTGs-fYGgymUuiCN)T| z#U8qmQSMG`^HN_G0Z+(i6$VWEb18; zV%MhJKOUARl5%Wm7N@fVAR&l%&h)8g;hT(IF^ZAVcM~d~>J#$VKj1(3RyNX3I`$=k zb8VUJk3XPJk%7^DY)G?9){C{|AU~5$!O?}F&OvPZ?a5cZj zYZ_-hTbM!k~wgV-T?S<`Mo5x!tR1VznPKW~y9o>(}Zct8>X{9UN==e4U zPggj!95e+Ke6%T{hYOCXD*M&U4`tj+Zx*?4jS32KRofoAk2|47LaI6`fVFPN$J1{z zXZ2rvXi`9OsltqHFQq1*y1FPRaWZT77|ee|9_GE}WmKP~R(tLV`Mtl@?hm%5@cR&y zdt8nVm4GX4*R85(I(pV*evgs3$-#Bi?lG!3pa9wSmeV?)B>z@vKb9>IA|taz1SG9P zfSRvc(Q$)Izs=|EbWFy89lCYqejGzeI!Tr@CCm3KZcsHw9&+Pn+N|yI;?6?jQqHAV zn|nHs=lxfq;rR}sV~&o&!`CRtEm@IcLZU$S7HPX#cf3YuSiC88fin?`Y4)OIN?me4 zt*r72*I=^EWpBdm3dVniRv^i0cYy z!))y@IKOBy|EB5&2l3LPOERIZmt6NgMl z5wqL2aT~&x98fk5vA7M)SSxmshGMLsi-k2_QT==kddo0`_;<9b> zkY>DHvet4b<=*mAW6sqZ2ZNz~QDNIJh;-*A_utV^?aSgX$cTx52>R-{b4LphaP=Yu z2(=}g=mH1ZO8WmLW3qrxotu&@`0Qx5j$Tp`l`+HW@bbQ-xFXjE+OeR}_g?#@pTcFu zvD#vnaC-_#v;daSmzr2d8|TV9I_$L-C~Il;oOayy0=-U$+}8NU@;l%Vr~4cVl^@^` z->J;6JtKmSB+M(8Um; z=&Ae-LL<3xf?k;hfP@>nHkJ`SF%4Fb_^CEhDvN9Lzf7jtgC-A@=po^+>sMhU$DkAI zgxrrSD=O~MjK@jECziZ5pjBbnbsGFlYPOcUdt4MG8225~+elci>l}!%lYcTqqC^1=u!J9ZiKAMlv zJ21k00-4*F1w7^^3IF(#^g-%U(mlqvPA616%Y|iQD3u!XjOUM-Sxm!oI*f?QJXT+S zm%?^q@BsVo4GVi%%#q$tPfNY;EBcYy79lnBPKZbB^{)YQIsDM*Nwy=LD$6(diyuKD~S| z;0sGdF6&6~ZadVATt^KHjTN(VDEn(r6@AZEo2CCMgrHh2RTcl^k@UdfVl71s6b`nD z-EdR0*E6dljmERSI{Q- zso(uzn`Y#a`NAu7`6P$u+p?#~S4#ySv|6BOAQa^L_|oP#93%^cRLdPfMJ7fe0aPi6Fb(sXZE^&c)a8>;|FrI-Ku+3=<*bjVi0ho9&@Q|sz5Ga_I;uqAED$V zRFIKaJ^X`tc7A@6n@T#0WUX|TqcykP)Kv-LV_`={6o=O>!{*wb_VwxAYg1*-7%d09 z@_ZNXyUw)TS(}waBo|tB1AW#a1O`*o#IhV+FUVyLsmjkas8A|fYUgr1M{%3VPH!w9 z%{h&hzFFb!d^I=sto;CLl*pa^+?JTg_uc*R9Wf#Gnfv8Jn8e~YlCw_BKLjX2$qPie zH`=YllxLu;pxTCtAkqW@qmjZ1@`kBampiIRQeKS$-f@6zwCM^yl&mBaw2c;Df1{R% zM#>S^KS4~Y_we)5Dg6;q?Bf!r+mg2XtHNtm3DQ-WsSJM%xt{ljYkObRgCI3;`M)W$ z(bmmkcsy+y^{6O@>zd^=gc1cY&F21O^p zIgNI%ZGZ@z!It@UTxMTk`WIZQIaGxu>pP};ofrEy0d6G=3SXbPVrOTdrZeyhBq7|<^;Mp9o!@M8 zYW8St32#k#9rZ6m%x2W94r)uZ*6qyA{G1vr|NORbt5{nv1{>c+C1JPD>blT^?#nKR z4^uEyu^+vdaWt{DW z_9jjz(_yNJVyJ3M);&^c+i7p*5OB#H#sRk;{d%Q$xm3A&kEqk?m>I=doy+Vt0Ne^u z+@5uXT_i-~xZtVsUyWg%QD5!`){zJkzLh+K{6tpV8N&^OnQN1M%o;smIe5yof^GNBp3^u<|*CIwGK`iW|W@ z{o}4vErI>;!g=HEmY+|>o)r|Gi2@Pt=8i_6Qv9pox!Zj3A`MEn&-mSs zjV_NrfUu9dGD+4!=T?v#9d~e{kK}gp$#T6_+{Y84l}(4erxff<$E$yKpP+`FvsB!- zlqoECg0KrT*IvGXDV1pYe3}i{qDk|P|Ng@a0x@f(f=D^Zj$$DQck=>HAo~q$(v1J8 zRLx(Isq-pZ3P3`wDXzQauB z)gLPJM_~Z)9`2J;V}M@I75!@~d6qH}?;vjByubP| z*PQ2eHVengpPY}n*3?Ty7|4T`kr1K>&?@8 z&VE8o90oN9bszgoYFlyO&%9(ZSF@4nFpeil#o@z77aqp%wN>e{2`Bo#U;K1nYqKN>{JylH6&jCK)>5U zK3<%Mbg&ulXaUFPedP#Vx$iGth0@an+yfI+GFhVQ45PGlK%k^G{H8S3;b^MPuj)UV1u`U(Bc_Kcx;UO>4Jh(_30seIK> zAZ6}GNjB^9oMK)UA}1e(3LHKNBl>T`+Wf3!IfVV;_H~@M7RpOaOOsaakF#4P3tw%n zk-#+@js-Ud*64#Zpxm$&S{=eChMk$q01I#aT0<|s3LGikQl7w+qHeC>mHn1&CjzZm zjRcs8+FAz{%_j};3hhkRw&iN4ha}cbK(ZLzqShZHNF;5Natri2`!$0C{X8~FEn7;F zPiXzKrcXM=0bYyHud2!8F{p+R*1W+4D!`!sjHfjJ2%;ZmZ0CATl>hV$P z{`z-#o{+t7nLg_0%&JwYtr~C<4mifi^A*M?LvLa6vy@z{*OjgC2OMzyodH%|(L65J zdW9BLE&FuZIYWWsH#jeo@J>t>ku-qqEG^j&fDW|HC(R4OJ8K7z_w{&(iZ0ulP#{#O z7LP#*U%&iMD*W*e649}RIc0%)M;$QE@x@>1q}>$y9rJlR@pVP~Ja6rWWHjwlPm1D2 z9?=}g`e_j!=1&9!K#%?RK6xzqub?|dV8o;w$*%tg)`3~^2XEDL8d|y?6v0Y0RkH#8 zhJ~T!6>S9svL(zte3ysiWLba=SFiHp>tZX$eNoAY-!}Ez!?*nKQU_9ux&Ggfh;Y9v zRwdE5s7&VBhcrW9HCWTWKu zXQ8XTgvYbTjzOcnofQxE<1vRlrBTdM-bu%|>^j2i!=tr7N!j;Vt)@rVt{FgxJB}Xl zhiAp-i58ILKIPhjqg3BKXYhwHx`&Q~vH0?c}XNIxL z>!U^MT}NuQn$JpTb|xYdP@Y?{ahmk}d~&!}{M94LmNhYRS+14XV?sQ|xA5hTj{SBo zY>kX}EIVhiVp#riO>m`&$0@woCUYCv{k+tPi}jcXd`SWWFW=#7;(Zu=`RaA4=TQTu zipeHm8r5n{xNp+DefOG_)n+4*-CQ&0NSxk4BG0KKR@h8bsAGOp3DG=C!w5`$TOi*5 zWBN_DbF=jLxq!=VeP^{FUu!@=-ssN31Xwn0bkivL(Di#}f#|-!)ht?E&iu3dlG6c| z3~tL<=ep6R+~W(aN3u89oGi?|??t_3w!voZVU0zz^c{zIt<+6Vj>{y*6GXVM=vcSf zG3Oy>uHU5D>`lMg*E9EhIzjZ z4X}~@lwmpBz~_3CcgRSfITMg-x9|rZGd0zBb#9a>UpNm$)zhCqf0Vxd*lN;XegS-# za9i z68NSr{xQ*&fk0XI zl)zPwTTX1o8OK*ox6E+|jey=%m7>qpiZ$<+yk6E_tkf=hg3%Y>R3Hwgmr;!aoSKW~ z#m=8^su7#g=htnqzf4(A2+F;V@tLZo$W~^Za@p}j{oXz+ML%~^8nK0gq_)n(FR>rX z!SRd%8=N`Shzf_B@2WdU$#{~j)#i)S^!@dLR$U&C4IfgVyF|6>2EUuQoQaLqO5Pvf zAv)oq7g)=n_w2jSqP-!^UUZgZK~I}cBl|oG?^l0t{{ESy*8JJxQN8nEJSWbeoWPLq z(<{fTOPcfc+`3*zm$uxRytJG@8E8a>7#FL}nwTj#SUxa;mJk;O!e6O_8~_{ zarzj8=(6m9)wn#W2mEmjOOZ9126>P((HXDbRLU%x$JtuoOP`{f$GbDOBPVF4iBiqd zgu;27mqy*?Nj{d`t(N_TXfHY}K6EuM4c|wAzk<7aZM~)PI(#?t7gkS=V05O`W{38*paZ=EN}XJEP~R z`k9fUu37Su_~AwP4>41cYQ(HLYQagJ)^OPO6BTB02r}viJbvtn3l+;HHPz_NTXT5> zx8#p5*GGp`W+;|Re1WnOb?}i)bB&2E_vNCoAD?yAa(W5o7PymMtX^;A8O3$+xN&{| zc44PFGxq-0GZo>W5`%Q_9*TWmGwIZ6i^)EtaV)9{e_Yw&iPMxE(61nCbr{KV~gM-6Qf7IdO5G1~rbl}1T%qePwM6gcz1%JiO0 zRDbu9dDUF0xUgHI#h#!L?i@lOr)!gU3%9zNLd25hyS)0UV0xH~);tdJQr*vZ+xAjT zjjUVS&YYbo6j&?o+rGl!A}cDFO-4sBo{(!c><^aj&d>SAl*;I<(aWdSjTP<22ctvD z-VUoK>)`d&9eO}c*P15QKWeify0r+ZYNO&#xOlWACtXJsq5R8$- zT4{AXv~}AP#8^487KInBU#jZf_aQb?0uOGE5F4} zw!}(rjViN9g<|D9gE02pUaE!y-`qV}vZm7)F59j`yd7l5D`j3->qKvDo*3QCy(jx! z5~mOIn4X!dg`){=PPJZ{L21#WToLyUySV2wAQV0?F(}z)|mj3Y}JXw10#?-J+`Qv_M_(~!~|G$!h(~3oQi<*yegip2 zSO&_3OI5H7uX**`oN7RN{%~G6Ye`xCDuBN zS1WItjn|~+>UW(b7e0HgQj8AA>zACY&^Vvbc=V1UI;~&2ibImH83NcRH(;Mk6T)<# z7xwZY&%&dwa5dB4<=}3rhTi7v2(DyEgm9${&rKqW2g3rmuD?7)Ezg^*XBp?4>eoyb zV(lmi>W{^LY}o94TU0QoPVruCP;0L1qrzQ^cgz)OS4PK)xPGf{6+HdW&lkk_2A_$mvm4P!e`)X!`XLU=tD zzT-SzS9@6S_H-v_EMIdkq#C)`+GFEm0nw`&w8tjLdp~dq>h;DV+x3%ZZ%JWP#@?H6q~dr)c~xai3dIgjxrj_Zar5pmu5rq# zVXXo;582p2!Us)Wg+yg33fr#})rChAvh zB)uYn;JtOFR}MkD2eYk!QW6~wzlqD4H7ul+D8Uq2#Ap_jr^>zsMOcO=9=5$7NBey- zmhS=omf;Ui?=APl5th8KG4HutQ|UQ>&WqN=C1j?@YojJqI(2MJU%l8GFSJ7yJLlga zzLM$gkXqcPlJ{|#XLan7!Y41?n#M0IrGsMSHD!G`YiQ>cFOWxP&DgBV?TMrUQ?xbN z+)I6Bkf^(yGXcc|kk}DBX~%hSr&5;N$BEOT$q{;j;(_ABdJH%>U}d>1=Q4L4(;RnM zAE9bc4-r)ec=Q@Mj=VM>M&(}k)1_orvjII%NT zLs@n?$14}mljggLD_@XU(X~PRtKH)Jeo2YV9z)$i)W>N25BXxOJ(Cg+8Hw7nsoy(9 zMRPWr&DScTE-Z-lOw171>is=}$vC>hgf#m8K8Diqai#R<)jJQiJ~I9&nSYzYTDvnK zKnQ+QHlKBdRT0g{(1ozaWG(*Kx~?jlOgJi!IMz(rxCjXrWVxi;JTzvF$`)a7jo#iW zEx6=fqV1;u`o3K&ZAC&$f*Z$qS1yU%DmLj7k?i#wDpd4413Fgi!n06SLk3{CGIrW4 zAyF42wkE=wKx-)S*?r+?QKfK}>++)al2;8=WWK@j3E|q_!F5+eQG>8+mT8XFePz6G zmso_L8t>ZXPlkE5JkV~mhFG$EZlNr*g`Xjl;XrC)Kevy07w`JLYIrE!?FM?fkVP7% zt(3>W75zU*qp>40h}#j)+q^h&E)cTbk?X=-t%gMdW1i}AO~^z11uvwPj%r}6R0HPD z{jF_YR_yZdjn&okDeDrzlsE`&fW@><#O%Vap<7V5Yo^1&SVLk+vCz#8&Xj zW@i)NANABlhv%Im24U_=-J%h0^L(ZHKR0vWQQFl$WhF*LQ0@o>^t6Wdl4x>;)8=!@ zSbuxL9Cg*X?r>rCC4@$W|NJB{ZEtFBV<@?$XHu({y6@O25Nq$r9tdr z#M1r4+eyJYCFUo z8Y$&-{fY2W2UIJFRsz;hT8YlQaJk%R(IsgtX-5ML#MCV~J7&nv#{1@OGkJ8l(czzl zz{X(Z(j5YJsr0jEQW(N2(xG6|tA;N3%ZH{fAd;t1dG^kG_WeI@u1PH0%`6p8u5HfK zkbYW>@NgOz+5}5m_}Do(p^b?fNn3A^OK0tB7??KoLIYQ? zkC`%DXKWdCd@y`dn7CRCXTjRULFBp<*Aa9`!tyEpt*a)vn_xn40JhVNI?p9=6P#KY zv<02M;&5i_B(Pc{<=!#2r%mxX%Zb)mGa01a-{cC*jvI2)0kBK5^%0abtqO89dIP@% zvYFH9FX%E>#0<|HFG|bOxF;H5Y!+SR6Q?&^?FFs$Fq4+L3am-&s-Th{xLqCubW!w{ zOUmJD9n1Al$OYGsd$XlMlxK>CV_;3jOFye)GvlLIzaoR*j-5i9DhaDZG3LNx<~*&v zJ3HCUx`JD|+JAh0J9^B5PuO%Z&k`O+ixD}N0BOqXJAOqZ&-6?95z@#@#I&<#Ce@`= zj@@#Ed@|m}%Udy4Ama;6xc_#NR5SUe17$$NPi4XsA5~u4cQp(AC8(-4qL+(u<#y7A zHpvOFqW5W0g9n%`H(K|+#?|~1avRn=?qb#+LSU_S{YNusM=#*kG}wBovf^*7w$oLkolUvvCq zFH`=i=b2=1av`OY)qFRfwewUn_p6ZEoFvn;+16A(b%n@90{`MR4Jk032O{l@dH!Pf zH4w769zR>LO8xaZwf421A+s$@p7ysDJw0bDHv$RcxO7p90%lYr@uzZ%ToHUk<~b@b zT3|cp1TsX6Ht0~d@ZQ7%s+xAA+&rP+j&Ic(eLAA`-C%J0w^wOj1{=g^a)S=}N@5Y$ zUg(BcaQI@Jk{yo$rceMl&g7ak!wnv`|RS%9!_0okts(Bjw=IXTR;1sb|97g>CQ zU)8rVOu4~PZ@jR^ao9tXN+<@vFUuth(F6i!BxId+dLJwA|LZ?rZo~jWITbse{j1Sm zE&ubvt^2Yb*SeMg|DWIOH`B%mz#&6hZRjIJ)p2d;^RB?ZMf<0LW7no!06xW=8~^&Z z&<8%*A44P`(1aQL`hQ9F`_KAiVBp&tUB}P;+s8NbUe<$K?*m6>{zdeclSht?Zz2-t z+4g(+uTHN$LIHyge?NTqfAs`AU}?lBt;! zXDcKtYX<;?{J%ZRRnh>W2fg?EH;K>QsRVSQffOud|JQjE@MW3>1^R8XokjHMrY^2U zzKdhw5Mk?06c)FMF=H|0Y+mpBkY**k(|20q)xY#UU`2kd zz?~rY?8AFb4vvmptT{Mq%$XGz^XtcF4XKZdewq=7*|bl^{pjPm`3e7}(7615AAC9T zYomW<`I*bN>XDeKSF1R}(}O1Iy9j6x2wda!`5n;m5_COLPn=olrWS4kd?FB_PMw=) zVdmZG-1}N;t&DHE5pbH0$N9(g>quC)tgOo2)pE(nMw{1{Mw2ccRNtc=Kylh>9;s9n z!|66{<80FYQ{dQ~S~SqxmCbr8izG+-KO{#J(Im%394G z5D>7k?6arD#>O_25wpu#W#s2owFew9XjfwO;uEzV2rD*~3G=68Zp%vY;v$ZgM##$k z43oxxEM|SMJOQw{C00USO{XfqzdAXS;j`0k;qf%!pzWB`1I8{^7*XcZ$xtU)Mgo;u zKj_@}=4ZhwSgzc&CM^m1CaN07b=a5OU z$w8(={Q3(NwQ1@!2y6Kz^SfD(OSN1A18q1&nJ-i$`vrF%EQ+%{T?7rEqoTwh;m@EfbMe;SpZxk9P92LB0b~%gXllIyuabxN{0cY$Xk& zyh*vs;tg+s+rh_dR4f#o~L->s$lDsTw|ZoNtfjber4tNoLpQ@khxOJ3Bzas z2~8KH#N|_R9=DADV_XCKu2&tl0uRo`qFdUOa0m{~bJvAd5a9Dy8Q9KDBwP#KtxYj> z>!wX=wgfBnL$=0s`r5nR!Zj?9ruNgy0o^No-t4jZTc}6HhIPBB-ye;YO;6?6iGO#6ULUeYOyokQD& zkxCNO1J~JIp^FMxik^?_?5LD%30(GOhlNvALabI(q1?U-(Q*Mg2N5Qjlb z9S@zl9JdfxgH0acnbTVXH7=}Zcr7e$NrQDDIvgth1}4o8~7&D`_n$ z)&$JDAT)otABN7c-Pwe-iuz(8T(``F7T|-K_{nr5^hvYs%w^jift1;dzHj*y@K{al zkcw3Q6_2_rk_pfKo}_%e-M5%fS4HlFme226(6<=abgi)l2;n>)N|Ix@wcaR?8KtFb zOv{AZQ@?mi&M$&ho>|vF7Mja$N7=>E65$01lUIRy;R9cX=slu(;A=KsU0QR8?aHj$ z>xi&&(q^z_J@URnbqVuE;DGfo?y}cS#)Ul2%2ndyx{=MY-Ruf8<;4x=fPyij^^9%H zS8k9)?q~rvu3mfWOG5?cS0zh7vad)NDffwavBTm|MT*rZ#UgE=aaEL$8yOoJl`TD$ zp0LLr9^~ee>Kf`T>KvR)C|52!USZArQ>Kjdd*E^EDwKU7y5!>bBUCihD%ZUBycvbz z`7GUCR<2nZEW~dmR{gV2A<+v0l6^Av{h0-5)tuTwJ+uzU*-{XDij}LzeJzqTQ%x*F zzgjQXbmaKK=?=VfZ5rvyT4zi5{>2fq>W7&Dr?v1bC3(wLwY~{soI2s>Kbeo0FHB&n zSTAYEc)UH&(5H5&Koi59zOdjE34MC8^O6!E(oj8zUH46;2kv z@yuhlQ`IPHJmD21b1`hJ4GBw9XtpB!~&zYTpZdKgSp2tzS2{2ULMA z9D1zZrQ0RivRdlS&Q9XKjXwH}#WB}88RtP{a&4+xNs^YQPG|1$-EOiWH#vA-MVL_+ zEsR;TZdLlA$6V|-M$Pc=#i{D4P&PZ4;9$+@%F1T1p;i@u7Mh?AmEF}9wpoIalyBBj z>`^T7_MhKLc2vMzhC49%`O`wS!`hH)%nweZ;E4C)t}SO{MWO!NYlWd>rjNC>%!j{! z<-FQ``afXNZ|t7?SY;zwOQ717lg>~Wwaaao z2AVg>nvx=2H%ugUrn6cx*Oh?-u^mGK)^2^M5w|ys6D1qQ$cPyq>58$zsET@(!lR>f zBRogdX;Y#<>KE8fb?Ge=Fc5m{A)~Fb5mG0Up_I36(&u<&rN$KUM*H}-eJ{yR55S<- zJUzLvcxqysh#ss}J&xfiHmzCWF&d)2+84=v^b8AX>{Fvni=*(S;@!hon-b&|iA4#@ zq(p`B9#vQBl{+sURXGzOT#o|F2?_4wl12Z4)@K=#^K2^@ZZ6l4^IVDhtv2Pp5q0y zsv*axmW08O8ddwQfZ%+oer*xKX4A(EXIyT_?z=kBW=Q6rC+6g853wmjMek53# z)On&`ATi}xFV{7lJMnzjRYORJRF-A3N)UVyrb7CW$~|@L_8R_5_X~LGBozIS=C-Oe zCWJjp&;PCZoI&bBbZ)FKLeO)}Z1hX488tLRxZ#DpDW=Fz0!Oj=6qCg zh|xuHY{O1isQ{ho$?X z?MNLo1soEr9$5h*s-5i?O-r%BfzI9A3XwoPBMHOD#aUL7CA04sPih3gwbUOXBI-P= zc1VQw4?BboSJ#>oX6J`QBJ}TMq?cjEBU}{XZ?B7e43H@K9A{s}(&f<@yov3nQS>P_ zCB9J_5IJ0dsk$q^;GDPccwAGbTcn}yakPE_j%aqV%EQo`cIv|pv#QkA(U#JfSvCVfuv${)kS6i&%zS4Q_#VA~-`EagY*I zN$t2j_6L4_`A#nk-6Jmp0PBh`!F$mVZuBvO-RR@bS;FQlWUf^5jM?J zj8kS5skmfH{VdKci?i0qqMx{$b(i9S?5Rhzub$@46rt^m_%Ps(r}9b3)up1&hH!`;u0!V>uDV zwiNRc#^u70*zeQs!Wt$cv`~j(xa)3(FNRn;U*USR-w+H5Wl<@fp0|1-+)lF?a#aIX z4#s>Ys>a@2GdLxr=Yfp1jsQ(qmuERh_6}}*rsCVrIUV$tFXglWmFAs*6+*A7$Mc99 z*v1sKyaIBhiMYw;rD#l{dYFQ_PwV?j2R^MNMU$HCAb9HcGEyNIJ$}p%EyuJ z-}$1ymGiNWn-Y^twIWkV)wsshV#fw(UkL%+m)>tjsz-!GxTIdN&qAwP7=opDWUNdf z9(HbJA$weKv4QtNyY|fnPV3OxEItpg{!dp0knvAna4GaX)2?ApbhAC&TXsK#P-Zya4Wy6#%8 z%<56lKb5Lco5I=eENUc9cqXj(jyKuE1bbe>tZJcbVJCquWOtiL2bXPDY92UA7g|Qu z=x?Wvy+dzlNbWa1LhadAyDkUd)&J5qKs()C6rJjB*YW-T<{azaVmI?y? z@PeMh^SiGV6koSQ4|K4Rm5q1QGH6MGAkBA-WaND_e&N`LfDteTj zdNVF18sXNH&@JkZ=zxu1_5^vq-w^(5L5e z)5l@BB4=ql(dni!8`l5Nu^|Ye9T(9OVB0kfP_JsjQ(^j~xLm&% zE8Smg_C7wkkRvLGXDopZZCdK&=tgmw;GgJhjGLc4ac89aZ=?_GP@y^B^sJTgCbRZsF|r3jisXqe&MndME~F2^bxT{HCdT z)jl!A%H>7BWu5t`TT)W9HoIK3;a~++hb9*-XZEDz^A~LR{O}#&D{^Kq`-#egH9nN8 zqD~{vBc#iOxKp$JPl^0Os>v6q*UmGksM%Iu8L!iY#}}`mP=T!aDHpU+K-S4m@!Rv1lFYB)r0> zRzCith`QtRtZ&e$^;X{@tX}yeoW)6CP}=i+Jk(2Cx_;r8BC6( z-rCige7i`|4D#s_te>Rbl6f*2`gj|t0qK(MN&upQ zeeO(!zGuWV^s0oR)tctH1B%JG*h5a)@{at*3h=SJj&pp!b@n7q&Q*Z}-K-PGb@7ic zj8v54&hH_oUHHAf2wNQJ_>Tz5YJgtbK7Z-@qy7W$Hk4l0BYYBgXZc`@Tu)S_pZpu& z_-F^R$Xqt^uMeujgw1qQmCljV~w>jMSrdlpF=XNi5evp<@zMkPVIBYPd{%*z)X>-KOC z<{L%NP>zkDks6z~9f_j%o|~GEQ@Z0R5uV?7G2vDGie+}{=L!V5no4n`nKg4D$S@mh zyI6+2*dEhblvlVu+PL<83EdrCz!N{aKIVWXPL@J3H3HpLg_w1wSXqaV0-LcR{*~dh z&PGr#DZXPC3a&v_LZ{?m2Gd7>cv^gZgi?ZJ8MFy&^m^g-s<~7l%lFr1Jf(J}K^6^U~D&zHY@xMlV zgsKw+JVv@ZRlee+z!i=NE-yQ3+y2>5myod6?rZ6K=uD?&FQB428Zt%{r9#$iZ$66^ z^Qw|IL{HdPEpRc~QNuJC#XKwcz*}g#rW#6@rCzmJ@i?5qx&-O`#OywMaixjb0fcGS zdMG>Xy}fBcp8-&O=UFciCP;ji3<>a6;sEgYh_GUvf;f~nPTy_Hmoi&LaCiad{k}6D zD*NH+)$Iu2Cg@f+iRoZr;)>!Wx^VS)u@M^?0H7SMQb^W$} zF|zVOCO`QyFvnk}ihh#`zFO+n#Km=MH@*c?$E>xtX_K1EC*1S$jcQboqG071K0UVS z<~^)^zlmXYV$DnwvwfuFbkhUiT7S;lw>1|BByOt~3>8qUVx?`$c6N7WmWeJqDDNG2 ztMQ6rO0j_2#tc1q`k^dkoR-wJIMGBV-C)xB{a za67l}*#36cQ%~scz?VLbyJ2yPMmqLJNRP1(X-c?uP&96|G_UhAtT?>PA~b(@O}F1m z?8)L#0bzn$QgW;&0VdThK-f%3#aYy-HhrMS1DPm$@#ffI$?j=qb5~b7jD2$#f^^f_ zjj~Q8HBX#W5)vBELkWdqVoE)TSYsb^KiF8AUBr=-bM0<;#PS64RVk8z$m$M zfD;aU`3$&ub${(O+_*L8cN@NahX`@+6m2x0@8O*ljyUepUQj-qjGMZy+fwbe%J*Ia zq}l5HSG9p4}&qspr?TmQ_zC5A{9S zUlG2GH_qA%;Yl@FCQS(VNw2k1>}(*fK#cEUN;|VdEzd)l%@XHj@965SwsxUTH9kkF z_NZbwsS-aNaPw-#o_9cKXgN+BIQFMSQr&5m-4$q656{r+hX|RqnDm~iD3SKyWS2D{ z&BZ%JTPTHuhsta{z3Ta$s=t#g>_#c*74qB|bZX^{sc0_ZRXyy4f~wIPS2!>9DK2sk zxOCqbt9DaOnkGa&aWO9|NQV{!2S@($*w-q6-S`N0XU_W9CiTit?ywF((>%TY=8Re< zj!;;0Gfp~FUXuUbTO+%sN&~YdKgv@95qi+L8=hrlp8d?2ol?k^VtNTF2-kbpl~!)