From 3fa713253412b1fc890f04599bb9882ec9dafb35 Mon Sep 17 00:00:00 2001
From: Milo Schwartz <mschwartz10612@gmail.com>
Date: Wed, 5 Feb 2025 21:32:49 -0500
Subject: [PATCH 01/35] fix update resource without subdomain

---
 server/routers/resource/updateResource.ts     | 32 +++++++++++--------
 .../resources/ResourcesSplashCard.tsx         |  2 +-
 2 files changed, 20 insertions(+), 14 deletions(-)

diff --git a/server/routers/resource/updateResource.ts b/server/routers/resource/updateResource.ts
index 94958978..f7dcf6ea 100644
--- a/server/routers/resource/updateResource.ts
+++ b/server/routers/resource/updateResource.ts
@@ -175,10 +175,10 @@ export async function updateResource(
             );
         }
 
-        let fullDomain = "";
+        let fullDomain: string | undefined;
         if (updateData.isBaseDomain) {
             fullDomain = org.domain;
-        } else {
+        } else if (updateData.subdomain) {
             fullDomain = `${updateData.subdomain}.${org.domain}`;
         }
 
@@ -187,18 +187,24 @@ export async function updateResource(
             ...(fullDomain && { fullDomain })
         };
 
-        const [existingDomain] = await db
-            .select()
-            .from(resources)
-            .where(eq(resources.fullDomain, fullDomain));
+        if (
+            fullDomain &&
+            (updatePayload.subdomain !== undefined ||
+                updatePayload.isBaseDomain !== undefined)
+        ) {
+            const [existingDomain] = await db
+                .select()
+                .from(resources)
+                .where(eq(resources.fullDomain, fullDomain));
 
-        if (existingDomain && existingDomain.resourceId !== resourceId) {
-            return next(
-                createHttpError(
-                    HttpCode.CONFLICT,
-                    "Resource with that domain already exists"
-                )
-            );
+            if (existingDomain && existingDomain.resourceId !== resourceId) {
+                return next(
+                    createHttpError(
+                        HttpCode.CONFLICT,
+                        "Resource with that domain already exists"
+                    )
+                );
+            }
         }
 
         const updatedResource = await db
diff --git a/src/app/[orgId]/settings/resources/ResourcesSplashCard.tsx b/src/app/[orgId]/settings/resources/ResourcesSplashCard.tsx
index 9f857080..d16a0a57 100644
--- a/src/app/[orgId]/settings/resources/ResourcesSplashCard.tsx
+++ b/src/app/[orgId]/settings/resources/ResourcesSplashCard.tsx
@@ -42,7 +42,7 @@ export const ResourcesSplashCard = () => {
                         Resources
                     </h3>
                     <p className="text-sm">
-                        Resources are proxies to applications running on your private network. Create a resource for any HTTP or HTTPS app on your private network.
+                        Resources are proxies to applications running on your private network. Create a resource for any HTTP/HTTPS or raw TCP/UDP service on your private network.
                         Each resource must be connected to a site to enable private, secure connectivity through an encrypted WireGuard tunnel.
                     </p>
                     <ul className="text-sm text-muted-foreground space-y-2">

From d0704155158b084ff10efa3ba22303f763bd9a7c Mon Sep 17 00:00:00 2001
From: Milo Schwartz <mschwartz10612@gmail.com>
Date: Wed, 5 Feb 2025 21:53:30 -0500
Subject: [PATCH 02/35] fix table page size selector

---
 src/app/[orgId]/settings/access/roles/RolesDataTable.tsx     | 4 ++--
 src/app/[orgId]/settings/access/users/UsersDataTable.tsx     | 4 ++--
 src/app/[orgId]/settings/resources/ResourcesDataTable.tsx    | 4 ++--
 src/app/[orgId]/settings/share-links/ShareLinksDataTable.tsx | 4 ++--
 src/app/[orgId]/settings/sites/SitesDataTable.tsx            | 2 +-
 src/components/DataTablePagination.tsx                       | 3 +--
 6 files changed, 10 insertions(+), 11 deletions(-)

diff --git a/src/app/[orgId]/settings/access/roles/RolesDataTable.tsx b/src/app/[orgId]/settings/access/roles/RolesDataTable.tsx
index 16eb73b2..7d2ef642 100644
--- a/src/app/[orgId]/settings/access/roles/RolesDataTable.tsx
+++ b/src/app/[orgId]/settings/access/roles/RolesDataTable.tsx
@@ -49,11 +49,11 @@ export function RolesDataTable<TData, TValue>({
         getSortedRowModel: getSortedRowModel(),
         onColumnFiltersChange: setColumnFilters,
         getFilteredRowModel: getFilteredRowModel(),
-        state: {
+        initialState: {
             sorting,
             columnFilters,
             pagination: {
-                pageSize: 100,
+                pageSize: 20,
                 pageIndex: 0,
             },
         },
diff --git a/src/app/[orgId]/settings/access/users/UsersDataTable.tsx b/src/app/[orgId]/settings/access/users/UsersDataTable.tsx
index 8e1442e8..8a790a2e 100644
--- a/src/app/[orgId]/settings/access/users/UsersDataTable.tsx
+++ b/src/app/[orgId]/settings/access/users/UsersDataTable.tsx
@@ -49,11 +49,11 @@ export function UsersDataTable<TData, TValue>({
         getSortedRowModel: getSortedRowModel(),
         onColumnFiltersChange: setColumnFilters,
         getFilteredRowModel: getFilteredRowModel(),
-        state: {
+        initialState: {
             sorting,
             columnFilters,
             pagination: {
-                pageSize: 100,
+                pageSize: 20,
                 pageIndex: 0,
             },
         },
diff --git a/src/app/[orgId]/settings/resources/ResourcesDataTable.tsx b/src/app/[orgId]/settings/resources/ResourcesDataTable.tsx
index fdd92fad..8991a7e4 100644
--- a/src/app/[orgId]/settings/resources/ResourcesDataTable.tsx
+++ b/src/app/[orgId]/settings/resources/ResourcesDataTable.tsx
@@ -50,11 +50,11 @@ export function ResourcesDataTable<TData, TValue>({
         getSortedRowModel: getSortedRowModel(),
         onColumnFiltersChange: setColumnFilters,
         getFilteredRowModel: getFilteredRowModel(),
-        state: {
+        initialState: {
             sorting,
             columnFilters,
             pagination: {
-                pageSize: 100,
+                pageSize: 20,
                 pageIndex: 0,
             },
         },
diff --git a/src/app/[orgId]/settings/share-links/ShareLinksDataTable.tsx b/src/app/[orgId]/settings/share-links/ShareLinksDataTable.tsx
index 98fd5001..5e973273 100644
--- a/src/app/[orgId]/settings/share-links/ShareLinksDataTable.tsx
+++ b/src/app/[orgId]/settings/share-links/ShareLinksDataTable.tsx
@@ -50,11 +50,11 @@ export function ShareLinksDataTable<TData, TValue>({
         getSortedRowModel: getSortedRowModel(),
         onColumnFiltersChange: setColumnFilters,
         getFilteredRowModel: getFilteredRowModel(),
-        state: {
+        initialState: {
             sorting,
             columnFilters,
             pagination: {
-                pageSize: 100,
+                pageSize: 20,
                 pageIndex: 0
             }
         }
diff --git a/src/app/[orgId]/settings/sites/SitesDataTable.tsx b/src/app/[orgId]/settings/sites/SitesDataTable.tsx
index 2381cde5..33c54313 100644
--- a/src/app/[orgId]/settings/sites/SitesDataTable.tsx
+++ b/src/app/[orgId]/settings/sites/SitesDataTable.tsx
@@ -50,7 +50,7 @@ export function SitesDataTable<TData, TValue>({
         getSortedRowModel: getSortedRowModel(),
         onColumnFiltersChange: setColumnFilters,
         getFilteredRowModel: getFilteredRowModel(),
-        state: {
+        initialState: {
             sorting,
             columnFilters,
             pagination: {
diff --git a/src/components/DataTablePagination.tsx b/src/components/DataTablePagination.tsx
index 3ea08d7c..d909b7ea 100644
--- a/src/components/DataTablePagination.tsx
+++ b/src/components/DataTablePagination.tsx
@@ -25,7 +25,6 @@ export function DataTablePagination<TData>({
     return (
         <div className="flex items-center justify-between text-muted-foreground">
             <div className="flex items-center space-x-2">
-                <p className="text-sm font-medium">Rows per page</p>
                 <Select
                     value={`${table.getState().pagination.pageSize}`}
                     onValueChange={(value) => {
@@ -38,7 +37,7 @@ export function DataTablePagination<TData>({
                         />
                     </SelectTrigger>
                     <SelectContent side="top">
-                        {[10, 20, 30, 40, 50, 100, 200].map((pageSize) => (
+                        {[10, 20, 30, 40, 50, 100].map((pageSize) => (
                             <SelectItem key={pageSize} value={`${pageSize}`}>
                                 {pageSize}
                             </SelectItem>

From 58a084426bd7faeef83f28ca38791a67839c3a47 Mon Sep 17 00:00:00 2001
From: Milo Schwartz <mschwartz10612@gmail.com>
Date: Wed, 5 Feb 2025 22:00:29 -0500
Subject: [PATCH 03/35] allow logout to fail

---
 server/routers/auth/logout.ts | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/server/routers/auth/logout.ts b/server/routers/auth/logout.ts
index a2e0a7f1..db95c2e6 100644
--- a/server/routers/auth/logout.ts
+++ b/server/routers/auth/logout.ts
@@ -31,7 +31,12 @@ export async function logout(
     }
 
     try {
-        await invalidateSession(session.sessionId);
+        try {
+            await invalidateSession(session.sessionId);
+        } catch (error) {
+            logger.error("Failed to invalidate session", error)
+        }
+
         const isSecure = req.protocol === "https";
         res.setHeader("Set-Cookie", createBlankSessionTokenCookie(isSecure));
 

From 3c7025a327374b8a6d6f1f5af365074fca9bb1cb Mon Sep 17 00:00:00 2001
From: Milo Schwartz <mschwartz10612@gmail.com>
Date: Wed, 5 Feb 2025 22:46:33 -0500
Subject: [PATCH 04/35] add strict rate limit to endpoints that send email

---
 server/routers/auth/requestPasswordReset.ts |  6 +--
 server/routers/external.ts                  | 45 ++++++++++++++++++++-
 2 files changed, 46 insertions(+), 5 deletions(-)

diff --git a/server/routers/auth/requestPasswordReset.ts b/server/routers/auth/requestPasswordReset.ts
index 08d563ad..1e8e5271 100644
--- a/server/routers/auth/requestPasswordReset.ts
+++ b/server/routers/auth/requestPasswordReset.ts
@@ -8,10 +8,8 @@ import { db } from "@server/db";
 import { passwordResetTokens, users } from "@server/db/schema";
 import { eq } from "drizzle-orm";
 import { alphabet, generateRandomString, sha256 } from "oslo/crypto";
-import { encodeHex } from "oslo/encoding";
 import { createDate } from "oslo";
 import logger from "@server/logger";
-import { generateIdFromEntropySize } from "@server/auth/sessions/app";
 import { TimeSpan } from "oslo";
 import config from "@server/lib/config";
 import { sendEmail } from "@server/emails";
@@ -85,7 +83,9 @@ export async function requestPasswordReset(
         const url = `${config.getRawConfig().app.dashboard_url}/auth/reset-password?email=${email}&token=${token}`;
 
         if (!config.getRawConfig().email) {
-            logger.info(`Password reset requested for ${email}. Token: ${token}.`);
+            logger.info(
+                `Password reset requested for ${email}. Token: ${token}.`
+            );
         }
 
         await sendEmail(
diff --git a/server/routers/external.ts b/server/routers/external.ts
index b63f982d..e74e0472 100644
--- a/server/routers/external.ts
+++ b/server/routers/external.ts
@@ -27,6 +27,8 @@ import { verifyUserHasAction } from "../middlewares/verifyUserHasAction";
 import { ActionsEnum } from "@server/auth/actions";
 import { verifyUserIsOrgOwner } from "../middlewares/verifyUserIsOrgOwner";
 import { createNewt, getToken } from "./newt";
+import rateLimit from "express-rate-limit";
+import createHttpError from "http-errors";
 
 // Root routes
 export const unauthenticated = Router();
@@ -452,22 +454,61 @@ authRouter.post(
 );
 authRouter.post("/2fa/disable", verifySessionUserMiddleware, auth.disable2fa);
 authRouter.post("/verify-email", verifySessionMiddleware, auth.verifyEmail);
+
 authRouter.post(
     "/verify-email/request",
     verifySessionMiddleware,
+    rateLimit({
+        windowMs: 15 * 60 * 1000,
+        max: 3,
+        keyGenerator: (req) => `requestEmailVerificationCode:${req.body.email}`,
+        handler: (req, res, next) => {
+            const message = `You can only request an email verification code ${3} times every ${15} minutes. Please try again later.`;
+            return next(createHttpError(HttpCode.TOO_MANY_REQUESTS, message));
+        }
+    }),
     auth.requestEmailVerificationCode
 );
+
 // authRouter.post(
 //     "/change-password",
 //     verifySessionUserMiddleware,
 //     auth.changePassword
 // );
-authRouter.post("/reset-password/request", auth.requestPasswordReset);
+
+authRouter.post(
+    "/reset-password/request",
+    rateLimit({
+        windowMs: 15 * 60 * 1000,
+        max: 3,
+        keyGenerator: (req) => `requestPasswordReset:${req.body.email}`,
+        handler: (req, res, next) => {
+            const message = `You can only request a password reset ${3} times every ${15} minutes. Please try again later.`;
+            return next(createHttpError(HttpCode.TOO_MANY_REQUESTS, message));
+        }
+    }),
+    auth.requestPasswordReset
+);
+
 authRouter.post("/reset-password/", auth.resetPassword);
 
 authRouter.post("/resource/:resourceId/password", resource.authWithPassword);
 authRouter.post("/resource/:resourceId/pincode", resource.authWithPincode);
-authRouter.post("/resource/:resourceId/whitelist", resource.authWithWhitelist);
+
+authRouter.post(
+    "/resource/:resourceId/whitelist",
+    rateLimit({
+        windowMs: 15 * 60 * 1000,
+        max: 10,
+        keyGenerator: (req) => `authWithWhitelist:${req.body.email}`,
+        handler: (req, res, next) => {
+            const message = `You can only request an email OTP ${10} times every ${15} minutes. Please try again later.`;
+            return next(createHttpError(HttpCode.TOO_MANY_REQUESTS, message));
+        }
+    }),
+    resource.authWithWhitelist
+);
+
 authRouter.post(
     "/resource/:resourceId/access-token",
     resource.authWithAccessToken

From befdc3a002a91cbea65915a0f4a98cca54588546 Mon Sep 17 00:00:00 2001
From: Owen <owen@txv.io>
Date: Thu, 6 Feb 2025 21:18:34 -0500
Subject: [PATCH 05/35] Add table