^ z&;=QSUdMOno4^odyq<_jcC+-#cjKi+z%K&w89`!1^B#^ljoH=3BzecNch`MSo#!iI z8Yc{*v&_uRW8vyW=uhrLIqf4{x3V~!)t-ONliF@c6WYW$n155iZnztirMJ9g4T)j4 zuP_1et8dbdY=ZlB8$+|3EK58 zY*{T88q*0sJoYyR@XfvOy_urvQ(cHuY3xgk561MV6w7Wx5B+@?0PA1CrX{73alP)I z=Fm$7G{K^2l!VJ*J;8=G>(##BqcN7k=$)9sCNEi#B{ViSA`ty|^HemibnDkFR;Fsa zkyrkjx!2tRfZsT&oJN-undwk6ramV|>dA;u3Hb_{gjH&sej? z{u7mEfP!eJzF80Q57s71F5ISBmQs9rANaP0oiA{-=0WG^ng%gwX7RvCGG5l68TtVfG*TkJ$!}#iU&%~gpUnZh0nCuX@vhvwXC5fxl8e2-Q^TaF9lIkD(sn20c zrq`UOsCm`pEK43A-Q4R6cf|Xw-n9r03=k~o^7!IMp5Rn|ZwOBP^yyQzIEK{*Y~ERQ zGW1;}ljtY&*%d{U=@^3nHqd;PQ=m3eL=CtU@r{_cpf0j%S4SC(x~-95 z5Wcer-!GWuvdqb^UmDRZ>)u=was-&jYhg!3RyCS02Lu&z(lLo&^eRX{u!;cS5Aw*@ zP$>4mi&Zu2&{|3?0;}zGNt+CZ5NhL$-u~6$HvV)`JCrjIfaG?dw3jk$69im!jqcbx zjp&X{m>xlScM3ZFwDj*lh-TE2G<$EKXS_ITbm`nVJCr0FQ26j!VPaLG+{VPVziJSk z6m2)!9);cO+I?X|YfKTaco1rI80U*YktWmda#lktCEHu8>23tLQ`3l-IZ!Fe`H5zw zgkReI^ew>~W9HpRmdAzOsR=_!E#G=@{5sfdazcbG`imh>I6)0+ddFh%I;LFfE8L0h zfU~Fo0;NixT>I-CW|)iGKu|MV>Qi$=DU>DRgW&eP-Q96vMWQwKlCG}fQE$qoE90H{ z6AMmr66PIzANh~ta+Z9YlII&8}L3u1GjbFx{A)G+%PNM9yh}`YF`ILR()k&y37?e z{m7sNWIS( zgn^NUjTQ%x(}c4;xdKU&_`+cEX*LARUN+*mZo3Adx+9pLyzthcb&k%4Ge>!qn%>B= z{At$f*NIQzLsrQhJZ=!N(JR78gqCxH)biu#9SZoCLYKJkWSMopypV8c>*)wZJlF~P zFu}OoZlp*fJg%$==N4aT%Rbh5*}Hc1EBH+4pKa`Kx9OY909gE>OMQZ@uyDTxZx>;* z8|g5JdP8LMSbdKjZf- zz7h`^Pzu0ip3%Qx5l=Oy zEmLI)Hl}fZQ>D|&YKC89&5hlrCs#&vBgXlc%(!wcJ5n6X z$2X3z;AU9I3DTEJkSGSkySo;agY{1fcQ3Wy7iPCnvrTX&^p0tOQiK_-M-tX%+)gf)baUvqIq){ICT$k9wO9Sk`JykI&EQg zCl5CX4Y3Fq(oPiG%nLPt8Jm#mmM6AeH{>`zK;FU9kAqcX1Y>QQqL}&cbX9${KY_!5 zLJgScBN|!gcF-5oUgXL+{CQFz(PwG+oMetd{AqB8)#?yDzv>7yvz3vnVwkuzAw+oV zV2Hml&aA6b_|zJLA@UfA7r1D&yByff{!(-D=*iau4C1UCWHg12DzX zFYsc~21SJBG^S7ng&qcB8-NbKhswd%1BwN9piQ~bs*O$R=6E>DBX3>c#h>CvU%7p< zlW;oRQCB^&mFZpJyWsE&eOUWoYU9!Mi^m{QdFP>FwDo=D%!?iyAA%dd*vrN;mwF}2 zOG@i%%1h$lz+viA;qFX(oLY~D{Eh!vkY{fJQABQUfyyLitSmFXL2{qS)Jbd4VNl=v zHcjTBY&c3Jf>#t622&eEsQ+_f_h+{SC@<9QOgzE#vb{|Tc%+o%a^~Vk_|cA;lM{@V z6O<#XrU+NRf8nKQQh~xiYgequ*{nU-I41j}Yd~-?P>c1oEJI?XnG;xK!M9!By#$L^ zyZmM+f0@!hFWG#6zl-8@JHO~i?aG~EoqMn->~ATv=crQ#tGz^k#}fR{$~okl3~;cQ zBFhm$`)KLEKhGxZtA)an>h(Vw10bb5kKB~N4F}0f@Bh~mUweexFN~Z%Jv$pUeeLu< zmIFvOZ2Pt91w-Jd!k=CBNgSX7m9%uW|LJ@m7~gyd;7vC^~uU$UkT63xi(!37DC`i&`0VWYYFAv_vJqXl^^%ODiYI)R;H=!<^Q%b)#H0=pO8BrpN+k-eAO9bBVIgZL2P> z(`({0aW?+#AJ~;tJRYR%Z1-w(M|35LE9vkVbG84 zxx;U|rT1QS#ED`)uOeVWu`6N6$4f1H$4Lg!rbH@E&t6*$3D+HtopeRNmJXWq1aw1K zdiD$%`~_f^4BXe2c$lOPg25>udk5vXxdl7~v$OR!4ia0Gni_s3^bj=_S8}1p)|OHx zV$Z=)e^h`u-+iXHIbAEOD?B=yi=9+)@6%my-GpG}#&f;W#Y?@x)!Mwe!+a8U<_fMA zp4+`jC_9@#oS5mBNWgm->~;-M)Jm*%?*LfZ*(#gD;!E&JFY;)9ZLz6r7(kh3nCI!N z)bEg0!mi{QF|eKj{p|egpeQ#ts2PH)^cB4oV3Yh)lUx=$xd*8oKu)p#a)G_g=`P{t%{fwH@q&GiR+`&m~CFF^gU3g!J3=m?kod z_SJZ3mq34xIq0DW?08bWHRe( zAEA<&0Rn;?2sLmZ)9O0NkA~O|x}nTf13M7n4@XOFxRW#z zOsL)B%@f`7XPa}hW?A~9U4_LGq4{O~5_r6^=Q9F@9PjV|pwE^h2-reyiv-6^&s&h- z*YPi>=gap@2`k%uIi}na0DEV~B5SYvFiEV_j9ePlI_V?0u&}T~ncUMLRYPCn=9b}$ zZi025?>Z89B0M)|V}#~YgJv3zlE}8TU>WPtq}W(a7D*Ui$@>EZ#|^xX*j)v8IE*SG zle4joi5+#1`lFOF!m)zuuQw+(zP08s0qZu~lgj1HQ*<)!85GBRbI)+#skd)|LHVek zL8+}BwH%A>+2v4|N%p#J)Z?K71MY6wy@XRt&L2wbaib*ik7jzarjA$?q?1YF#rI?u zc8$Y6;y7otTD%N+wA9YD>T5`JqI5S*e6fwUF#JsrL+gmNdj(eF3Nfu)Q_VmF7zGCpjEuTr$=y zB(;G0qXB65Sa20XXMDRN*NZIQ>gKC^d6cb$Hvn}WNcv43{FU)I2jmzZB&08|H}bQ- zco;4)`0L<->j}%~*l0RtZ2Z*Nd$`-u$1_VV`1TQtB)g_h%$z%0>rnypvLEvE`Iyx( zy)=Z~RR`>4M`86_58HvPOor}qExgjF&U+n0OANdTq!64O;>3MwJFEKb^S(q0S0SE> zOX9c9XH}T5kO1zM&lsq7fC{aPY-H?Y+YkN66L+uDOFu>n%+Rjd>= z0-(j?`w9%i-FDwxB1-q1s!k1rPvffHpqlY|zoh=fPn~@YY^blkXF^+l4K2%G?(W^x zagT1?iq9T7wUy0)2Xr-|OC!$om5cGm9|I-xWv5v{Ep_T*IF~)jkTa*8C)-Q?1&(J-TwN^%wv7*JRR=Tu=W7MrV_$L3*Eo#0jL?FHe*G$?kf&#cbh2DXYT! z&EX!T%}eP~u{&$@^y!k*!S?Xr$_!PX=(oGuVN0W>szzRG7dPGeVw^Uw|%Z0kp|@&kpL^kw=xT?gp_?>|17a zhfUH$7R1e3%uz4CvOzn2;J{-9;UQNf+GrP@qk%I5o^mofOTxVZ#V(UOO2Xb#9`MZ_ z@?->XJYd+UF|V)^(gYKa-e+QdgHhjPhGRKNVe=I5i$~}eKYp8h;dm z(0c_hLzak)L|3VYuyzaR_Gl1pIP_?Q)&Q$t&3{t+yj|6otI}{a-I4sen5iF}1%bbM zj~YQMC@Qv3CVJ^`sl9;Fua7tVfzEO-PKG&N8Yd^^{Y4#8?Fv0@O@8u+Wjz~7U0n#r z!J8^hwq?ow-ymI^EU7^GTjPHZY<~h?JqEDoqY1dc{{HgUjQsO1xe7RPl1FlRxBe%a z{|D96WB}MSxteGw^0%M*O+o*%bUE0iY)u^VgTFgXcJ*z^w%q63dW#*;Up=R{-DUfS z>6HV@6`IjPvzATIBs}L|nq8IDZ%Z345ZVW*nOv~ny-!*Ax*wub=Bi%%U6}W(7-SX~BzdhZd zcR+|gAK!=oY(~hjSopw*{xrP1zmKz8bp1;Z4a9}9G}e(;4uAIw1O?fQtb#DYAkV<= zwB87SOFUB6v@6-zqzsw3MZ@jJ9&<`cW_?mWex~sH{y7y+^Sqh4IqiyC)RVA*iefW} zd0V2iN4wKgUoV4ldwxl{ZA@@5`;np5-)?Dt5dis(Yty8G+B!p)-}2h~mQQ*cFbF(- zG{3jKxjIgH67$A;hcW^$vmeZT9OvA)CO*9N-1Pa)44@Yv`){_n64b5g^#F?m&ukG2 zd5iYOCD60Lj-OEvy86dv61J$##t~cOkGy~RmJ>k9hYAD|9enwA>dTg|*IK@vIL`B; z)!Xa)_^M#b2lkBaNX&GIY)e>!pZWI2Ue(y<3U6T>AREEEc@Ezisd$E1nkc;o>5jWzT#O7B$N5Z* zC(ZbgC!>J)VL#BZ^t%1U?DPA}j&JkzD?bgDKHn5#gs%;*kJr|os$F`lx4ZfnvpgzV zr_!A$eR4@B3vL&?jVmWXeKu$DB%5BA*pU-YL~p#C)^XOezOJT&#>;uI)&5FA_MHLNEhz*2Hymw~Rqqrfu}wtL{DaSdjCi z28-k<5eS%aPt~lb1iX7!L|KsTU5Phv_<-(kL!?r2@~+mIG)O_c@Su2wvAi`&ovj)u zzKcXWP?JIv0@(6_T;Bg{?>nQK+P-}iQ3O;x#{wwD3Mx&cM5QVMdZ>yTDFLN-kdn}2 z;3y(hQF`+LB3*h(Xwsww=_DaR=_Q07N&-+y^QJU*rgkLR;0hg@go=un>`Y3l z^gU*4b02@dc}ERzI(bsgE2h&SQtu~0)c@>E+}+gvHLzQy4dWWF`#9eDf!hgyN@(2Y6*wdEiu0ck4u@gTp}75Hivd z-4GBdmg$qFVi{vx)RVy}a`*1txlv!9H?dN%#+Yl4Nk;XD1{e=jtc<{OohKz5nwmnN z4$8jG8L0@1lCb*g=GrQBr2uU3`U&5uG;I$z&z2}j0Hw>m{-73JyyQ8i0e`bN3HlO| zW0YLTe9!Cp>=9((Pfat3^YUO!WvM~_=JxAd2o`2@rD)S;*W(92L+rnwiWDEWI`TML z7!Jf~=Q`8*TcRZ1xlbbv$Wu5oZ#{@f_R4y=oSb0C2aO_Mt8O40jX#&DmVmxk{emqV zfM11G#jt)(8y~|W{5lg-J8$MiR6_SjJJdK)SVLwlfHDhg-+T-7gs6DvWw;~r5;)zk zEk#qRXVx4TR2^*C{v%VFgh6yBohK`Oa>rI~S;9MvABC%JsD z?Q#Fv;8Je{ls{Oc`US)WTcG5&G;Y>YXyYE$U>b9NiQpJ4y`17pydL{^b*kKzGxxH} z$S0y(9)$@bc~XpleUn=zKH(MPm*Vs@F6#bt*Z*KYU}&QPazt3DG^)P{Uae%YTX%S@ zEm87oo^ivUOINK<1WaP`!kI@T#3COX8DrXO-$X=Q09vh_c+;IHy>tLmVp9Q^TXCmA zDl!Zz^iM={K9p(tTSML0+jBM2ioqACtk3k-3iF>o?;oTEvLkV6UxsI?u6X6P{MBJC zG2LEZ1#Y;a?VzsfL?Om|IZSsK8So-AssuAtXz@m+pDeG9_BjrxXY*l(fjvw)c>Pw1 zNwr~z#n`3^2J(UU!@U;mROe!O9cIhOn$(s#sbUSy~b;trLX zE=7JRb(nX+*mQCZOb?(<#8= zB&1~Zw&5vUkrW%g|LmF1toe!{u3mU$S(&Ma8Zrh*PSvYcs`zW!0g-^9cJBQb`pyLn z3GO$A%NG8OHi6B2yD^SQ51txH<8-clM)eUXFm$gi>qj>oE{=GBP7( zO~Rg?n|oMV@G_^8Y1rfm{7GP+%eF-9=KwZ-GmJcJ)1-@tdU<68TV3z$pzQkck#T%_ zxcj~5y3IrTPXK@KIm9yl^?fL_^}*2MtKh?_XEIBP?J9U*E6{zR`4KeGIe#2V?0r)2 zkEG5C)UME~-|`x_gZZ!Y#CU=;SG%CBYU=9HhYinmui=}-)Qav2U4Iy-)dNITPsBPN zX6v5~mRWr{)|>@&0lq(X9`p`~gxi8dmzeTwF}d-X3U8E05<(GUvNtXQhqd(~&A%#= zUjmtrcP>LB0$w?hFMLFh&1H7p4M`oMGhxEIBR{WcW$J19I(+I=-ja=02!Qs#&i~Yq z^mL;kX^QdC9wu@)h~Uu?)YDx?(Vm+S5NQ$@%c+?a1czZtM&pe5(_Fr-Q_joE6860Y zvM^d{juh-TFKrol4s=KIh@g1rX@z}FK-NH2sb9aX83bfVJo2Qa9Nu~?wAIgj^I_}t zJ5BJi%8xueU|BNsMr8=WM7#eH3#1q@R*|cNM^`G~RIPo7I8I?}J1=4b!FfwS=JZag z(UpD9Z(hD`U2lPc)_UYj9JxW8kHI zF>ZGmmt(fq`ij{#3X!LP%yBe2Pb3>Z?^Z1EIR-fbJQ3$Y78mF)5${|{R#a(DN^ zzH4F$ZrzKBhJ5!84=;v`xpVx*p)#z~Nyxb)d>+<(ZXD-e1Xo|_)i2fL%dtb>FlNe) zMyBmA0ULOa96`#9t5toa^KncyHBNEQ3%9q_c~P|)S7^DEfgxklifFx zhjS?AH{;ulQQT&>-jTx(>tpAI#Z1v}!u8#>Nus;|I{0PW)ww+oXfadC(w4OZ!ateN z^3`_L!tYVdH?k>p(YAja3@D>jF+mG)H++P}N0H4u73OV*u0R%Ws)pnG?i$BLrH1)d zIkO@mebl4%)xWLy^ku+Mw4ZP_R?=Y7$$^>MNW));;M&6*SgTKQ$%t$qLmlye*Y!Sl zS<(XAmjx?5VIb-9lDb@d^yKBvT?y*gSzuTB7wTSCqStCIrl-vNr^x!*(T&LZ(G0{% zUVmR89j+(1?H9N1yAQS1xRx4d@xSlCy6b)Xpv${t^AJs>za_YH-@!kdBb=^5$=Ej& z`wt#`{eiE^W`5*Npfk|csoTIOrhV(~RJs8IuxYhtDpJ(rrxab;4OAMq@itt~AA&Iu|@ zU6I!Q0*ZTyF-EVVPfK>y*KnYpDth(^Dx?6Bn*~D%dY#ZO(GipoTg39C29D5D+34ib znv5zwu_c#4T`gF8?qy6@nX-hP$uP)nq&c#^Oqop^X$u(!s|W7HE-5j0nZ~GQq1{(5ems`0%a`LG+aw9T^W7~ ztN|Ab3`HR2OSJNjY#ZDi(<^`K<3@jB*VKsNf0p)vt-gvtxS!B>5&N$*7q+N4e19W3 zHvx6b*&%D^3ULOg1Zt9wPW`I>xc?GR2e{#kEZOX!`Y+Q$$OCa5`vur5=r5^xw~u;bz`b=thB z5xa9D;;QC#`GyeYB=otee)Bj)ccKB znYVx0x%CdXrTq?P{EJ(^NBv*$FoA_ZEA&VkfuR39HDb^9DpdY?_}eE(9WqIUtbBKZ`_&T1+{+^D#4lknZ;uGHDV@^7cI(X3D2G*HhxiRY{L?s}HkM zwc*##{8(c9LIw-&sP04^BSuD8;8W<)&G%@EA^c`@IJh~33MN6_85-Pw{16HkQAGZ_ z>aS+Q!gZpTSIB1SGcqb|B4AsDzO69cGY{{Mx8P2bPzNS-)k>NEb%|pxBn(~@#GbQ= zVoih(Te4+*OwB_7kgax~3+>m%GC>`sVwrLUbu9UkWcwf`x@dOZJGE9ThBr!rDZ(@Q zQ9@X(lqIID{Kwd^9CtzU?zX;?Yf(`;#|heZ%CCVyNAd>UjjYG2I8H7b25^^FoI5LaU~5<^a|YJQB!l2! zvyhEEgLRiw)XKXsWNmpBB*h(imNM|AQsJpfYq+6({9-SrxNB9+OV>&$4XB|4?EQKQ zK_)mF4eu?wC0wupS3*93MlIlqKqjUPQT8mIyd%5s+uubqWoNd4{U7F$n z8CQ2z9^8WppNUAi5&QU7eyP#sDdAYrEh}XMRSllNlH2Uu=m(ZTi?Pjmw%u)cqJ_3J zP|o;2iL(m|MfGD}Nvk{$r&E~oot757X7Xhu=}V2+%es&?7Hm|le4M(Lw`O>~$#zXZ zj;9*Aesy2`@~z|MGRN{d>T?Us6^|!kq}x5(QA%VupOpV)!>M83z|`-`hHlpVm@6w> zbdUQiG+dvC6csI%dzgXei7kts-<8b*<`Yj#YPj?~t|6<;N=-F@7-)lo%PQ@w z;2f-bU2YfAXhi6&VT>7nxl{u!P}kHkwI?ax=En-f8Igp;3jDXJq9x=49&yRhM^w$&p0;l8f^ z-aj^}lW$>c?=b4{xe(^4GOuyy#1>*nxDXP@6U}q$eHZu?C%;wZI)gWI^`sQT=IxJ> z@_?L*$}R^+EfyV>`s-igzE+T4jg1lR_t_xp80eof&!nB^LTm}lJ9)>^k%&mHj}Krf zx$)w(p@eO)`HEpm=3;)d0I3jSgb0dT)DBjYAU%MY{du@A_D-$rCQ~%;AwGNvi-?ZB zI6ihlEaTt9)mjXL{<$Ml7#)S1Xv>ssJ@xG#Ml7LMamTW5d)~)6dl_N=klpqCKalZ{ z3;TV$tMHtf#2wK5{;fHtUA84}+u4z_X>z3r6YRP$O<4z=i z;xgYKw?hZ%@c_c&YWd{cCR|N;!k{aHyeJ8wk~@Mx5~4>bPy%PG*JP_Yt|BBbZhhX6 z66|q>R56)iWVrD4X6Xz!{d3PM|6xI`ELsg1lsPNp7sYzGO)L-Tc?<>NXTKTMTV5$l z&n5=XHei;qXRBS|+2tOJs8Md+f$shlb&tu^wkR$IeidDL`=b0wvxUuxJg#E6_z~wi zO_`g9Eo1~2;0PQzVOo!IBIcKVisZ0dmL0oo4tBPdd*W~ek8v4uySxq%zhHo%S?QILdDl`x^idCGHmQ&9y@rBQWE$9J2XhH2u|U#Y^SO@8eN?rIglIatjj-C~AE{H&ap{mCX7Y zTF%`jdX2Feej9I%zuJ9`y+Wuvo)%_4tD*RRr2W^_;pWiRsfQ zmjzauB=T?a*lZE?+}5(cRsS|h$dy&9Hyeb|zBfdCLBCX)(jc7(E@R>w0NYCQ6UZMH zXH#huWEaSbN&>Z; z6jRvL>y%{|Rf$-sI5)kvkfZ=w?jD!uQ&7-4njm@@%6T?XW>T$y34KzmyqO?N-H2a zWyD5XgiM--&Eo8#~j!lmT8|o}k5a+1?B}YuPR6Qi`56#>){JhL_2ipO$+IU)LnBz5=RbL?Q}Y+u2JsKy;jp z&UXC(&FN9KcWfyLQUyAn_2iY zXMl#OS${HA3#x&NcNxU?&b}fP%SrhN7a-oJ7B3d2%=Or0sy&538*I#!9jUc=rhykd zna!=ADK+t}aGC^oVK`oDF@7QB70h$YPkP9GCg-~gt<}z7KxE3lb$#u-mK?OMrw5fQ z5{DJzshHE92j8N0^kf7WtYRE|SgHe>QWW|7)q0<;n^wXsOQk)w}B4fw(@9=)6Lzd zU5M1#Di;zC7QZ}_Cq)D6kze2po7hliIrQ4SckTMa@6N3o_t{9L53Pfm;0sz9ZxJMK zQ>6k%W~Mv_-(>5#z7p0QL>*n|WR;r|d=3pA^v%_ri5i>0a~NqCr))dOM#0PWE|*MA zM+ZJTj@q#~Og!rF9FScn%n!yf1u22+JwCylhK3X_1qB)R34=V%mw zfu3LDJWF51kjjOHM@|d2=-|Rx@1iJo40TkF}Rn`KusNlkG2b} zRuMm&>sYFOaz$)bFxp#*r`Eya0ONs;dSvP4CT zy)jS0*me%!Oc=ngeax1(ayQ7pI5>NSbdw20f)ni=+W=Y4%dFha*7mxN4)Px{DXpyJ z0{%iha*zjnI?X@#q;OGf6+Yg7Q3UR&s=*!jp6HjaD~!B|y$-Hz8|6XA@gOB=M3S%E zu{`a{qIrTrE1EzN!C*WOsHss5G-NYM*L$w@d^FSF*!VsG#bbEB*$t?ZYX$m%RUc<>VXNCK! zH20|8ctDTYQW@@@%xiLTp?kU4Ia_MZ;%o;fBY17kky(+v94^+afXhqp-q%7} z11&VzVj3-#cWOFK+FnKK1sN^@m2q*8K@NryyZ zgCjOM@M%(MpbKu%;3eLmxZHLvK6S9097oLUCF+Y{LQS-+8g1hoq(fA2EiFPTk*->y z{C21qa!;Pn3k8|cL_4~vPmp8)m#xhgjE}w5cSGt94C|H-=xPK?Ps@y~<}zvL8;7F~ z@yNJVAhk+AQkoXjKy)c}^auY?N->U9k|=@mfUcfBr%4j3)@E=$hTjuBiGel-*|s?vrf zfPadP{vC|f9m4a9g1F0~y^2jeg_DEkT+QZNxx?Bk1K-i7ZvL|JTRFwZZNQw%m1K4B z8o@#OcCOlg&f?PLg`ugOi2>b2$Khd#sUl)*^2!I-lohK@)&R-s(IYOa?{R>a4Y~@Q zX&a@yTw^_Y`$K~yr&Zt|hx;VzFn6~DM84puS3dpA1&@jb3r!qHAlEyDTR<&REe2<| zAhL9PB@o#6uE3@PAarSFI6#t^6j;nF&m5X~NZ3)LI zOOmFiI|%N!8K`ezFF$m1;Nh?UHm|d$d`yP6P}2qlkVMgtMyndzKVPQD!y!D;==>vC zp_TTiEk;EA*VIE0Nv*9dPc|wFcS7<-vPVJ*CY8!uHh$yicpP+muGi@UB=IIvDJ#86 zkG~2MnQmmg!HQ2qjK_@-Z3QEZV>&R1Q)b^EEwRywsi`InCC8Yg>G_xWl==@$cZ*XX zcfUx|9TreWNtc9hrWfg*T${{#Nsd#~w(oH(G=Ox+M@Pp7HN0Ng93s9N2lda%5;m$@ zD-6rIRCjAr*7d#RSqd0+MRqqU(^Upxaz2D1MafsaiKW+g^3pdRnDcPgHTsvfSWGVg zJ!jreIzBR@yS0WtKQVC$h?D;Nl<-GEXyXD=$^xiaW4hxOFx^tB&8e~;Iov1I+)}iy zq(4oy^8rvg0qe&e0p3yRa3mr&HZW}D!?2{y{P`bL0;Q<@IQ207-15MU7Xv@sm%TJ_T+eeRyQNei-|7M zYJ2(W>l4fJ@;-R(RIY$2{pvx!`oz4vdQXyNTAJ84xrpI2Atbx-?hXq`CNqh8XsbTQ zk`z4_6v*R`CLNQQ0-Nnn9_Ayjqnxss@2k}e##LVotF|k<_9wsud4;_|uVkWGEsGgm z;y%9W2XSGg^4D>~nTZ{4I?+J3W<`z8eu?7|aZ!!5zj|>+X>~G_K|lB|@4UBt^;)bA zFeNPN**CP^R-(qIa_05fHY}D0kC$;CgM{x)DeZhncZNne>s@G6dSqJA4>Euu z=zNvQ;e1=DA93knp~Y0`K}X<(1fDG~_mCme#-^>mg6~5L|6p%hRYc@s1wjWh;k!-P zV+)ofrn^abL?971t}68&A31rUSSruIY?F|L5e9)(AZ|y3lwSB6c{n|K26lYHy}{Vc z@oyog_CjOv0&`p1i)RI^+An>UCD5f!;@EAo{>6oiFMCk4v#%q#cw1?uSH;B6e@Rcx z-ziHro(l0U4GSy0J^77{MvoDR4e?x3SFR8Rk$D$FzL5k&JpSJNSf@?`aIVmGtkit1 zN~v^0a)Cs&ZXejL8u;}xCSkIC{n83BR8 zBebqu1J7+31n^Rmdp8`LtuE9;|I*LZ%7mN1O0XR3xc`IYKQ7XM+Hv~tK@5z)8L_1h qzZvnH5p>JAZ9@LPlL#8`TwPUD?NQGIzzL1J?kK9?%DVa3`+otA->KRF literal 0 HcmV?d00001 diff --git a/.gitbook/assets/posture-check-summary.png b/.gitbook/assets/posture-check-summary.png new file mode 100644 index 0000000000000000000000000000000000000000..3c14ec49496f7625bcd5c191e7f04a2dc3c4b8cc GIT binary patch literal 98090 zcmeGEWmH{3(gq3x0RjoG0fM``y9R>0yE{3!2TyP(xVy{2-JRg>?(TL^X5N`e=9{eV z=lye8=PWjRcXxGHSJ$q3o^HO&$$Wx;hy4x=3=CdETtop3400L_3?dQ+8g!>VM(P#} z3|!J&SXfR%SeQT#U~6J-Wef&J5#<@lC@Cb5*5_RgN9>OcYT#qmfRIv_GAW5&WP%Wo zH$BgXkA4hud`7NGPEvDjg1jI%(^d|NMMT8ja!cWYOP0E{;Qj84_pSFB=SKuMNVr@o zz6=Y_+O*G*s~eRKTQ%xl4SM~mnwxg))5iSJC|4&Oqu3*^vrdOMBM zBJKPux_#>o)47jafn+qT?Rwd}+YxIXy1mVZuFQQ5jc-j=2P?wLM=WS{J&CdR0R-T} zh-HsF?_b`Sv1{D|_ZyE<_q`DlX1M3Xw1w&f7)e0dRWVkRFp-u9qXJ#SfPn{@gF%9> zz(HSZ&=(BsO>`jGThMP5&{re_;$Kf8r!(IC>lz~RS3yBVVF?M)Z$(3Zv9XQ4nXQ8r zbyxtXsabO+H3v0mDK0}>YdU=+TLWV{7i+s;Rls;$xImZI#t!-fF4k5y_FOK!ME@wk z1-kxqo1Tc^A4ME2d5P4dlv$HduGc%nnz?7bmlarI4fr*}pi566X*51{|LEnYe#-8|}jr^+}5o3EpfVrK6 zxvdSsuXgnfY#kkViHLp)`uER2`)TZA{vSy;_Ww65&;aRwJ)vi$W1#x#M_ZF z3VLyT{#u|){A-p5hEF9YY$VwK{>Uk9@(MtZ{NP#vme<6v$mTb+qNZnH~7p@OVYPW z%A{+}j;8T9pqI?*HX&H<-`Ui9hGuRh-8OJs%We;EX(&(Kye zM1IKswe?~Q;gb-Nu_Mt7wYws(d0V7o zvf+vRW8Fs@!fw@gW7#iUZ_VLEV2b_b4D1?^_4K|O_Ab;~6R)qY-^BNaMKPJ4Xu0zi zzlX<}NiZ2nO76NjUZ&n8e@fk_D?3`29E_#4T%gx(R8lEXOWZe{Kbs(zE7##QpRWqQ z+VgqycB{OtS3BD8Waar?p;~1Y)?)BBwb6c+al#e{Ck0Bs3WPdRX7pvFfyna){d!}D zdVQMJcK_%fK7=3$^^6)B+X>bi_0DgF&Yy{tlDQD$sSK8(g zyCkVT667~QN&w`73osIBpiKI{dtY(dGu)7)U&Qb<(aXS&<`{qjirgz8KT1SHD2|zM z=(XL!C0Bs|Ir|`&dUkt=rgyvuv`3w);H01sZ*)427R|9rL-xs)#2C6TmK<5FTlGkl zw?Fyic6}tn1*8rMke@MGUXRoU_{n9Sl(@O4mAzvn?p0Ycg}!#zOt4{gL|@(w?1xi& zUh1BQ2>j5F{@tkw?7%QQF$YWvBl51r&3WD~Q%~ke-!?|zj710t2(;hh_GkZ6{~8J* z7=2B%{P$?n^dV+i5=Qk=7R2ZrqJvD8DP4m@NNk_uEmlI58diBX#vjS#TcO{ z61j+>+lb&VumdQIB;{_+_c-Ns{?RWeNU0=*k{dm*{>8Rql5EFsp1WUJa7TFO?Na|( zaWB#!A0O+K#sfZ4q)c7Dq{(7S=i}o_LP+?Ggm-j015BPmD5p(k5wYnVRtM}1W0gO< z+R(^n)jRAjsS67a4L#kzH`RWvNNvkG`u_Os9a`>xSxtLKi^_Fx>Ux3{XAvV%j-V*Q(^ z=UgjJ)mBaxK9{o$f@X}JExV&Vc}_>JUMqU#qF55r)EMC)gk;CVT!(#yiCSsRLZ!m2 zk9;0#@#ZTPK+9Q;rs^l1Dx-oL>qV6!r9zq@MBJ!pOBHkPLlXINTH-Dbp!KZE!E8A_ z%)NGvS=6GVJ2zjJ46gZ7PNjbw4P_I^lw2=&7U5ceb+yw)>cUAZ))qUiec=@94Hj`$ z%Z<|usr$FSP#2Qp20ceN^`{XZzt_$-2taVg39Mz3d@tX4AZIxZ7lGyQka-s_dG9gZ zhx>^7`ChWW2=bgeie&e5;jYGIGfMqo3Z$(}H1oBxgC!0PA@kU01ut(23LFCPzGzYx zPv7pqx7e~ZLVIJI>3-c+uEVaE^xtA!(D$Pi_+{*=EOapcSQJ`SpfF*73ho1g094A< zha^m0H+3DaeNkrfIX;)4diOU?r_C}%fIQEOb367-82DWaA3wvsaChF`g}a+Y+kr?; z8w`H_1edEV)CfrcpsM+1;ZP+;s!cYTZFjD2Oz$s;=0(YEC|y!rLz zt<7R3MAUW!f3LWinOTx2Qfb+Vvo-b?_^jEcuE2q{4!@;4b=;$s7R^TO@nsBk40;WU z`^()rr{r6)FziGIxstU7$-p?aMb$EK>2I$C`RRj_^eqOpn@|u~ou6o%ZdV?+XIH(L zi)9en_G{(Tn6_pn^Ocn7y(=A_}4@BVVEZK>8U*X!Bs zVrZ;Q{Cq=n@@TODimmZ>FHvktq-z0aIq-wAt@uujXygkLI=;u=x|F+#5Q%oH)pvbM z$D8#a`~l1IHvQ6zR7e1gkB7Zsk8VI^y@e0m7wLeSrvvSH(@(zV41WFbNC)(;wWJ@Q zO*Jj*^J-yr@>a|b^e|#&Ny?luNZ!`-y^d47)>LDQCDDMJMu&kVC^58;Xwp*7$r>y` zV(HV3jfxN#ZL766GyL{y14pTcgUO+iNa)a`pFuip-b83RoSRd-znVk_986KVFCN#e zTF`T2u1#Oxn-WjJSeQ-9*w&@{{6nJ2@PdDdfIm@_cY8_r=B*;z?w+4{UcIHs^o7%jS$wjC44mFJEz{ zR;5v;uNcNOv%~Yw9I{@hVcZn9;mPkHw(9V`*MVZK@sne9JV2w=%nQA&a7b7$A%Gi^pAi^17jA%=_5@nMM5wQ6Yszw6Uyw$3hSQ9B7%FYB z9unCci&O>StqBTVt~L68VzlA+vykKpLNzN)>F z>$-+H?KNt!97!aMw3mYoC@WoysKAP^d#|$B?~(oeh2;E5F&&$gH?-Gc4cb*O)C#U-}VrUa3n0-y)=m!6W6fd31wM-+E z#4^7?!fG+~(;_b5$dN`sJdx!~R&vlxrD2~^N)ll)ODuwkYeph^-}}+G^sM>Ti?z~u zGRb7_wz-+D(}H)EaEAAWM{4t}o=w1k zBV7jXGBm2Kjjs$tqp95UkL$_-hJ3h;LN`bAhPH?Z2=S^qUh^dpc+b_tx)lOl42qkH z1_lPhY*ufZj%p^bJ1x{bJemW)<1rLhn~Wgs^7+$r;=nc2yoqq7itTtqOPrkPO9Ck} zWQQ*`<^CqkO{VE4$uh?@0&i5>W+<86mJKe&Ot&t)HrA(NgsC?+rI8s_%ru}oWb$|(_uO*yT{tZ<#!8aUX#iLBdM5`*9j z7Xaw+b8-@h7~mA^m2Y4-Psmk(#ec{vO2B;25l7;sL0I$i)O1+4gMZATeoy_JzwpG; zLgHRoK=K}wv#>%^>QXU+H9u8xjD2ojrX%lSw;_wF0A1-6=tNaJ{zs7X74pRqg7Ovi zwLJYcnsXi3InS+7Uk)GswLjGQ?rh!0u=zI4eQ74yg0IMzs$adv&n3P!nUz)ub9UMr&V={^JUX(BeWX;x$}X?e$Y)p#S39{df-CZyL8Je zZ#ALJS2MHEYyHG6<}bE~at(5+0FSuN*gEVh4%NV+VcXji)w#nJjL4V~%0ZzIU7mKA zw8FXan|T*=o3iz|PP5w1jis8@m%C#LGu8`YU03OY4@`<3qi=zm2gBG*e5oY6@$c&t>?uz~U*%@?FQaga^2vw9Z=d7E||2JDu{L zcaysHrVQ{z{4~%MUm)6p3OFrG6B+=7O z7as=V*v{~n(GPV+@K8A~Z_|kg>=tj{ZU|`2ZKIZJUMMyrvA@K|6K> z3A+$WV0r*GScumVU4kY3e)xO!d*t>I+E$OR7!*G}iwd`AQ>^>TcUWA2nM4K8`S>Gd zoA{e_t(+0-On*c)k)R|mviLoE#z77<+}UXxd1DkFyG?UyGMsBqWDFIRMS}TcmZ*Ib zZ8y9vI`KMiszP75DHZrNMJ=ANd!m|&gi23n%`VVLuT>y(?RYuo-#wkM^1xX z>FVZUA|j#^vMR&A8k7`Qd3$23+GFkvNQPTyO8)@lTB(Y_`}Y|?1ps{f=lt27@xqH2A=2@_s0u|sd0%04@N6$CNO#Xs zKc2F@PA;sX9m`(k2!*wUrnf?>Gx5GZCQwjG7ieqXY=#4SD z$<*`&3Sf+CDHo&KjfLCe#%b)kuDSEm4Dy$uSkpgQOtSbc43NNz!(I=UWb9mi#N)08 z@Ztpl;{HgG#M|HcXdM?iT~B*@W=J$04pO@hJtOj%Ia#gNYE!8e8O2A1t|kWr#-G*B z!^o=;-Jwu!#G7`l>7DBPrX4qzx??C;ETB=PV2in&tr1q=i#yb4!!yrF*~h=-kvId9qx)wHybjrcLX%daUfib$&dFLhXw%H`|u@?(9G5b~ri9 z1_Pu}0TV7Ddq;CuB^rX6yquV5s#Godwd!$w8>|-Qj$ocQ`LP!Cz}SQ z-fWhMOZMJY5Dkq(R}%zsc&-Y9Rg35p^QV+sC)YwCAD^vv9niXV9}SwNfxI6zGZ4(j z7zV4wYmLBi+Ut`bl+|i8V^Y z?_hF&Dr7S?cEi^m;s~B2r#NY4I9OVBsu5j3=&+>)-m461qbbUa%#Pjkut-o^xoExW z@_g+OP>D{h)rp2J{O$f=DC*`5l4$G80k!+H2L^$d=jDj%LY-u6=Of~3M3pGjRfAd7 zke~U?(fkc15*G(xYxjl=qxIu`0ByLw=RwWBOU$Ben{q%^-_(mp7!EFHLY9*WdFe(o=3cRIqq;rgX@@(iL_T?FK;VaKgV%Z8&< zYMnn&n{eVaRU#G|d#ot?pSi*!b1jznv`!y+T;zxjW@K;Q&6enxW3mXm)Ld*+2dCdu z+8lFH>NFR4e&h*avzj9ym5h(AGG1;emUC(U3>i@|E_%=cDLBI9B62*zs0;$^!rtOG z$22;$bXpu-drl8-n~#3iGCKri(4zH!{Jyf7tP+8{3+-3;#0F)d`r5dd8>F%d3x?a!6?2|JC;F)RGi;fkK z6&StG*ZDP8^PL*3(|ifEnq{7`X!!F1J|9wB8r|63x2N;av0` zOWf54Np{7stIc)%fv@1Ri6iy-AiUC+mGLy)i%IL@_B7puf5&or5FJ8rqzaT9_Ro|q z!a1W&Rlwb9^#sRBwX!LhXg3(RCb{s6(WQMr5_8D<$`Dada>KsmDlTTmUq4CBiCE$-yl{2hy*AfCFR|!4>mV&RjTDW zHbk9cZBGZ)o9SNI)~7)UvbrNZfx)TEWqWx#s)eg+zP`RvKv_vSKaTYgClS#B-rGj^ z4}`KR*&eW*OQZ{ zP!@6D6Lgjpg3*Raq%FX+L<%Xf>^@fqwyNq{Lkb*n*!kw;c7Mvxxam!{HKr)YjIbL_rxQg0+-G6qq<=|h{MoL|4|2=MtB0)~;%v>CKW zIP){0%XrGCWI@rNUPp?HBtF z>fap`2pEkNC_|gJX`*FyfVaPxH%-4!NkYbZw8iC`s#yhE*1@%|ld%iF<0hzi&JtSw z)D@J!NH0?890-s44PV9&>GmszumHrDUn>oNlQ0ieLBq}-$tls%lr{O#=c`^l2$M}p+^3>zQn_ibO-rL*; z=x^?xWsQR*Q@3m?-%_#E6%?u*P9{W6MpKTJQ~Y)}ernpr+^)V7WS0$lUCjbD*%R|J zD_6Q(yFP{YJHCM)B*(^Z=L>vEb=v!>56Xl5tQKoW8s>F$T1>(m_U0ro^3fujj&`J1tLz>`^R=`3f!t@5hF8yz)Xux2#lpq?Io-PfLM7M{Eri%vI;JYr-Nx!0T16)l!FdUM|&9jiTCUc+ZlCn+2fY>3xSzLqaZ_%95sBpq3b= zT%;t(dyFk9=52u-syw?8RV+RIdyJP&6%WE}L*{D!bhm+k z;vj9;WBl0$uV*eFGso7z`;zQo$$&T}gTq1PV#pp?x_I>IEHs!p+Ojy!+mrd?^}fTf zTYa%z`_apnH;>nivp9(Dq2Zfef51%tG91ib?9P^qxUA9;VM5=~zi$6o)<-f}pbYM{ zImhIyAK{;Q*S{;&AHi%j9ElBsyOT0_Jwck!loZah+rB`QTh~YZ8NL0R9VBr7g~GdY zRAK%p?%xu8v_!tHr#F~YxfcG7ubdYK@yR!KM)ZFx(C`h!6=|`|H!J;3$PpokQvUzb zi!2SgBr6@NKU122n~cB>i1m)={W$;rZw2UxKr%3;+35c(lKov5AYvIW{3zgW%ECkj z$p|4!PWb$XEB(*7BYA&u%ZQ(Dg#K0_1O_BSG-gDS^xrD}^P(T`7rh)r?Ebe|?iU5g z*v=Z*$^C;*`L`y(V2u!cc;+YJ|J8y|iUa`#MR|?ciqOTur%y!>ixSLGWWj>#tT#~2o$o}P^6Dx61~yz#{URI=SYYDR(6{TN~S zKc|!+85Tsx%%6Zv zZjM$+U)@i&&u?#;`-sudcRO^;(|C#Wz)whIHt8>%WF))&6(>0IMU#{$VLiej zB@ncxa@vbgsT3L1p3b)@{t7lUy+K>lLTarS$+m|Q>RPr+!UN&mRaeH_-k}eI_(-~S zgxw1suNPmai9AQkLx#r|!@kifn`bxTQCjupxzK@?eYLxT;_~gn{B%am5)i2&5{d~e zc-|Gk7Yll!50voVKE1!V-_`xGZO{`ukk=1y;tHb8CXR#gOcMX}WFYgbf1UM^Y55#+ z*mx7jy|vJ>^2+7dwvc_@qY1CDUStur5KS&?(ee#X6+U*9_d)wiA_R?=44q1u`_!xP zwn2x>q3NJGVrxt3Ntuh~B^uIkp!#1? zhc-7L_LTXP-d2Kc5gK3~5L1fGGOfrClOQZGCCidximV>y!xU8?Hl;9if z(=L7kh;-W8l9)w=RW4SUz6|EMJhH!7E|9+wtXqn9;`_oQQZcLJz6|4F1}At7;-3Js z%eMul%NCD!LHJ&CG`IVceHc?&Sx)b|*%I{j9vIE{eiGg=&Oku2e)9$4(@ccrpp*nS zvXh5nTah$iU55Zn;Kw~rY#E07(|8LZ6{b^C+yZpUED!uwN!t0_kM^fp%Dn`+Xo}(54$E$bkS@XIqUUlP&r>ChhLj`3m&(d zNIbRQj~|Md9)Ua7+(U^!CYc;NPxH!;jvjsA_909lnJpFu(daNJ63v!=u0CB|v7-zV zRdmKmX14Y{S97TPnxCX9$=Q3zXETfj?(gPwFeU2sa!;;U0>(MD_62$z*83MFUpyNJ zxR|>4R_Va0U!9)q=e*{i&R;Q?zMG?Mcj?_a_UbWKV zF5w3aFBS8M?;;M`%|QAdgC-VesWqk;M-?~H`sOXdAf|38i+-MM8?zLMa>&js#WA`M zMxQ7$mh5l@aj=3Qg*T*@*(^WU%r=^h8~obmFjXKg42pEjZnX0a14s+{ZtK5nE`{&D z`@_j^i9j?cC~+4M#T)OkOkG?Rq9%=zUB4IEwgBenPpT+n=;@;d)|>PY%{Q92IDT8? z<|)Evv!ym3Qf66n7PXFZWhS53c_SK<5UFz9BvH9RN_umIHDAf9phA;KZak?{VVTeL)XQ&sYG9Me^kMbjyNdDw zn+08uq<+K*v6sgoy5DbU_sQ7Dq)!u@vWdE1Uy@F-$qXu4<%^pF|$*21pkB8VwGU6NEz_4x874*u@WV7;&~9f%B%y< ze5NXU|MlAryDveAdvAhZ0k7vleJl(uE$QcYrrV#x1BSVufeR=)<&}4Z&I5Vy#l{1^ z>Q3y5+kS7bSuG8BoJT`pt5ofYl#8+GuCakER$pvso=w9Sc@5J=Fh5(UX>{dT4?i~8 zf3NZ!5>saxi*tEyOg@P=4%z9y8NnGLtZ&nB-lNNIbKExXd?vOnn-A-3=ca7IIP4K5rn3`0dD@ z9byX4mtme{y|j#3m=2^demI({2O7M&I>|0h!;$kedSv*dy_RW_o&=8_&h{q`c%7s( z9crbV0#`mZYc*0w9F~Oiw#O-+*Ii~j(^pPMto3MQDl$Q%#{C`59NE*A+62{74WLo( z4sWqCx0Yzm<@=Gq3@AbPTDx^2oXs4GnB(o^MQ3rB`le6SK>P8mDO2k>w_NqCg(XgV zsTj~2`{46F-O532m6Z{i)nw1&aI zi(Y8#LRTpBJyi7?Luk^OUxkstnJtZde!LMUeU3(mdK+lyUdRAFZuz(azcXZ$`cOvS zMjnA5x11z^U2A>mrrze3NRlQgcj`kVHq7mHR1i$>g`!gzW$uUR-;0h2ALIA-=G}#r zfsdi1iN^l*%X zuqkjSVQJyvhAkm!U}Vo!y6#HbN|R?3JymSdF|3f7{Qr=x!4r! z?>={TvYDihEA-3`E4Qp#s8t{|=&KDgc_9d|nX)%A`q8z39F`GtutXE}1oaME1$e*~ z%Sw$g^d&WU0T~{u;aN|8T`^llyKu205jlmRAdXVC14ei6trg>mjH*^Hkt(befEh+Y z+wF!qWu{z%YCH&0V&v>$L054SVY7qRQhg;uZ=hITcjluZKP2zBqNc3cALqCA2X4eu z0y*F1ZHJ(##Ab^WR}VUmd0Xze5*$W{k+F&Oxpv-%dSLZ#94@t{Azo<;w{VY}gynt-sa5y{HQ|59VQ;&(ayWkL=1HgBFlL9S$1l{ZN~@V6 zWR=za2tT$Pz!zd-7oPC>!F96Ul^a#8l@t&bJT5xosn1HOR#4$^xV-wUESbHGkw_!k z#9DhS5rM3!&oK2C;QeXh<#q+v1m#Lt&ux2KHAiC7M1i|G{AjgpRSPfpox{P@z_G&m z{x(Z-`&av9AY269P>Qd4sN0-IeB|20dZ&hSYhQQwT=6;O{mR<239RGXKBbMI)?$Tz zsz;9NIB3fqHR)%xgu6S)>v);f%~8#?arJ7`MWR!9_9X)0K)A}ji}ADd8z#&@XkP+y z)c&|Mi&nB4{Y$nyx%NF?Q^DI}eGwU$JL;vbMr4-bT7 zujo7qXFa?Em$}c^hjmmaA6Xxp%vxDoqDmFz4XeGt%d}eJt<+kU5MEir6m*=dzO!T@ zU+fSNI$p;%Yb>%`M_$Agf39)sk-~jVJ{M7I*}%u$eRII6_^Bsuo9gVCO-Cbs7Kx|) zon;!Usf#xCHA9h3Q`y!yz4~`P9$JE*Afpai)<8eg11b|(%oJt28OAZ`0MZ__vk|e% zvq2UpJ}_Y%8Z^3ug*sCCs04SAXJ7k0&L?gf&kI=Yn777#%hnxhYgywrxrUHX<8M5 zRDcdiWS#H|;1K3ed**Fn#-zy3*yn4fj#l4*VC-@0{i=C3W)~$vo}m(4t_oSQ=j{ub z!qtL+!}HcHxJnem>4la4v({E3?3UrPC0aDk&?{8HPMpEu+_Fcgjb4Ao zRUG*@LJqPc2_H0yO1cYn_wIQ@o^6{Yc{LPUyxWh-pHqrv>jM@|XQH91M@+%%yCNeH zpS+*X-*XnbR_fiQ_>z;u=>&p&zP%lSmyeuMp@OJ=z-FIpX8tRC1rsYHtqRix?9aa5#dD1I3#wN?kaqq$!XTOUtiexlHgd-jGVUYrp}6o|VB z^oHYZ0^5Dc8DBwxKcK~}*=Mp;SUU?FP)@6L7g63-AMr=#4}b$9GkA*XA^}V;zMQR1 zMeIX(K5vuraTRToz8iYS2FDdkhTS-_QhH&b(*@7PJ#-GnvgbFES!fk4D%1-^>UO!-n#&_}Ys#)oJgcr?LMKt`f*VQT#3dJDm8C8;^b-sf z;Ae2zZC{hvrA3=Ono3|mhtPu=sIkfqf19NtvHX_);}3iO3j_6rO3?bs)q3|{tyiiUHPmZw0P3Vfv zI&7VRPXhW>R4GVQ!V56b{VRsmuJlzu5G)9N^DU?~&6kW7HN*2~@UQD+>dIHEltbnE zK3FmN>a_i>tFm5qoior*b%Yf;NHX5do4)ztTYdT*$ zs87~9JlSl&S;O!GyC*6Xwx#OJNDJ0K@U)$|_-pr@`t1`0wLV=OmOF)4<9px9uPB!T zb-nIIv01Dr5P9!1Jf{tNLm7wU<+*drC&^6i19sEn`qEt#(!5VN?aSxF=zRi;Yvg>4 z3zlF7OZB@R$kLO5Eqa2pycVVTw|qy-&S3?C&qyfxsK6iKf0D(3_rL6j`M4Ykjz?H~ zgH;u+6PXu&1%I~i7RKLy68phvE7GmF@WQO&Uf~NN&#s^b`Bhpakr2!B(aZ z-8@5)Z{G*n3BQ72;_P}A4F`sGx2EW9^`0^2WsK;aRDO=7k zX2HA6{*08Ctmu9YW>B@H8z+xnhu=2mAmv#gD2gjrQ$}KgskFSf)3uV7++|GDx0>5+ zrrR>_baY9>IbO@$-+y)?ybRz=1qGReHji$6?TEM1{(*+Gwi6RB1ILTil6jnvlDqdQ zLuW_+J(hd$12`m6VRA=J}`6IeuMsc+Mz>oM{L*Q!N;Y9r&{D!$|k zX4D>e^cmu&E3SSD{XobLhiAky5{yYtW!rimcyF&m-zh-MZq1e~=J}d^b-KDrv$?F{ zRNICYpFpom=Xl_soJsS8e|AZckg!b7!P0~O<*X%k^5;dU)oj_auZN|KZ8IX@9YJAWD1pJQ@xr@y5fn&&xb#DAsqk(eab6rjz@5w1A;?vRdtcd7 ztYJA0;R5?yNSImMQA&<04Dj627e=6i`M^Eh1QUqVWP~o_b^pTr48XSquy$OM@^a^_ zI5UtO)kWuaDZbMOkjvspo-$M~Ul{ly8KPTJ6dPb1Wds7%4Pxy1gL!M@2;tL=;gf3E z@SI{^u&sHVBZZ|7lDe2Z3em>}c-;<)*=ONm-i~sCHM9{Fl3XjeDz9u(BGmBLnQg+j8-{JESZy zc4}>gbzPD9r)yYnIHEff^LNI!LEichV)k=ti} zfwVe`>#sxobX)3IGwhH`va%XzVuI^1bFIAcJL(;tm85{wbL>*N!lY$or-;6jJ0{(4 z-#HBd1$|u@6*|B)3o^QB0b~8UtYHpbU{$XvW2ZMp>Kb`^hBK-;*Htm)TFHBw1sjmh$qj}gN9^%io81OiufEu7RJiHK)ch2y>&Gl z+H!GVc`^S@c7zcoY`Ml<(geW}=TGDV8HDG$N*QiF#Pt>zxu=8YP3TLbJDvr&jtq+8 z(M~T?^t^%1bb{#+HvaVO?OkVp-6u410UK(U;r1>#B4{eTGVO-$s{s1liZiz`DReQ@ z{*3ud`eYV%^wy)eWw7?~kvm8zg&pDU(g6&*h zJPY463Ix81Jc?gM$T299ihdw^$K-bW4tL(IZ8d;MxWKyN53IHbUwd5cQ~mz_oYf%E^C(QeY(mOvG4(7uvoqROgmbkfi=aT zA7EdTn%|L)Ow)MP+)FZs2nQGa70e};^he&=Rk2({60(_4O+7@sC)PVFfwSY4UAGu# z1c`_BsCwyBcYj?sX5C9DTk0*y?xnT)vl6}iW^!gOXR)!Mw)8e+a>5irt!kbI8e1V< z!|^`NfFf>oe0FvfD+hnw=`mk_ zW4p-$e+?yyUDn!IK2@YX31cz$(u5~V{5wP8vm`I=7au!mEtvF#>x*1umxcc% zc;v%SYt$iy>hzZJO_nn2b5$rGfsJx0vQ0M?3@T`^u=3{$f!cV^#WOF zRd8!x+IL1BBaU17(t~>UU6n$$!p5nopF>nhvAD|QQIL4n>-s@$lLzZe_7iH?OkBx3 z3rKt_4I0wKA2X1^cQtK)I@LnBL+6ch_i%8g%;l`olJ(}@VV4NHS>r7DaG7Tfxd-#6wVp$nAOs{Fw3 z4bM42677IMm%A{Q5BnWALR=rbU7qt<{PUWMaF6!MyRNyqLGC7U%p; zAAT605uiqpL$D)c&7&ibSB;<#n`%6(-8WxQAS@z+)gC4a>J|)OJCbyffUGK8a2I_4 zM%D#)V}W3yOy?zHzsM(0LSwTXdiYs_H_u|k&VIEs8x`-XeZH*tW}M&8{?Hw2K~dJF zw;ymslhWZDx*7Tk3f|dHOb=n~+gC5AFlAS^8`jkDz1?PA zB|LE+?s-yIG-?aBW*Bn^TZH33eysoL@)4_&GQlGGg83%*uA2^BFd4F-I4(8Z3nVLTk4U%z=YTqL^+@Bk?{ zj!GDnW)3;QztOg6f7g%v>`VZhpb+!L4@gm#n8eWrZGr-^CUp}9^2C#nv+mFBK8ajx zEqo1s9`m7Nhww^bS?Qbg8#)G5IX6Qok=XBqd@gr(3541ipf(+Aq&ieb4jQG`xtqYt z--u(bQ*e7WHsh{TXs2n;C1X$Ph zB_vjwu<%_WqxiahzJ?jFX#3^Y7zIQGfuK!kk5e%ID+@-BivbrPSS7R%bL*=2>m%}t z!f47D70oTkP+lCvu^8a;EH@9b_N{Ytxe3*o)}4oITKnv;(3v5k1H0B$toSZ10?JGu z&gD8o;rMaVkPk_TcL1*>@qf3k%n~;ljxqf%P^3e^=Xk_Z<`A7U& zdkk=wljlrP?6cF6hwDQSuXby+{BX^ANaV`;A5s%^3^)=T6v1MFZP=ikiGk@@g2D)< z`>W>TT{aXDsL5hE-Qhx@;kpq?42a)Z=f?2dQottb`!A9YwBrOF)JVd#!XA%{6T*ivJYEG>rrHC4ah1_D}81Llc#f1`N8VDCsG zHHbz{nNLW5cUga4SAbZ~YVor_E#Y@GgGmC!XOjt5V*P=f|9&1>4fMuVC%OCk0p`SC zN2Fsi=0g973x5|v17dk;P&{N4K!@GFqEV<(EI%);r+#f~OW&fGYk!on`Jeo7eF=yu zZ7Rv9cZb%^F=H&0E7WLA{hd;>NlvLHrr=O3nkk@lz1ZSBl`K|kXw>4qLl{7HdGSoS z9dIT1U&Cq_B?X=T%-U$-;VRc@N~<|sVqWg}2ZutRM$O2WKVcm+>4ZkBA_NM`2tm}M zR(tNfc6%jH?Ef0zngUs*rM4Nwn>V@EyE+PuR<6waO-@#E=#o1U!~2saEdZd#M1?su zygLm|zHI6*jBj8@`f#Kb6u{&t#3iA4Ze>grD668NpctL|CO+WNmvUIAwR=wDcjUF?3&lqt!pJ?TcIiI!T6>8^anzwNRN@>&? zhG;f(HAd_TXA5#+CwUw%>VJXhoNsR&4^~t`xholndyp7VFeV}7TM2dUn-MpksA`!i zniP0?em4G%e&86c^&q^@)#<`O0XoKXA6DveS}gtRe*x@e>rb-nJTEnf%(oh6()oXf*rRSgcA1qtjDXnvTJY!j4Kv4CG;r>H@{;w?=SCkWMj163ITrQV-A8SHAwj z@L7jmk7*?