---
 server/db/schema.ts | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/server/db/schema.ts b/server/db/schema.ts
index f44873d1..0e2a2f70 100644
--- a/server/db/schema.ts
+++ b/server/db/schema.ts
@@ -371,6 +371,16 @@ export const versionMigrations = sqliteTable("versionMigrations", {
     executedAt: integer("executedAt").notNull()
 });
 
+export const badgerRules = sqliteTable("badgerRules", {
+    ruleId: integer("ruleId").primaryKey({ autoIncrement: true }),
+    resourceId: integer("resourceId")
+        .notNull()
+        .references(() => resources.resourceId, { onDelete: "cascade" }),
+    action: text("action").notNull(), // ACCEPT, DROP
+    match: text("match").notNull(), // CIDR, PATH
+    value: text("value").notNull()
+});
+
 export type Org = InferSelectModel<typeof orgs>;
 export type User = InferSelectModel<typeof users>;
 export type Site = InferSelectModel<typeof sites>;

From b92639647ae545b507fb9f92588377a5cd27c3f9 Mon Sep 17 00:00:00 2001
From: Owen <owen@txv.io>
Date: Thu, 6 Feb 2025 21:19:55 -0500
Subject: [PATCH 06/35] Add applyRules to resources

---
 server/db/schema.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/server/db/schema.ts b/server/db/schema.ts
index 0e2a2f70..2ae27497 100644
--- a/server/db/schema.ts
+++ b/server/db/schema.ts
@@ -54,7 +54,8 @@ export const resources = sqliteTable("resources", {
     emailWhitelistEnabled: integer("emailWhitelistEnabled", { mode: "boolean" })
         .notNull()
         .default(false),
-    isBaseDomain: integer("isBaseDomain", { mode: "boolean" })
+    isBaseDomain: integer("isBaseDomain", { mode: "boolean" }),
+    applyRules: integer("applyRules", { mode: "boolean" }).notNull().default(false)
 });
 
 export const targets = sqliteTable("targets", {

From 2f49be69fe137d7ca270f1e0e1aec95f4070b810 Mon Sep 17 00:00:00 2001
From: Owen <owen@txv.io>
Date: Thu, 6 Feb 2025 21:42:18 -0500
Subject: [PATCH 07/35] Initial pass at rules

---
 server/db/schema.ts                    |  1 +
 server/routers/badger/verifySession.ts | 51 ++++++++++++++++++++++++++
 2 files changed, 52 insertions(+)

diff --git a/server/db/schema.ts b/server/db/schema.ts
index 2ae27497..7c8c2739 100644
--- a/server/db/schema.ts
+++ b/server/db/schema.ts
@@ -414,3 +414,4 @@ export type ResourceOtp = InferSelectModel<typeof resourceOtp>;
 export type ResourceAccessToken = InferSelectModel<typeof resourceAccessToken>;
 export type ResourceWhitelist = InferSelectModel<typeof resourceWhitelist>;
 export type VersionMigration = InferSelectModel<typeof versionMigrations>;
+export type BadgerRule = InferSelectModel<typeof badgerRules>;
\ No newline at end of file
diff --git a/server/routers/badger/verifySession.ts b/server/routers/badger/verifySession.ts
index 5830d805..a40cfd21 100644
--- a/server/routers/badger/verifySession.ts
+++ b/server/routers/badger/verifySession.ts
@@ -6,6 +6,8 @@ import { fromError } from "zod-validation-error";
 import { response } from "@server/lib/response";
 import db from "@server/db";
 import {
+    BadgerRule,
+    badgerRules,
     ResourceAccessToken,
     ResourcePassword,
     resourcePassword,
@@ -28,6 +30,7 @@ import logger from "@server/logger";
 import { verifyResourceAccessToken } from "@server/auth/verifyResourceAccessToken";
 import NodeCache from "node-cache";
 import { generateSessionToken } from "@server/auth/sessions/app";
+import { isIpInCidr } from "@server/lib/ip";
 
 // We'll see if this speeds anything up
 const cache = new NodeCache({
@@ -79,6 +82,7 @@ export async function verifyResourceSession(
             host,
             originalRequestURL,
             requestIp,
+            path,
             accessToken: token
         } = parsedBody.data;
 
@@ -146,6 +150,15 @@ export async function verifyResourceSession(
             return allowed(res);
         }
 
+        // check the rules
+        if (
+            resource.applyRules &&
+            (await checkRules(resource.resourceId, clientIp, path))
+        ) {
+            logger.debug("Resource allowed because rules are satisfied");
+            return allowed(res);
+        }
+
         const redirectUrl = `${config.getRawConfig().app.dashboard_url}/auth/resource/${encodeURIComponent(resource.resourceId)}?redirect=${encodeURIComponent(originalRequestURL)}`;
 
         // check for access token
@@ -438,3 +451,41 @@ async function isUserAllowedToAccessResource(
 
     return false;
 }
+
+async function checkRules(
+    resourceId: number,
+    clientIp: string | undefined,
+    path: string | undefined
+): Promise<boolean> {
+    const ruleCacheKey = `rules:${resourceId}`;
+
+    let rules: BadgerRule[] | undefined = cache.get(ruleCacheKey);
+
+    if (!rules) {
+        rules = await db
+            .select()
+            .from(badgerRules)
+            .where(eq(badgerRules.resourceId, resourceId));
+
+        cache.set(ruleCacheKey, rules);
+    }
+
+    if (rules.length === 0) {
+        logger.debug("No rules found for resource", resourceId);
+        return false;
+    }
+
+    for (const rule of rules) {
+        if (clientIp && rule.match == "IP" && isIpInCidr(clientIp, rule.value)) {
+            return rule.action == "ACCEPT"; 
+        } else if (path && rule.match == "PATH") {
+            // rule.value is a regex, match on the path and see if it matches
+            const re = new RegExp(rule.value);
+            if (re.test(path)) {
+                return rule.action == "ACCEPT";
+            }
+        }
+    }
+
+    return false;
+}

From 00a0d89d6c6bc0639b71de26ac38f3c0f1a045c3 Mon Sep 17 00:00:00 2001
From: Milo Schwartz <mschwartz10612@gmail.com>
Date: Sat, 8 Feb 2025 12:26:52 -0500
Subject: [PATCH 08/35] add allow_base_domain_resources to installer

---
 config/config.example.yml | 1 +
 install/fs/config.yml     | 1 +
 2 files changed, 2 insertions(+)

diff --git a/config/config.example.yml b/config/config.example.yml
index 50c1a623..de094f03 100644
--- a/config/config.example.yml
+++ b/config/config.example.yml
@@ -41,3 +41,4 @@ flags:
     disable_signup_without_invite: true
     disable_user_create_org: true
     allow_raw_resources: true
+    allow_base_domain_resources: true
diff --git a/install/fs/config.yml b/install/fs/config.yml
index 4a97dbb5..8e4411e7 100644
--- a/install/fs/config.yml
+++ b/install/fs/config.yml
@@ -54,3 +54,4 @@ flags:
     disable_signup_without_invite: {{.DisableSignupWithoutInvite}}
     disable_user_create_org: {{.DisableUserCreateOrg}}
     allow_raw_resources: true
+    allow_base_domain_resources: true

From d8a089fbc2e807af90db89ef1de3344eee93a529 Mon Sep 17 00:00:00 2001
From: Milo Schwartz <mschwartz10612@gmail.com>
Date: Sat, 8 Feb 2025 15:47:01 -0500
Subject: [PATCH 09/35] remove annoying debug log

---
 server/routers/traefik/getTraefikConfig.ts | 2 --
 1 file changed, 2 deletions(-)

diff --git a/server/routers/traefik/getTraefikConfig.ts b/server/routers/traefik/getTraefikConfig.ts
index 98702aae..29a4d2c0 100644
--- a/server/routers/traefik/getTraefikConfig.ts
+++ b/server/routers/traefik/getTraefikConfig.ts
@@ -149,8 +149,6 @@ export async function traefikConfigProvider(
                         : {})
                 };
 
-                logger.debug(config.getRawConfig().traefik.prefer_wildcard_cert)
-
                 const additionalMiddlewares =
                     config.getRawConfig().traefik.additional_middlewares || [];
 

From dc2ec5b73bd50d60a46b016c6e15b33a841ebcbe Mon Sep 17 00:00:00 2001
From: Milo Schwartz <mschwartz10612@gmail.com>
Date: Sat, 8 Feb 2025 15:51:28 -0500
Subject: [PATCH 10/35] add description to whitelist email field

---
 .../settings/resources/[resourceId]/authentication/page.tsx    | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/app/[orgId]/settings/resources/[resourceId]/authentication/page.tsx b/src/app/[orgId]/settings/resources/[resourceId]/authentication/page.tsx
index 64464d60..9c62b156 100644
--- a/src/app/[orgId]/settings/resources/[resourceId]/authentication/page.tsx
+++ b/src/app/[orgId]/settings/resources/[resourceId]/authentication/page.tsx
@@ -732,6 +732,9 @@ export default function ResourceAuthenticationPage() {
                                                             }}
                                                         />
                                                     </FormControl>
+                                                    <FormDescription>
+                                                        Press enter to add an email after typing it in the input field.
+                                                    </FormDescription>
                                                 </FormItem>
                                             )}
                                         />

From ef0bc9a7641825455e45153fa983ce24f41e5bdc Mon Sep 17 00:00:00 2001
From: Milo Schwartz <mschwartz10612@gmail.com>
Date: Sat, 8 Feb 2025 15:55:49 -0500
Subject: [PATCH 11/35] add note about backup codes to mfa form

---
 src/components/LoginForm.tsx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/components/LoginForm.tsx b/src/components/LoginForm.tsx
index cf50ad31..2190e2f5 100644
--- a/src/components/LoginForm.tsx
+++ b/src/components/LoginForm.tsx
@@ -195,7 +195,7 @@ export default function LoginForm({ redirect, onLogin }: LoginFormProps) {
                             Two-Factor Authentication
                         </h3>
                         <p className="text-sm text-muted-foreground">
-                            Enter the code from your authenticator app.
+                            Enter the code from your authenticator app or one of your single-use backup codes.
                         </p>
                     </div>
                     <Form {...mfaForm}>

From b1fa980f560d7b58c65f390fd9a82f5ab0ac8fe2 Mon Sep 17 00:00:00 2001
From: Milo Schwartz <mschwartz10612@gmail.com>
Date: Sat, 8 Feb 2025 16:04:41 -0500
Subject: [PATCH 12/35] expand list of allowed special characters in password

---
 server/auth/passwordSchema.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/server/auth/passwordSchema.ts b/server/auth/passwordSchema.ts
index 5554b741..9c399092 100644
--- a/server/auth/passwordSchema.ts
+++ b/server/auth/passwordSchema.ts
@@ -3,8 +3,8 @@ import z from "zod";
 export const passwordSchema = z
     .string()
     .min(8, { message: "Password must be at least 8 characters long" })
-    .max(64, { message: "Password must be at most 64 characters long" })
-    .regex(/^(?=.*?[A-Z])(?=.*?[a-z])(?=.*?[0-9])(?=.*?[,#?!@$%^&*-]).*$/, {
+    .max(128, { message: "Password must be at most 128 characters long" })
+    .regex(/^(?=.*?[A-Z])(?=.*?[a-z])(?=.*?[0-9])(?=.*?[~!`@#$%^&*()_\-+={}[\]|\\:;"'<>,.\/?]).*$/, {
         message: `Your password must meet the following conditions:
 at least one uppercase English letter,
 at least one lowercase English letter,

From da3c8823f8404d57e7c488931a8e44972d97b28b Mon Sep 17 00:00:00 2001
From: Owen <owen@txv.io>
Date: Sat, 8 Feb 2025 17:02:22 -0500
Subject: [PATCH 13/35] rename to resource rules and add api endpoints

---
 server/auth/actions.ts                        |  17 ++-
 server/db/schema.ts                           |   4 +-
 server/routers/badger/verifySession.ts        |  12 +-
 server/routers/external.ts                    |  21 +++
 server/routers/resource/createResourceRule.ts |  79 +++++++++++
 server/routers/resource/deleteResourceRule.ts |  67 +++++++++
 server/routers/resource/index.ts              |   3 +
 server/routers/resource/listResourceRules.ts  | 133 ++++++++++++++++++
 8 files changed, 321 insertions(+), 15 deletions(-)
 create mode 100644 server/routers/resource/createResourceRule.ts
 create mode 100644 server/routers/resource/deleteResourceRule.ts
 create mode 100644 server/routers/resource/listResourceRules.ts

diff --git a/server/auth/actions.ts b/server/auth/actions.ts
index 8bc7b823..7c0f5d28 100644
--- a/server/auth/actions.ts
+++ b/server/auth/actions.ts
@@ -51,13 +51,16 @@ export enum ActionsEnum {
     // removeUserAction = "removeUserAction",
     // removeUserSite = "removeUserSite",
     getOrgUser = "getOrgUser",
-    "setResourcePassword" = "setResourcePassword",
-    "setResourcePincode" = "setResourcePincode",
-    "setResourceWhitelist" = "setResourceWhitelist",
-    "getResourceWhitelist" = "getResourceWhitelist",
-    "generateAccessToken" = "generateAccessToken",
-    "deleteAcessToken" = "deleteAcessToken",
-    "listAccessTokens" = "listAccessTokens"
+    setResourcePassword = "setResourcePassword",
+    setResourcePincode = "setResourcePincode",
+    setResourceWhitelist = "setResourceWhitelist",
+    getResourceWhitelist = "getResourceWhitelist",
+    generateAccessToken = "generateAccessToken",
+    deleteAcessToken = "deleteAcessToken",
+    listAccessTokens = "listAccessTokens",
+    createResourceRule = "createResourceRule",
+    deleteResourceRule = "deleteResourceRule",
+    listResourceRules = "listResourceRules"
 }
 
 export async function checkUserActionPermission(
diff --git a/server/db/schema.ts b/server/db/schema.ts
index 7c8c2739..cf5ad531 100644
--- a/server/db/schema.ts
+++ b/server/db/schema.ts
@@ -372,7 +372,7 @@ export const versionMigrations = sqliteTable("versionMigrations", {
     executedAt: integer("executedAt").notNull()
 });
 
-export const badgerRules = sqliteTable("badgerRules", {
+export const resourceRules = sqliteTable("resourceRules", {
     ruleId: integer("ruleId").primaryKey({ autoIncrement: true }),
     resourceId: integer("resourceId")
         .notNull()
@@ -414,4 +414,4 @@ export type ResourceOtp = InferSelectModel<typeof resourceOtp>;
 export type ResourceAccessToken = InferSelectModel<typeof resourceAccessToken>;
 export type ResourceWhitelist = InferSelectModel<typeof resourceWhitelist>;
 export type VersionMigration = InferSelectModel<typeof versionMigrations>;
-export type BadgerRule = InferSelectModel<typeof badgerRules>;
\ No newline at end of file
+export type ResourceRule = InferSelectModel<typeof resourceRules>;
\ No newline at end of file
diff --git a/server/routers/badger/verifySession.ts b/server/routers/badger/verifySession.ts
index a40cfd21..12058825 100644
--- a/server/routers/badger/verifySession.ts
+++ b/server/routers/badger/verifySession.ts
@@ -6,8 +6,7 @@ import { fromError } from "zod-validation-error";
 import { response } from "@server/lib/response";
 import db from "@server/db";
 import {
-    BadgerRule,
-    badgerRules,
+    resourceRules,
     ResourceAccessToken,
     ResourcePassword,
     resourcePassword,
@@ -16,7 +15,8 @@ import {
     resources,
     sessions,
     userOrgs,
-    users
+    users,
+    ResourceRule
 } from "@server/db/schema";
 import { and, eq } from "drizzle-orm";
 import config from "@server/lib/config";
@@ -459,13 +459,13 @@ async function checkRules(
 ): Promise<boolean> {
     const ruleCacheKey = `rules:${resourceId}`;
 
-    let rules: BadgerRule[] | undefined = cache.get(ruleCacheKey);
+    let rules: ResourceRule[] | undefined = cache.get(ruleCacheKey);
 
     if (!rules) {
         rules = await db
             .select()
-            .from(badgerRules)
-            .where(eq(badgerRules.resourceId, resourceId));
+            .from(resourceRules)
+            .where(eq(resourceRules.resourceId, resourceId));
 
         cache.set(ruleCacheKey, rules);
     }
diff --git a/server/routers/external.ts b/server/routers/external.ts
index e74e0472..73e32911 100644
--- a/server/routers/external.ts
+++ b/server/routers/external.ts
@@ -186,6 +186,26 @@ authenticated.get(
     verifyUserHasAction(ActionsEnum.listTargets),
     target.listTargets
 );
+
+authenticated.put(
+    "/resource/:resourceId/:ruleId",
+    verifyResourceAccess,
+    verifyUserHasAction(ActionsEnum.createResourceRule),
+    resource.createResourceRule
+);
+authenticated.get(
+    "/resource/:resourceId/rules",
+    verifyResourceAccess,
+    verifyUserHasAction(ActionsEnum.listResourceRules),
+    resource.listResourceRules
+);
+authenticated.delete(
+    "/resource/:resourceId/:ruleId",
+    verifyResourceAccess,
+    verifyUserHasAction(ActionsEnum.deleteResourceRule),
+    resource.deleteResourceRule
+);
+
 authenticated.get(
     "/target/:targetId",
     verifyTargetAccess,
@@ -205,6 +225,7 @@ authenticated.delete(
     target.deleteTarget
 );
 
+
 authenticated.put(
     "/org/:orgId/role",
     verifyOrgAccess,
diff --git a/server/routers/resource/createResourceRule.ts b/server/routers/resource/createResourceRule.ts
new file mode 100644
index 00000000..68578da2
--- /dev/null
+++ b/server/routers/resource/createResourceRule.ts
@@ -0,0 +1,79 @@
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db } from "@server/db";
+import { resourceRules, resources } from "@server/db/schema";
+import { eq } from "drizzle-orm";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+
+const createResourceRuleSchema = z
+    .object({
+        resourceId: z.number().int().positive(),
+        action: z.enum(["ACCEPT", "DROP"]),
+        match: z.enum(["CIDR", "PATH"]),
+        value: z.string().min(1)
+    })
+    .strict();
+
+export async function createResourceRule(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedBody = createResourceRuleSchema.safeParse(req.body);
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedBody.error).toString()
+                )
+            );
+        }
+
+        const { resourceId, action, match, value } = parsedBody.data;
+
+        // Verify that the referenced resource exists
+        const [resource] = await db
+            .select()
+            .from(resources)
+            .where(eq(resources.resourceId, resourceId))
+            .limit(1);
+
+        if (!resource) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Resource with ID ${resourceId} not found`
+                )
+            );
+        }
+
+        // Create the new resource rule
+        const [newRule] = await db
+            .insert(resourceRules)
+            .values({
+                resourceId,
+                action,
+                match,
+                value
+            })
+            .returning();
+
+        return response(res, {
+            data: newRule,
+            success: true,
+            error: false,
+            message: "Resource rule created successfully",
+            status: HttpCode.CREATED
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}
\ No newline at end of file
diff --git a/server/routers/resource/deleteResourceRule.ts b/server/routers/resource/deleteResourceRule.ts
new file mode 100644
index 00000000..9c19ff04
--- /dev/null
+++ b/server/routers/resource/deleteResourceRule.ts
@@ -0,0 +1,67 @@
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db } from "@server/db";
+import { resourceRules, resources } from "@server/db/schema";
+import { eq } from "drizzle-orm";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+
+const deleteResourceRuleSchema = z
+    .object({
+        ruleId: z
+            .string()
+            .transform(Number)
+            .pipe(z.number().int().positive())
+    })
+    .strict();
+
+export async function deleteResourceRule(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = deleteResourceRuleSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { ruleId } = parsedParams.data;
+
+        // Delete the rule and return the deleted record
+        const [deletedRule] = await db
+            .delete(resourceRules)
+            .where(eq(resourceRules.ruleId, ruleId))
+            .returning();
+
+        if (!deletedRule) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Resource rule with ID ${ruleId} not found`
+                )
+            );
+        }
+
+        return response(res, {
+            data: null,
+            success: true,
+            error: false,
+            message: "Resource rule deleted successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}
\ No newline at end of file
diff --git a/server/routers/resource/index.ts b/server/routers/resource/index.ts
index 187d23fe..b3e8016f 100644
--- a/server/routers/resource/index.ts
+++ b/server/routers/resource/index.ts
@@ -18,3 +18,6 @@ export * from "./authWithWhitelist";
 export * from "./authWithAccessToken";
 export * from "./transferResource";
 export * from "./getExchangeToken";
+export * from "./createResourceRule";
+export * from "./deleteResourceRule";
+export * from "./listResourceRules";
\ No newline at end of file
diff --git a/server/routers/resource/listResourceRules.ts b/server/routers/resource/listResourceRules.ts
new file mode 100644
index 00000000..02c774a6
--- /dev/null
+++ b/server/routers/resource/listResourceRules.ts
@@ -0,0 +1,133 @@
+import { db } from "@server/db";
+import { resourceRules, resources } from "@server/db/schema";
+import HttpCode from "@server/types/HttpCode";
+import response from "@server/lib/response";
+import { eq, sql } from "drizzle-orm";
+import { NextFunction, Request, Response } from "express";
+import createHttpError from "http-errors";
+import { z } from "zod";
+import { fromError } from "zod-validation-error";
+import logger from "@server/logger";
+
+const listResourceRulesParamsSchema = z
+    .object({
+        resourceId: z
+            .string()
+            .transform(Number)
+            .pipe(z.number().int().positive())
+    })
+    .strict();
+
+const listResourceRulesSchema = z.object({
+    limit: z
+        .string()
+        .optional()
+        .default("1000")
+        .transform(Number)
+        .pipe(z.number().int().positive()),
+    offset: z
+        .string()
+        .optional()
+        .default("0")
+        .transform(Number)
+        .pipe(z.number().int().nonnegative())
+});
+
+function queryResourceRules(resourceId: number) {
+    let baseQuery = db
+        .select({
+            ruleId: resourceRules.ruleId,
+            resourceId: resourceRules.resourceId,
+            action: resourceRules.action,
+            match: resourceRules.match,
+            value: resourceRules.value,
+            resourceName: resources.name,
+        })
+        .from(resourceRules)
+        .leftJoin(resources, eq(resourceRules.resourceId, resources.resourceId))
+        .where(eq(resourceRules.resourceId, resourceId));
+    
+    return baseQuery;
+}
+
+export type ListResourceRulesResponse = {
+    rules: Awaited<ReturnType<typeof queryResourceRules>>;
+    pagination: { total: number; limit: number; offset: number };
+};
+
+export async function listResourceRules(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedQuery = listResourceRulesSchema.safeParse(req.query);
+        if (!parsedQuery.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedQuery.error)
+                )
+            );
+        }
+        const { limit, offset } = parsedQuery.data;
+
+        const parsedParams = listResourceRulesParamsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error)
+                )
+            );
+        }
+        const { resourceId } = parsedParams.data;
+
+        // Verify the resource exists
+        const [resource] = await db
+            .select()
+            .from(resources)
+            .where(eq(resources.resourceId, resourceId))
+            .limit(1);
+
+        if (!resource) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Resource with ID ${resourceId} not found`
+                )
+            );
+        }
+
+        const baseQuery = queryResourceRules(resourceId);
+        
+        let countQuery = db
+            .select({ count: sql<number>`cast(count(*) as integer)` })
+            .from(resourceRules)
+            .where(eq(resourceRules.resourceId, resourceId));
+
+        const rulesList = await baseQuery.limit(limit).offset(offset);
+        const totalCountResult = await countQuery;
+        const totalCount = totalCountResult[0].count;
+
+        return response<ListResourceRulesResponse>(res, {
+            data: {
+                rules: rulesList,
+                pagination: {
+                    total: totalCount,
+                    limit,
+                    offset
+                }
+            },
+            success: true,
+            error: false,
+            message: "Resource rules retrieved successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}
\ No newline at end of file

From 8f96d0795c4edb0302bcb66da4e3dcc4616e17ad Mon Sep 17 00:00:00 2001
From: Owen <owen@txv.io>
Date: Sat, 8 Feb 2025 17:10:37 -0500
Subject: [PATCH 14/35] Add update

---
 server/auth/actions.ts                        |   3 +-
 server/routers/external.ts                    |   7 +
 server/routers/resource/index.ts              |   3 +-
 server/routers/resource/updateResourceRule.ts | 130 ++++++++++++++++++
 4 files changed, 141 insertions(+), 2 deletions(-)
 create mode 100644 server/routers/resource/updateResourceRule.ts

diff --git a/server/auth/actions.ts b/server/auth/actions.ts
index 7c0f5d28..001b9a6c 100644
--- a/server/auth/actions.ts
+++ b/server/auth/actions.ts
@@ -60,7 +60,8 @@ export enum ActionsEnum {
     listAccessTokens = "listAccessTokens",
     createResourceRule = "createResourceRule",
     deleteResourceRule = "deleteResourceRule",
-    listResourceRules = "listResourceRules"
+    listResourceRules = "listResourceRules",
+    updateResourceRule = "updateResourceRule",
 }
 
 export async function checkUserActionPermission(
diff --git a/server/routers/external.ts b/server/routers/external.ts
index 73e32911..d7934f9e 100644
--- a/server/routers/external.ts
+++ b/server/routers/external.ts
@@ -199,6 +199,13 @@ authenticated.get(
     verifyUserHasAction(ActionsEnum.listResourceRules),
     resource.listResourceRules
 );
+authenticated.post(
+    "/resource/:resourceId/:ruleId",
+    verifyResourceAccess,
+    verifyUserHasAction(ActionsEnum.updateResourceRule),
+    resource.updateResourceRule
+);
+
 authenticated.delete(
     "/resource/:resourceId/:ruleId",
     verifyResourceAccess,
diff --git a/server/routers/resource/index.ts b/server/routers/resource/index.ts
index b3e8016f..03c9ffbe 100644
--- a/server/routers/resource/index.ts
+++ b/server/routers/resource/index.ts
@@ -20,4 +20,5 @@ export * from "./transferResource";
 export * from "./getExchangeToken";
 export * from "./createResourceRule";
 export * from "./deleteResourceRule";
-export * from "./listResourceRules";
\ No newline at end of file
+export * from "./listResourceRules";
+export * from "./updateResourceRule";
\ No newline at end of file
diff --git a/server/routers/resource/updateResourceRule.ts b/server/routers/resource/updateResourceRule.ts
new file mode 100644
index 00000000..f96ea0fa
--- /dev/null
+++ b/server/routers/resource/updateResourceRule.ts
@@ -0,0 +1,130 @@
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db } from "@server/db";
+import { resourceRules, resources } from "@server/db/schema";
+import { eq } from "drizzle-orm";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+
+// Define Zod schema for request parameters validation
+const updateResourceRuleParamsSchema = z
+    .object({
+        ruleId: z
+            .string()
+            .transform(Number)
+            .pipe(z.number().int().positive()),
+        resourceId: z
+            .string()
+            .transform(Number)
+            .pipe(z.number().int().positive())
+    })
+    .strict();
+
+// Define Zod schema for request body validation
+const updateResourceRuleSchema = z
+    .object({
+        action: z.enum(["ACCEPT", "DROP"]).optional(),
+        match: z.enum(["CIDR", "PATH"]).optional(),
+        value: z.string().min(1).optional()
+    })
+    .strict()
+    .refine((data) => Object.keys(data).length > 0, {
+        message: "At least one field must be provided for update"
+    });
+
+export async function updateResourceRule(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        // Validate path parameters
+        const parsedParams = updateResourceRuleParamsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        // Validate request body
+        const parsedBody = updateResourceRuleSchema.safeParse(req.body);
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedBody.error).toString()
+                )
+            );
+        }
+
+        const { ruleId, resourceId } = parsedParams.data;
+        const updateData = parsedBody.data;
+
+        // Verify that the resource exists
+        const [resource] = await db
+            .select()
+            .from(resources)
+            .where(eq(resources.resourceId, resourceId))
+            .limit(1);
+
+        if (!resource) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Resource with ID ${resourceId} not found`
+                )
+            );
+        }
+
+        // Verify that the rule exists and belongs to the specified resource
+        const [existingRule] = await db
+            .select()
+            .from(resourceRules)
+            .where(eq(resourceRules.ruleId, ruleId))
+            .limit(1);
+
+        if (!existingRule) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Resource rule with ID ${ruleId} not found`
+                )
+            );
+        }
+
+        if (existingRule.resourceId !== resourceId) {
+            return next(
+                createHttpError(
+                    HttpCode.FORBIDDEN,
+                    `Resource rule ${ruleId} does not belong to resource ${resourceId}`
+                )
+            );
+        }
+
+        // Update the rule
+        const [updatedRule] = await db
+            .update(resourceRules)
+            .set(updateData)
+            .where(eq(resourceRules.ruleId, ruleId))
+            .returning();
+
+        return response(res, {
+            data: updatedRule,
+            success: true,
+            error: false,
+            message: "Resource rule updated successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}
\ No newline at end of file

From 4a6da91fafd10c9d02934b473ae3cd8cbf73b112 Mon Sep 17 00:00:00 2001
From: Owen <owen@txv.io>
Date: Sat, 8 Feb 2025 17:38:30 -0500
Subject: [PATCH 15/35] API and rule screen working