>kLwc|1r8uzR&>kx3{pmiHG|Vs35~v3L|gM|iwyQ}^||l-OE8-`K^^fG~t_ z$rIts`Is8W=2_mPJFCR&b}<2NPztSTCyiydU7eoL}Yk zEtim}lWWY#jg`T;>%Ak6ROD-{?msKY_f_eS0L~T3E2+yHvpLZ^}hk%ZQ#Y*tzvrbR6)t&+CHp|n3eG!uDOLnXXFAl9=|V-AGX@zZQm zt1xz|3*)M0y;C{M^DWhGRf9%okv%AQi`l%cH{eEy+UrriAyf5H4!LMo`3-4}lKOn9 z!OV+iQ<(F##dYsc|2qsSD$sFTV-Su>rBli zfcG3~y40vF87ANe+G&w^wQFX-hmD^80N<=^5x^dcF1ed*-P#)l-8bE2Ju~$suQc6l zQIy4uilRhL?Xr6v5zjyBP$luXbipz10C<@6(G)Apx;oe#Wa82A#R(zX-&MG?GLIB} ztQS_>l3#94!lOssjzL^#{6?m}m_P3Aq4Q3ffM0PrzCnFbug8Dwi23KXtbTb&KyCqs zN@Gf5HwCNbNWlUb6bZAE9@-KqSI+!J5Kj4+U(5hQ zosp&m!?|4Pn62J7R2V}Z%C2p;&va88+KUUcu3pBl#~_r35`|vVhVgSzDHX%54rNgJ z(5dGcHo|h@QrY|dlr@=oX?;qF^&^JPw|bSsw00+$igm{jgQ(vR_5aH_Ng}&owm!?l z-&g3JV-N0)JhA35$_P`YV&G#IXNDI#;zlc805ZekvWEsE0qSLKgX>vesv#3cy`rFYhCjHYp>!zgM%%ee~|0--sOoB z--J}o!O_Uf#`CH}Up-?}CYsHSS=$mOBb(lHPSACKwoIpx0~3B>{lK$8cjdvsN1@A? zn2G}Z-76~jsK(99xGqlRwEA1%i1BF67qS`_Zy$&W=XNCXrIJ)ByxWk)eFSs7s%ZUO zQeE+HJJQ^SH^7-JsDAC+S=&`?+s5EHOArlAXUppHBXhxIs#d(tYt(c*(yg?k);ydW z?bBCuI)!1hJPy~3A3NTX-d5fg^+nc{D`tHWP0c6~xV$v>d9T(^!e+u8`|Ey>EKk)r zI+$gwZ3DlEk8!#L0sHN1_bWD4?w8}L+752qt+nM~3j`5ZBk zzss`IDr{;ts-M_DiZITJ-}@FhXsLM}G00BXpG-lzmlsXWryutso`~*a0P6?@JVFO` z&h){q#~KQ27>D&@UHFbI$Y!U~WZjo@eN;N6xV&=HLj^`&$r^F?E1VZ)nSRUX03S$% zqASt4kiTT zsarg^07)R;M;pCs_j##^;q#so+Gldu?|i`4X%LGYVKz#8_2HL)&Vf}fpbOF-c|7pw z(`*qA4gXf!))%im&MzkygEq?zqG*r5=iK&gqH8`a77Ro%*}tTayL|duM&~5+x=(Wc z>(8TLLx4~<%p5R{TQ2^H;Rhv*lU9Z*a{lZuXMnvA1dvu27H=sQK;C zvs8r`G3iMt_)Ql9g~_rl5yk&LN7V(lkz-hWfh3WIhE+#E>@cu4tA+4 zRM?^j*ukE0xNap=C-ZQO+Vw|?rg>PnUh^4uVwJ?2SdNB?6dadOc&BzDATL!A5O08y zx9z>yZewrJpQ4{kuu3?<$c6*=W;B7+OZ^UI=GSzS@jgJ9q}~G~4leg$oy}s=mI>7U zqH|0XP1Z;{_ngv8MA5oZ6Xos`48kCHt4YlI`}>o`7p7$;`M~TTVmS7-N>m)=>r-`nWwWj4`QbDbVvg%`x5XSurDrwHVl^6MY{>U2jQhaB{3&A;qL zo6jDP8eIohhqxggJ5je>zliOxl-4iTc^i;&W%>qZxrp<=T$s4-{wS|exa~#hs16tT zwyr44^P0Hwx^Q`OmRfHP%2h9F)zS2J?1_d+B!Z*a!I6K<{8vTMcLe3PNXbswi{VMb z$LXP`p%Un+;c^xJKx8V+`FkD5c#LDI-eH2a2Qi)@zer@Xavi0$Bf;@tI(&xIFGuV2 z0Zv`G)U7RMV+`3=T1V=wH#PORKqo;tE>zT?+$771G_rnI$&WZ`^#Xb=$b*FRZq<;K zbwpVi!8Zq`6!l=YsFe$iQ-pch8qNLbv%=-DtS+eVz`D3Fvta&RgS-RdPQsUy*2RF@ z_KP{&%O4}nHU(aGqh*p!HxFs~iuIZH;}Z~zv)e|?vXQBq7k3Wj!-`1jIcBI@d@WD& zm`oRsl^2&tx`PoEs8ybyF)!OLJ|2N=kl6T`pHGjIM#^x5*Jws(e!RSJDTWg`9j|?1 zH5DjqJ*a%PSqkKZG8#%uN?Lyq^LlxaRIfAib<5FJ!-)>}JYMva-3<1<3t$IFtohiS z4+K2sc_ZnplO^q?d{{?w1YCSxuhP};$LkVHxrSC26_0E1FdtJF`Tq2RS|`x9a(B#WyX*7g~(Uc%wJN^oo-Lw@;Jc=UR0Akou={UcAb z7)`0tJIzLq*ob?h?S^IBIA*T? z|eUg1sYs_PedoX}mgaKcSv}P>yqd zt6#By^yKYd*$$)1ZwvbojC7n7B&|7QLeNH&Mm!&0eqRBXS~XE3g4=koB=7+^TN4YZ z_wei7+5uq_whLPDN!A>H8YyA^Btw43bmSKAmKTUWjuPiVt3Fo@_k@|%VuD#qq1u+a z;<((ZATUjs{cyb%=wNhI&X>0tHnt%TZ8LaZT{w8k7tQ$0r8{L1%-Ys>enizxQsSt7 z$@X+fPz!Vk!6xwH?s{1BY~C(S%8H|M)3v%75>$ekC!^7@00tpaKHM;NC$m|kuHEV` z2_4MT7G51Wl%gq=e_Od+X8i(W^F(*utu>KOt2=HMOF9u#mtV7e^t`GE^UFRyx{L=x z_y>zMzgG>>^~oyHuGJFtdf@P64Ii zeCM@7XdzfP#p)RjF&0#gXSsueYkT^&%w#l~L=tm6X>G`CKi74q{rqf&fW1PN zQl-Q^Q}U^PeDAa^hBSO9tqq(!i=5y;ZpZ89Em?=p-yX(N**pKg1 zPs;;_nE|LCe$!L$3E{Z!OmBs#; z{1Q=-yymfildd9(FsVlik4{NFtwbF#;aCmt3W%jYY!GUmq&I^+|4uL}{y z(Fa*{F))9wIiiojxeqOr%YDv8)9-Mk*n2ou2rjZB=o+TFFl}1jI`-lXY+1vuCWxNZ zZsk-%%M{eehQn%Zd?OSR@EI|U#WVLirE(uP6f&7U>2;e=a>&pMayw!6n%lgPo2&}+ zBabfREK^Om+mO{-jn1@&Wr8SW%-XY$q*73kzX@PBna4AZ;$=ovL~ezvKk8#F3x(fF z3&*r!DsQz5ZK;WM8U}-3HimqA4)@~)J(Edi>H)+!O6F!a9MTZRC?bM@!$1a7s=l-` zS*HfpLED$iYfc?q2jBPUA1m>{+B0HI*zI>HlsGky72sv&oR#P=!WbB9M4p{<5PMhr4t|5anh zLr^V9+DnJ~b|3+v+aY>95)uX>^+n$7h4mTb4aX~F%>}pM7RU^LF=6;+Qcz2t@h*`o zQVotM>92gPF_6FPR_T$Aj8op5qle%RHp9jgIdXyS#5t*Ru$!rC^)x=w%>d~Bz#$q3 z=?C628)$wBcPD%Y&%IEpe^ zkV(&s9!gcSSc6}l=T9&CUU}o+YrE|wZPy4!n!Kv@V_pWIwhb=Rx@$)4BzqjS5gB`y zcn!Yl_1xNT&qDn=q~pEdfCWHzK8UPf%ebz0%i_wP#^}t0cWk~Z=!Vg0OSdj5%X8`- zhK|>c0Q$~Nib~s#LGMMcHIFvW2CTy<(wdXMxb~Y#v`j(Ot0RjtxX6qght5u-snT6# zQ4cEZx^y@Fg!rr(kV#?~Peq#25&wHuKpyf>LX6hCU(Z#tLJ|7N=v+?wX72o7al6hl zJYG`JN`PJ-%TXt%>krq=ySvNA*H-~*TFRGw zTk63b52bE>G|61UA7Sa_Lgr**C#w0%{!|a*mjP=T(iDz)GA>0b)h#9lPy0{56?D3sp6c^|&B+=dX2S^yBwPj7ZAeY&^HOC0P+UZtQ zqEZFJ=JF_=Loi`&+#wm^+Euzn;7+5&@m^E31H7Q2i{zLFL==?gX&v!sq7@ycbivT@T$HD{9T0TUh8h zdz=$>ZPdf=lZgqnVR*F9Bzmw6OVhwv+tKjL6d`Zq*$O)I;KS6pG6_U=TFnB#w_Kj0 zt&7zD6ThfW^sH`KFjdkb*4Xx#47UwM+~B!|5@9S*p*ubqTlBvuwEPn|ZzALH*P{;tOF$#b22PlZk+T=?xLG{cgrfGftcTqZu!T z2*N`k(Bw<)0ZU|k_~jdye(qu&1B9KC3Z9q`TU*Cu$hg!(pRtc3!X#Cc4NAUPSXZ?k z#QJ+E(*Gis7~cr=w`B_<<8ixYBC>poykKUh zVG1kqwM9dNrwf$yeYf(g$X-KBtK^&n{=Iz$c`E~dvg<=7*Y*+wn>?f7KvU7Cs_TK-$N@M z+D!R~-SgH6S;3Z1paYx!PGxy{@)Aq;h!H2)L^nm-*}j)y_k-f;BXnySn9IM~0@$EM?qP?!J~FHcso0l%(||h~$@4g&GzFY8Q}tt8 z)lFy%p6XMSRG|?@Kn!WOL|Xb+xc5ib96=hjpYr+>=E3PjyMZ88xVhS*#i@t6aGkS` z_uPR(IHsbW=| zEC8&}aq`kV>U(+dHv@0$65gkl5U#nlk~W+5IuY|PGpN5H{K@f8-mV;;HTZSL7q{$S z)Bq!ie<2f1(=0oFFOGk?aBB)_N=>6B<;HB>*OTX}Gp~f+F1lZBdwo!(QP}tp84HCd z!n1|szcbh{EjnHp)+y$%YQGR?C7yIW07`n!;7|RZ z{VyfDdgYh^l6_@-VW%OkQ+KJb1VDnW_fy};U7UW(QP){1!WF`ncQ7z|m%B1-r{O!} ztm1d_3FiZ`LiVd0ImYfPx?#n^AL0gt#F~KX{0?{EDuh(X25jrgRo|OV(iUq^*RylX z8jXF^QneIWNS52=?Hp+N_d&uhMIRa^5wH!NMzBYNIedS@Y}WYOGzw+9+&HDMzc`!a z5C!KeeZCm^vCZD26EQU*HgX&(biz8TA`2wPh`S^&a^6@`S9E-DVnJKocJTyyjbE?9 zF`WELderl(LJn>dz*I8n)lGY^Z8(63WIh?nQU@@pU2b+(Z2~(BxQB)EF4besYbn7O zA-LO=gZzQ}Ik8^Q^W(R}tngN+wurU%`z@jP^3(15U|b~0fUkm5RYyIQ1_h8*Cswuq zSrpoz9xj&PP`O*dV?-8`q2Y%LMxb8AgcvshpwV-yk*(JL;8p{rx*?_7yT-h*-aPlS zqaKe#AUrzDnuF(6ir{Bv=zR%gpn7-BdTbhEAm&Nat6lt$(qa`}t3v(OyNEMpa4=kV zcKk|7_&*K-`zdW z|6)KlD%*3az2|be2=K_6<%-7RGuLRzZOqH`*p$}%CHSfveb;d$v@U~NzNHhcg7@nL zE{hRe%z(uvwUCGpy$3!Zk~W>Kd+quB(PqFvw%t4cSIJ74eP8T4bGh20(5%{W5Yp_& zGSO292FP}{#mT)oA}OM5+PuMH_uC~5E)fV>K@J)sQ@bLf?@e@z&cXi0fFfPW4V==^ zy#@>pR!bv&K~(BMyW+gg#hz!qm~o%w`)@6V%mh&dWLIn@j%E%rA)b1yW=~j)IhksS zq~wj`v9)-vJvyG7@;`k8!$Rn_#tRABj85i&0vn1B%*=V(_?Mgqsp+9X#V z=|B|P+vn2gfFjCD{QUiw%MD>!mu87);Yqx%gfX8mrntjkEO01ZdLHNGSjl3cFj|FZ;)s@e8PHU zd0z`6rn=yMzCJA~fi<2}R3q3{n9;ZO=dRt?g2%?>_t8Yi>V&Oh9wO8BJzWHe*~(`9 zaOoB}7B-4;zJGW)=1%+zxQ&Si+$8`I9bPdx$hGmx|AOObW8Mg|#(H?JXRh8Pos@hF zr7!a!BKjt1H~#a|Y+KU9_nPdxYn`+WPx+3vAmn*}rspgGrAX|+4C{+8B#g9L(JpTZ zrkrfH3p!#;;Fzn$=?W{jbXwrHTVm!ddA>z@Y#uSjsy1f&4iGAgUp#_A!Jfrn!b~v6 z@aYJZqcbZ1SFyv%@Cf4$M$nm-P0(Q^htm=UaSK=%ll6D}@x^#NR=(Lc^@?E45E)Tk zpuR3lNa)0+0}zy%U@XtQbysPsnRhem4A#6FJxRv8ZSkCA0NitX9w-%L$)E8v_+LF# zKh&;OyAj-_hUdER5qaEeapqEw!LSw`fH*fv%|6G_Ti(rsTN}ylPe9S6St{*#+*h=p zaCmL|v!(djlYaHu$^8j;#K8QPOL!A5{ihoLh63qCX}@wG0?ZmsInQfRP)SqE#7pV9 zMlMblk6B~V8}8&xk8_&lucR&gasn5vY?*9pdW}g^W6kyffc0t0V9 zpr)}gSIl9mKU4__eI3EfAxXG*Y=7n%9oxc$av;2*BDV3+pZ%}#`rV3q5pF0PROBz@ zP@Cd(Zy`H1)a$eYU#oBN_3S_HHlDPjvcgf@k8$iuy@7`CgBTHbH&jO|(O>8Bw7`3F zT}yDk;!d#qWmiWs(Q+6bLj)!)53A!NM2s+Dtiu?G0cM)BiSg;{tmWv<*v-}0&J}uS zM&`)@@Sq-O(bV>GSiWi8RFa{xNCe*}Si|n?>mP*W?K>u-t-*~-_Lo!w-gmGR$9oM1 zYK;Gd;DI$H`1?sW4jV)a2LDc0`p0v&0r-M}Iflc){6FXApY$p)?7i0k=0`bg4C((B ztN&YK2tJYDY{0q4Fub23~mjaWp;L1K?{IiwfKO_17hw;~B{+^TnuV#aA z!gqL%C~QYkJQnS_&|AvYoR?F0Q4R2W8O0L$ot&hlR*UAmV;7cbKe#hdj~f$qxB%Q*=~;ti*(D@_p4S(84QDv~?0@<2+QZT={dG|C>E9;RUv> z-pX50Oybthk_C3^Cvf^V0rPgFSAhSCvP^`e1QHkO|JXMF#c#%*N`=hj{V}y{b5hpt z*G_D|-4OB9eeAF$kpk7y>MpnZahJirP0=@zm_MGH^lg?I+KdKJoBW+!MnHKu- zOjy|J-1lIR@?Up=EP-!DV8P>in34FjV^ef|=)>_ls^t$R^zlM|&S}yz__tQizaLC} z`0FueO>^e>5jOR~KVU7=p;6)l3g7AdZ+RDfRDh#}{3x{qe|Q8LGj1lBU^$WSRydI5 zTashVzpa}I)#s49o$s^Ddzs;pn3l}e{E`|q35hTgCFR)^ zy3$1>+5Oc*-FjSzyBYnMaaqY)<9d9uKbBay3nf&^xj8E|;5s!v$)u+yE|-{sjwUxG zF$V1)m&`aSLn1FuF*%S>k@tsKhy(^|Un}6Ylvz^%@12I;)6C*n;zs=I0~AUVRrOQ9 zrPbTJy0%6Px}TS(p-sEk{GA}`=njcIU*&KaN%g&}>u`0-ywp9_Lf?!F_Fp@~H|T9e z`}dg{rTs-vR$CxdT$dj%+6<00ON7AR6m2FD0Ug(GGo#PbBX*6r*_`VqctmPXREAr0 z{&)!)iqCooKF{M&X&0`7hQ?GLv&)Bn7`~$sq>D`7C1YmV`O`{0<UD|J(1iFoUl6 z43UUf7^pFQcTWAcE$(|F@@9P0#jDT3(fKXfY?Gw)CFdXeBaZA%^>xIE78N^ZJ&Qe59bD+{%T%p0q{!$ET5y`1B&2eT>}Q zKS2f`HNhG?EPw1466ucJ%anSH?WQo4|8fKTKLHyYICJJMWhVzj6SH&`Jmux~$-0zq zkNH5^umC1SDfy@T*$*umG{w7Jac-O|nY{*Uf7mrG^pwJMeoIS$iaD)i!(SJw{9&Rv z#BVHExMhDfHkGtk(A|m1m*&h(1pGvvmN14UNykHGRY%K>tW z_4mirF!_RaQ!zE2&8`By``_jfe1Nt#{-F7`kX7 z79rsdf1*^Ju)h3+%7V(uct7Z=Vg4~kj)IUbnSBmUsz_+F8WllAQ3+C4Y@8zLLi(kX z3oid+@YKLVc=OXlc7y)_h8FejjN?6wKSzN78CWZam`0H$jXYy{gFF`_Dj8r~CM)Rq ztgtFzQO`*u0`$Kw?5pdkWkUS@4W_gZ>`H+IfIlq#Kd!U@rQ?zrlhPEY+1eGuqlkr# zFmi`lM~;=0Fh3qj0dIQ8FV3w|!+uUxLP8m=2t%&S#G~wCq)`@4 zl@?wyI)-$8k#g~fKx~yr&h$S+ki77>lTZj6(tWX>~Hy}elY3RW0h=1amg5^)+6(1@&6 z@i)>4)hISPMw0AXlcR2(anRpC_o`jd%AiaT@`(G!NS%M_AE%%}ljD)4^ll1WEF4IB zDJM1+H5aD!Stv!LMfqAPcIMDcOZ79NRw#b|ecJ~fzH#ydPlX5{%(1B&vO^A*X;r3Z z3ywNf@uFy5Yno8jNnczTM1hS&E=V*2EH*2#E6|ki zi_nGW0@&NtXtsb#dPD3v<}qQ)^@(u#9u)SizC1?5D;iXXq*|E_B8KVP6 z?cRb23(eGq+stQIh*O&254wB|i?EVh38}Y*JQa9pG+;kcX(gCbpTxA8+KW&g>9;Qj zsHi=l%OZ(Az@V4R5YwiYZmS9)8KJZWTvXOVnmW0KDHSd3DQ;5bf@O;GDcKKNPScNx z&WrD05V*9QmntjnhCq>TLK&gylo6h~&`T7oDY?JuW>+lPmVCsQUN6utTd!8u6K+Ic z@eGOBNOby4jqaAA43&G1nt*%V{jc-vzv2dxiF3e&LMhAvIFyoQgz#H}TldoOYQ1E+ z?`+Cy&Wy9v7>nN?M*CA`Q@I}z=YXTO>_J39P}{`YwGw%WDEWDxdar=t{itlx#1{e87rR z)0TK8d|DvoNiiU)%r#%=gwiC=o&+iDL<)Q|MIQqyI%8 z!LuOj&Na*YG!@f4z?|>?={~?uLy?Y~6lfEAx7y1?jp4H&%-Ug(2$_J0>_)Hr0RqER zjRj2+|GfN;wH8Ye0$wl)u^98m7IvEueU~6$mQo|3*u}{rA6}=`G1ZXowrYWSiw}x( zdpc-CnFdLT5^;d7t;MX+LIh-5veYhs-a+^ceJ#Ih4GVqYyY$Hy`AsUsL?<`wid>=3 z1jk9twWi&~?|rG{@nM|vB^qV&5qI;GFa4T2{4|RW@T7kTmp)O0Yzx97+%juvyK7|5 z1kUCGQ4ny=**kBu8~{4otSEPX;BJ40|oBpT6 z%idS%9?$vh-?O+MWG{Y1wtqL_bDtEodluG+MD$IYbm-!lF+Va-2jrznD|>~dsF+P( z_tG?(slWyr7uXSX@;LTNwR5q%RQIp0}06}cr&)l#$`^J zL<$4@{A4<7I?K0ojYLbcgP$w#CDAt6-Yc>V&#-Asenf}9p1DHhM0ZroKX>0z&9X$N zEPyE&8JQVfiTEElhI=bP5B#s?=V&sM7qJxuD@yGWZ760mjF#27Na3 zyG#ZCFk@f5cg!jaHP3ZRXeMLv`X4R}9AFcIYZn^XjDD(z;pSrBmWx*}MyR|$9k!jf zcwEl5C#+j(PU~5Vfhs%UEIvQCD|v=)d&#LPfjX|l(S0E2&8Gti=%tF8-(Rp)!(SH$ z^}^97FczKb*(EfRa(aF+^6mC4EZU*goz31GD!jK*IzanE6A)yNzIYG_)}U@J8pC@T zMk!W7d1utYEOnwqjh?&Mm-MuQ7(pL~%A5dl|%><5_=@S-Fa%KVOr1tK%?> zn}WSJE~T@5G5!CnJMe3QvAj9RyiHV)M?mw$TNRjJrYR(vwkH<4Yco! zwHNTfS=EFGRxq05N-!H{=`@5nJ4vzv6&C*hP=pwfBAtCk?x1%?SCu#qLA*@7IgHcPJUD}JXeh!wEI&v`=tDRfR4CIgcM!~L+#-h)D^f_*Z_sYTo#oU#sI6tJF)-Fz8qrx-K0yHpTW@syJ!@SrBxO2P;g64)PUA$yuc< z{8^G}!+_GYW||d!RbFi^3Kesjp<5(WMVlUKz4`}+)aDftXd!`C^qCkQn1( ztg3gO!%L|h#3MU7_x(u()ABalXxF!i)$-%Aa(zJ!3)Dv@9=zYY<9W4*R`VQx=bZe7 z#2bo4qr0G#vbAD~v97-tE*uRZUGxvV4ZbMtnUz$) z3XEnh`}NvMQ<}8Oz#JRi%0INlq~O1OHBBbAP@!^aRNm9pSDEbFJlk?;mi2pPE7=9|`jZ4#E z{(RZm#LWSvKVLy;25D}a<+zgf33$CcvH8QOqa$bPhl$PL@F@lQwvmGE&!&}zZz556 zYve{oq~hfB$ssA~9I2|s0o|K@>3t1&KK%4Cz-x>+z%#JN{1Y-jg5<-b_w{o1_%3Gq z3kY7hZ_D8aEd(QQ*neFNe1DkBwZ4^h;z_cu$%D34!tSKC+WyN($2oJkf}$lDh%ydG*VcCG1iz2&~DiO67=j=~4S zRUX&Tq>_PK4kj{U<7>}`6EP_EKOfNJk89Kse%&Y|4ZLV;=4-rKlujsFOY@YImUj;V zp1X$J2@+bl_--u`N*4)wn9N37TG($+xcKqiwvc{J-B&AUC@7JedvJjqD#ATN+xsY{ zcYBva6=^3gN{T)w9jemx#|;dP#rC&f(VRa%GumGXt5jl2Cg)rA45G};T2t9IW^j!r+-JAFD+CfJFY-k-*vAwFd>+GFT$e! z9-CF6s>(t0*_Cqg+Vx!AF>3zBaM{A*smv__wAg=zXJf&)Ti@&8RL#N61Oaw%sD!eA zUi<8OL*m1hOQp(Z4Gly*Tu-PbkD9CI9FotmoqIB}U%qfR>~3=Ybrt$)l=dQ`G2H0t zZqWYWmpq4?Uj2I|d!v)BWusXr-53_S7lk2-aNLnk`FN`Q8LfK7M~g2hN2^Y)o%Y{) z0FgB9xQDr2kl>C}?F*7Zscg9Seo zcQ?+7+A?|xPT|)NwSP!1n~pf?G~3Gy=1^k)5L`rgMy!J9!tSaRdNf)pxmVEErpdCo z8(3L~f<;Pt8*c)Dz0dNv6CE-3Sc^lqKVjoz*zGOozSp?fP7-gy_Fj2-5 zY@ESq@uEOMM-?BwyS&?r4WAVv8&69;c(a7l4w9y%lQmZa`-&wrHl{yiKYSBO>Am+e zC{2w9m&;#7X(r8Sj;wXBW7651)&Zs>=8ZS!!R5nU`ObrW%PK?HR7v>_4XoCR63qG+ zQlDro)gHf%?(gR3=8mYHN2IYUf3sR9LE^a&?)z%JFkly#np%*^M?T8mm$L4Hx6u){ zQH$wClwfY>^XAYO!9;e@B+F|ff-=5fEU_}aKvGn+V8>H(uI({3EKu^=$|b7hdZ=7_ zr3JtB7cKe??|Q{t9^83(u*RXl#$uIS>E`)DQYM2P`FJuFYT;ZL#gTXdHr!`A#deb7UX8S=vLIt<43&&|4 z`c&aMKi+_dqg=ggo#%~RhDC>u%|#7IpZz&XP(d4DU0@^Fyqo$EjF-z z6+Ow-dMOmB)bDOB*GWudvykgAR6!yXL+jPfx(1%kzdG>I-|1?%Xdax-_yTegqlXSFLxtMp|f!St! z;x3ip#27|8(IM(p-nO$AyiG$LJ=b;#Ofg1y3Ab+740?xWRstnUz(<+J=h?1f9(t1G zhJwcxbJLX%G8{OQFBr{I9bQBvXwARoR9s&E=(>HMg}rH9w-)?KG&(8C`%=+hli7LG z9=l|>9Nc;BzkEuj#s&2NVm69N z%)~z|KZ`r*t1W`j%k`p_*R6Xh3zl9MY>#R~ZSNNfiez;4xVt%(p4;I$rPCuniyR3)k|8PDyFkt`O+RqVs0NgO@dUm-JqeP#*Ew!^*xVfB z9OY1>di2VoQ7L-ge)?kMsy{7Tg%EybTZ04(4y(fyQLE=n57Fv^HG`_tSGXN`OTy?o z8a!SiP(IPiEr8X*DY29WzTzdrIc+q1&$FW5?p%YaWDCy)q#6!8$)!2rZY-G~2UbLe zN4r^i$nw}Urg<7{f>RV6`&W^0E1{u^c%NaDgWX6P_~CYuX9x$h8yyAuirE8w1DH1S z@rm`yd7rljI#>I?e!c#rJJorI4$;2JX?qGX^Pv;2vTUW*qJss6J8k$rTW_~(4kHO1 z_ryXe6nz~~s-56}tkBPf_j$avW>eJJUHuk}Vs=!UGM;*vPHz^3GBo5w?_(y9MfeN& zxyE)e!>^O#PLGqMKu&++6IS06c;vl3!g z-~3`*(!^joe^N#!gFDxXX}CtUM`U%$9#3@=eQR+QiPz`=u#bq(DF`!WkG^puCZmJ& zDQ2t1aOv$9QHSgnSo%AkUqm^C35%a>7;%?;OVRdcDvH2lon7=V5J6wtGhFJoAh$r- zzC#u$^E`jKGLJ72I5u@~h}h~5>!R&QDxCs7Cd@!Q)T15l_`_L{GM* z?kcWRCco5U$<>GPg0rac<lJi9`ec4R#j~x9^8Uaogyo*l1A@zKb)xLI-haF6T~z!J}x$J^yhT)V6gv3deg+< z8*4y@!*Kk4*m3N3&80GPJ(IHb<3hVh^N5@sC6?55@Y>S8Yh)+j{0)RnUhO?6 zq>tY1y45Z&fHeW0{=R@$^}Xjg32~uJ}s& z+Yhyp4;W2Zm4yCxOcHPv71^B|?=gfLQ~>hz@N{5pYFI~|X9Gk64xM3?7%2Dp6kmGi z*5~H>1E^Ns6_A)S|Ds+@keLvY$0mqVZkiEq!R%tS-T_p#4D^q3WRlZ)eL3v=f(QE% z8SPtggUa_$H&H@1-Ih3PFTL`<-?bp zLmWdTeko$>IV|Q~bh{0GKf~+sh^}b-j$d`}_Pj=TnR&DZPzT)R{Y$`5c z$6-F%z>iXmD@BTN`sjgm6{d@n=!~$vJsjy=#$ArnWNR+_989&?^KU9K+N$V3SIu+%#&X2Qa zBas4J?gRsBNtbF6)%HlhLKOkilwUcZPBcSmk#&P2u&l}uT=|o6^KK!ioUlztUV^bQ(!>DaNFQkDo5QSE_slfNA8>OA}r$nh0Ejx46PTSVYK_$c1IZD z|8{84k^oGF=%7>au(dF0xLp}S_dW@%CXe)SJb$97=0^+&l{a4nRF1gXus=fIE%tcc zZfepE&r)I5Agx-IB)i}2r^T=cmkU3eS?gTgZbURe`gHiXW7FBBcOK&$x7O&Ca&@99 zGJc5&4Xe@7%D}K?v(aKv@lA#dTaTV}JN?vQJ`5YO10uMuYBW}h@`HJ>Fu6OLMv5e; zr7&;xIA6iu%~`n7v-&AxUGda>I!SkUI>gT5%=*CCS^C-|`F7WJ@Jy8NeAEHr$wrX+WU)EggfFRxPRR2o2h=p5)jD>T z>XY+|O?m5?t}z?+>e=dXoBf=3?mBEpJHXmw=*soe{gQFI>xWuoG565qmc&y0FKk zb^O}%!{J7bS(^;J;}RYu?1srKum`qfwy&FVEp^$p)tHh1Kj1tjqSM%ez09Vsa3tLX z7U&-w%`7PQG!%~MnC&mHqZAqJizHkqeYnmvC+T7v)B$MctWa2}w+P4HAmC}32T)^K z>ZNW+(csRc7S9QGCPHnYLJGq^RYUko;aabRa02VcN{+8mzDi@}B0$2LCl3Yei?|4R z3umku*luFbJE7z>6p0aUhAgszY=I81O6c5nUV-n$P8xRg9i++pUVKAP2rTdA>j78; znz3)XP`hS9llv4EL;OBP2V_9~m`J^!Fi!%lZTQ9n7zF$sZyG8)Xlnwva9tyAy?^OUh3V8`s{;%Acy2UnKKd8==#>(cVp)D;-IDcaq}5^n z#B}8W4(~g@>&?JG!WOHus9;B$ktZ=rVon+Ak@2SO>-@YPtEusdzVpv*pi(5WBrL$FXC?a%-YcV6cnN*zv_)5*u61MW50 zEA0x6Kp2FFcOlJ4hmQ8R)T)oGhhE|&KmiiLrLiO^HB*?c_yN}63)?k(5fwlz;J=5& zEAm@r$$*S_gJL#y#bJyb<-Uep0m)Q?Dt}rBZb^4UolW1>Z_csj2y~mlEl8p{w97&X zx8*HZ>78$_mQ`yoM9JRgCqklbE2Tg$8`$}^`V z=#uH-_#0ZdN1i5)LwW5bxUQ|7pWgI@ z2_%y#as@a^5}oq`lw5oW@)Yxh*W;GyZ71lf&EPQZ;zr;@&kUgC5f%6K?6w>^t)_!! zd&_8W^Tj+n5wSTX$i|ZmVD0E$4)`LJXCSX>*sOL0QJ;TJ3K^$P1y&bEtkVG^&U}Lc zadcc?cCRtyKU0Q0BrVoDDURH}@8M7z%QKmivMVXqT*^(6eFx1Dd6l8+ZBby^W&hr$ znn7g5j75HzB$^JJQf4caz9JZjO>IGcsaUfD5{vq_#0bZOqqD28Orsb*R?9ZjS-DhJ zbnj{fLZf|m)_X#(HqXM*R=mFAEJ%Fkc;1W3h?G*)=_aLTla8q_uw9a1a}P(J|9xw*deKm;yW~8ls?OeLA4>O;LVerA(XyijSt;Q`v>THMdsEmw0@z@T z7U%Cu@Vb<)ZRgdMhwv6UeoFP`)CBGh)k&{@OxEs8db8^D)5EDzb#c>bz36C!^X)o$ zIOuOo%Apg+HyrC-Rm6erI)upy;=6YyXm8#1n<8Z<&+i<1 zFQ(*C>anUF&nzi;{ppRUZXPI9^c`uO3*4kqgSF>%^ZHRJI#^M}eKO1kOB5fU!iLm& zrsWW?#62-6F-N^1#GhZ)u%`VzAC6T`l;p#!=u$7Ys0gE1Z+CiY+?LOpKo56T8B#V= zwS=?R!O>(tL6Q({PmKDQb(U{0ZgbYi4^2r>7cRadm!O;P9mnccKr`b>B~x^H9#RDQ zO2MkV$Rp<@Yc>kfYcaY{Td#-r-6n~#7Aji1BRQHsR6LN}4oE(b8B|?ETIlc63CHgS zUfqIr?5yr(fq?+#K5o}_#R5*r{dN7*cl;1ak;5FQtDg#Yi^MiyA2X_Hm<>cy&-BEb zd5$o2F@0T`VOyis$&x<(D_~8f4Vx&~E-x=D%i9X#JyK`X_$0~*5bzWXz#>79V2>pi z^=Q;_zuvIkEUQX{8YT1+Mwm6ozg;e)zdsM>E4 zI!f>DOQL(QR=hA(sf<0waABC5O#}(Am!E!WMvcWX=wGW#5EY8-cwU4l1j#*zzKL4D z5QyW4GlN0)y7Rg@5HgiGxQ#&y+_*NxxZ7(+s`IT% z=`(kK9(Jblp|{CQnit1Zp!7D5=`j4{zp9pG(K6zIE9TdFCeTIvu7TNY3N4S09yQ8_ z{^T2?GE(%JgH1)*`I=cN1rio1bw!cnf=oA(&2y2@RPdQ14r=)Fs(H8i*-1|lrWPSnINZg{g7Qht}SK)W=oiTzH7y9pD1zWlD-vWO6Yb= zV?pQZ%aAQ}1E_3^H@OcMyy>-mAdSy;agZOU);YD|wX1~xCN;Csia+IL#*387Ce zl#;@_&{~^$5g66CI45z&{swH`Kd3PYCZ)UQi$%%vFCmUDQ-o^{nU5H6YrzmukNG{1 zU`&slmqSzxn$?So2JCKZsw-YvF||H5i+wPc2!_{kz=F}`t9ms;UvYl7JxT8=!R7SM zCIwg?!wetaoJYpT*X7H@*Y(%Ywf?P`ZPY)GKi%HSO^tS#Oz!hxiLg3(ZKNktoq#-* z?=X?wK3Y}S_qgW7T0hX=+O&6)g}*Ugb#bz*e^~OGPLw|ms`IrYAbdm4tnbmbczBz7 z(6Z{u>E_A^L}>-pT`DX7f{2u4p8zx;+$2@wyQHPl(R}e!O3{oC5XlJkRL_Bm? zv98!Y7zQD4+Qd_r69zGOZ%2Nr!o&-+f_%-&bbCzXenN?1-NNQ~cSpkq}vrD#PI9ECQDc z9_5m!H}+x=5|THPnmf*j<#)7M;nl}C*DbS&ngI=?Mz11YeWYx8sFEQmmPwi_Q9?0> z(W@YO7KlGwX^(isQ{z@+++3qoZjpnL{S**FN|yG`XYCd@1&E4K~pch8GBv+bM2m@!d2_ z5O^dxbeZyOr4fYKFC9CXH)_6HmTxxfLjHMQ_{P!Q*J5B&g_fM$q`B z_%UYEj3sPQm)CFGyz27!a$!Yo)Oz-$!zW`0x}@EA>H?bNI)ZgR#bNdj?omH6p;MN= zT9S4afx1z^zG}Iy|a9zbskK6uiT1V||j4G2VGBxiXI?sXU zvdINu@HlOFVuy3|LI-Q9vo3{3pVvE)s#$YR0 zG&iuRJnZ3oG_Yq<^v?KnM40~e-ow?e3Y@j6@f3ocjTg>i;PFzGRjZ_9udlZ4+UjZ# z4;MmN?u~buuQddtdY?vP*;9S8MnYM~(#8i_{)l>*TBis?pq=+;Nm()2Qn{7xRXE0H>Ob@{dCj*-d15KOl~dKvYwc{6#}Sff zG%hT%k;_7n(1~sDtH~$uX-Z?5X2TlsX4n*^n5HI@Pf@-4cr$#a=?~8AQtza&c8u{^pHZ5 zs?@q@yY>zM2${(IVL|k1N=wp6)H}qO5s$+45V~;OY?#lcukJ@xo>nNg_3Y`Nd^Uj0 zQ2LOuOfWiqsP7PP#ro|0FNhZS8bO#65s1sV=XxlzLViqvB1g%!Hb4WoMIGd3;=$Ai zy|+*Bk$8Zy(R;!~faI-j0m9k;NP)oqE#&bjko2!VjtQWU2~;fbFJ#s2xTflJ36FZv z+KaUMjcVwl8|lX9QwvP4|3R()yLbM`QarV=e+3S9VBuLaMOmz-9K1C&qRZ}+=sj*) zhKfS!rWD^BuVPde84}jZ8T_ZVr8CiQG_-=T{>+@T(@f)cPsYemb_T3yd+LVTK9N1T zy?m|JGE)AuLYDp&gkrS$L;B^!jyi{K?Q=OGb*)_{TL|i*rTskmd{wWN3#o0nyho8^ zb|SSr2n5X1M-iB^$2sp$a(}p}-!zJBV)(p~4Eh+qP2DwFi}XHR=CzXxO7C~K7vx&y zQvj%v02B0SdSO{bDC>S6{Nn&&9G_d4QQll|olYScz(Gx#D4x#hK2T_c+I$}aAjU4- zS%k0cp8!NZ_2D{exj1I-NYp+|_}44Z%-Jaw!j)+PT}CW(!PCPoj}l0o*VPgIw?27= z6#4tpnUzfTb6%0L86N{vR<>3O5+_>;2QTQM-R*5aHA1Kl3!apMz8!_#;~Qr7J)n0GJZ`bV)+Ss#gE8Gx+n9Qj;Fp7x�Yo8sx-nkG@=PM^$bW06k2S&r zC^@q(Z<&qLAOe`}`%=iT3fLLg2MX%iXx(yaa@>(SYmey}N%CjV<>*`t;)@1H>*I{i}&MZ*~yT%P^yL)w7 z?~&U{Euo-|zeSoa9+llX+nbi)q^Bj$FQ^c!wbr4ZEjQ4hDc`sYd!F1X*w4K9&0^^l z>rK-;*X1UsLBzR6hs-^F*Og1Ws5X{^M=sb-9Oz*Zlhql>_4e`24?;Z}K}8*x^o+BUDW+m6@J*Y z!l*nyVmd8Y3jI~MK46uZ`XW8-!PL;RH&@uBSFdZ;<+75`OlNM>a-bVA- zc%IWA?^`w{4?Uj7oB!C@b&|hhs`t-j%6ESxq5dYm}D zFWgm=_m{o&%M2P;v@z?hlr?m4nbM5it`g9RIdotj{SW58y5yAPk7TfczV}q!#A9t# zZH33~7|5#e0eprpm;a zbnK(HEk+uP_tpLr4aHi z_kf~^w&l<(k)-ke}K6o-yphV;Q6E+ATo z9?ZHrY@Q)#KP{yRMlQYd!aDrbC~mfAC)RPf)3UK~1c_Qk&?*U_E<40K4600X$+;o` z6O0)8Lc0KFrf3&lv8j+mj%z@zKW}Vid@(`0@b_ztug!P8Xn8TA)1b84FHYu)?nyMF zZFS7r4fFT4?R^$hM9!IH#5tmU;+CANtBXWAS z--OXATCvn-RxICt*Rc8M{|u26+q}v}Ja}<|H$7m+gxuRm6cKxJn;BQ@<%-r@v!s%- zfR}l$tlAFc#KG22_jvd$j2|jdX#nOtCuh}5A~~LhCD*=|2~8>9FfL6t!-Ox4!Qv-k z?MCoH-%#Ssh{geh`{Gn5yLdHW5y{eOvmyPLL^WhTtB28BHOhR4GD15>Q&3cM)j|SP z`(malH#l)DAIWB6IJ)W3O`wPKjC^H=Uv45b0Y<|5#=!ST$J0*jj*GFL!DELkv)XOe zRtc#t<0?NWFFCg17YjzSfDp}-_g+~v%c_?BNT=|ysf1o7M-letx9Y0C$P(Cy6I`4_ zk4==`6ZQfQ7ugXnzjM0GcoXxO#nEdznFNYHAfofS_~}VCO%C9{Vc5&(=+G9)KoWlr zr(S-=>38~`nAha<%%<@$w4nA2O5X6QH^8uYKI?Wf;h~)!$N*IN#?@rik9A<|#U$RU zD429YRb$@&9%Pe1?y(I$u$iZVhevllKl38_0=G+ZF%5InnyLFz7pdNfaMAdRdRY5B zDaF-C4*?6k{n+>9m8v1#n_i zo34(}7Q_XGab~@*HaJFGLESqjdGd*g2|r|PVoZA#c@B|tau3T-!m&@@-LZKK-n}NZ z>)c4)0*N_{voy#at2cX#86r|69Z;A2tp5hd!aQ2|3I!V;DODopU>WePPz3)7j4fcb zM|Z)%AzRzRZ&4g87iVxS4n;|$xNZOD38tK{n@ljZ&FC?%g2uA6fdZ>u;wcdp5F$qc zjG?y~-Of(sR?c~mB26(0!Y$6L893`Fxb2ALt^u!+u*j+LH#gIu6#f1C#s+k&dSrtG zBfR}D8If+S?lHyDyL=D=Ft-~*B-^O#4Uhwk{0XJ6Te^-}yeGddS+_YE9lP!p`(z%X z;U@MM+sQj0*C!_50jCX16d=(j38C&U{-!^C9Mv-z>o&|SwhUpG9w`Le=-{CsVaX(; z;b*vZLs)wfkC#@-x#s1*X6!Iu)-+Z@0=^&HGDMx;e2O6}hZ}2*d2!N&z+tm~>n1Ow zA$kVFXE@tWuzboow3MpWmMSl;KAmFU%GKz@(NdFpW}@-bML9-+O84wI-_L#}x)Kv0Wiu*>ZKRc|ZikANVDvVA*u9_Njbk zXQH;o;td~6X?T5GPif8ozyML6BwOSP-U-@dmzXM#})2rn#u6uFS>9)@HCE zxl~aRA-dEw`b?EsbBO}#m4qs1>muT^)fwy~$)E|YTCS4&8R=QxXqTCp1KHA18s!-cCE9RH5U1HlqG#8O$2u)2pc>+__^MbM8qVc|9q(b zn~ox3)HI!e2){%XREeEs*hA-A?eg`5(^kkk2j#CGse!(=U#)70(Z`k(foP@41HX5T zIF-bSsQM0IBVefI!@X-RtcjIS3RM!U=+@`VFCs1P-=zpjLNMJPygCp7#<2USA=Lar5J zhE~F};)Ek5F!#u=x%*h(O2?}=&wn**D5_OY{xVAZ^lUJOLf9+Si4x%2T00EUBN`CB z?zrtL<8`}P^Uzc-9SOfh*bHDW&u?D61_3FewB(YA`TRjJjCs-kmSs33h%zaShfrQ) z41*75yNCXa4QmlTx(c^YMNS?8hm*e*7T>7oh$ixulmscBBfcT}W zw8iK>`A;!vAFX`P`Deymh{*E1VtVZt;x%YBx^k7(lRP$LHGCy+`F~@2@``*W5=EH7 zp?lmv)W|c|noVrVd5u;g{4KPQEAGYaoN6m02}h6*LX2Rxtw#-PIOe$J@^1SK%vA@B zC&QkY3mR&3bjQ7zlHM6#=&UX+b()Y?;Bo=bQfLYTwn(3(TT z=A-z1p2;MKa&i7Qiwy{Jrj(o}2_=ok4o+Y_ez&*0R^TJ_{w0YU3!jX9+7^sr-Cv=| zJ8d}auTrnfd^Oc_+ni5J1hD+ZkhGMCi+ynjZ8~Pyj!sKT3S3B{sog6_RIMc7o85sr zh@H1h%9ge3PcLsVWH8=_{IJseW>X`*knUsQzuPk6iS5OoYT3*Kg{EAC{ z(Ei>QD0GnKLuB2-hKraEqU|wbOpMA{=4uEa9|-C&8#RCg&3TjmF!onBFmN;a%`Z!> z2Ya97={0%EQ1}*UoK)TjindI!j*IJgx0=!`a7|)xY%<|^ncto+NFj`i^OYc$UJ~DP zB?@|576w)2c4c?ad=5ha8@o;`qI+_L^*tZyg-1?6PO-FrV`jmH5LN{6tbc;orSD*O z7P(Yd!rgCCXFnLRKaLc)@u()g+vPU8ej%Y7UYFNZQvoPfr|r5_Y=}M580{9=>>c#4 z^X>+NrSWEM;o#}uneOKw{;)4=9b53Qd{-3^HaU`@2tNYEgM0JFe~n6l7-oEt4o6Ez z@G?yi3MD~jf>>`Pu`>6pg7CXfgmI%&7E|X9Uu+aS+a|U=67?!Sns1berkt}=2=E&? zJL8lYEopd1Qm<+A6gT9vrcEat=4HItWOX5;$f0V?5i(zQZwram1&EtlOA;=)k$13G zY;rCb#kAQiqY-LT3VAI72)EWHmX;D(5i7jz)8$d?m%BZJO6xP(ns#!+Q4yXgo@h{{ zQ|fWMF#KUBHRhJ@v!5Rwx0)9|C#GZN^+WO}hDEJSDWm_D`7CDs(x^0@eHa@KwJC>k>E0AT z1E(K2y}Pyau~&jyH`#bQ;o+mdyDgco88m$^G*GsJLv|jqw;#n^_uD#U^O2>vJL8f; z<2F|$=h8p}sL{M5&6>aN!b$*THV8?i4vLZBY7WS4|DyYJ&#B;XN>LZ_dTn5OH_wc* z7;~h&2tn5FvIh=n=|mmA&7$I@DhZ7rD+f0ZWa5cKCOMkc)~!|C;TDabVSVeFlWG*zEYj5okf7;$g*i_i#)v!?ag0 zz;AfnA%t3~?K;@elN?H|nuAD`&ZjU*;T05mWr6f15AFP#Uu zOcg7vyN8YN9govpp*FC9%aojhL9WQJm2^~J1ZBdM#{={VEtx5Tc=@hWgL_vAi~D z?8BqbV@Enh=nv&TCKbZ`nLQpeRd zQv(=mUlDhXvF^LR#sq|HXuoUYQo8#{wqO2W5rSF~K9Epg7xFWCX9-A@NxC7gU=y=$ zxRHTD8EF)P~0Is_BH8-R+O)i^Z! zo$XMQ6X}$zTxNSqQjv zRggiy#ySzFjVym=?pL|O6vv67!zfL!%C4#WdJ=1+zg39DM>&LBY0WDqM7iC7Hdgeb zBftCN#kNh0Cb>O&_bv`0#BAggo%DhhttaJkwcsXw1U4ZC>c}T{5gpi zmUw-w5B!AvRTQuMUAXIHzM-G#;%7o4a8aUV;%%?o6^XGrlI;9$HR0Y1PBeK@qsglx zLsI&y-IeDH`J~|k0n48hMZIP3Z#j)utAvIlpEZAsz%po~{-UI%ne!;^cv<(Mp-k=b zBT*YdMG`NxsTEtSEvOdOFp$)W*&Xk%i;xjSX9LYj9LU@cxP@0ygOndi?Nc7ddBFzE z>|+m@A%6d0vOX~?h@JGA+=V>XRpz9b0cffqLzRo=y!h%ub9*D1HN#?B)^>RLs|Jg^ z-kO#VI!q8Ld>D(yhX6&w5*3X+%!73}?@t0gY63A`ulP0079cj?v=^=8bTm3bqxBiu ziDzv{L1L|^lUz7_1+5lE)1I%EUNz_np5CpM^E~pmcFjLi9kpIkps+nX6e+K9Kvz9m z8zl2nsPdpz)M_^N4-e3Lhf?t?$R$KqddgspxIWVgDsCisi>H&}E=|$1xr0|F+PL?C zuh{truXEQ|`%T|Y_x>8`q_)o0%;25GSlMR4PjR}+Q8f^Da6A~7(fklS`{9A4axm9 zS-^0r|51=Mpc|fD|FvFq!TU9>VWA0fNgioTbQZDf4{y(vUqt0aSR%OPzvrJdzRF%x z-J1rKR`h6F*ESLhlVyg z?p~TWCuWky|T0%m@1g+ z0cP#`!atOV&%EbQjm+#{klP=C$1t)M<>$qND&2d>^m2HJJ5cN*utJ3^5{J8bM;gw8 zM_o%6P>}iDVrj6Y_{Bb2xf+SDg7mqntgkt;cTZBM|g5j^RN z7X3qnB};pyV@0N0s-DUJk=s#tqa%+$eNQ`$TTg&L3fq{XGk*#cA+}J-O)|eJmtuji z%U4({hz)$&nWBkG^QC){TJcsjv(VkRNNvY=`~jg@h1SYVdO{)iyS1m%z}s8+Z8HiK zS$-y|z%<4AudzCPH@Ws9c~7n&>pkNJ9k~!^zpK20^*trgwuC}j^&T zp@E<%g9wWo!yhs|x%o-efMQa_HsW{3*d&}&Xo1oWj#0k`udb#J`Da=UDNY5+mk(kL z8Wh`w-x*2FG=tUrBaRS`Ia%z~N1w~I7_g-3)V3!UNV}dta>u*PUGJQ(075)-N`*;& z(<)`VVl^c*MQx|{Y4En;8@@y!>vN`NKKTh}LA%@5`Lp$ARD6Z=rLx!x1E<{~K%YmG zb%5$T+fjgIxXC0}u!ekvuuX?JDdt2rS^?wjL!eD+gvT^vMxK6{^o-eNS$}BFJ-+GG z#Hrea_f({emw%qV1`F{#!31@^rPzF;#64~^35SOF&t#X1EB;n40E4Sxg<+=BAXm2H z0e5xQyHtPJ`}>9s;AlpG9@q2HZ|KAH*y_}2V1+t`ukU-ZKfu95>e@~-tVP?(v$8*N zlf-KTdF;uohAZYh1vNT^@As`Qn+ZyUMMW(rIjo>DkAHQ`l#;rcY zs6zyZKJA<;MJq<+7k-=;lIp1_pmN^F#D{*mRf~;~F49TFFFe`8k4XBSx-Z?5y*94g zlIP(2N?Cb?#VEr1rDp@~-Z$TqB&l`Kv5G=tn;60yWEJEvFWEtoW*nRZ;e_NDA%i*e zNUZN(B1iJ!Q*|&td@Qv$JHK2mDXYV^E<8IY{D_p-Y1~nijdPB^|E6WcgYhM13~J2@ zwWi3M5Dxr{iD_7zP9k{71c#1WXlGpEnr;JXHuf7F>^4TWv}&2VvTPg*}a$y(A5M1r4LW02Fk^9B2*qgIjUjp+<% z3%(ERe7T?@!pQ(gYo+=|j)o<@deD;2zbS&GqDJ17tA&-<=uBKT{}8swV=aLY#|`+& z#uS6d-W2MfQqNRCnQ@9F{QkajrW&Fl;n}c1eOoHV zf*B>2TxMY*Ams1IpAZ!Q-v|fOO#WF?jTL`B#gS3CXRGcsE;-PZF%p4ZawpHk=)CwS575KQ`YxuiGtrj;vIg{H0Rl903CF zw3nJBC==nLGI);=F3NR$`(4DjPWhi?#C^XjECEB zL1Rx{K9`D7fU~XS?TAISL>9+ivqoOIcD^e;GOyQ^_l9g$!32KA$2b(JQ`G7crwY0> zVE)LduJaaI85xifVi|*-%~?xoA1E{98UM%(Z3`$i-YlE>Xi1C=c2yrBD~>ktyV?1e zMQfR9Cc&?Y^b;HQTk?lB9dQhYiIGA`8miTrERSmN>bqf^ju1vjdlzc{2m+%Dgu>{C zps>&`0WL5N#Zy}xl2BYrNWM7O2KWpcF{+$AsQbFOaVdro7uw%*xU&UMRUicxZ4wA0 zX!ZuSglCiGNpDZl@DoCdHz-A}Tbm!=jrIe1zp^*|-=1EI&R@%VTvZbaJ4x!W5SQ%0 zTQM+IAiP(T3nvLD7S(r@a>+lo8s-i``O3OIK>xo)6B$wmxon0v&`XmQog)7#wPa3Wi za{Xl`v2I>uuO+A>)kwYvwMkHn6}g{Pmyn&T$@EyTLH3~w-Zx7reVh#Bb0*2Zm27g+ zRr}o4i8ixVzQwFM+FBqa)HJ9Cw}$3jnTnlUYlAf&^v9!|1kX?cp|#nP`kOVe7!L?o z%oMu)-XMA0A*}_UKGbE-vy3*M@l_p>jt=q}KIq;o*79I%eX7x6Y#$}ayEne24JK<7 zoPUR0#0FWpDTp9Y_OnXKL3wv`3Zp8)AzbC1A=p0aWOS&((OO3JDFg}IXm^V#JWm^D z`)L@hvqm)w{3T4&Ay$jq@y&64@fd$1U%IV1#M3W$m()h@}J z0W<9h-qCdx-@GU15HSx3~w{#MOrjeHxf?UD* zF`V^%tS@RJ4rTf>kftYy3iEm=_%eWAN>o+l;;~oMIWT;g$vGjXn(UwF0P+xj5!pRy zbt&$<@^8;etdfFqbkL@(_AK;`9o}Xy{V95sW*9=8J3XZ|$0x;j_ZEQxSwL%%%Sty9 zCpnfbPy5QfTm>~bp9BW!j-8gvD?UP+#{>=0Y2?{gpn8jUh}uwq|MRIc{H4OjcCu4P zwVI$p-<<<{Q zeG`*7hyc~%eIw^-W%De$sz-4Tujb;}T&7R+>Tf2e+H{go6_LduuIKVsq{bD{a;u*+ z3FN-BMUV{I#v(HaYAp77mD{J6?&AQndY>Cb@R7=3Z`1!3Q*cjKx};+f!2uwwbEw65F&q z-_t5y58b1=s?&HN2EH(H8O08LpGcE815(JLajnYo-NH=j$v9;%}=t7mX!y$mZ=% z4e&8pkuT0>`0wUbU^<~;Z%l2eofiwB4i5`k9yrSxKF@U2>D$&h`1la@p}g=hRp)t3 zRa1{$zYm?A+&3Hl(BVnF{G1NwU!Pzn2ukZd5c4Kb#JDK}I!L8dzsQj}vc#~}1Ur9^b zJ;N;Jy?Q`Gvg=^XZ*cVg{_Npp7ifTG;-Mc7!W4R}{*o@*7}DL9l%p9oR5fO9cws59 z#pXQ3^!)_)Us?du*56;JGXL#k{wAjZ{>J(DJ+b~1RrF2yyWH-szO-Rnk*TVwP)%K( zg1KhWJCsOzKOr3_p4#TmihsNKe?C5?GJsGz(^!b~C%=OLwjGf?PFUii9v zq--ui!`(rR$rP8fLU=6~_g@AD3{y}T04_?kLNxTOdYDtV|9e*f*NJ@sk;oeQA0P7j zb9jDd>NVbKx&OUG|5MM5D&UF=h!_eNa4G(;1`6`PX!6TM2(tcrSEaLs0TF&Hti2(? z*8kfYNoT79t29$s924?y7UF;O0U+IB0h2x-BzXQGck(~g8vl6RnF7?pA;y=R(1XcO z4IE7WtFtpNfYCsHaO(fB2CTBcXp&2H42b^MoLc=BzSH@T%KE<=B>#@F4r;Kl{a4-D z--JQP?+Ib4lKW2q=f5W>d+>Lj7^paj@L%Qq{%JnHe;?ENJ>GxtZ2wOK5Q>u8ewF$l z+P`Tu|KB-f`EAIN%#;5V5&mbJohslvT;_^4L;k7Q_0MOahTyjqN+s?7Q$FmU4V<-q zuUmzs-BSJh|DVeurbz{eS+KTvLgQDz^}dg}&ysI^**3~{<5{+RT<+u>Lva(An5b@U z*tiv1kKEwlaTz@u{;QoZ-R}K+I2?}@cry4;Sd@&{gve7i<1tUW5~2N1x3l2Edns9yZF7+MAk_ET@NCiVe)gw`wfDZ_lg{I* zp|8o+!{zcr{C&USy?*9;)D5TUm3O=yd*Yinru8n{^^pWD38lKVDSpfMy?l-65tR2U zcV}CqRv!+2I_Phuxl{jp`Cq`i`S%)r^n!&$!b;RWPbQYFsJTE_^#>?)gE!UmAVBMg zMJJmpUs0N$EXjgvYoJ$gCbfoMKFe0b_#r7Ni4Gqhf9r0CV|{b#^qbiowC(P@nuZiK zojmG60u9oOyFYbmoLcXGBkZ`bV%y;UC>LM0+4eLC?isn8pKYakx;lQsxm!x*%ksHO zcD%oK5OBM)Hg82w0wC8vJpffSz;0giKVkaoA*w+LxcDpwh^yCWiL(^GPUnxQYSh`7 z>Nn+d?cC7foirQyVo5f}?z{H2>s?TKL0H`NC`bEazz;3=(@!@~((FXseW&J~xrJwb59e5$^rI~=mQ@GqIo9dAqmAKIWuG=i zpRjJ~z>f-#4{Zjq$M-$UvY#A@a$#vEve+$jm>&t-Zsl(tWBfoPl|oNPPmg|^`^(p= z=a;qLnKmdNPm$=#pB}y$7T_Oz6@8i; zH94)Ubn4?3aJ!#$P~R-9h@@!{_U*< zF##t)p3ka<`=bIOFW!