---
 server/routers/external.ts                    |   7 +-
 server/routers/resource/createResourceRule.ts |  28 +-
 server/routers/resource/deleteResourceRule.ts |   4 +
 server/routers/resource/listResourceRules.ts  |   3 +-
 .../resources/[resourceId]/layout.tsx         |   5 +
 .../resources/[resourceId]/rules/page.tsx     | 452 ++++++++++++++++++
 6 files changed, 490 insertions(+), 9 deletions(-)
 create mode 100644 src/app/[orgId]/settings/resources/[resourceId]/rules/page.tsx

diff --git a/server/routers/external.ts b/server/routers/external.ts
index d7934f9e..19c57008 100644
--- a/server/routers/external.ts
+++ b/server/routers/external.ts
@@ -188,7 +188,7 @@ authenticated.get(
 );
 
 authenticated.put(
-    "/resource/:resourceId/:ruleId",
+    "/resource/:resourceId/rule",
     verifyResourceAccess,
     verifyUserHasAction(ActionsEnum.createResourceRule),
     resource.createResourceRule
@@ -200,14 +200,13 @@ authenticated.get(
     resource.listResourceRules
 );
 authenticated.post(
-    "/resource/:resourceId/:ruleId",
+    "/resource/:resourceId/rule/:ruleId",
     verifyResourceAccess,
     verifyUserHasAction(ActionsEnum.updateResourceRule),
     resource.updateResourceRule
 );
-
 authenticated.delete(
-    "/resource/:resourceId/:ruleId",
+    "/resource/:resourceId/rule/:ruleId",
     verifyResourceAccess,
     verifyUserHasAction(ActionsEnum.deleteResourceRule),
     resource.deleteResourceRule
diff --git a/server/routers/resource/createResourceRule.ts b/server/routers/resource/createResourceRule.ts
index 68578da2..f01ed115 100644
--- a/server/routers/resource/createResourceRule.ts
+++ b/server/routers/resource/createResourceRule.ts
@@ -11,13 +11,21 @@ import { fromError } from "zod-validation-error";
 
 const createResourceRuleSchema = z
     .object({
-        resourceId: z.number().int().positive(),
         action: z.enum(["ACCEPT", "DROP"]),
         match: z.enum(["CIDR", "PATH"]),
         value: z.string().min(1)
     })
     .strict();
 
+const createResourceRuleParamsSchema = z
+    .object({
+        resourceId: z
+            .string()
+            .transform(Number)
+            .pipe(z.number().int().positive())
+    })
+    .strict();
+
 export async function createResourceRule(
     req: Request,
     res: Response,
@@ -34,7 +42,21 @@ export async function createResourceRule(
             );
         }
 
-        const { resourceId, action, match, value } = parsedBody.data;
+        const { action, match, value } = parsedBody.data;
+
+        const parsedParams = createResourceRuleParamsSchema.safeParse(
+            req.params
+        );
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { resourceId } = parsedParams.data;
 
         // Verify that the referenced resource exists
         const [resource] = await db
@@ -76,4 +98,4 @@ export async function createResourceRule(
             createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
         );
     }
-}
\ No newline at end of file
+}
diff --git a/server/routers/resource/deleteResourceRule.ts b/server/routers/resource/deleteResourceRule.ts
index 9c19ff04..b562fc11 100644
--- a/server/routers/resource/deleteResourceRule.ts
+++ b/server/routers/resource/deleteResourceRule.ts
@@ -12,6 +12,10 @@ import { fromError } from "zod-validation-error";
 const deleteResourceRuleSchema = z
     .object({
         ruleId: z
+            .string()
+            .transform(Number)
+            .pipe(z.number().int().positive()),
+        resourceId: z
             .string()
             .transform(Number)
             .pipe(z.number().int().positive())
diff --git a/server/routers/resource/listResourceRules.ts b/server/routers/resource/listResourceRules.ts
index 02c774a6..3364aa4b 100644
--- a/server/routers/resource/listResourceRules.ts
+++ b/server/routers/resource/listResourceRules.ts
@@ -40,8 +40,7 @@ function queryResourceRules(resourceId: number) {
             resourceId: resourceRules.resourceId,
             action: resourceRules.action,
             match: resourceRules.match,
-            value: resourceRules.value,
-            resourceName: resources.name,
+            value: resourceRules.value
         })
         .from(resourceRules)
         .leftJoin(resources, eq(resourceRules.resourceId, resources.resourceId))
diff --git a/src/app/[orgId]/settings/resources/[resourceId]/layout.tsx b/src/app/[orgId]/settings/resources/[resourceId]/layout.tsx
index 5506866e..51b147fe 100644
--- a/src/app/[orgId]/settings/resources/[resourceId]/layout.tsx
+++ b/src/app/[orgId]/settings/resources/[resourceId]/layout.tsx
@@ -99,6 +99,11 @@ export default async function ResourceLayout(props: ResourceLayoutProps) {
             href: `/{orgId}/settings/resources/{resourceId}/authentication`
             // icon: <Shield className="w-4 h-4" />,
         });
+        sidebarNavItems.push({
+            title: "Rules",
+            href: `/{orgId}/settings/resources/{resourceId}/rules`
+            // icon: <Shield className="w-4 h-4" />,
+        });
     }
 
     return (
diff --git a/src/app/[orgId]/settings/resources/[resourceId]/rules/page.tsx b/src/app/[orgId]/settings/resources/[resourceId]/rules/page.tsx
new file mode 100644
index 00000000..2398bf32
--- /dev/null
+++ b/src/app/[orgId]/settings/resources/[resourceId]/rules/page.tsx
@@ -0,0 +1,452 @@
+"use client";
+import { useEffect, useState, use } from "react";
+import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
+import {
+    Select,
+    SelectContent,
+    SelectItem,
+    SelectTrigger,
+    SelectValue
+} from "@/components/ui/select";
+import { AxiosResponse } from "axios";
+import { useForm } from "react-hook-form";
+import { zodResolver } from "@hookform/resolvers/zod";
+import { z } from "zod";
+import {
+    Form,
+    FormControl,
+    FormDescription,
+    FormField,
+    FormItem,
+    FormLabel,
+    FormMessage
+} from "@app/components/ui/form";
+import {
+    ColumnDef,
+    getFilteredRowModel,
+    getSortedRowModel,
+    getPaginationRowModel,
+    getCoreRowModel,
+    useReactTable,
+    flexRender
+} from "@tanstack/react-table";
+import {
+    Table,
+    TableBody,
+    TableCell,
+    TableContainer,
+    TableHead,
+    TableHeader,
+    TableRow
+} from "@app/components/ui/table";
+import { useToast } from "@app/hooks/useToast";
+import { useResourceContext } from "@app/hooks/useResourceContext";
+import { ArrayElement } from "@server/types/ArrayElement";
+import { formatAxiosError } from "@app/lib/api/formatAxiosError";
+import { useEnvContext } from "@app/hooks/useEnvContext";
+import { createApiClient } from "@app/lib/api";
+import {
+    SettingsContainer,
+    SettingsSection,
+    SettingsSectionHeader,
+    SettingsSectionTitle,
+    SettingsSectionDescription,
+    SettingsSectionBody,
+    SettingsSectionFooter
+} from "@app/components/Settings";
+import { ListResourceRulesResponse } from "@server/routers/resource/listResourceRules";
+
+// Schema for rule validation
+const addRuleSchema = z.object({
+    action: z.string(),
+    match: z.string(),
+    value: z.string()
+});
+
+type LocalRule = ArrayElement<ListResourceRulesResponse["rules"]> & {
+    new?: boolean;
+    updated?: boolean;
+};
+
+export default function ResourceRules(props: {
+    params: Promise<{ resourceId: number }>;
+}) {
+    const params = use(props.params);
+    const { toast } = useToast();
+    const { resource } = useResourceContext();
+    const api = createApiClient(useEnvContext());
+    const [rules, setRules] = useState<LocalRule[]>([]);
+    const [rulesToRemove, setRulesToRemove] = useState<number[]>([]);
+    const [loading, setLoading] = useState(false);
+    const [pageLoading, setPageLoading] = useState(true);
+
+    const addRuleForm = useForm({
+        resolver: zodResolver(addRuleSchema),
+        defaultValues: {
+            action: "ACCEPT",
+            match: "CIDR",
+            value: ""
+        }
+    });
+
+    useEffect(() => {
+        const fetchRules = async () => {
+            try {
+                const res = await api.get<AxiosResponse<ListResourceRulesResponse>>(
+                    `/resource/${params.resourceId}/rules`
+                );
+                if (res.status === 200) {
+                    setRules(res.data.data.rules);
+                }
+            } catch (err) {
+                console.error(err);
+                toast({
+                    variant: "destructive",
+                    title: "Failed to fetch rules",
+                    description: formatAxiosError(
+                        err,
+                        "An error occurred while fetching rules"
+                    )
+                });
+            } finally {
+                setPageLoading(false);
+            }
+        };
+        fetchRules();
+    }, []);
+
+    async function addRule(data: z.infer<typeof addRuleSchema>) {
+        const isDuplicate = rules.some(
+            (rule) =>
+                rule.action === data.action &&
+                rule.match === data.match &&
+                rule.value === data.value
+        );
+
+        if (isDuplicate) {
+            toast({
+                variant: "destructive",
+                title: "Duplicate rule",
+                description: "A rule with these settings already exists"
+            });
+            return;
+        }
+
+        const newRule: LocalRule = {
+            ...data,
+            ruleId: new Date().getTime(),
+            new: true,
+            resourceId: resource.resourceId
+        };
+
+        setRules([...rules, newRule]);
+        addRuleForm.reset();
+    }
+
+    const removeRule = (ruleId: number) => {
+        setRules([...rules.filter((rule) => rule.ruleId !== ruleId)]);
+        if (!rules.find((rule) => rule.ruleId === ruleId)?.new) {
+            setRulesToRemove([...rulesToRemove, ruleId]);
+        }
+    };
+
+    async function updateRule(ruleId: number, data: Partial<LocalRule>) {
+        setRules(
+            rules.map((rule) =>
+                rule.ruleId === ruleId
+                    ? { ...rule, ...data, updated: true }
+                    : rule
+            )
+        );
+    }
+
+    async function saveRules() {
+        try {
+            setLoading(true);
+            for (let rule of rules) {
+                const data = {
+                    action: rule.action,
+                    match: rule.match,
+                    value: rule.value
+                };
+
+                if (rule.new) {
+                    await api.put(
+                        `/resource/${params.resourceId}/rule`,
+                        data
+                    );
+                } else if (rule.updated) {
+                    await api.post(
+                        `/resource/${params.resourceId}/rule/${rule.ruleId}`,
+                        data
+                    );
+                }
+            }
+
+            for (const ruleId of rulesToRemove) {
+                await api.delete(
+                    `/resource/${params.resourceId}/rule/${ruleId}`
+                );
+            }
+
+            setRules(rules.map(rule => ({ ...rule, new: false, updated: false })));
+            setRulesToRemove([]);
+
+            toast({
+                title: "Rules updated",
+                description: "Rules updated successfully"
+            });
+        } catch (err) {
+            console.error(err);
+            toast({
+                variant: "destructive",
+                title: "Operation failed",
+                description: formatAxiosError(
+                    err,
+                    "An error occurred during the save operation"
+                )
+            });
+        }
+        setLoading(false);
+    }
+
+    const columns: ColumnDef<LocalRule>[] = [
+        {
+            accessorKey: "action",
+            header: "Action",
+            cell: ({ row }) => (
+                <Select
+                    defaultValue={row.original.action}
+                    onValueChange={(value: "ACCEPT" | "DROP") =>
+                        updateRule(row.original.ruleId, { action: value })
+                    }
+                >
+                    <SelectTrigger className="min-w-[100px]">
+                        {row.original.action}
+                    </SelectTrigger>
+                    <SelectContent>
+                        <SelectItem value="ACCEPT">ACCEPT</SelectItem>
+                        <SelectItem value="DROP">DROP</SelectItem>
+                    </SelectContent>
+                </Select>
+            )
+        },
+        {
+            accessorKey: "match",
+            header: "Match Type",
+            cell: ({ row }) => (
+                <Select
+                    defaultValue={row.original.match}
+                    onValueChange={(value: "CIDR" | "PATH") =>
+                        updateRule(row.original.ruleId, { match: value })
+                    }
+                >
+                    <SelectTrigger className="min-w-[100px]">
+                        {row.original.match}
+                    </SelectTrigger>
+                    <SelectContent>
+                        <SelectItem value="CIDR">CIDR</SelectItem>
+                        <SelectItem value="PATH">PATH</SelectItem>
+                    </SelectContent>
+                </Select>
+            )
+        },
+        {
+            accessorKey: "value",
+            header: "Value",
+            cell: ({ row }) => (
+                <Input
+                    defaultValue={row.original.value}
+                    className="min-w-[200px]"
+                    onBlur={(e) =>
+                        updateRule(row.original.ruleId, {
+                            value: e.target.value
+                        })
+                    }
+                />
+            )
+        },
+        {
+            id: "actions",
+            cell: ({ row }) => (
+                <div className="flex items-center justify-end space-x-2">
+                    <Button
+                        variant="outline"
+                        onClick={() => removeRule(row.original.ruleId)}
+                    >
+                        Delete
+                    </Button>
+                </div>
+            )
+        }
+    ];
+
+    const table = useReactTable({
+        data: rules,
+        columns,
+        getCoreRowModel: getCoreRowModel(),
+        getPaginationRowModel: getPaginationRowModel(),
+        getSortedRowModel: getSortedRowModel(),
+        getFilteredRowModel: getFilteredRowModel()
+    });
+
+    if (pageLoading) {
+        return <></>;
+    }
+
+    return (
+        <SettingsContainer>
+            <SettingsSection>
+                <SettingsSectionHeader>
+                    <SettingsSectionTitle>
+                        Resource Rules Configuration
+                    </SettingsSectionTitle>
+                    <SettingsSectionDescription>
+                        Configure rules to control access to your resource
+                    </SettingsSectionDescription>
+                </SettingsSectionHeader>
+                <SettingsSectionBody>
+                    <Form {...addRuleForm}>
+                        <form
+                            onSubmit={addRuleForm.handleSubmit(addRule)}
+                            className="space-y-4"
+                        >
+                            <div className="grid grid-cols-3 gap-4">
+                                <FormField
+                                    control={addRuleForm.control}
+                                    name="action"
+                                    render={({ field }) => (
+                                        <FormItem>
+                                            <FormLabel>Action</FormLabel>
+                                            <FormControl>
+                                                <Select
+                                                    value={field.value}
+                                                    onValueChange={field.onChange}
+                                                >
+                                                    <SelectTrigger>
+                                                        <SelectValue />
+                                                    </SelectTrigger>
+                                                    <SelectContent>
+                                                        <SelectItem value="ACCEPT">
+                                                            ACCEPT
+                                                        </SelectItem>
+                                                        <SelectItem value="DROP">
+                                                            DROP
+                                                        </SelectItem>
+                                                    </SelectContent>
+                                                </Select>
+                                            </FormControl>
+                                            <FormMessage />
+                                        </FormItem>
+                                    )}
+                                />
+                                <FormField
+                                    control={addRuleForm.control}
+                                    name="match"
+                                    render={({ field }) => (
+                                        <FormItem>
+                                            <FormLabel>Match Type</FormLabel>
+                                            <FormControl>
+                                                <Select
+                                                    value={field.value}
+                                                    onValueChange={field.onChange}
+                                                >
+                                                    <SelectTrigger>
+                                                        <SelectValue />
+                                                    </SelectTrigger>
+                                                    <SelectContent>
+                                                        <SelectItem value="CIDR">
+                                                            CIDR
+                                                        </SelectItem>
+                                                        <SelectItem value="PATH">
+                                                            PATH
+                                                        </SelectItem>
+                                                    </SelectContent>
+                                                </Select>
+                                            </FormControl>
+                                            <FormMessage />
+                                        </FormItem>
+                                    )}
+                                />
+                                <FormField
+                                    control={addRuleForm.control}
+                                    name="value"
+                                    render={({ field }) => (
+                                        <FormItem>
+                                            <FormLabel>Value</FormLabel>
+                                            <FormControl>
+                                                <Input {...field} />
+                                            </FormControl>
+                                            <FormMessage />
+                                            <FormDescription>
+                                                Enter CIDR or path value based on match type
+                                            </FormDescription>
+                                        </FormItem>
+                                    )}
+                                />
+                            </div>
+                            <Button type="submit" variant="outline">
+                                Add Rule
+                            </Button>
+                        </form>
+                    </Form>
+                    <TableContainer>
+                        <Table>
+                            <TableHeader>
+                                {table.getHeaderGroups().map((headerGroup) => (
+                                    <TableRow key={headerGroup.id}>
+                                        {headerGroup.headers.map((header) => (
+                                            <TableHead key={header.id}>
+                                                {header.isPlaceholder
+                                                    ? null
+                                                    : flexRender(
+                                                          header.column.columnDef.header,
+                                                          header.getContext()
+                                                      )}
+                                            </TableHead>
+                                        ))}
+                                    </TableRow>
+                                ))}
+                            </TableHeader>
+                            <TableBody>
+                                {table.getRowModel().rows?.length ? (
+                                    table.getRowModel().rows.map((row) => (
+                                        <TableRow key={row.id}>
+                                            {row.getVisibleCells().map((cell) => (
+                                                <TableCell key={cell.id}>
+                                                    {flexRender(
+                                                        cell.column.columnDef.cell,
+                                                        cell.getContext()
+                                                    )}
+                                                </TableCell>
+                                            ))}
+                                        </TableRow>
+                                    ))
+                                ) : (
+                                    <TableRow>
+                                        <TableCell
+                                            colSpan={columns.length}
+                                            className="h-24 text-center"
+                                        >
+                                            No rules. Add a rule using the form.
+                                        </TableCell>
+                                    </TableRow>
+                                )}
+                            </TableBody>
+                        </Table>
+                    </TableContainer>
+                </SettingsSectionBody>
+                <SettingsSectionFooter>
+                    <Button
+                        onClick={saveRules}
+                        loading={loading}
+                        disabled={loading}
+                    >
+                        Save Rules
+                    </Button>
+                </SettingsSectionFooter>
+            </SettingsSection>
+        </SettingsContainer>
+    );
+}
\ No newline at end of file