>N3&*Sl1LF($@7h~ckKBwu->uS5bi@7bQ*{jiE zb8stMZr!bugtVqr7}aqkn-2HSTYS|)3X}lv%04f;Rff^X836x+f|!EIh|`R z#U7!A*(8)r3PJ1K3{khYw^#di130Lm8>KvK0L?VyzJtq;E+`Z|GIKO)hI&PHwb=Z4 z$pv?G%++D`LGk?)OweZg5_#2bJanH-@oLaCM%Yqve%3&jrtP|?daLI6eiz)Wa6FkG zgQNYVA_W;3aBOhijk`ErHk@g`iU7{4Ok4;e`E=J$qBYSPCIcLceS=a=YpVMZZ+vD!APVQDB6rBU4C@&u` z4u>?bVAt|$y*G;Ml**P(uR?65Pz>pGH1BCjRWW5>$o(XCV{2=m?QtK=2nE-I>#UlTkHK>F_Zyz?y3@Eyk&*lZ(~~lh5Q>2(#8KH&DiN4cBk9ZmeAROqTfru^X<_eK;cZ2-FD4iRQN3h zzN-Q^PmecEXF*R7qML4Qx2X~KaO%vY)O}NFAJ1yE>3qQ=5AaFe*raBokvap~tH*4(bL zz4sk8r~<9)%r#oH%%lrU?TC)P#>4;Ucm0iWpxpP;O7$s5c>km#U5}yUSa`lZl3LY zi`h%qc@GIBWnt1Ni)*_rZqw)(r1yIeeH_RL75ySD`8JA#B|cv+UYpBYrsx*)wf#!= zuc!7PPM=<80mqH7%I?pZO4X<4PY*(LM|OU9LaCfCjjRLgDkFO}V>n%*>CV>PHBZXl z`hHA+>IQq|)77};zDPw9E_D3{X8v5looBxf3nsK`nCG&mIZxo0JOA>c9~At)6L`{M zo>(nt(sqn31q^}6SD$_=Ik?y?IJ@b4At*mri?Hbl^h3bWk6jXv;Qq4Yh4M1@aWpj< zD*Xm1WU>)*zqLNt1Uee}b?g(~Z~VT1teIEtYVrAzL9I>S0T~JmJhoW&32HZmXxVwb zjRJJO$*YM>*qeQ^vc|)N$KSrzV)RI#)yP$*T4RFBMFg@rNYKxDSgKK_Mht!DOP)Ds zGrYH%Uux3vE4B5U^ieB60D1JJc8_Nd`1)qjtF7URH-peT9T$@N;gEAP53K$;ge>Dc zSKE=2LR@0v?_KK=GUqdgdSam4seW7OLVcqSNLMIU|5phl(B>I!*=N7k(8gcx`->{- zLAXzk3*V|fe4)4BDfW-jBjm5JD@Rlef|$=^Ok^voHWZD@v)Xg}47gQ!ZkC(tgE8W3 z3=ADe#)>q{Tb++4w66{q@|nhy>?MRI30{K+`m^jw`D`8Yb1tgS=dH>c4x5lLosWgR zuIvNK*;=nV5Az>5SJP2$J>*X?cFFGB;f`t$7Fcb6jv-W(%>HclaB>+BzBxPT!fHIn zAk89s)8hN!DL}G*lciVx@k?*4t+`gR4b z4xHQ3KqZrJcrgWo%oo9}p4>~&g6q(THbtP7$H_AW+}|rnr5fO3r75GIDLM>m0#)*;HJa+ zdadQkpY`juLUP+Wx^aRrx|3$5KrLt2s#PdN@UwH;ex;f4tmUi~gDjy(pgk}A#f>>d zaulg=@}QtgeBa}loqqoX&GMLrA%gWrWBaX3TYt=Q)a)~rxEkwO88178{*B|-F@ZZ@ z(fr0E3ho~WRn|)_4yJwe$r#X@i=U=3-NpnQR%egtQWLFF6f-l6G_;V#bxlv^7V;PpGMx9sxYEX=C1ss2I^3K;FUcDM3rX-= zj16h9915*y@YPLcOeM-TUF^`3JJ%Ot(DHC$=)SPv++#!Df?d-z{^`t^@!0@V`Kx|rBuypH0q7F5_*G9jJ8e*j97a5;FeDHS8#ZEc$s-xrcg=C7u$MJHX7nc=4GTE z|9&`k%L+5)t7G_RG7)CHwi|9u#)|Men{ofeCbvPS(Fc0{)J!3_i5~d0yH6H*LaF^D zx)PxS!cg=HkAb4btawqmN9uUJEQv{;FtZLl(kcs!9d^Z77HaD8;Zid+jG-)^E{x&k zo2_)0@n{uJJKrr~fn-*FM)`E!L}i-g$ z4)<&b8e;>mmR%iiLTOlq5SJTM{&om}W!|g$XIVB}=vfox^YOd#O3g#IIiGU_xm7Bi zmwfyWY^DQy?!Dd!4$DU@wE18Yhy%fm{kK=f^9nw1x8veyYCdzt%w@?Y>P0?-B}{1_ zr+KHhGGuFYQ=YZNZ!6@2ykl4Bl;~k6L`yq|abE4S&tdjTI|h_w&9Jpi>6h)4gP$A# zeUi~UKA<``SA>3;UP(dd$$HqQag+GnEqG7UoV+IlTSEAa`=>*^p8)TopHJ(bJ6Abv5nBvWnYOUuOyFRt8D+uS>Km_Kmjzt-GOL$Cm zn%%=k#(5ywO; zb%dn6=%rx^7ZbYxr&64YyZuR7JjSA%Y`x_0bn0yML`iMf`WiFrB_9Ylu#^42SGXkq=zcKgf5DT0#c=e^bVnyP(-Eo8bSc+5FkK+ z(3y+nd3@imzge?p&8%57YyM${+}wN5+54P*_Wtb8J}1_^ec?roR4T8Rs_u$`4LjJJ z%d-~AA%pX8;4qRBigc7pmi zmS}&tc}4%6)$nDm=Jrb{uN~=#kCaU0HFtFI$nTy!V5PE)x!HX`r4{z&?xoqUT13tu z1_f`2%~CQ!Vd((ex_(bUvI5z-k4N5&^} z3v}LXYA~F5$od|}6n{`Y(zT?P&l?`5x72t%FcPJ=tr~Jd6v=03u<#h#B?u%2?msU) zE6COQDj-Qts;jU>L)t0Mrj_f5j|EJ`OND2o%k|w|H==s-7m$y>iv~{33(pp+Fhrdz zSvoQ6Zx={+@E_mBtmWG=~u*|w+cgIRJo z#x{vDX8Vlzgkq1z#Yic5=xbs*@_Nxe6mCO^iQJw0(Gea?y`o>_;6xCic@|M5K1R+F zeu31D*kSIg0I@6XT7?EGnzaf&O+(O8BIBtqsd-`lm0a=h1Gkc7l~xB3y~oWbC~-I2 zJ>#Lf)v|tpYyIeQZ|NW>a}QDBZYICRJ*wii(a@~INRQp#vxs`z(xNLB{N|>n4&cU= zsvDwGXWA|_6W~#w7qT5==g}+gH!waZqcUB?x4ZkanfK>{bdhn2;^LNViNi1+AIN+>E*pmg-u&t7`J>jwhx*QVH3GkqsgvzG`J; z@9^ooRl@r77BVU_1w!Jm2cQSD55G!TT&j$QPcT-+k@KOiUrf24b>ji$pnY2a_5Wju=BeyZZ7CZkehYA;O!_B|WKkD09v&q@-s9_v--98f2?`a+Sf4Wbik zkbl9po(DbWoNxB};ZgXrV_sYHaDw>pI(^EOKGWuhwjTmtM_@H-Cm>fEJT-5Y8@Gq)Rkb6 zncn(h@3mCpv)pKe8HaNvK`fLe3Qm2iS;<&mB9aC?PEE+nOmGaTgmkHc@QPC=|cO_bsf z%UdD*bt{B*iYjh*S#U_%Gu7^Gyvc2M;*FPc&;3M zB)HgIre!pEx#up4Ud*CrIl?=rVB`FE7_5x`W-Z@AYPqs^V!bBWHjfW`OlMbAu-&pI>Q9^~%16{+KU`dI@hfu>1X1NQ zb5JN)VFXqSqEi-lEX_gRY%DX}E?O?Ssu;D>P}lJ3guiuvr8nlIx~!@s{K4mm*iFYz znIta;jY2ZM4AMKwiEj0Y_vAxHyKNeJFdS02_mrU0TE?;M4+_1sCynu$OR?qw!;7w z#OPr7&~lXd+mr{%7FXVUbWJT>DLY$!Q#4S>_ELF;Swuf7nBY1Oi&braTjKG33};HJ zo{9t;(IMjg#T~_FHNKv9HMOAqqUzK=7QyUXL=rlf8Yz@;+g7yjffy+` z=YbIVyj&PTB7gVY`OVDt7nWSd=q=7d?1o<5(Y+)Q%`H7P&}r}t>O7jg(8Atq_@vJrBy6av%|?B79kI4lZD` zS)rdH&%fhEYRU#*t@)+}RAeMp>NP=e9o8)4nob!cb{w}oz`vT*Gdp2_%$dx$FSNR( zSXq!iE-PfSF*PKbrM)a}sF{f$7-G#=l8yhyxEY`4tB?xqONSuGLl#*o^5UzXn#mrh zK`U9%moh7){M_zYjC~GSQdNo%n%KA_v`ygG@7&OU!ow|sKKhP2br|8pl{kXF>@VzkFn2)e; z!p&c8g-yj?$nADKA7M?aKaaiu6D4D|Yj>dNLp80ycX>%3Sq&bv(efD<@d}Ffy90PMHSL)7@L{d5 zOu>;;gN+(6-ZMtc!W5hr+DmGZu#^|E1eT7vzP+iY!jm6)^vS9pLSHQ{M?XdqK<6ot z32jHZ+_FJItW?BWkNb%%qQsN)={Z8T77TPtW3Ie|KbM)7g_77 zZU@&A0xqhIC7FeSMFGr?jg6oNk<>Q1kwWYKwk@(nhmh@xs7L?rk+G~AL z2B9N^=qM5QBD*Z!&qimJ$$u}G|4fou_^Fq3n*^1>EL}rxVh$h5-%TJG3=nWPHk;FY zs~yhRk_S1@DHv@k&7tRVH?xG-G^I&^_LGhx74>V#cO5xcpm0h|Md{PA)yu@COd(W9 z*ZG3Pf@-3;SIY|8sYP18F`2jK*M1_=z70h3?34=geLzuyIf~q0b zdmNO-{fCd7{m)~t91=WDs9+x6sqQ5_{M4L0=b9bUceV&`vwM_w0;L`WsFb&W;d*`2>ML-apoRU;*} z#6JhSXfo>w_E9%_Ud&b;9#8zXh=%zwZ%56-Q{`n&p}S2~Wo>fDrQK=px^S0gc=4kX zF*eL*ap1{~8+PgEp|6a`tUe)FD%k^w=uM5gY-QI08A{IG_XJ%)ayCaJw0ZuFmwd~ymW zzER&0B@w=un4;@EwXQZId@fH2|L6o&uGF(#`2MVW711_FQq}>CUhz>m+aQ9qb{I*t zY}3)Y;X-ppo=UZpsE3g~QU^q-*m3F?yPQoa+s;6B=dWLGv7s*o2FHq;TTxcdt=fv@ zHBaHJF-UuNuXB%G+@UMO0y$af%Uj)Z`-;dG>HnO9z>I9w^!uKSAfFR|L0nljOK1FX zfQu((9xjwM5>_;I={&l3P|YxNM~$nhQo7^HpVJq(mwgcL{E*|`hTd~-%LZPu=W!y# zbsA$gtRA_1I=~J;=+e7`+2fMJzz(;wT>tyUj?#W9y1b0$+@AwXcVHgF(_9zi?#G^y z1O?O@ZkfB*bf zwEE-UJw^a)Wa!QLfhGRe-6=*yWKX$9dqRhQz%i%L`Op9{!1BBj78@!=FUZN&;5_p7I=+*F^mgi2iv}O7X=NRB2xExK$F0O}bn>EyL*NOZcg#s6KXr@4fxExl+>PM!Oc$p1Nh% z{<;6(&NlJ^E!q2Ol5*vb?)}qSd^te#|8Ki>%)?9f0_h4UwEW4nKb7{YS5gLqz<}Y> zX@B&u6#n^CWrTk*7hD_~P5a=V@BUR@E7$2jW>KjAo2;nvfiXd})93h0Z~qAK$B#W& zfU#C&%0cxP9ZUsW16J2230=F(f4Ta9WUTBpy?+#0t^Zk}Jfhc_nE7^Dg7p)}L%TPU zF!|}7o)4q&yN4-J0%!m7^eIK4!-+ZCB%6A-3$(XuS=jTZIjUE+A5ueIhQ!5YTfaRy zKcf6(`rq;N&!?$Lyvrw@a|`Nq-xxWbU>ITv2KhD3&I)x{kA(e?5f4c7Qpo92>7_|| zgG(3ENF8H2LZ&TdBE_`jBBgrG(iYd6m`$@0{e$o|Ptl!max@3jQ$Q zL0WePd*Rin)tA$6- zQ=u=3B$wJnqakLA5c~4Rspo`*wXzkwP_2+P!`0={(r4j;*EqPoc2q|B`ANyi$wkYc z9=BCoyEQk}y~nFk0(+mKiGO=6S1?EuA2E`Qt~oxA9`Q+J3j0{R4r-{6VOM$&Tdyb=wARI za1O(t?AXO|o8@jt9w9S3y30>owh=L#68}@9#g3PnnyQwnrr{oDuZP&}Ek44L3+1_Rw26rcve4Bp5G9`bDl8-a z@~s9xs7LyIcZ}4*&Z_D60Q@x<3<#G{WQDCus+{mtuRmGS15)dDNh6Q&f7znv$EQn5 zfQyl3HMasGAz_#skoPxMNpE$!G&l3ESqSHMm8GQ_uN% zD&f;SoyVV>o4qTqJxR}gTJWT$(zlzI?ZkUJ@>7L9lG)HlNQQ)d+_znXgfUFrKc$gz zsdw9I)pltK5`(F=Z^dkWt2N2ch*$9L zD#p59_Ux@REVFzoT^ zO3du*reOxa0q9Th@pfB#@g%K(2=3f=Q>W6k{5(NsC})wucKl(@;N8TRxBx8!kG3cW zm!iD!)XE^@D9Pa>r)_SXI@KB%^m0hhtH9QIC0f%juia*2AnK?J;?%YNjMBryfl!#q zfhG>Nn%(+oEzWgytj+KEh$Z)b?0^}rkdDR@$vx?F@ct@~E;D$~9=-?U z0)<{qLv`E5_IG5z$({3K7;^Osp4ZZwDusMS<(v99uQ+-$H1F@2!Xwnp?~JJiy~ zuBd%-pC3S&X=r9%OQ$c}YvUZQmA>DsAa{S92~mDbt8+Y)2s^+Pr7LddmAPrXiHONM zO5|r;4PjGoR14s$bYG>LjmD<4VCAN za8%={snJehDvBTm5%Z}%3kI;jAhb-gcUkEYm6M&^-i^zo*ctrR&%hr`fKeyCjL@K z;?dk-Q83Sy{S~NzQ(9z^s*YxX_Dv^qML9Q#EU^*8NtOEoMuN{iS8nz_PD7bJp!aEY z^N8g)8(&y*AkO{T($ZE4u1)va+uU3YEHaBCK-iEVxC$4)A0$Brvp+m7)Yqx7pG@US z%{mF{T18gMWynXRdtlA$HxCSb;iKa(Bu@?{JuG%_Q>RGhPfZ!=)O%HPEzCHWWB^Qp zebN9XwTGC!ntJaH=@QJP@{L!G8|^U!7TfX5v3NP0+9ZPtV(fO}+S&4BCSVtmmzJ0`lj);LaD9 zZiBCX7eZ9+5+|nd@FJ~nc5yd_CUvW6w3gTV_+ctIIbc9EzGPLcwjw6%+Zzavh%m*i zt*%9dC#-~Myp`BR};3S_NOCA0lveF%~pz@ zb~vd-YEuoP2X@Xksb^kYi=ME|(y3a%??8qF{EgyiIX>vd2uFX>q)XO#+kBT^xxh=K(N7pg_VBQ)rpfRujTHomZ+uaw zS-%vSmE`pqY+)F_4J|Y8(sgu5W9_fgaT2~T4V(cz7dJ7|&Y~3G0ay&?o1d|yx%I)$ zGan?09XuqDwwxe?yW}~V1+Q#|o}~`uX*kWfW5Drixz-=V1tW$^U**hql%Hr%1=Jf4baezhzoR+0&lOVxF z+P$1L8*p+BSQ6mBX@27KQ1xX}iX3f@*Y7^3msOJ*`5|YafC{;%Tu~*h-M6V$I9#q) zp=qxLa6NTY#%QTZ!ODwV`{7J>?3SJW6uHfL@5pu)Cbh0oJ zX0aetVtbGVmkV~yx(x0ZAjqJs{~qcRo-Qq+5HIZh>V%3fDRaTes=jj~ybJ}Lc;m)V zcs3?jaCc)P2-D6)4Eu1YzR}+s3J(32G&0UeOd}YTw?96M_jn-7i!D#<*mGFevYEMH zL@R-yYO z-uIw3JLIb{&jEmV>Xnzw`>~;st}q{tmi^_-Oi7-i72kEftR<#4Q@bUo^>>3dV9)pN zOj-{yBqiyfg}%0xn6zchR`TcPm&!Htc*v009Xx6us#jiiq2VkaJ093x*WGStqS3|< zmP1im;VDk(LnBy0<*5(Il(L-4{b2Hw1o|bAQV0Ct3cH+#0&W$2)ld zt&CSss368RUbtq}B`>DdNzhtY9E1CK-Pcj{jQw+-4w(eect5n+Y!?F+6&f`Q_an+T z#Kj-(qTGoYS>!rg69uMdnIjqw?hDx-9wn@;tVzGnXY8OvUl(?L2Sq$rQ3wU?XxG3< z=|uNPBiNJ^R<`XPNRiTuvjYj`!PKa7R9G865#>IfI)tc1YIwZb35+SrREn3yt)cY8 zY(EDQ+KraZl{2N4l$5MpOKZAI`>NV}mB#RnYj=DI8fO_fZjz$qb3FNLQoU;>nJi`X0Sua*bG{j z7>4+K#&rVEI6kI+wWD-BZ>`=IIa)J)4!23K*z3{TKQC9C7;z{ze5~bKNXyrx+rX1= zwA5G;yRYD!Vy*CPbH%Hew<;_p_?q@u<=$+AV(mFE>C?!w%8xiPZ!){OHu$}7!l4NY zsz>WRRZbPi_1I5;8Yt8X}=<)XWU%^(P9q)Pg+BU5``?(3>56F~SDE52y&)IZqBI zpHj){)wzG@Nc#AZF~&NjQw;$#o9&Z4lAG_2U)Z_pvxGXJp+0Op+Kh`fYgR3&L`HH% z%!MHBBiNF?IKewC3ei=mNk=Z-6~Ytl1BvKZ&rtO&C54z6x?cuz-Tsu>wdIu`q+>bg zn_-!8)tWc37uHn4(lmB}6QxVzSvHkBO8Q?_CW2J38PCy`yyLF~kCdngNg)$0}1 zy(d~EsPJQE=nub^ve@IBsB5jve0T3PJQr=VL{BAC%o=!UEnE5M8$ZCIAeN!)uY;RS z3n$B}sj1b7TfitNDS2aD7UR~)iM;5SuqrS`a%(8dQ;xyS=$vS2ym`iIj9_e!%2tAjJ+7$r+&1~?#;3#Q=_r0wciR^ z5;=?SQweH|f44%E%@(MuIGzV46ni6Hh1zsQ7p;CTq`78D?Y`DiZq2$XOo+`fY??)( zonW=Vya@=Ng@BX87le|-3ryXSs22lpJL+9OKGm26QLx{UNf0rngOf-1w%)OJ<+mv8 zqWVdsU;_`%te}vh)@|7}DH`6FY{I5)-b9QX$&`LYrlnSkdP;_sJ zNv3qwyODpHMz_cSrqQ(;xm=r<*>#Fn%y?srhcMA8#c#6;zRjzaG9_Dxg^odp7MOvU zGfV;R%^RHyT8=rF8aOk(zFH#6O%#$U0rn0}-R4;QYz)T<+d+AyRx@i?#-n(WrDgE# z1u7l5@ta6au%@VMgA6OACuMYWW@&SFLD|$a{R`U{^mDj6bY|9~HoNxurP1X??}MEW zP?uc`xaaoln1r|4&WgxF;1zQ6eE1?~d!~}eNvvv~CJ&<4E%b&&!qM{u$GP_EJ&Mp9 z+lnp@%J1ilf6mH7#VM~NgT&-YC4m3B%~M5bkee7tY0c=LI;XGHwo%J++{#&^Awifq z$0YISmY-DNY1AXwu6~I#my6P1Z0{1H+&gbH0RJ&*a)KX1^65sQsmJXh@erVp;r%@I& zDgovh@bz>yM;UkjL_wcFBf9!3g@)*w{%G>EHImcCqOk{`TYKjqE-JQSbFuH1qd>4z ztU;sn`Aa2Ij*jir!~@)4o{o$DZd&*mqHD9{%wPW#RQ>5KT%`xh*~tMz!+&7) z)yzQqV;DIIeyvb{B9kfW7q7Ob=*r7~_h=mFI7KLUfiq3SsX+gMEcz4aq^J@M@y=do zhyRK>|G_{{Uo{Jt`hGdLZ~G=jQfCnOg6h>7Nj|=J3$5TkTPsyabo#DKzRdIc7vA7q zk(&B^b!uVm<(_^u*Dt&L1OB|{=6|31sRC=Z>ss;+c|Za8nHqaK?r(gomiv#N5uN_* zZdRnJCfB{-9-v<;LOQCGmu_rt%v5jM~K1QuTCg&W;&6r>+&dp?i%QX<>DSt`QiIy-2%`>?tB8labFgrhyu2OgG^RHs4HpW@G=V$9Bz z;Mk901`R8pNPp)B+A)eZL2tE#Jsp;R{yGfE)e07UIHrq@On)G)Q`gA#Sq#Wdk)J)N zwvaqoOx2X7zgPL@&wHwGk|l6u=u5qG@OA&sERE|upSSC(^?qEHBx6^vsADJ#VEwlPSIzz5P}gho$et)DTXroyxnMsfBkr=NadC5-=@cI0U-4TZvlb7B{zUuf%FqPA{G3H@cwCq z50{i`mpub9@!yg$>sr9HKi)UBr213vzwY&$yhQdCi+udxzvTK;8iyKwDRB)F)MGFI zLuo(novH+4kHek5-rIi>-C18CRWtwpclF}`yS3_npNou9Ek|CEkeHBX{d`kXlUlj+5ng-Bg`|z-^MR+9cf~o(V z-+KYvzu8;wEf%}pHL_-x?7frBf0*dT_gc&sT_8Nyzq6X*6k`W7{`!_^I;o2A*B~Y% zfX!KNzG{WKB@GK}JNuOm6M4BlSl;N)oI zfIaUPK)@hyz-N>D@-e2%3_=*1bKxV32eZ@xDpjxh?=RdRRXmHp&bo;wOu7lOGo z@?;dM9p}8vwio-r6?O<_74c&Wol?(o9|PC+w{s2h?`Z_nrH}U4#xJDF>}?{y^|J(< zqQ-`@E`to<%ffpuOViFCh8}Y)THl7?g^n$g^g>U80o6TJYPxZMX}BOyjGl)4X1uU% z*p*uo9}F{O1+fVm>r{C3*#z+%k87YWp%-0Iy6F% zr5z~PEpLnZd6s3-rc*S>Df+$Cr||HFE9EF>&e__AW30wf{}E^Gy=QecBL)tME@D8s zK)IB%0I86Sw*LSuRvnRY6wKTLiuCTYkdcrx#9N^4P^t`vfoRwG^RusFGilC=tSRytOjK{ zwFyWTkzCd=#e~cD~Ci=oCcn_Ml|_14ZYKr+B`%Iainv+VVbXe;X}V zTv76R0_);^Ape43dv38WZLOxnL`DH9uQluY^c7~&Ll5asf1?;D&=hRvUlQreM=Q%r)7}k8x|z?>I|{=)9kB>yss&thgCZU9f?!nz`4?%YmnIW zxvWCBkK5!2HY>6tVk^LTc@DOgeYtRGr2&L!zB^3Vz(=$G&@2D4FBbpJyLaKRv9!WZ z6(wp>xtl}2Ej3sZfr~p|*%+3M&%5Z`m+O|J+xl+BlBSkR#o=GEf~a=&HyrP?A>dB6 z=sURm^*fuN(YIz{BuVtryypxLKp;CojQGodv4(IDA@Y)SNj1#uz6$+jDFK}GnUU3pXhc@&O^19<-DJxka?OV*^ z^AQ@D3tBVBpdgN`C4RDA#cDX0hfdTr9N{!?*?U`R%+NCjCxH3oTuog#b#11Yde5Iu zPyf#xsu{YrB~oKc{nH);;LyT>xwfThCEAe#Jo?j;yqE&*iZ5`6;5Q$3t0>f@g93H; zZC2Q0Zy&3VyjW3D5$D1Yd-T&4>0ylN2*!GC`4WUX;K-O9Nu}@uOx*iI@ockVG8XU?^H`<_bd_4PLGjK=o;CpS6zTZYg?SFur8dqMmOOX~FzLtMTf^f$z9IrO#}_We+vmLb~~h8uv11{iG#h0E^RHmPSO ztPoZ@%&@v~%Acz*g73s3>!DLpxQS8=QmWnk>0rKbpD{j)`q&hrXUw~=oJoA9&bo~S z*is4GEJ~yeTiZ<3Rl}Y)d3o%9zW`W!V!oYgr9Wz1ojOxAJuRAG=i2gZ|o;MK&q7#e}EVT5odK`BonzWu8f3h&^3Ji3gESbI9!?5m} zViJ?IS+_%jcCqy(4tv=;9;@!X_xYAM2t7S*?A_9Dm#JHMD7Sih*p)=2YX4l2I3m3MhJW$FVkDM*+hG$#BYrix?+F4nFfkYo5%9;Of^{Cp|FV z-dB=1#?uNP@;a~?qr~m0sbsY)OjA3Yo-BX9Fk$V1BmJY?)cM()|I_8B0vGlFEjQ(H zY@wi_m~|wMMC2uRR|-82GSc0P&6t1}IXET3H|F)!s^!a^mj}P%FRfJ_Rj9-Gbf%Z+ z#w5Ewp98659G1%&^@9^G;#3rg|7&rhPD5U3K^p|YQUs5l3)0JCtn@O~j zDCnXcPVUjmEWAs0&vCa{@o;|NZq-e6zK}x$4^1%?XXmk2eUjcWTJ6LJR!ph3|7czl z5xY_+=$t+7)WevVm7mLNPR93VeQC3jZEI#mYO}a>MPT4V;mSB3f!omG%fbTK`FQ*2 z{tSh-x;-q2%3`YEIs9Un)1QJG0V3>V52Gf&~^v9a95Ncay&P= zR#57m)h@dJrlc2!NBCXoqxhZ8g$4;WAwIpKWx?_GG)bjnNyB=oByY9hLIaM1F$3OE ziS7LHJB!Z6qh?9 z%}qL@3;1nz#nxIMjA_QF*`6G~FmBepoB1_3X7PsY1LwtM!lj9Vc%tmpp}iR(Rl7*} zxbb#abS;xQ2&aQcvb6-%T~rpSb*ZBTq(Uf*v&#XOqA!1XzYF< zpG-%|^`0-sI_8~e6haBu;%;1Ix|5~OrGAmJI%EYyD)zHZW4Gs_X_U>HKyB!YAQIE4 zuTgrbj%L6nHDUGqh9UwT!6N>C|KPRdS-OAXwWbuGK-^p!x&M}DmW|BQi+JsBoprL- z20U^7qOMyxL~aS{Ce_z}B8id|_a+;(7Ft#*o_3JBEdRhm*7f`kcaweN6~q)!uVNC6 zjj?h^;!DOhEr28* zjH)Ws0)LN+f7qWtrWNc8aFLiS>u-c`vQ~Bg)J?nidq)1(V^6n`pk-A4 z8*!U4>;DeW8vonkzmVzyyjKXg2s=A1@RwJf!J`I%HM6V#l*RvY zK7PW8{x$$t(Cpk7$glbMpOXK7MxkU08)ts&GprKNtUbC1d5N9wU#S3%1~#IKQX)~d zU;`8^#?<{&6JZ^AhjDjof6>qV|srF%egbSj^bI3-KyX={IsWPj2R z=dH;OJWoK7a2#OMP5J&^WVZ2FSewhSGVgN2~UPo6&yGc02hrg3m+e$`(Fi5O>p%m34x zNd*kq{oUSbvmdtM0po<2L4^(=+%PZT=*-h9S`kqX@j`^2qmYLm9=dxEOu z-)(Br(RVNpLY6^pg-RZO)Gl6AR0rZfub#yT=$gnt$C1zpZt^5q@$eYhV9W3`b+B&l zZ**cuU+^=JF!h=0HM`nFUPzy^)ewXoJ#xglDz+2$?J-jR;fGJvZdjW5;7~Cp`-Z)` z^Z593K*`!1Oc^|P%%sv@Y3R*5sj_?Xu?u*(q&AXWM>olLo)BOsT7(peFvQ~FIkN4# zON@D@4qv%?ojJy}UTwI*fK{y0UL+5BLwL}Dxu=j9li^RZtd${{F{O|V}xFjK=s}(_89%DRiuZ!1VJvM@UDVYOkEb%?5_qNnfa9 zG#{89UR3);-cqb?