From 42434ca8323a63c9ad80ab9432aa000bcba1eb22 Mon Sep 17 00:00:00 2001
From: Owen <owen@txv.io>
Date: Sat, 8 Feb 2025 17:54:01 -0500
Subject: [PATCH 16/35] Add validation

---
 server/routers/badger/verifySession.ts        |  18 ++-
 .../resources/[resourceId]/rules/page.tsx     | 142 +++++++++++++++---
 2 files changed, 138 insertions(+), 22 deletions(-)

diff --git a/server/routers/badger/verifySession.ts b/server/routers/badger/verifySession.ts
index 12058825..39415023 100644
--- a/server/routers/badger/verifySession.ts
+++ b/server/routers/badger/verifySession.ts
@@ -480,7 +480,7 @@ async function checkRules(
             return rule.action == "ACCEPT"; 
         } else if (path && rule.match == "PATH") {
             // rule.value is a regex, match on the path and see if it matches
-            const re = new RegExp(rule.value);
+            const re = urlGlobToRegex(rule.value);
             if (re.test(path)) {
                 return rule.action == "ACCEPT";
             }
@@ -489,3 +489,19 @@ async function checkRules(
 
     return false;
 }
+
+function urlGlobToRegex(pattern: string): RegExp {  
+    // Remove leading slash if present (we'll add it to the regex pattern)
+    pattern = pattern.startsWith('/') ? pattern.slice(1) : pattern;
+  
+    // Escape special regex characters except *
+    const escapedPattern = pattern.replace(/[.+?^${}()|[\]\\]/g, '\\$&');
+  
+    // Replace * with regex pattern for any valid URL segment characters
+    const regexPattern = escapedPattern.replace(/\*/g, '[a-zA-Z0-9_-]+');
+  
+    // Create the final pattern that:
+    // 1. Optionally matches leading slash
+    // 2. Matches the entire string
+    return new RegExp(`^/?${regexPattern}$`);
+  }
\ No newline at end of file
diff --git a/src/app/[orgId]/settings/resources/[resourceId]/rules/page.tsx b/src/app/[orgId]/settings/resources/[resourceId]/rules/page.tsx
index 2398bf32..d74ba6e9 100644
--- a/src/app/[orgId]/settings/resources/[resourceId]/rules/page.tsx
+++ b/src/app/[orgId]/settings/resources/[resourceId]/rules/page.tsx
@@ -93,9 +93,9 @@ export default function ResourceRules(props: {
     useEffect(() => {
         const fetchRules = async () => {
             try {
-                const res = await api.get<AxiosResponse<ListResourceRulesResponse>>(
-                    `/resource/${params.resourceId}/rules`
-                );
+                const res = await api.get<
+                    AxiosResponse<ListResourceRulesResponse>
+                >(`/resource/${params.resourceId}/rules`);
                 if (res.status === 200) {
                     setRules(res.data.data.rules);
                 }
@@ -133,6 +133,25 @@ export default function ResourceRules(props: {
             return;
         }
 
+        if (data.match === "CIDR" && !isValidCIDR(data.value)) {
+            toast({
+                variant: "destructive",
+                title: "Invalid CIDR",
+                description: "Please enter a valid CIDR value"
+            });
+            setLoading(false);
+            return;
+        }
+        if (data.match === "PATH" && !isValidUrlGlobPattern(data.value)) {
+            toast({
+                variant: "destructive",
+                title: "Invalid URL path",
+                description: "Please enter a valid URL path value"
+            });
+            setLoading(false);
+            return;
+        }
+
         const newRule: LocalRule = {
             ...data,
             ruleId: new Date().getTime(),
@@ -171,11 +190,27 @@ export default function ResourceRules(props: {
                     value: rule.value
                 };
 
+                if (rule.match === "CIDR" && !isValidCIDR(rule.value)) {
+                    toast({
+                        variant: "destructive",
+                        title: "Invalid CIDR",
+                        description: "Please enter a valid CIDR value"
+                    });
+                    setLoading(false);
+                    return;
+                }
+                if (rule.match === "PATH" && !isValidUrlGlobPattern(rule.value)) {
+                    toast({
+                        variant: "destructive",
+                        title: "Invalid URL path",
+                        description: "Please enter a valid URL path value"
+                    });
+                    setLoading(false);
+                    return;
+                }
+
                 if (rule.new) {
-                    await api.put(
-                        `/resource/${params.resourceId}/rule`,
-                        data
-                    );
+                    await api.put(`/resource/${params.resourceId}/rule`, data);
                 } else if (rule.updated) {
                     await api.post(
                         `/resource/${params.resourceId}/rule/${rule.ruleId}`,
@@ -190,7 +225,9 @@ export default function ResourceRules(props: {
                 );
             }
 
-            setRules(rules.map(rule => ({ ...rule, new: false, updated: false })));
+            setRules(
+                rules.map((rule) => ({ ...rule, new: false, updated: false }))
+            );
             setRulesToRemove([]);
 
             toast({
@@ -322,7 +359,9 @@ export default function ResourceRules(props: {
                                             <FormControl>
                                                 <Select
                                                     value={field.value}
-                                                    onValueChange={field.onChange}
+                                                    onValueChange={
+                                                        field.onChange
+                                                    }
                                                 >
                                                     <SelectTrigger>
                                                         <SelectValue />
@@ -350,7 +389,9 @@ export default function ResourceRules(props: {
                                             <FormControl>
                                                 <Select
                                                     value={field.value}
-                                                    onValueChange={field.onChange}
+                                                    onValueChange={
+                                                        field.onChange
+                                                    }
                                                 >
                                                     <SelectTrigger>
                                                         <SelectValue />
@@ -380,7 +421,8 @@ export default function ResourceRules(props: {
                                             </FormControl>
                                             <FormMessage />
                                             <FormDescription>
-                                                Enter CIDR or path value based on match type
+                                                Enter CIDR or path value based
+                                                on match type
                                             </FormDescription>
                                         </FormItem>
                                     )}
@@ -401,7 +443,8 @@ export default function ResourceRules(props: {
                                                 {header.isPlaceholder
                                                     ? null
                                                     : flexRender(
-                                                          header.column.columnDef.header,
+                                                          header.column
+                                                              .columnDef.header,
                                                           header.getContext()
                                                       )}
                                             </TableHead>
@@ -413,14 +456,17 @@ export default function ResourceRules(props: {
                                 {table.getRowModel().rows?.length ? (
                                     table.getRowModel().rows.map((row) => (
                                         <TableRow key={row.id}>
-                                            {row.getVisibleCells().map((cell) => (
-                                                <TableCell key={cell.id}>
-                                                    {flexRender(
-                                                        cell.column.columnDef.cell,
-                                                        cell.getContext()
-                                                    )}
-                                                </TableCell>
-                                            ))}
+                                            {row
+                                                .getVisibleCells()
+                                                .map((cell) => (
+                                                    <TableCell key={cell.id}>
+                                                        {flexRender(
+                                                            cell.column
+                                                                .columnDef.cell,
+                                                            cell.getContext()
+                                                        )}
+                                                    </TableCell>
+                                                ))}
                                         </TableRow>
                                     ))
                                 ) : (
@@ -449,4 +495,58 @@ export default function ResourceRules(props: {
             </SettingsSection>
         </SettingsContainer>
     );
-}
\ No newline at end of file
+}
+
+function isValidCIDR(cidr: string): boolean {
+    // Match CIDR pattern (e.g., "192.168.0.0/24")
+    const cidrPattern =
+        /^([0-9]{1,3}\.){3}[0-9]{1,3}\/([0-9]|[1-2][0-9]|3[0-2])$/;
+
+    if (!cidrPattern.test(cidr)) {
+        return false;
+    }
+
+    // Validate IP address part
+    const ipPart = cidr.split("/")[0];
+    const octets = ipPart.split(".");
+
+    return octets.every((octet) => {
+        const num = parseInt(octet, 10);
+        return num >= 0 && num <= 255;
+    });
+}
+
+function isValidUrlGlobPattern(pattern: string): boolean {
+    // Remove leading slash if present
+    pattern = pattern.startsWith('/') ? pattern.slice(1) : pattern;
+    
+    // Empty string is not valid
+    if (!pattern) {
+      return false;
+    }
+  
+    // Split path into segments
+    const segments = pattern.split('/');
+    
+    // Check each segment
+    for (let i = 0; i < segments.length; i++) {
+      const segment = segments[i];
+      
+      // Empty segments are not allowed (double slashes)
+      if (!segment && i !== segments.length - 1) {
+        return false;
+      }
+      
+      // If segment contains *, it must be exactly *
+      if (segment.includes('*') && segment !== '*') {
+        return false;
+      }
+      
+      // Check for invalid characters
+      if (!/^[a-zA-Z0-9_*-]*$/.test(segment)) {
+        return false;
+      }
+    }
+    
+    return true;
+  }
\ No newline at end of file

From 874c67345ee353bf5357b67a9ec26a1c7ed084a5 Mon Sep 17 00:00:00 2001
From: Owen <owen@txv.io>
Date: Sun, 9 Feb 2025 10:50:43 -0500
Subject: [PATCH 17/35] Adjust rule processing

---
 server/routers/badger/verifySession.ts | 54 ++++++++++++++++----------
 1 file changed, 34 insertions(+), 20 deletions(-)

diff --git a/server/routers/badger/verifySession.ts b/server/routers/badger/verifySession.ts
index 39415023..8e120dbf 100644
--- a/server/routers/badger/verifySession.ts
+++ b/server/routers/badger/verifySession.ts
@@ -151,12 +151,22 @@ export async function verifyResourceSession(
         }
 
         // check the rules
-        if (
-            resource.applyRules &&
-            (await checkRules(resource.resourceId, clientIp, path))
-        ) {
-            logger.debug("Resource allowed because rules are satisfied");
-            return allowed(res);
+        if (resource.applyRules) {
+            const action = await checkRules(
+                resource.resourceId,
+                clientIp,
+                path
+            );
+
+            if (action == "ACCEPT") {
+                logger.debug("Resource allowed by rule");
+                return allowed(res);
+            } else if (action == "DROP") {
+                logger.debug("Resource denied by rule");
+                return notAllowed(res);
+            }
+
+            // otherwise its undefined and we pass
         }
 
         const redirectUrl = `${config.getRawConfig().app.dashboard_url}/auth/resource/${encodeURIComponent(resource.resourceId)}?redirect=${encodeURIComponent(originalRequestURL)}`;
@@ -456,7 +466,7 @@ async function checkRules(
     resourceId: number,
     clientIp: string | undefined,
     path: string | undefined
-): Promise<boolean> {
+): Promise<"ACCEPT" | "DROP" | undefined> {
     const ruleCacheKey = `rules:${resourceId}`;
 
     let rules: ResourceRule[] | undefined = cache.get(ruleCacheKey);
@@ -472,36 +482,40 @@ async function checkRules(
 
     if (rules.length === 0) {
         logger.debug("No rules found for resource", resourceId);
-        return false;
+        return;
     }
 
     for (const rule of rules) {
-        if (clientIp && rule.match == "IP" && isIpInCidr(clientIp, rule.value)) {
-            return rule.action == "ACCEPT"; 
+        if (
+            clientIp &&
+            rule.match == "IP" &&
+            isIpInCidr(clientIp, rule.value)
+        ) {
+            return rule.action as "ACCEPT" | "DROP";
         } else if (path && rule.match == "PATH") {
             // rule.value is a regex, match on the path and see if it matches
             const re = urlGlobToRegex(rule.value);
             if (re.test(path)) {
-                return rule.action == "ACCEPT";
+                return rule.action as "ACCEPT" | "DROP";
             }
         }
     }
 
-    return false;
+    return;
 }
 
-function urlGlobToRegex(pattern: string): RegExp {  
+function urlGlobToRegex(pattern: string): RegExp {
     // Remove leading slash if present (we'll add it to the regex pattern)
-    pattern = pattern.startsWith('/') ? pattern.slice(1) : pattern;
-  
+    pattern = pattern.startsWith("/") ? pattern.slice(1) : pattern;
+
     // Escape special regex characters except *
-    const escapedPattern = pattern.replace(/[.+?^${}()|[\]\\]/g, '\\$&');
-  
+    const escapedPattern = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
+
     // Replace * with regex pattern for any valid URL segment characters
-    const regexPattern = escapedPattern.replace(/\*/g, '[a-zA-Z0-9_-]+');
-  
+    const regexPattern = escapedPattern.replace(/\*/g, "[a-zA-Z0-9_-]+");
+
     // Create the final pattern that:
     // 1. Optionally matches leading slash
     // 2. Matches the entire string
     return new RegExp(`^/?${regexPattern}$`);
-  }
\ No newline at end of file
+}

From 9694261f3e2cc285bd2418ac193713f9a84f57b7 Mon Sep 17 00:00:00 2001
From: Owen <owen@txv.io>
Date: Sun, 9 Feb 2025 11:02:40 -0500
Subject: [PATCH 18/35] Add enable rules toggle

---
 server/routers/resource/updateResource.ts     |   3 +-
 .../[resourceId]/connectivity/page.tsx        |  37 ++++--
 .../resources/[resourceId]/rules/page.tsx     | 125 +++++++++++++-----
 3 files changed, 121 insertions(+), 44 deletions(-)

diff --git a/server/routers/resource/updateResource.ts b/server/routers/resource/updateResource.ts
index f7dcf6ea..cc48894b 100644
--- a/server/routers/resource/updateResource.ts
+++ b/server/routers/resource/updateResource.ts
@@ -29,7 +29,8 @@ const updateResourceBodySchema = z
         blockAccess: z.boolean().optional(),
         proxyPort: z.number().int().min(1).max(65535).optional(),
         emailWhitelistEnabled: z.boolean().optional(),
-        isBaseDomain: z.boolean().optional()
+        isBaseDomain: z.boolean().optional(),
+        applyRules: z.boolean().optional(),
     })
     .strict()
     .refine((data) => Object.keys(data).length > 0, {
diff --git a/src/app/[orgId]/settings/resources/[resourceId]/connectivity/page.tsx b/src/app/[orgId]/settings/resources/[resourceId]/connectivity/page.tsx
index 7cc21914..0e853194 100644
--- a/src/app/[orgId]/settings/resources/[resourceId]/connectivity/page.tsx
+++ b/src/app/[orgId]/settings/resources/[resourceId]/connectivity/page.tsx
@@ -131,7 +131,7 @@ export default function ReverseProxyTargets(props: {
         resolver: zodResolver(addTargetSchema),
         defaultValues: {
             ip: "",
-            method: resource.http ? "http" : null,
+            method: resource.http ? "http" : null
             // protocol: "TCP",
         } as z.infer<typeof addTargetSchema>
     });
@@ -316,17 +316,31 @@ export default function ReverseProxyTargets(props: {
     }
 
     async function saveSsl(val: boolean) {
-        const res = await api.post(`/resource/${params.resourceId}`, {
-            ssl: val
-        });
+        const res = await api
+            .post(`/resource/${params.resourceId}`, {
+                ssl: val
+            })
+            .catch((err) => {
+                console.error(err);
+                toast({
+                    variant: "destructive",
+                    title: "Failed to update SSL configuration",
+                    description: formatAxiosError(
+                        err,
+                        "An error occurred while updating the SSL configuration"
+                    )
+                });
+            });
 
-        setSslEnabled(val);
-        updateResource({ ssl: val });
+        if (res && res.status === 200) {
+            setSslEnabled(val);
+            updateResource({ ssl: val });
 
-        toast({
-            title: "SSL Configuration",
-            description: "SSL configuration updated successfully"
-        });
+            toast({
+                title: "SSL Configuration",
+                description: "SSL configuration updated successfully"
+            });
+        }
     }
 
     const columns: ColumnDef<LocalTarget>[] = [
@@ -652,7 +666,8 @@ export default function ReverseProxyTargets(props: {
                         </Table>
                     </TableContainer>
                     <p className="text-sm text-muted-foreground">
-                        Adding more than one target above will enable load balancing.
+                        Adding more than one target above will enable load
+                        balancing.
                     </p>
                 </SettingsSectionBody>
                 <SettingsSectionFooter>
diff --git a/src/app/[orgId]/settings/resources/[resourceId]/rules/page.tsx b/src/app/[orgId]/settings/resources/[resourceId]/rules/page.tsx
index d74ba6e9..ac863c5a 100644
--- a/src/app/[orgId]/settings/resources/[resourceId]/rules/page.tsx
+++ b/src/app/[orgId]/settings/resources/[resourceId]/rules/page.tsx
@@ -56,6 +56,7 @@ import {
     SettingsSectionFooter
 } from "@app/components/Settings";
 import { ListResourceRulesResponse } from "@server/routers/resource/listResourceRules";
+import { SwitchInput } from "@app/components/SwitchInput";
 
 // Schema for rule validation
 const addRuleSchema = z.object({
@@ -74,12 +75,13 @@ export default function ResourceRules(props: {
 }) {
     const params = use(props.params);
     const { toast } = useToast();
-    const { resource } = useResourceContext();
+    const { resource, updateResource } = useResourceContext();
     const api = createApiClient(useEnvContext());
     const [rules, setRules] = useState<LocalRule[]>([]);
     const [rulesToRemove, setRulesToRemove] = useState<number[]>([]);
     const [loading, setLoading] = useState(false);
     const [pageLoading, setPageLoading] = useState(true);
+    const [rulesEnabled, setRulesEnabled] = useState(resource.applyRules);
 
     const addRuleForm = useForm({
         resolver: zodResolver(addRuleSchema),
@@ -180,6 +182,34 @@ export default function ResourceRules(props: {
         );
     }
 
+    async function saveApplyRules(val: boolean) {
+        const res = await api
+            .post(`/resource/${params.resourceId}`, {
+                applyRules: val
+            })
+            .catch((err) => {
+                console.error(err);
+                toast({
+                    variant: "destructive",
+                    title: "Failed to update rules",
+                    description: formatAxiosError(
+                        err,
+                        "An error occurred while updating rules"
+                    )
+                });
+            });
+
+        if (res && res.status === 200) {
+            setRulesEnabled(val);
+            updateResource({ applyRules: val });
+
+            toast({
+                title: "Enable Rules",
+                description: "Rule evaluation has been updated"
+            });
+        }
+    }
+
     async function saveRules() {
         try {
             setLoading(true);
@@ -199,7 +229,10 @@ export default function ResourceRules(props: {
                     setLoading(false);
                     return;
                 }
-                if (rule.match === "PATH" && !isValidUrlGlobPattern(rule.value)) {
+                if (
+                    rule.match === "PATH" &&
+                    !isValidUrlGlobPattern(rule.value)
+                ) {
                     toast({
                         variant: "destructive",
                         title: "Invalid URL path",
@@ -334,6 +367,25 @@ export default function ResourceRules(props: {
 
     return (
         <SettingsContainer>
+            <SettingsSection>
+                <SettingsSectionHeader>
+                    <SettingsSectionTitle>Enable Rules</SettingsSectionTitle>
+                    <SettingsSectionDescription>
+                        Enable or disable rule evaluation for this resource
+                    </SettingsSectionDescription>
+                </SettingsSectionHeader>
+                <SettingsSectionBody>
+                    <SwitchInput
+                        id="rules-toggle"
+                        label="Enable Rules"
+                        defaultChecked={resource.applyRules}
+                        onCheckedChange={async (val) => {
+                            await saveApplyRules(val);
+                        }}
+                    />
+                </SettingsSectionBody>
+            </SettingsSection>
+
             <SettingsSection>
                 <SettingsSectionHeader>
                     <SettingsSectionTitle>
@@ -400,9 +452,11 @@ export default function ResourceRules(props: {
                                                         <SelectItem value="CIDR">
                                                             CIDR
                                                         </SelectItem>
-                                                        <SelectItem value="PATH">
-                                                            PATH
-                                                        </SelectItem>
+                                                        {resource.http && (
+                                                            <SelectItem value="PATH">
+                                                                PATH
+                                                            </SelectItem>
+                                                        )}
                                                     </SelectContent>
                                                 </Select>
                                             </FormControl>
@@ -421,14 +475,21 @@ export default function ResourceRules(props: {
                                             </FormControl>
                                             <FormMessage />
                                             <FormDescription>
-                                                Enter CIDR or path value based
-                                                on match type
+                                                Enter CIDR{" "}
+                                                {resource.http
+                                                    ? "or path value"
+                                                    : ""}{" "}
+                                                based on match type
                                             </FormDescription>
                                         </FormItem>
                                     )}
                                 />
                             </div>
-                            <Button type="submit" variant="outline">
+                            <Button
+                                type="submit"
+                                variant="outline"
+                                disabled={loading || !rulesEnabled}
+                            >
                                 Add Rule
                             </Button>
                         </form>
@@ -518,35 +579,35 @@ function isValidCIDR(cidr: string): boolean {
 
 function isValidUrlGlobPattern(pattern: string): boolean {
     // Remove leading slash if present
-    pattern = pattern.startsWith('/') ? pattern.slice(1) : pattern;
-    
+    pattern = pattern.startsWith("/") ? pattern.slice(1) : pattern;
+
     // Empty string is not valid
     if (!pattern) {
-      return false;
+        return false;
     }
-  
+
     // Split path into segments
-    const segments = pattern.split('/');
-    
+    const segments = pattern.split("/");
+
     // Check each segment
     for (let i = 0; i < segments.length; i++) {
-      const segment = segments[i];
-      
-      // Empty segments are not allowed (double slashes)
-      if (!segment && i !== segments.length - 1) {
-        return false;
-      }
-      
-      // If segment contains *, it must be exactly *
-      if (segment.includes('*') && segment !== '*') {
-        return false;
-      }
-      
-      // Check for invalid characters
-      if (!/^[a-zA-Z0-9_*-]*$/.test(segment)) {
-        return false;
-      }
+        const segment = segments[i];
+
+        // Empty segments are not allowed (double slashes)
+        if (!segment && i !== segments.length - 1) {
+            return false;
+        }
+
+        // If segment contains *, it must be exactly *
+        if (segment.includes("*") && segment !== "*") {
+            return false;
+        }
+
+        // Check for invalid characters
+        if (!/^[a-zA-Z0-9_*-]*$/.test(segment)) {
+            return false;
+        }
     }
-    
+
     return true;
-  }
\ No newline at end of file
+}

From 73798f9e61d0b3948465a74d047377dde23230a9 Mon Sep 17 00:00:00 2001
From: Owen <owen@txv.io>
Date: Sun, 9 Feb 2025 11:05:42 -0500
Subject: [PATCH 19/35] Add ecr login

---
 Makefile | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/Makefile b/Makefile
index da0ce742..02d97f3c 100644
--- a/Makefile
+++ b/Makefile
@@ -12,6 +12,9 @@ build-arm:
 build-x86:
 	docker buildx build --platform linux/amd64 -t fosrl/pangolin:latest .
 
+auth-ecr:
+	aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws/g5j5p7x0
+
 build-x86-ecr:
 	docker buildx build --platform linux/amd64 -t 216989133116.dkr.ecr.us-east-1.amazonaws.com/pangolin:latest --push .
 

From c415ceef8d188c30792075d2d360cb04d53d8c26 Mon Sep 17 00:00:00 2001
From: Owen <owen@txv.io>
Date: Sun, 9 Feb 2025 11:10:19 -0500
Subject: [PATCH 20/35] Add migrations

---
 server/setup/migrations.ts           |  4 +++-
 server/setup/scripts/1.0.0-beta13.ts | 29 ++++++++++++++++++++++++++++
 2 files changed, 32 insertions(+), 1 deletion(-)
 create mode 100644 server/setup/scripts/1.0.0-beta13.ts

diff --git a/server/setup/migrations.ts b/server/setup/migrations.ts
index 5581fc24..52a82ad4 100644
--- a/server/setup/migrations.ts
+++ b/server/setup/migrations.ts
@@ -14,6 +14,7 @@ import m5 from "./scripts/1.0.0-beta6";
 import m6 from "./scripts/1.0.0-beta9";
 import m7 from "./scripts/1.0.0-beta10";
 import m8 from "./scripts/1.0.0-beta12";
+import m13 from "./scripts/1.0.0-beta13";
 
 // THIS CANNOT IMPORT ANYTHING FROM THE SERVER
 // EXCEPT FOR THE DATABASE AND THE SCHEMA
@@ -27,7 +28,8 @@ const migrations = [
     { version: "1.0.0-beta.6", run: m5 },
     { version: "1.0.0-beta.9", run: m6 },
     { version: "1.0.0-beta.10", run: m7 },
-    { version: "1.0.0-beta.12", run: m8 }
+    { version: "1.0.0-beta.12", run: m8 },
+    { version: "1.0.0-beta.13", run: m13 }
     // Add new migrations here as they are created
 ] as const;
 
diff --git a/server/setup/scripts/1.0.0-beta13.ts b/server/setup/scripts/1.0.0-beta13.ts
new file mode 100644
index 00000000..26dac8f9
--- /dev/null
+++ b/server/setup/scripts/1.0.0-beta13.ts
@@ -0,0 +1,29 @@
+import db from "@server/db";
+import { sql } from "drizzle-orm";
+
+export default async function migration() {
+    console.log("Running setup script 1.0.0-beta.13...");
+
+    try {
+        db.transaction((trx) => {
+            trx.run(sql`CREATE TABLE resourceRules (
+                ruleId integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+                resourceId integer NOT NULL,
+                action text NOT NULL,
+                match text NOT NULL,
+                value text NOT NULL,
+                FOREIGN KEY (resourceId) REFERENCES resources(resourceId) ON UPDATE no action ON DELETE cascade
+            );`);
+            trx.run(
+                sql`ALTER TABLE resources ADD applyRules integer DEFAULT false NOT NULL;`
+            );
+        });
+
+        console.log(`Added new table and column: resourceRules, applyRules`);
+    } catch (e) {
+        console.log("Unable to add new table and column: resourceRules, applyRules");
+        throw e;
+    }
+
+    console.log("Done.");
+}

From 34e3fe690d516dff20049723d9c6c090413e9ef2 Mon Sep 17 00:00:00 2001
From: Owen <owen@txv.io>
Date: Sun, 9 Feb 2025 11:33:40 -0500
Subject: [PATCH 21/35] Fix check on string

---
 server/routers/badger/verifySession.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/routers/badger/verifySession.ts b/server/routers/badger/verifySession.ts
index 8e120dbf..4515e981 100644
--- a/server/routers/badger/verifySession.ts
+++ b/server/routers/badger/verifySession.ts
@@ -488,7 +488,7 @@ async function checkRules(
     for (const rule of rules) {
         if (
             clientIp &&
-            rule.match == "IP" &&
+            rule.match == "CIDR" &&
             isIpInCidr(clientIp, rule.value)
         ) {
             return rule.action as "ACCEPT" | "DROP";

From 2428738fa6ea36823fcdd8afe17b29f4c0029117 Mon Sep 17 00:00:00 2001
From: Owen <owen@txv.io>
Date: Sun, 9 Feb 2025 21:47:59 -0500
Subject: [PATCH 22/35] Fix missing ruleId issue