>6IQqJ1r(8>PlKeWLC1boO~4Tj564x%cZ||QpwnNS8{*0)Nuqv zT02vY9**&a-&34mI4G~%`gYJ?s>N{1VCHqVpf>P6xCI$lbBr0O*Y7XOr~~4!=oyix zC2H3^PMOfP4Da2FpahchwH5M1R=k)wy4q@b$6-wcP+{G0l(oz8>SU2Tu+xFcGp{Zx z|K4KNr7^TS3lw~oCW(vuZ6?H_7S%g@F7eein+KTZSBc`X`spm?Ng)%)WAFwP3hvqYc`+dgsRx?X$zNIGh*k#fhDX5&7?l4Tf?-A3p2C}tMZK&@6@T|uW(vEja z4OL0OUq5|H|41Ts@~r=%H@%)|%TB>&M_G>XoX#fAyXzYvVs^GALgMM5BTDX%3rV3U zTrGwK7d3ehXT3FXu(uO00O2k*S9Zf0^^A`#((#X{J$4(ZXQMwU&DVjCMOh?A(9oR! z3GZK3K26+XtDQ!ExQ9MB$;io<@nlb_jE_kfqK!o-5pO6Q_k}4e!Ez*G6 zRrH`6W@OSi=oBAzwL@~=%{*q;_>|W+nG6MUTLQbG@e}W?My97T$BIJ&Iuk+Q_DBx4 zP|%S*2e=|%F)>{8sTyS8X2xRjUz0HLZ#f}6-dN(*@{Qkd$s!eW;*4@Z#rY|u&geXPDr?}Q~}}a$Jz-`EgjfY z&lzHJ{0kR409ZH!V25mORF$YT)U$=*HmV$e*wq42{46bBw_NuH&$Zc>wg`cf949{= zqfF&QQGVZJJnFmV`T5!qRJtSq=1_jH|d+Kox*DZn;I;G40z4iqG~k8%5Av}z4snv z+H$LBz6%TrQpizD5*bo=7nB32lWJ^-F0;Nu_M{O69tJpd|W;z=E6? z!>muX3^V0}DZA#Tn$E!hHWUP4peml2#RV?)uopG`friIbzC3&YWz@`9ePZ4fH|Ha> zUArc_w;-A9;G&uP^oe}*)~@EiXm}pT0as;V*JBY!ux3LqkHNa@zp&caa1d4Wh$%gG z{XDX?_TmSl&i^wIa1^YITd!R`^;R20@onyzk8l-5NSs@X1lYOEX6;&G925EV)nCWp-GjW4*OV%q=MnT3TN*;s zXiY?@h_6iy_>^qs$HY|D3E3iRg~smFl1i>D?ZpcDep_8xo7~h}FETF}>o(d+5aD%4 z9rr8DN%k}_-Zk%Zek5^wSGoi`UTRT95NF<@A_*Zy6b;~L6!dW3IMjk`5G1Vg)uJxl z(LOjvC>VLXJEJnYNkW&QQ#x-qiKhnOy3d!pkCR-Q?R8`+&VIARnTHu8C}hDZ#A|<5oM6CMZsRRu0BU& zL(6k-Cba!*aowx+Sex0zQ_lMKUGh_4zjwl434G?>%}=kjRXT>aK+P;pr8}*IjGZMW zcZ~A{bOAv9jsUWnGffr5itjMFSAc?WJ?X=jInuEJ-J>b%##2d!xXJD+>&*lMS5$H4>)sq~8* zlPcX}`6BF`*Txa6nLL=(pjWbA<)h}dM>?{P>@gFo9YBh2&a(4PrKCeYGw!%}C%=>_2dD-tB{=4dL1L;p=u{3e zPHFaTr!;#U^U=G*^=8vbTM#20(jFNBzawlnK1=fWk>}b_e9(_#3IESbWZL)aB5Hq< zc^Vt=$;qeZaDp8uvR;6`-jRClfThNhXH{DBmI|!_+?-D9IAm4N`L$*sQi7i17NvN} z$T1vh+V;5`240|S=cW_$e7N9KnwrGc6V0o>GpoEDO|rE`M|An#9y(~-5gnWZGHELKnM7!OL+o^#M96D+&=SJ$FwIP*UCQJq6#B8t zC0YnUCP9>qP#v~N_F!GjQLhMICVQlCf%L{!qFBmgeDqCc?M&gsdk&v#mnL|6(R9ZN zJAuNjkrm=Z~(l-zIi-#1mhwFj5_CZHYmAX)i?f|82zgg*-2j$Cx-YqoC#XR;_eKm=^{A4UA#|LSfTWPqq zgJ#2sPl&DE(FXg_9SN&xp3m^dT3yH~lbZHRd);A&oMh+=NU@NoR^B$ zQ1#kjZM3GPQej@PW2(dl^TM!~v-VGH+x^6l3_vV=*-d9JZd5l_bt`63(J9UUHlh zEHT|Q$YL8qet$D#}aCitKR1`BKDhK`g zR>P^><=M0E{~LSn8Q0Xdbq^m=upr=30TC${K%^;EK$=LGqV!%v4h=NMy->24TadNDhu zQNJ*&h*XVbpP4{9Po7>^ZtT?tbuMT-4b;Q0jUn`dj5mw6S=@?f+lsl>7V_3{v*1KN z+x~JjO;})mD4>c7y(Rphn{v5v5l0k**XH)1m5E{Ry!1;1`j(>c*2dC;%nB z2lZux3qXIStaG9P!^w*84`peWCLL-q-VFf-a`%mIWdsq!tfap2vg<1@o~Rt*T3oqx zSo1uD#=lB1Z`s6LvRX_BRcbo9=#gEz|4FpO1U6Y+;N#kt;%FYY<25nlf`0Lkp&K7x z>pri#JWci!gOCX8k+Et54a4)5*9%4U4JK^h<3RZ9fVZs%%WH!N!o{WoOoI}SJ~O*J z@_0`;#tYf?#$pd43v75Z*Gqe7kFgRD0qMQT;Kp!_|6*?{P!74UtY@yCaJ}^d3~{uj z=0dt>{OAiqR>vKh5qdLlwU+VA<`+Kc!6X>+FoLRY6;kDj(r6+%HUf55dNpos8$MG# zRds;;puVqLQ%3z+1aFnY?Ab%KM@ORb8Ru!~z&Qt+x^b&Bad-6G!DWp#9U)>FNt+VK zX!kkjA5tUd)+-l#e}Uge${A_=r!0ybOHHdMDTfPD`Fv06-&(kE5?b-1skN(se{7tZ zr039e@aehvMbZtSAo20mS)5qf5arn*l&mfrWV;}ErBMqsN31m;x~_HFM0=2Sx#DEV zgc=T$DbT63P8SE*XLs#uDk10ArCLs{U(>nNbf^=a&GKv>6SOB^5wQGl8q8;Q-#DDM zl+hT2cO?g@^Scb1eEV>9t=Al5_gttvb?&m}Mo$eQ{q7WvN=XjB5wq7ndl>FoMNKs! z{6p&^>uCNuE}s`a}D=PDzCqI{`z_TYf67ZNhblP^(}K#Om!)|wtCjcr@WM< z?8G1?_n^PP+3QjV=|VHoW~|p=y=0t1x*lyzr24OS?@e_eXS(0fVk+q$lGn-K>b|3d z`lNZN8CJy~c)ie=Ah$7^*TGs?1Gk^ll0)gF=LEZf_<`Gct+AD|IqZD3_*YT2S{GB( zKRUzw%!1nDu6|F#?UtWLyF}28L2!_0syP=p&U@N>T_Kn1W!NFhdU0j1XVGIb9}JDe zOL4U(;;ymSy(UnT>HR|rSFvdiL*kz9B$C>gWrTC8R^cSCP^m(MtqZ*=b74}VLDlQ$ z%)FZ_Zwo=H0@i3%wg%fM|1)m5%9!;)vb|n}*AEtolIeY23 z`W92xez+18OQlfT`Mo7{9)K2}@w_ne$9b&y&mJhH|kF0#WtetR?tmLoL_Oy=-=^Z^0qw&mHe(Arybs`wgv~rK70bV*Q2nhg{|C zH#jMb9W6d%1O+e6wGdCM<(0xcSu=4!DN)~GrkX&iQvMs;-Z`w}+e=>;45+=!|1fE! zwNw+ZJd+%3Tum$KOQrSUiewxGEq*hyd}4$tmo#nG8>08vyFOc-%RX^~_Wf0{Vc4b~HU)AZl7rs91T2L7P2dm1C9W_6jNIK= z@zXz-i)_c4;g^Ub`30+ftz#?`fUHA4(&wL@E;7t#w{g|H`r%*rH!V|umnl?B!~dI3 z{^d{Co{w-(;cLHE-+zC}s0Vm5-Gm2=|7J9E#t=ZSuKO?B-#=c;|3z`idI9A*Mf{Ln zz()GNKKS|Lg$iIm4|fL#-2T3cf36#{a*;h>&vYy0-<*QjZ2(s9)oRY?ng98t00%k( zcnp=)&xs5C?hv)Cw*h?wB<~Cr2_M4#jrr6`0OoHc zda?1J0cm7-<1Ra3>T`tcwGfY@bcmBRC?Hb!iVI;IEu_b-aB*^;a&ce(eB)+LFqt%1 z12*21<`5qriTv>4PI=JnKzof{u4{)sU_RIhU7$W`89vYSYkERX0`%;}2@h`jGrw<8 zONjCtaSySDjpY^uuRu8{x)blUf`bVqVrrAD`!h^-DKjhPUh{Dw$&-W$ua%Cx^mj2R zb3%eY`3rSl!(oYWEq8fPe!zYE{>)M~TgZ4$LYQhL(s>ccxOvk94;?=3k0ms~FD-9hpl9Nc|L{OAN!SV22Uk;8{@4;q$5TTtzp13^?EJXAugmY!pMO4a zjC=QvW$TdHwZo$iq2&nILi-ZEPzOm5{I>0gI6lj|VW2)PB5erF05%9gK?bUJlpd-r{#pbn& zdL<_Ov)_nH6yg56{SqEQ$sEk1(70*azF2Jy@o}7)f!6K3bnm2V9^Gfw-TWVzZ!ZqG zu%UfOjSzQaj~MPrJ0U|eeQN8#F1>3-m&e4v*t91})GJx(-F+jyQUlJtBboV{saz#Zo zgvOd-fcn^K1I(LC-;fnK5p7|Exd5=qm>!%LjY+Qy7hhnRWr@=9_DTth?ElaO-XF*fDdp+gfs&Kn1xl>zcALC9cVX?g@BUuvD8H`%RsP++}<{+^i0#qItU`XjX~*z_h~!$U$L8B(&!N(Y>A-!o#i2=RS&Y&2_9-Iz)j(asPh>6t5>hwmzqPi;8YGrCuMJb zke=vit#KT=cZ6e^oujH~O6j$1PRaW2cK>)0o*_|S;9W7kv zQAzcgA2w%Y&a(b0b)C336&FN2?E3O5xC0RDm^P3O`oc})hKF_DL`1~!l-5nM*a6Y= zV3q15ks$EU z!iPkbYzV+RHaj<>Z|H&1trvz9q8i%`51~o328@AKcPK=EAtFX)C z>3&_@Kf!JlO-0LD50txm20ISHu1gX2v~>*wYiM{g7Sdqc|zI|Jl9b?+W*Y7Vkj-#&RK$D2i* z6zh>wO7$T3Xgl@j5bsOlhLikO_blCBi}z{o1N>v3kJJKd+HV{c6%Wj6LL8llVPZYKqoc7n9tfZte zu63BLL2Pv)OpL$1W700}#rTlb50^J5s=xv;7>wT^Sy2a=G4PrP6W=%PO%d8w2ng8G z77~NbOAAt+3c&L*+CRWmX%ma;P{;)6M^-8S2ANS#YSD=-D)XR&IO;Bz;4hn{Q}YS* zJ)OHxWp|UnM{5nP7%z$4I%`u5k9R7eq_(~5dB{nVyDn>!)0k@UY_ja9yOvqQC4i%r z<*UrYx?x8`jJS42TWc+RC?`!4qg}85Q`5l&BJ#Y?7=7!JCmSi z;?Xv~uh+ldvMro}aJ7~C_}T0Niku1QFXhaCZ|Xy*YMdu-KY22c^vOHkb9u`6gXDoT z<9_1C2$!I1Z?~$)17f$(+7&a|#jFU@>J(z*;U=u_(CK?;7ZTd|BMmPii*I8jdqBZg zGWBzpUJ}R0#n*7mSM4hX0WNCKWFi!#Xb3T_%nM2t92Zjw3I!UUfxZ}~s>E=@WXFEA zMa-v`yEe?^dU;+yh3u+$EC79+c2qPsKi^RMQ&sH0Hd+!Qt%t21( z&Sl#`=Ax7)u@OKg6e)DS0d)Ydll!m1$*tBBRfAn^jEo~YVIx3uo(RFCj+>Yopx{Vc z5??t}u17n>`v}TwRHZ!Va~Z@=lJF{&OaN7>6TRL(a3cpM(ffYd#`(O~$LyI*IU#I1 zFQ)Isc4|+OdXh!(Ea8mDXSL2NSx?<-FRlMkBfLa3XT9FSBrK*=Ol)=a6$D zIdCh@xgXL~m{n|!FyoCW)Xvjz@0U9b>lR98a|WpQHd;1Dw#6yef%E)O=aI~Cy=X5D z0cdvK`i5CO?Az*l(4#ortgI}PTzy;HTxcQ9&8mxRY*6`YK8MngsLWLSB6%$=#@5ab znWYecadHYLYYhV_ZY>B~lSLYHQzusldF(v{y9o1$KCUiy-{eTBd(6vhd$>?~{qvMG z;BoNT#B;N4%2@2tkbg{S>O9<2UY4(Q?W6qR^2SK$ zgPp64oGPt&p0v2XQlxO{d+_dZ``YIOGyX0`d<_~8cx_Snlo+Z944(oL52)_Q|>#y^h3>606JUc6X;$AT?v%x^U>d3;5tMXGN| z_OqQ28drK6=cYKVF z(NWkG;!f+({#|GLvQjq5_5)DGmSv%;yN4e^nI$x=9TqXy+skE^U#)UToG2S}02~jr zHKYxJ&N_Nx*Mll^dnRr6<2ScwBW3DUh(Nainw186-aO58Zmtw9;dB%hig>bWu=|a3 zxOQt>TeIVU(d4!(cG3b^ETP7x!(lcPg-N2%NOjK?LZtN}sL+HzK{2b5O&b(UQhrs* zzSE-VIUcQ$al;y|=Ou~`Os0UngQx##s**JST_*9}u_!^e=06zofn2kI`G&(MYnjI> zOBJmX)$3*0ZUs%zXTd@&qxObD!DNEWTd?Gh*Ou;Oy{CPKpD4%+Mu2%|dM;^7a|3Od z-t;~}sWJ+6L>4!3{LCBEGh*TBlk3@&mSK2v$r% zjD>2Ro>dRikR;>0aA03S%Hz1%;_Sx) z2408W<8}ITv1$QU#&S)}=kELOI_tX*&UGf0$8w3Fz4^a?W2C87z^bi3{nWuArD8PL&k<8Oobu};(+SIc-qR4pX z{_dEymog}gDlskY?A6=&x0Jcg3L4Z5q64}rxSdU|ckanIACZT;#f>?H%1i=xbk{!9 z2}kgkJ@^a0kV3N`<+!C2juMhIT7+_EGjrx7LXCNp&$QQN3(|d2urk_Ez3-{L<3WIX2FX#c!nGOKj;{GqYtUfl*mdJURPD#Yg^k zRki|!N@q1l>CpQ=&<^tIsibOqZWQLwN8EX7U<*k%t!idg3Z++K^{+^I*4rjXO76qh zk$tAMqobnuc@hM6MhYARDAXN|$R!AC(&kGWJG;)UoCwlhXQSekO?{gM#!4 zt%dHS8YRL+)%tge4hM8C3|wMVn}C=MsO?TXthBLRoBSN4AXE3Oo9O=aNjoy*x>DzN z%bPZ11MO;iW<;CLtb+<6Yb6++ep*v3!9rK(9w(>bTI1d`z=<=?*#J@VP>JRU20P3} zs3xqzZ6@Z@?|7y}-^mkoFDWjjQ_9cOm~7g~*J*SDQRRWKA@q^`B=1I{QdL zvC~rN8V~hiPjq#WeylG1D=wThsOs|NIj3BW*lm`(20{BI*ek(@|K56VC}`uu?qJiR9N-A&x)`vn-G zrs$5xm0h5?;R1k(F+609$o>0OI-Mo^*!kUg=4a8u0AsM_Ub)Ae&%nfV9pkq>z?-Tv zn6IL}EMsr*>V+c^mM6sY-q%bLb>cQO{3Pgfc=-U(1;(EUr-_+qPq|Gu?GZ6IH+Nqe zN!2ytElu7huEA-D^)tPMuN1;V!9>`VO$ehYA6jH%;8EmsBglBX{H8i5`M#OZg0#mD zt<;h7@^E#y^LXQvN>e|iBveX3jZq+WRzpJDk9BgIhG<;r_^OexKwaU5jJIm14e-ED zleiI&_Z9b;**{4N%>nW}Z=(1U0%)CWvPgC-c?&=Mt4-X7ki3D790jfo{u?9=klXSQ>Lc-^ z?#!t2W)VHQ(m58zk42R}Tf8d1;<-HT^ZeG5h-s~D+&h1=x?u@PZ*^=IaX1We87V=@ zLfbhZ_#7_K?6(~k|DsXcoH9+AVeS(Rm(uPuQA26c1{eqrEnWALM;bONu-OVl-cR#U z-``@%n%{zn1xNQuMONW;KMo~x%gL=`5Pt^u8-7)rgcPnlj`3jGhBBCe|Ip z_&o_jG#{?)HcJV$!AhFg6)cfrOO@zupl%h}wfKdkafr9ewh z+EptTN;r%|Bd3>xWHgUPN2=3de171oVh)_|cMRx`cBoW_EvxKOeLj)S*NmpmnjFkD z2$*2tQezkTg!@kwB4S}Eaw=+ED2TpcZz8%g1kM0O*|*Kmpy~6KJrbU9skz63INS`$c0Ps|QuxpT4~o zILYnz_RKvsEGj1$rW;Nt8r>=LJ^^Pe+TgLrChQs6YM`|>=;RU;D&ZXmL-e?vsP4u1 zbwU`)Z6noR(+2b>mtLHgA@8RGT3*?3iru)o|V zI@;v(yg3+GJ)f01Hes#Uo68b$&5=o9m~-csX8DfTbgrec5ogBiY6)uL@AGjtJri>= z?F`SICmQ3nQU2qq3Tvm=4MO@3`~tZgr!QTM{z{<<`n9-+WlV1|_)b(=mQd&K46?g1 z)69*QYNJy5MMX72JD*v3e1+uHP+?ZY?B}K?0$wk^YkGR|QVi%zt+{eNZLrktS0Rq; z_XfbV>EeWgYNvZXHMGei$$NtE4}2m^Fq;7i8e#r~&z|@9r`}?)dI;+T)FSIaP_Ea|_owl_$axTNoaYxn z?xK5=eOYiVv{ra%@lU3EE5e_|11q2_LrGCTa58Qie*&$I*S999BO7qR-N~~rjB%3Q z0~UtMipT`gbpa`28QK-tGGIYckZIGTv$dUp-b0C}gbe95f3aTD>i~md%FnXpw^Hu4#Wbbj=#c*|_$7G7(lh*1WQ*0%>J_Tw%G&#OJj#oN%9p zDo}dO)co5pjM0>1)6eyEe8pO=xKLi_lbf0YPBlSL!&gI`s4$aFz)$yu=PPq!SE- z2_tqGrd;x2jEQHPI{$ukf;I!84ov7xlB#=5%3<;qziLqRxT%5F_ZwwyaMJ$!qGV{x z9f6oqg(A_bWkq?d1~Soarip#v+HNswlLQ^!o4pk7<_@-VkE*LGymwTYAYYbUX2PO( zH>E2xOBpT%u9750hO|u3&Llt_+l+4qSkrG33nX(YIrI zJtea90VxFRu23L8-+||Mb3boH-ve2 zb4^<&lM=MI8^Rv_az@X2%)pf;UNSC>+ho**}364HVzeC!g-6&L0^tCxQ3%Z}vEs zUk}pr)*YI$I=y_M&Q>ts>+L<*-bTw<@Uq)T)*qM`uu6F3NcQax_l1Lm1L;b3&0;@8 zw^l^e@bw5i-sd0}y~gu=$cjpHQhM-@pyk2OwX~Q9*>J8J-Q=+7DxL`BJH-^YB$FH_ zFVQDWpe`x=k`#ZL+YCs4a&vd|!wZV{())4d!JobhzTvg*p|v>i0VisZCmVi ziD^*YHjDr6JMN}PzWeqqPnmm{ zs9J-o$tzR30tw+ULGF_*eEm98R`PH8grK#yLKA)VLOoZjt!qYVeC0%vse5^PMDlIt zYYi1zt#Q?ubbso?ak5(Rk*L#NbV7Jii)%IlpNUxGdqEP4yx@V7ouaV_;`55fj#Bn1Tb z8n#D=5y-CA9^Z+_&Bi6x z8SDuP-IQO{nUD%k0=XK-$Aa|d9lbvU8J($ilU`ew>^b^?H{aIK{k@|gR zV;?1XM9ImZ1sJNK*A?GBuGMI~9yCT{TnYQC=Ww_A(4tkpWGuy|Pv%)Vb=c0(swmLw zycFLqMclyntq!7RdUO|Qv*|=_`ok7?R>Wk_`A|;gY9!r$Bat%FHRU|17`X9sF^G1f zc&a_kWOxiEBcMs2isbGwFD%jfug4v|z>G3{^gC*joU>rQk3jygwvG_IyyrcAYOTQ|0g_s;(8>Y! zFYYDU?me~GBzK3Q{My2vniZU|BOH{IeU36cKJE0gR|j|Q5yW2)C@>V;tS5c$GqVHP zPH4a3&?5(1Z~!etzv6NN4R|EFXplQWy~U;Qsa*VLNLyHdUt7fpAimJ51QOtpRjlUv z-)Zc*v&E=`d}-p6I#a;cXIn#iWDk$mx=Vj>=&;`3S7vO6%#;%XjQPyGh&Xcp8+_zo z#y9GwJ~hAcfaM!v(@!gGBeL`IV0RcUmseO~9Dx##_tY9Jd3aGnhEJgJul6;)7fjD? zc0_T(z@lsuQ*YJ3xQu(6ZFDR+b`3Wt^~f+7I4>2_Q)i6dIHBikZrn2*#yN3o(aCe` zU@I1+#@KLnolGDxS7?WN>hV_I7Khb9`KF%f*_-kR<&l0=Y_ED1Qk_S8FWri_94oOi zXVmiF9Y7FzU0V&{?n^VRnCy)y)mYKXn?H(NN1e0eMUW*&xUyNpGGy45U0iS-QU_fY zR6^)xFfXeRW3IjTJ+sRDK$CV8gxSU`&M>;dEM8q45A#YjD$fN{E>OJf6gG;SRRx?1M03 z!1#u;WEiC;U!6$6*Eem2IeD%g>&Z($7|ce~dcqed^TJsnDa_u7%^0yd1qEm6iXe$9 zFIT{QE5}9KjwQ>v)waZQb#O>3VcP=LuDV#N(At2jrZJS78TR-Z=8&K#3ZDGFu*6I- z8n|FtkI{SYg0kRfQ3LwSBb|qQw)x&Qv^IotmQrFnu#Y<6m z2J`Nl>JP8xgp?`wG<7|rW-`!n*!%+Fe?BO;=#yMh6fn{CCVY9)Sby@aV$ ziuE-1P73wgFb9WKrxL1)RUxF=cs)-jQm~$P-`2x7?lL=mJ)Gt=VGS9Xqm(Y6ou;9; z)`OcfZ#Ogk7Soew+YXe2=>$rlC~cibzKI95qA2!wmWhvh(kjK<_?uQ3QmwHvRvu%i zZe8O^x_c4EaYNHz!vu|{6;r*_4DNDE@%7N)tGbJU?L41WVO*rgsAll|^(gu9YkVpa zPZ}w+Rz_Ue9UK&5+LGTuYOn^vymuufwMqS%nK{*;vuiXDH;u)gpshfY;jXa7z;f;q z)3uBS)<$dN_)j#hrp2gc3M;)_%>xJh61WU_Sb@V?cNi}KSJW>%G7zf!aZ6F?iiant ztNG~yk)f{DY|3@`4GGOUJWi=v>uiKbFlvwi&Vw;ik3AmdQotnB^6J?8A!>j&u;P^;HK+g)cX za>{B}x4QBB(OnhrumNM4@?~R-FKOIn!2z(lOn#TT+b_B~SXh!sjX~D6oF(aJyuo^~z`D_ZBZBVo(p@FV=}oS5KFU`IrCn3Im;~&{iL&w(&%=ZI z`UR%Jawodli_5LSh!M(wRU06)(&H+V5?v95^9DST<9LKwdFp0v8!p`3v9Y@5Ohz`jw=In!$yziVc|m;I6IqYh?6UI;Yo zOUPR+n}O9Fu3dwtmz=8Ukw*3*eefr2ZE>DEIJ2=V)L;-*$v$~<%%6;hctFQ*a0ZW# zxP#+{(m4Z4iaz$16}GL^(^0VUy19J%WS8bsKplp*O-2nQGxBFhxc({2ejXqtSl?jC z#TTepvZ#;2Jsrgi!1nG?06EW`r27e91_;7d*+S-GFLw?@s*e_>3cEj*!sY=i;GTNu znaH}%jUgXrA4FBcVj=(yXg5+F9x;mF?hE1=DGwUIpoQGxF8aEBO<%9#Xdz>3xBM}C z@}+L4nA-0llv9mX)aSBuz+Nr)*M-($H*g!f+{+MiXW&Va#aGATnc~v)ye|v|%dA&} zG;N)7byXrR`+7Al7B)>c&c^SU=%QN44*f3y-93EzoE8vL z8`V3V6t3eZ@K>ltsRPXQ&?m8YKwGN%i#Ir17#Dy$_=Rz2gaH%?;>c+!CkK6IHRgG+ z7C4=@S>w#hPqL;xjg5~Pua?cU>N($g)DdxYDDrX@>{S|vBQ}jV`b}^I~;7A+Ue1h-e(}tQ}Lp^luM%xLD!BxPh zV&sO_r6&DKExGDRqyIqM*)N}Rj?)Cro>guOk5ln>Y0Xl5bC&?xgFWDsK|XsxDTmb0 zeg?l4Nx#24^Yfr$m-G0m!u!8I4%q;3eFkY%blU%5^8hDs>Su$;j~U{>J;49--^lI* zTmp5vlZxhl{lUL3`r@arwsL>UzxiqdqXp=KzUpkQf57H{zLWb2=H9Z`_=k@Chcvh# z4Nw$c7L5jf-t_-_ry=ZssFM1kaNfVp0UJPz%y{rE|7XkA-xrnr2n>kwY|^oi^*?VC zn1h#*KT|ze{Ps`J{r~r(?8?A^UYzQ2_@7UJ(S1<@W^dm_&F|Rz^>3o(*Zo|$1q?{; z#e(qfLHy^(Ge13Q{_k=A-{bthw-ew9|L^StIP(A7Y-Rs{+iWkeNSkK1wLWt)j_uJ4X0g<8GCf&#(`Jk0*0~$_smi*ZO*1R4##ZQ8LxZE25Zz5sk=k}J+H1%LHw5h z;tz`X%db@&IlLy!IWGRmCy5HY?tuKJ8q}-E&D$Zc_$Te8 zfVCM`fCq%4E3FSg(Dp{hDu(8u3(EOJPmT5(RkN(MZwYXzpKGIfN52*>^i25_1?4#m zks*1^z{nHvD9KYf22`0Am5SCor8h^EKKF>@7AFQCNvQZsWogOvG1kP`JKJ@7omjD2 z6$Vd_-=25v7?nvIvKYF^-GR=WE^nPvtJ!Tmv?g{L?B&=_zY$*A{5Y4}7uDEZO~52v zIzC0+*v}Yv8=)*Um3Mo+q9-#NzH*3owN$%xsLEUjaFAc7@J=_pi&|?)+&_#?Emt)1 zM(7CEkoXNHcgcI@7J*QHQ%kZ7NTZsFMGhQK^_YCK;P6$?U}e$XMmg_dqF*F#WWYbLILwLmw>JS&!80KeZFLSI~0G%28*jM#lh@(IbCFoee6!QJ- z7}0(&2a_J#1xOf*8m}uI#|9ab6r!s`3tC0oOpYOUOQ$D-7cbOB?Hym}<(ua;geprP zoBUUulr)ttV}TBPd6>M|uAk)~DQy17dKInfCyeKZ7&!7f+YVi6FCRx8Uv!)G4yqK+ z-ad0JpTawMB2cv;1qe*K4$8%jM@WD1HFQX=qK2fG8Th57VrTl=aaGWnmqoHa7iDt) zEt3W%#1~*1G#fOz<1W1}om@LE5ds1d`afU4bGmaN&dgJxHa1dCN{WYRt-;n&JD{tNu%@QuL#2Dmo0u z|8^yp-iaIG$IqI5jDoM;^tQT0n&D~{Y#eQadqHQj)9CXyut~u6qEl`BniAsnkc_x| zg^$Zrf_xd>@sm2E^EAUW!WXu#mIaIvK{RMHI_6A+bOzf zepII*Sb0vhROfv<>u6q$&HUw#Ve#dWvA3AKrlW06!F>IUsM3*Z(ypE{w5iX|E&+Jty1{`l2*x)ly> zbaKvT^ZqI*2`OZ-9}(6dL9Cg}%SN$mt{+t@Yt;HQI^7QkcIGFowLv2jyay0lBi(d8 ziCUG9)SAw>hJvQABT+WG2b(`-m zVQkI!jf!