---
 .../[resourceId]/connectivity/page.tsx        |  4 ++--
 .../resources/[resourceId]/rules/page.tsx     | 24 ++++++++++++++-----
 2 files changed, 20 insertions(+), 8 deletions(-)

diff --git a/src/app/[orgId]/settings/resources/[resourceId]/connectivity/page.tsx b/src/app/[orgId]/settings/resources/[resourceId]/connectivity/page.tsx
index 0e853194..b3b26a5a 100644
--- a/src/app/[orgId]/settings/resources/[resourceId]/connectivity/page.tsx
+++ b/src/app/[orgId]/settings/resources/[resourceId]/connectivity/page.tsx
@@ -269,7 +269,7 @@ export default function ReverseProxyTargets(props: {
                     >(`/resource/${params.resourceId}/target`, data);
                     target.targetId = res.data.data.targetId;
                 } else if (target.updated) {
-                    const res = await api.post(
+                    await api.post(
                         `/target/${target.targetId}`,
                         data
                     );
@@ -290,7 +290,7 @@ export default function ReverseProxyTargets(props: {
             for (const targetId of targetsToRemove) {
                 await api.delete(`/target/${targetId}`);
                 setTargets(
-                    targets.filter((target) => target.targetId !== targetId)
+                    targets.filter((t) => t.targetId !== targetId)
                 );
             }
 
diff --git a/src/app/[orgId]/settings/resources/[resourceId]/rules/page.tsx b/src/app/[orgId]/settings/resources/[resourceId]/rules/page.tsx
index ac863c5a..b5038b36 100644
--- a/src/app/[orgId]/settings/resources/[resourceId]/rules/page.tsx
+++ b/src/app/[orgId]/settings/resources/[resourceId]/rules/page.tsx
@@ -243,30 +243,42 @@ export default function ResourceRules(props: {
                 }
 
                 if (rule.new) {
-                    await api.put(`/resource/${params.resourceId}/rule`, data);
+                    const res = await api.put(`/resource/${params.resourceId}/rule`, data);
+                    rule.ruleId = res.data.data.ruleId;
                 } else if (rule.updated) {
                     await api.post(
                         `/resource/${params.resourceId}/rule/${rule.ruleId}`,
                         data
                     );
                 }
+
+                setRules([
+                    ...rules.map((r) => {
+                        let res = {
+                            ...r,
+                            new: false,
+                            updated: false
+                        };
+                        return res;
+                    })
+                ]);
             }
 
             for (const ruleId of rulesToRemove) {
                 await api.delete(
                     `/resource/${params.resourceId}/rule/${ruleId}`
                 );
+                setRules(
+                    rules.filter((r) => r.ruleId !== ruleId)
+                );
             }
 
-            setRules(
-                rules.map((rule) => ({ ...rule, new: false, updated: false }))
-            );
-            setRulesToRemove([]);
-
             toast({
                 title: "Rules updated",
                 description: "Rules updated successfully"
             });
+
+            setRulesToRemove([]);
         } catch (err) {
             console.error(err);
             toast({

From 5e92aebd20ff3bed818a8c9f95493e4c4c8221e1 Mon Sep 17 00:00:00 2001
From: Owen <owen@txv.io>
Date: Sun, 9 Feb 2025 21:56:39 -0500
Subject: [PATCH 23/35] Drop first

---
 server/routers/badger/verifySession.ts | 40 ++++++++++++++++++++------
 1 file changed, 32 insertions(+), 8 deletions(-)

diff --git a/server/routers/badger/verifySession.ts b/server/routers/badger/verifySession.ts
index 4515e981..ce8d3210 100644
--- a/server/routers/badger/verifySession.ts
+++ b/server/routers/badger/verifySession.ts
@@ -485,18 +485,42 @@ async function checkRules(
         return;
     }
 
+    let hasAcceptRule = false;
+
+    // First pass: look for DROP rules
     for (const rule of rules) {
         if (
-            clientIp &&
+            (clientIp &&
             rule.match == "CIDR" &&
-            isIpInCidr(clientIp, rule.value)
+            isIpInCidr(clientIp, rule.value) &&
+            rule.action === "DROP") ||
+            (path &&
+            rule.match == "PATH" &&
+            urlGlobToRegex(rule.value).test(path) &&
+            rule.action === "DROP")
         ) {
-            return rule.action as "ACCEPT" | "DROP";
-        } else if (path && rule.match == "PATH") {
-            // rule.value is a regex, match on the path and see if it matches
-            const re = urlGlobToRegex(rule.value);
-            if (re.test(path)) {
-                return rule.action as "ACCEPT" | "DROP";
+            return "DROP";
+        }
+        // Track if we see any ACCEPT rules for the second pass
+        if (rule.action === "ACCEPT") {
+            hasAcceptRule = true;
+        }
+    }
+
+    // Second pass: only check ACCEPT rules if we found one and didn't find a DROP
+    if (hasAcceptRule) {
+        for (const rule of rules) {
+            if (rule.action !== "ACCEPT") continue;
+            
+            if (
+                (clientIp &&
+                rule.match == "CIDR" &&
+                isIpInCidr(clientIp, rule.value)) ||
+                (path &&
+                rule.match == "PATH" &&
+                urlGlobToRegex(rule.value).test(path))
+            ) {
+                return "ACCEPT";
             }
         }
     }

From bbc1a9eac40a1d5d4755d9cbd4d8adc594007ab5 Mon Sep 17 00:00:00 2001
From: Owen <owen@txv.io>
Date: Sun, 9 Feb 2025 22:00:02 -0500
Subject: [PATCH 24/35] Format

---
 server/routers/badger/verifySession.ts | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/server/routers/badger/verifySession.ts b/server/routers/badger/verifySession.ts
index ce8d3210..a3c6abbc 100644
--- a/server/routers/badger/verifySession.ts
+++ b/server/routers/badger/verifySession.ts
@@ -491,13 +491,13 @@ async function checkRules(
     for (const rule of rules) {
         if (
             (clientIp &&
-            rule.match == "CIDR" &&
-            isIpInCidr(clientIp, rule.value) &&
-            rule.action === "DROP") ||
+                rule.match == "CIDR" &&
+                isIpInCidr(clientIp, rule.value) &&
+                rule.action === "DROP") ||
             (path &&
-            rule.match == "PATH" &&
-            urlGlobToRegex(rule.value).test(path) &&
-            rule.action === "DROP")
+                rule.match == "PATH" &&
+                urlGlobToRegex(rule.value).test(path) &&
+                rule.action === "DROP")
         ) {
             return "DROP";
         }
@@ -511,14 +511,14 @@ async function checkRules(
     if (hasAcceptRule) {
         for (const rule of rules) {
             if (rule.action !== "ACCEPT") continue;
-            
+
             if (
                 (clientIp &&
-                rule.match == "CIDR" &&
-                isIpInCidr(clientIp, rule.value)) ||
+                    rule.match == "CIDR" &&
+                    isIpInCidr(clientIp, rule.value)) ||
                 (path &&
-                rule.match == "PATH" &&
-                urlGlobToRegex(rule.value).test(path))
+                    rule.match == "PATH" &&
+                    urlGlobToRegex(rule.value).test(path))
             ) {
                 return "ACCEPT";
             }

From 4bce210ff560f08e9358603520471b3658676fa0 Mon Sep 17 00:00:00 2001
From: Owen <owen@txv.io>
Date: Sun, 9 Feb 2025 22:03:18 -0500
Subject: [PATCH 25/35] Be more lenient with leading and trailing slashes

---
 server/routers/badger/verifySession.ts | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/server/routers/badger/verifySession.ts b/server/routers/badger/verifySession.ts
index a3c6abbc..a65b24a0 100644
--- a/server/routers/badger/verifySession.ts
+++ b/server/routers/badger/verifySession.ts
@@ -529,8 +529,8 @@ async function checkRules(
 }
 
 function urlGlobToRegex(pattern: string): RegExp {
-    // Remove leading slash if present (we'll add it to the regex pattern)
-    pattern = pattern.startsWith("/") ? pattern.slice(1) : pattern;
+    // Trim any leading or trailing slashes
+    pattern = pattern.replace(/^\/+|\/+$/g, "");
 
     // Escape special regex characters except *
     const escapedPattern = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
@@ -540,6 +540,7 @@ function urlGlobToRegex(pattern: string): RegExp {
 
     // Create the final pattern that:
     // 1. Optionally matches leading slash
-    // 2. Matches the entire string
-    return new RegExp(`^/?${regexPattern}$`);
-}
+    // 2. Matches the pattern
+    // 3. Optionally matches trailing slash
+    return new RegExp(`^/?${regexPattern}/?$`);
+}
\ No newline at end of file

From 6e6992e19f8d6993b8f98afed9355582b4b6e530 Mon Sep 17 00:00:00 2001
From: Milo Schwartz <mschwartz10612@gmail.com>
Date: Sun, 9 Feb 2025 23:23:55 -0500
Subject: [PATCH 26/35] add rules info card

---
 server/lib/consts.ts                          |  2 +-
 .../resources/[resourceId]/rules/page.tsx     | 92 ++++++++++++++++---
 2 files changed, 81 insertions(+), 13 deletions(-)

diff --git a/server/lib/consts.ts b/server/lib/consts.ts
index 2f505ae1..20376f8e 100644
--- a/server/lib/consts.ts
+++ b/server/lib/consts.ts
@@ -2,7 +2,7 @@ import path from "path";
 import { fileURLToPath } from "url";
 
 // This is a placeholder value replaced by the build process
-export const APP_VERSION = "1.0.0-beta.12";
+export const APP_VERSION = "1.0.0-beta.13";
 
 export const __FILENAME = fileURLToPath(import.meta.url);
 export const __DIRNAME = path.dirname(__FILENAME);
diff --git a/src/app/[orgId]/settings/resources/[resourceId]/rules/page.tsx b/src/app/[orgId]/settings/resources/[resourceId]/rules/page.tsx
index ac863c5a..287e767a 100644
--- a/src/app/[orgId]/settings/resources/[resourceId]/rules/page.tsx
+++ b/src/app/[orgId]/settings/resources/[resourceId]/rules/page.tsx
@@ -57,6 +57,15 @@ import {
 } from "@app/components/Settings";
 import { ListResourceRulesResponse } from "@server/routers/resource/listResourceRules";
 import { SwitchInput } from "@app/components/SwitchInput";
+import { Alert, AlertDescription, AlertTitle } from "@app/components/ui/alert";
+import { Check, Info, InfoIcon, X } from "lucide-react";
+import {
+    InfoSection,
+    InfoSections,
+    InfoSectionTitle
+} from "@app/components/InfoSection";
+import { Separator } from "@app/components/ui/separator";
+import { InfoPopup } from "@app/components/ui/info-popup";
 
 // Schema for rule validation
 const addRuleSchema = z.object({
@@ -70,6 +79,11 @@ type LocalRule = ArrayElement<ListResourceRulesResponse["rules"]> & {
     updated?: boolean;
 };
 
+enum RuleAction {
+    ACCEPT = "Always Allow",
+    DROP = "Always Deny"
+}
+
 export default function ResourceRules(props: {
     params: Promise<{ resourceId: number }>;
 }) {
@@ -296,8 +310,10 @@ export default function ResourceRules(props: {
                         {row.original.action}
                     </SelectTrigger>
                     <SelectContent>
-                        <SelectItem value="ACCEPT">ACCEPT</SelectItem>
-                        <SelectItem value="DROP">DROP</SelectItem>
+                        <SelectItem value="ACCEPT">
+                            {RuleAction.ACCEPT}
+                        </SelectItem>
+                        <SelectItem value="DROP">{RuleAction.DROP}</SelectItem>
                     </SelectContent>
                 </Select>
             )
@@ -367,6 +383,56 @@ export default function ResourceRules(props: {
 
     return (
         <SettingsContainer>
+            <Alert>
+                <InfoIcon className="h-4 w-4" />
+                <AlertTitle className="font-semibold">About Rules</AlertTitle>
+                <AlertDescription className="mt-4">
+                    <p className="mb-4">
+                        Rules allow you to control access to your resource based
+                        on a set of criteria. You can create rules to allow or
+                        deny access based on IP address or URL path. Deny rules
+                        take precedence over allow rules. If a request matches
+                        both an allow and a deny rule, the deny rule will be
+                        applied.
+                    </p>
+                    <InfoSections>
+                        <InfoSection>
+                            <InfoSectionTitle>Actions</InfoSectionTitle>
+                            <ul className="text-sm text-muted-foreground space-y-1">
+                                <li className="flex items-center gap-2">
+                                    <Check className="text-green-500 w-4 h-4" />
+                                    Always Allow: Bypass all authentication
+                                    methods
+                                </li>
+                                <li className="flex items-center gap-2">
+                                    <X className="text-red-500 w-4 h-4" />
+                                    Always Deny: Block all requests; no
+                                    authentication can be attempted
+                                </li>
+                            </ul>
+                        </InfoSection>
+                        <Separator orientation="vertical" />
+                        <InfoSection>
+                            <InfoSectionTitle>
+                                Matching Criteria
+                            </InfoSectionTitle>
+                            <ul className="text-sm text-muted-foreground space-y-1">
+                                <li className="flex items-center gap-2">
+                                    Match a specific IP address
+                                </li>
+                                <li className="flex items-center gap-2">
+                                    Match a range of IP addresses in CIDR
+                                    notation
+                                </li>
+                                <li className="flex items-center gap-2">
+                                    Match a URL path or pattern
+                                </li>
+                            </ul>
+                        </InfoSection>
+                    </InfoSections>
+                </AlertDescription>
+            </Alert>
+
             <SettingsSection>
                 <SettingsSectionHeader>
                     <SettingsSectionTitle>Enable Rules</SettingsSectionTitle>
@@ -420,10 +486,10 @@ export default function ResourceRules(props: {
                                                     </SelectTrigger>
                                                     <SelectContent>
                                                         <SelectItem value="ACCEPT">
-                                                            ACCEPT
+                                                            {RuleAction.ACCEPT}
                                                         </SelectItem>
                                                         <SelectItem value="DROP">
-                                                            DROP
+                                                            {RuleAction.DROP}
                                                         </SelectItem>
                                                     </SelectContent>
                                                 </Select>
@@ -469,18 +535,20 @@ export default function ResourceRules(props: {
                                     name="value"
                                     render={({ field }) => (
                                         <FormItem>
-                                            <FormLabel>Value</FormLabel>
+                                            <InfoPopup
+                                                text="Value"
+                                                info={
+                                                    addRuleForm.watch(
+                                                        "match"
+                                                    ) === "CIDR"
+                                                        ? "Enter an address in CIDR format (e.g., 103.21.244.0/22)"
+                                                        : "Enter a URL path or pattern (e.g., /api/v1/todos or /api/v1/*)"
+                                                }
+                                            />
                                             <FormControl>
                                                 <Input {...field} />
                                             </FormControl>
                                             <FormMessage />
-                                            <FormDescription>
-                                                Enter CIDR{" "}
-                                                {resource.http
-                                                    ? "or path value"
-                                                    : ""}{" "}
-                                                based on match type
-                                            </FormDescription>
                                         </FormItem>
                                     )}
                                 />

From 3c99fbb1efc49c869d39ac39a7dff9f0e28d62df Mon Sep 17 00:00:00 2001
From: Owen <owen@txv.io>
Date: Mon, 10 Feb 2025 21:06:37 -0500
Subject: [PATCH 27/35] Seperate ip and cidr

---
 Makefile                                      |  6 ---
 server/db/schema.ts                           |  2 +-
 server/routers/badger/verifySession.ts        |  7 +++
 server/routers/resource/createResourceRule.ts |  2 +-
 server/routers/resource/updateResourceRule.ts |  2 +-
 .../resources/[resourceId]/rules/page.tsx     | 45 +++++++++++++++++--
 6 files changed, 51 insertions(+), 13 deletions(-)

diff --git a/Makefile b/Makefile
index 02d97f3c..793a3481 100644
--- a/Makefile
+++ b/Makefile
@@ -12,12 +12,6 @@ build-arm:
 build-x86:
 	docker buildx build --platform linux/amd64 -t fosrl/pangolin:latest .
 