#{UlC{B<60JDMna9hfb$jm@DS@;(mB=LM3P@;PwAn+<`m5LcSDpYY7J-J zsHi{PTjd)nWA$9ec(sGnV)RL)a=qeBnbd_ue6DwegVP6Lr^`I=SK2$oYkOn%>y%;G zx1)nKhQ-ufd`3|m)@depV34GR+#C<|DcDjh=U}NqvA>L~L+<3xwjk4BZH>t@J?*{m zn_|^oeF@Wqa8?<87kK`wYm?$CR@OH_nA~fy_4zmsDvVz7_t0i zVGwFu@wEUaNMrMX81VUV8hp`*kD2Q5D;Sq8mulpW35~#bZLqv#9Jx^@8D3?i(f36Rz$cZ3snQ*82}(YwU;k4r{pUHmIQBoEF6XwuNI)J@_CaFgiln9P#W#VzXs1 z!*_}G4+s2Xws|GyT&lDqGvV)7Mxw6C8Eo==c>Zq&_mPAgKWGlmhdg@fuoUaCtpTCAF75zC5Va z2WsbW2&z4l2&htVe7B8@=EW!2b>{NH*7kkO$0u0CbobzUD|-AHwk>(@iUUw2G{4Jo z4f>-#@+-2Bk1={sY0>Ea%FXiXEt-g zs&VZ!rPwLWcT2R4+S0<61?uAT9Y}Ydc?;(IU5*GEcPG zHsQof`b}tM>S}E47`y2Fq=3ya4o#Xgah9%bb|-s*vq7^!ZB7i$sbPv|h0DaXhSH>~ z%?^L<4^V*(UU@baI(tW!=TO)IPC&!2zm0jVO+y z3KQ>GmW_@RUUNwvNe;Hjz3|)}wL7jsHFDDZtM_;q&aV`PNK$`E_4X{Jeuz0*dTLna znTICLvEV=!kv4mN2IPsggQf(%uECK{(Ob`AANZ+BIux{8f>~ivp(}MW>Hf$&9+C+g z7A>Vkq^1rqY^&I|lt%2x!-wI!F`Z}hEG;z8&_=;_>bgX&daO>*d4lH;J;)|8>v0XW zr|+tY(y&j&8Q&e&Bb4eVQ85h5-skrEj(ee4hmS(?z2Y^Q1{NDfl8X(+;?(=_l0}KY zM}=tVM<*SNs=)edj>heyXSe!kz;pYVJ0RRQ%qKU7fXeSn!A%(6bWPszNhj*Q7Qj-S z;ek`{vBF3;?%d@$J7fiuCd^tOV}v5=z`0S_Mjc#dS>4T&p7aySVI<(o(6TyHY)rBlQl% z4<$cDs7v|*ULGeZW`d0>khmsd7L*pn|2b?J^|(${P&ZUZ#&LI)!-voF1b0yb6clfp z2x+V6EuIW|;<0{H%%&#ZHbvo%yxhQT-CEpteuXr1QdOJ&-p(^@8_BmVEYV1|=j{$y z$+k&&y!wXy$)2}DUdo2CFmz70g!B87S^XLYNw5I z+OuxCh-|u8v*~65k6@7l8fEgNth(81Z2qk74nVynAo;Xa+Q!wg8Xu8~y zQfw?XfBE?qc$PQS1IL&uSz^C0r{g)0!VZBoAS@1P=k~r(IEou4i&%&m{D`@#mPj8UDnXYN7l2^@D0a)k*r;jF;dy(PUTQn?ZI6R(>p4E{ zI~pgw(L!6G`FiJCK8XJJ9{8re@&vszvb%SWrCrojrOy)|e4xv>I~Y9QU-j-mZBH+g zHqRHa+T_|+T5x#WqaK@NxLf#S2_9;Cw=k+VBz`q4Z0$%}8+O>F;Nl|Ynl6Yt;JC8N|GQ*q-hVx_q zO@;W_;WcuNZOzV3V2#6pzTj+3C5Qi_;<(qQ7GN-nyXc%5K4*dp%=g+6S?ip zU~H42-~Nauk)ANNXFK|WWo_qW0eXH^DWOgV8c?SZM7Sv*u5H`-EQ!*#rR1I_Ujp7G zS-|H(lTKgdVnAV31Lv*EZf+hYv1KdDh7UgLcqFKa%G-9C;-o)M_zw4BuO<5Q9{<%r z2e3hLt1|BB{R(OeCtRBK(zm6&9Q@7*78!5Cb9sy`tB z@M=2PP)%|zd8v(masjBJqNWhcJ6`M-!Dk+|XDbsI!eR1C?YEXq?1?5HoiShNChcCm zf?T9$5qOql$v~fayQjhQyR>E@S}t64I9i>jDJl#c8P_-|Jf6!FF1qfWIsCSW#{p}H zy_3#of}yW8AH9A7Qt>?;EsVv{_q>qQ*XxC}f@gmfMgXwxZhAAdL@?^QMBkVKmsoVD zXWb70iARHBCs_-Fd69SA)&!s&Lc;wZL-ob<{{9kC7|1^@d1+dYbd50XXTEDx8+vh4 zt9=OIHhpQ_$M2zqBNN)Lx>dO6(zYKdhP(A9AzFL#Ms-6WVk>vz5WOl19+6H~K?4Uv<+=TH& znW)RK9~T`|z{g~8Fco2r%7TqHcGuDvZ)Ka}@7Mm(yd^U30{DRNRAxI7eD@6HO;3z` z&^J1moX8kAClAwWOcUK>l7(>FpP4(}9Wc4XJs}6$b*uTLE#`-pJg7GlI@324r(e6= z=vg#scc9O=x#Mf;~5k5~!(6KX`X*SW0eZ1PKQIT#w&%9KBD)Rn_Q9f69XadAp_thJiy#_D;R z%Z6?|H-$9U2Cm16>W|r75^adP*(brNy9O(a^X%_jpC&ch%Y{&TQIK|$JwUm=GPcyG z4gSbWD_wAC2TTXrd$3+H8j0q{j8A-37$po!JObi$iq%C;wjQUxo1SPi4NsrASA5iT zU*2rrBGtA?p~GG(oicHCOiZTYE12wgWa~o;GL5l$S6b!}af5eQ_YrvJ6wmsS73HY8 zQ+P?1!#qvuboUFF-Eqj(jbude?Ym2&YkpcuqLZgZ~w_XZvuTkB6ShL?UTJ@k@)eft9T1BaxT4rYL?7>p9@a9T8WaifjGmhb?5N{>$K3WR(ha;Imyg) z)n;TnY$ko=RNr6W^O<;AGY!RZ?Ss?9&hjC>xyBd1J~t}=w(*-{>$+UV9@V3yHxRA& z@NSP}SP#pBOt1ljLO;G*7l<`J;MkHT8cXIZl2BAgEuNBM6XV?tRWfleUVPD&$_s`^n;G9Nt=f%iugRX>GTZ_1m?E>_-v76RNp|eagS|B)$n5Nn#V zyn1zTF_Ze_@SGJ)?j~PLB6H0f%QC076VQx59;<=M28f0+)@}F&7lDPq(Ro_0{ zt;qR5uUr;5%iB4n(tN`N>Uw`0`4@}^AS~iCyT^b-#zTrv%ibxC&e>2zF3bAqmumlQp7W;Kz?ot3*h66dLyTCQ^X z-RhlsJ^$_gVvgy47x^J7m{@=vW4+3onVV|=UTM(Xl@&J=H++6UQa=r!p`;Y zg)~xDY&fvZ^}NU3zU^KybLB+unNKO-@Golr+W)ZO#Mp$JYtmIzw@!a^!vr`!>h<5r zDYIPxN(V!PWnY1rAPgr(N3hJXA<_wo;{KCUAt)1=zjxa!FasCD-|iBgALH28HWu zowB=yZpdVrJ-KXjrAah^``PzbT_;0gbDOe4(@#Qf-8$s3!0O+p{`L3W9|gC2)y$0( zlDrZqo*Xc&<&?c7)pH1~NSh;Qs0D#SR{h)Y1&t?kT_WdQHa_zqgu(oxUb3 z#9~h>Z?a}u$_;Ax`MF)xn!ioMal`X~)qU@;F6|Ea8&=n~`rZ^}$Q~u&7%#VlV96>0 z$*GVCv=O6p+k|#lidy-pb7Mi+-}9thAzqs`>J?gs`whu90kwVNO}d5 zKzj$@G+m5=BvizZEs)jt3U~=~*x&07Vn{mRrnJle4r9Z;n(&`XL`1|RB<09ITTXYR z9hV9{tZ#mA0Uj{*-6=r#&U%Bt;H?2GCOFi^&2w?Ry6S>m2yD;~0i_@|w-yNsE2tqwj2|NoVT32&vUhB8TMo4jP8hK!!ee|?h zwe#0;wk|-@a){~W?d`x#k_P%+C%5+Y zG~P);yX7RaMJFLS&%sx41CQzNeL44MXP?^O|NfR6uvHN9V(&v(0DTkbSQqM@b$y+F zWu@gN<=oXz#6N^TpXXJBSZNV3nI$KX>9pTwP`MFynJKGmE$6DMORVSZgX}W)QrKCR z+v)Eyspm_{$y+o13f2bAdV`2$fi5O7pKfoDGT_S0MJ%S7d|MB^b`8)CXo1e;Oi@aR z%8H=doSUXTI;IBC1C1Aeb#hcli0;Ps2Mr4gg~X@72>Ws7 zgva`cH#7f*PXyjF&9)wr*EE(pq@*l4a_q=XeX(hu;@(r`U%2ApWn~9>1~W z>Lxv4Y4PI89Qaywr1)020xV}*e~B)EoI8bxQ!vXBn5o4|iu^i|GX_+Rz$;L3@R#dS z9Xu!yb$#Ok(4Jo_OLfSx!YGA|07ogXfLd6`nhBkEL$TE10?8B`hEZT{vl}h?I|D);p{K ih2Cg%k{z9m|JfC1Fr>~u#Q1~(2s~Z=T-G@yGywpAViev0 literal 0 HcmV?d00001 diff --git a/SUMMARY.md b/SUMMARY.md index 5bab47bb..d3628df8 100644 --- a/SUMMARY.md +++ b/SUMMARY.md @@ -15,6 +15,7 @@ ## Features * [Overview](features/overview.md) +* [User management](features/user-management.md) * [Zero-Trust VPN with 2FA/MFA](features/wireguard/README.md) * [Create/Manage VPN Location](features/wireguard/create-your-vpn-network/README.md) * [Split Tunnel Configuration](features/wireguard/create-your-vpn-network/split-tunnel-configuration.md) diff --git a/about/features-overview.md b/about/features-overview.md index 71239d37..2815bdec 100644 --- a/about/features-overview.md +++ b/about/features-overview.md @@ -30,6 +30,14 @@ _Defguard is not an official WireGuard project, and WireGuard is a registered tr * Allow or deny access based on users or groups * Changes are applied in **real time** +### [Device posture verification](../features/device-posture-verification.md) + +* Check the security state of a device before it connects to a location +* Minimum operating system, Linux kernel and Defguard client versions +* Disk encryption, antivirus, Active Directory membership and device integrity conditions +* Limits on the age of Windows security updates and Android security patches +* Several checks can be assigned to one location, and a device has to satisfy all of them + ### Identity Management: * [**OpenID Connect**](https://openid.net/developers/how-connect-works/) **based SSO** diff --git a/features/device-posture-verification.md b/features/device-posture-verification.md index ae2d572e..6ebc1446 100644 --- a/features/device-posture-verification.md +++ b/features/device-posture-verification.md @@ -7,11 +7,12 @@ This feature requires an Enterprise plan. See the [pricing page](https://defguar {% endhint %} {% hint style="warning" %} -**Posture verification feature is available starting with Defguard Core v2.1 and Defguard Client v2.1.** +**Posture verification requires Defguard Core 2.1 and a client that supports it:** -Once posture checks are assigned to a location, that location does not appear in Defguard clients older than 2.1. +* **Desktop Client 2.1.0 or newer** on Windows, macOS and Linux +* **Mobile client 1.7.0 or newer** on iOS and Android -Older clients do not support posture verification and cannot access posture-protected locations. +Older clients do not receive the configuration for locations with posture checks assigned, so such a location does not appear in them. See [Desktop Client](../using-defguard-for-end-users/desktop-client/) for what changed in 2.1. {% endhint %} Posture checks let you verify the security state of a user’s device before allowing it to connect to a location. Instead of trusting only the user’s identity, Defguard can also evaluate device requirements such as: @@ -29,7 +30,7 @@ Posture checks let you verify the security state of a user’s device before all * Linux disk encryption status * iOS version * Android version -* Android device integrity status +* Android security patch level age If a posture check fails, the user is shown a list of the unmet requirements: @@ -37,7 +38,7 @@ If a posture check fails, the user is shown a list of the unmet requirements: ## Configuring posture checks -You can view, edit, create, and assign posture checks to locations in the "Posture Checks" section: +You can view, edit, create, and assign posture checks to locations in **Identity & Access → Posture Checks**:

@@ -47,9 +48,13 @@ The section displays a table of all posture checks defined in the system. Clicki ### Creating a new posture check -To create a new posture check, click the “Add new posture check” button above the posture checks table. This launches a wizard that guides you through the configuration step by step. +To create a new posture check, click the "Add new posture check" button above the posture checks table. -In the wizard, you can choose which operating systems the posture check applies to and define the requirements each device must meet. Depending on the selected platform, this can include minimum OS version, security update age, disk encryption, antivirus status, Active Directory membership, or device integrity. You can also set the minimum required Defguard client version and decide whether pre-release client versions are allowed. +#### Step 1: Operating systems + +Click a system to add it to the check. Each system gets its own card, where you set the minimum accepted version and the **Security conditions** available on that platform. + +On Windows and Android you can additionally require the last security update to be no older than 30, 60, 90 or 180 days. {% hint style="warning" %} If you do not configure requirements for a specific operating system, devices running that operating system will not be allowed to connect to locations protected by this posture check. @@ -59,9 +64,31 @@ For example, if a posture check only defines Windows and macOS requirements, Lin
-
+#### Step 2: Defguard client version + +Set the minimum accepted client version, separately for **Desktop** and **Mobile**. + +Enable **Allow users who run pre-release versions of the Defguard client to access the system** if you have users on non-stable builds. + +
+ +#### Step 3: Name and description + +Give the check a name and, optionally, a description. + +
+ +#### Step 4: Summary -Once the rules are configured, the posture check can be saved and [assigned to one or more locations](device-posture-verification.md#assigning-posture-check-to-locations). +Review the conditions the check will enforce, then click **Create posture check**. + +{% hint style="danger" %} +Before the check is created, Defguard asks you to confirm that at least one System Administrator will still meet all the required conditions. If none does, admin access through the protected location can be lost. +{% endhint %} + +
+ +Once the check is saved, [assign it to one or more locations](device-posture-verification.md#assigning-posture-check-to-locations). A check that is not assigned to any location does nothing. ### Editing an existing posture check @@ -73,23 +100,31 @@ To edit one of the existing posture checks, select the "Edit" menu item from the ### Assigning posture check to locations -Posture checks can be assigned to locations in 4 ways: +Posture checks can be assigned to locations in 5 ways: * "Assign to locations" action from the actions menu in the postures table * "Assign to locations" action from the "Actions" menu in the posture details drawer -* [Edit posture form](device-posture-verification.md#editing-an-existing-posture-check) * "Posture Checks" section in the Location edit form +* "Posture check" step of the wizard used when creating a new location
Once a posture check is assigned to a location, every client attempting to connect to that location is verified before access is granted. If multiple posture checks are assigned, the client must satisfy all requirements from all assigned posture checks. The connection is allowed only when every required check passes; if any requirement fails, the client is denied access. +A location cannot have posture checks and be a [service location](service-locations.md) at the same time. + +
+ ### Duplicating a posture check If you want to create a posture check that is similar to an existing one, you can duplicate the existing posture check instead of starting from scratch. This copies its configuration and lets you adjust only the parts that need to be different, saving time and reducing the risk of mistakes. To duplicate a posture check, use the “Duplicate” action from the posture checks table or from the action menu in the posture check details drawer. -
+
The posture check is duplicated and saved immediately, then opened in the edit form. You can modify any settings that should differ from the original and assign the duplicated posture check to the appropriate locations. Duplicated posture checks are not assigned to any locations by default. + +### How checks are evaluated + +Operating system and kernel versions are compared by major version only. A requirement that cannot be evaluated counts as failed. Failed checks are recorded in the [activity log](activity-log/).