-auth-ecr:
-	aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws/g5j5p7x0
-
-build-x86-ecr:
-	docker buildx build --platform linux/amd64 -t 216989133116.dkr.ecr.us-east-1.amazonaws.com/pangolin:latest --push .
-
 build:
 	docker build -t fosrl/pangolin:latest .
 
diff --git a/server/db/schema.ts b/server/db/schema.ts
index cf5ad531..16d8ada2 100644
--- a/server/db/schema.ts
+++ b/server/db/schema.ts
@@ -378,7 +378,7 @@ export const resourceRules = sqliteTable("resourceRules", {
         .notNull()
         .references(() => resources.resourceId, { onDelete: "cascade" }),
     action: text("action").notNull(), // ACCEPT, DROP
-    match: text("match").notNull(), // CIDR, PATH
+    match: text("match").notNull(), // CIDR, PATH, IP
     value: text("value").notNull()
 });
 
diff --git a/server/routers/badger/verifySession.ts b/server/routers/badger/verifySession.ts
index a65b24a0..a4a2944a 100644
--- a/server/routers/badger/verifySession.ts
+++ b/server/routers/badger/verifySession.ts
@@ -494,6 +494,10 @@ async function checkRules(
                 rule.match == "CIDR" &&
                 isIpInCidr(clientIp, rule.value) &&
                 rule.action === "DROP") ||
+            (clientIp &&
+                rule.match == "IP" &&
+                clientIp == rule.value &&
+                rule.action === "DROP") ||
             (path &&
                 rule.match == "PATH" &&
                 urlGlobToRegex(rule.value).test(path) &&
@@ -516,6 +520,9 @@ async function checkRules(
                 (clientIp &&
                     rule.match == "CIDR" &&
                     isIpInCidr(clientIp, rule.value)) ||
+                (clientIp &&
+                    rule.match == "IP" &&
+                    clientIp == rule.value) ||
                 (path &&
                     rule.match == "PATH" &&
                     urlGlobToRegex(rule.value).test(path))
diff --git a/server/routers/resource/createResourceRule.ts b/server/routers/resource/createResourceRule.ts
index f01ed115..24b08fc9 100644
--- a/server/routers/resource/createResourceRule.ts
+++ b/server/routers/resource/createResourceRule.ts
@@ -12,7 +12,7 @@ import { fromError } from "zod-validation-error";
 const createResourceRuleSchema = z
     .object({
         action: z.enum(["ACCEPT", "DROP"]),
-        match: z.enum(["CIDR", "PATH"]),
+        match: z.enum(["CIDR", "IP", "PATH"]),
         value: z.string().min(1)
     })
     .strict();
diff --git a/server/routers/resource/updateResourceRule.ts b/server/routers/resource/updateResourceRule.ts
index f96ea0fa..0eaacc03 100644
--- a/server/routers/resource/updateResourceRule.ts
+++ b/server/routers/resource/updateResourceRule.ts
@@ -27,7 +27,7 @@ const updateResourceRuleParamsSchema = z
 const updateResourceRuleSchema = z
     .object({
         action: z.enum(["ACCEPT", "DROP"]).optional(),
-        match: z.enum(["CIDR", "PATH"]).optional(),
+        match: z.enum(["CIDR", "IP", "PATH"]).optional(),
         value: z.string().min(1).optional()
     })
     .strict()
diff --git a/src/app/[orgId]/settings/resources/[resourceId]/rules/page.tsx b/src/app/[orgId]/settings/resources/[resourceId]/rules/page.tsx
index bffcc9ae..6a961a6a 100644
--- a/src/app/[orgId]/settings/resources/[resourceId]/rules/page.tsx
+++ b/src/app/[orgId]/settings/resources/[resourceId]/rules/page.tsx
@@ -101,7 +101,7 @@ export default function ResourceRules(props: {
         resolver: zodResolver(addRuleSchema),
         defaultValues: {
             action: "ACCEPT",
-            match: "CIDR",
+            match: "IP",
             value: ""
         }
     });
@@ -167,6 +167,15 @@ export default function ResourceRules(props: {
             setLoading(false);
             return;
         }
+        if (data.match === "IP" && !isValidIP(data.value)) {
+            toast({
+                variant: "destructive",
+                title: "Invalid IP",
+                description: "Please enter a valid IP address"
+            });
+            setLoading(false);
+            return;
+        }
 
         const newRule: LocalRule = {
             ...data,
@@ -255,6 +264,15 @@ export default function ResourceRules(props: {
                     setLoading(false);
                     return;
                 }
+                if (rule.match === "IP" && !isValidIP(rule.value)) {
+                    toast({
+                        variant: "destructive",
+                        title: "Invalid IP",
+                        description: "Please enter a valid IP address"
+                    });
+                    setLoading(false);
+                    return;
+                }
 
                 if (rule.new) {
                     const res = await api.put(`/resource/${params.resourceId}/rule`, data);
@@ -336,7 +354,7 @@ export default function ResourceRules(props: {
             cell: ({ row }) => (
                 <Select
                     defaultValue={row.original.match}
-                    onValueChange={(value: "CIDR" | "PATH") =>
+                    onValueChange={(value: "CIDR" | "IP" | "PATH") =>
                         updateRule(row.original.ruleId, { match: value })
                     }
                 >
@@ -344,7 +362,8 @@ export default function ResourceRules(props: {
                         {row.original.match}
                     </SelectTrigger>
                     <SelectContent>
-                        <SelectItem value="CIDR">CIDR</SelectItem>
+                        <SelectItem value="IP">IP</SelectItem>
+                        <SelectItem value="CIDR">IP Range</SelectItem>
                         <SelectItem value="PATH">PATH</SelectItem>
                     </SelectContent>
                 </Select>
@@ -527,8 +546,11 @@ export default function ResourceRules(props: {
                                                         <SelectValue />
                                                     </SelectTrigger>
                                                     <SelectContent>
+                                                        <SelectItem value="IP">
+                                                           IP 
+                                                        </SelectItem>
                                                         <SelectItem value="CIDR">
-                                                            CIDR
+                                                           IP Range 
                                                         </SelectItem>
                                                         {resource.http && (
                                                             <SelectItem value="PATH">
@@ -657,6 +679,21 @@ function isValidCIDR(cidr: string): boolean {
     });
 }
 
+function isValidIP(ip: string): boolean {
+    const ipPattern = /^([0-9]{1,3}\.){3}[0-9]{1,3}$/;
+
+    if (!ipPattern.test(ip)) {
+        return false;
+    }
+
+    const octets = ip.split(".");
+
+    return octets.every((octet) => {
+        const num = parseInt(octet, 10);
+        return num >= 0 && num <= 255;
+    });
+}
+
 function isValidUrlGlobPattern(pattern: string): boolean {
     // Remove leading slash if present
     pattern = pattern.startsWith("/") ? pattern.slice(1) : pattern;

From 8165051dd8da55ae063d3642e69b5fd70a7ea1e8 Mon Sep 17 00:00:00 2001
From: Milo Schwartz <mschwartz10612@gmail.com>
Date: Mon, 10 Feb 2025 21:35:06 -0500
Subject: [PATCH 28/35] fix toast dismiss causing components to rerender and
 clean up rules text

---
 .../settings/access/roles/CreateRoleForm.tsx  |  3 +-
 .../settings/access/roles/DeleteRoleForm.tsx  |  3 +-
 .../settings/access/roles/RolesTable.tsx      |  3 +-
 .../settings/access/users/InviteUserForm.tsx  |  3 +-
 .../settings/access/users/UsersTable.tsx      |  3 +-
 .../users/[userId]/access-controls/page.tsx   |  3 +-
 src/app/[orgId]/settings/general/page.tsx     |  3 +-
 .../settings/resources/CreateResourceForm.tsx |  4 +-
 .../settings/resources/ResourcesTable.tsx     |  4 +-
 .../SetResourcePasswordForm.tsx               |  4 +-
 .../authentication/SetResourcePincodeForm.tsx |  4 +-
 .../[resourceId]/authentication/page.tsx      |  3 +-
 .../[resourceId]/connectivity/page.tsx        |  3 +-
 .../resources/[resourceId]/general/page.tsx   |  3 +-
 .../resources/[resourceId]/rules/page.tsx     | 66 ++++++++++++-------
 .../share-links/CreateShareLinkForm.tsx       |  3 +-
 .../settings/share-links/ShareLinksTable.tsx  |  4 +-
 .../[orgId]/settings/sites/CreateSiteForm.tsx |  4 +-
 src/app/[orgId]/settings/sites/SitesTable.tsx |  4 +-
 .../settings/sites/[niceId]/general/page.tsx  |  3 +-
 .../auth/reset-password/ResetPasswordForm.tsx |  4 +-
 .../[resourceId]/ResourceAuthPortal.tsx       |  3 +-
 src/app/auth/verify-email/VerifyEmailForm.tsx |  4 +-
 src/components/Disable2FaForm.tsx             |  4 +-
 src/components/Enable2FaForm.tsx              |  4 +-
 src/components/ProfileIcon.tsx                |  3 +-
 26 files changed, 69 insertions(+), 83 deletions(-)

diff --git a/src/app/[orgId]/settings/access/roles/CreateRoleForm.tsx b/src/app/[orgId]/settings/access/roles/CreateRoleForm.tsx
index c17b1eef..cd9aecc5 100644
--- a/src/app/[orgId]/settings/access/roles/CreateRoleForm.tsx
+++ b/src/app/[orgId]/settings/access/roles/CreateRoleForm.tsx
@@ -10,7 +10,7 @@ import {
     FormMessage,
 } from "@app/components/ui/form";
 import { Input } from "@app/components/ui/input";
-import { useToast } from "@app/hooks/useToast";
+import { toast } from "@app/hooks/useToast";
 import { zodResolver } from "@hookform/resolvers/zod";
 import { AxiosResponse } from "axios";
 import { useState } from "react";
@@ -48,7 +48,6 @@ export default function CreateRoleForm({
     setOpen,
     afterCreate,
 }: CreateRoleFormProps) {
-    const { toast } = useToast();
     const { org } = useOrgContext();
 
     const [loading, setLoading] = useState(false);
diff --git a/src/app/[orgId]/settings/access/roles/DeleteRoleForm.tsx b/src/app/[orgId]/settings/access/roles/DeleteRoleForm.tsx
index 5c7c2c4b..6bd41df8 100644
--- a/src/app/[orgId]/settings/access/roles/DeleteRoleForm.tsx
+++ b/src/app/[orgId]/settings/access/roles/DeleteRoleForm.tsx
@@ -9,7 +9,7 @@ import {
     FormLabel,
     FormMessage,
 } from "@app/components/ui/form";
-import { useToast } from "@app/hooks/useToast";
+import { toast } from "@app/hooks/useToast";
 import { zodResolver } from "@hookform/resolvers/zod";
 import { AxiosResponse } from "axios";
 import { useEffect, useState } from "react";
@@ -56,7 +56,6 @@ export default function DeleteRoleForm({
     setOpen,
     afterDelete,
 }: CreateRoleFormProps) {
-    const { toast } = useToast();
     const { org } = useOrgContext();
 
     const [loading, setLoading] = useState(false);
diff --git a/src/app/[orgId]/settings/access/roles/RolesTable.tsx b/src/app/[orgId]/settings/access/roles/RolesTable.tsx
index 1c74d91a..66ed7b40 100644
--- a/src/app/[orgId]/settings/access/roles/RolesTable.tsx
+++ b/src/app/[orgId]/settings/access/roles/RolesTable.tsx
@@ -12,7 +12,7 @@ import { ArrowUpDown, Crown, MoreHorizontal } from "lucide-react";
 import { useState } from "react";
 import ConfirmDeleteDialog from "@app/components/ConfirmDeleteDialog";
 import { useOrgContext } from "@app/hooks/useOrgContext";
-import { useToast } from "@app/hooks/useToast";
+import { toast } from "@app/hooks/useToast";
 import { RolesDataTable } from "./RolesDataTable";
 import { Role } from "@server/db/schema";
 import CreateRoleForm from "./CreateRoleForm";
@@ -37,7 +37,6 @@ export default function UsersTable({ roles: r }: RolesTableProps) {
     const api = createApiClient(useEnvContext());
 
     const { org } = useOrgContext();
-    const { toast } = useToast();
 
     const columns: ColumnDef<RoleRow>[] = [
         {
diff --git a/src/app/[orgId]/settings/access/users/InviteUserForm.tsx b/src/app/[orgId]/settings/access/users/InviteUserForm.tsx
index 346b9fad..c812717d 100644
--- a/src/app/[orgId]/settings/access/users/InviteUserForm.tsx
+++ b/src/app/[orgId]/settings/access/users/InviteUserForm.tsx
@@ -17,7 +17,7 @@ import {
     SelectTrigger,
     SelectValue
 } from "@app/components/ui/select";
-import { useToast } from "@app/hooks/useToast";
+import { toast } from "@app/hooks/useToast";
 import { zodResolver } from "@hookform/resolvers/zod";
 import { InviteUserBody, InviteUserResponse } from "@server/routers/user";
 import { AxiosResponse } from "axios";
@@ -54,7 +54,6 @@ const formSchema = z.object({
 });
 
 export default function InviteUserForm({ open, setOpen }: InviteUserFormProps) {
-    const { toast } = useToast();
     const { org } = useOrgContext();
 
     const { env } = useEnvContext();
diff --git a/src/app/[orgId]/settings/access/users/UsersTable.tsx b/src/app/[orgId]/settings/access/users/UsersTable.tsx
index 03454bf1..7c11c06b 100644
--- a/src/app/[orgId]/settings/access/users/UsersTable.tsx
+++ b/src/app/[orgId]/settings/access/users/UsersTable.tsx
@@ -14,7 +14,7 @@ import { useState } from "react";
 import InviteUserForm from "./InviteUserForm";
 import ConfirmDeleteDialog from "@app/components/ConfirmDeleteDialog";
 import { useOrgContext } from "@app/hooks/useOrgContext";
-import { useToast } from "@app/hooks/useToast";
+import { toast } from "@app/hooks/useToast";
 import Link from "next/link";
 import { useRouter } from "next/navigation";
 import { formatAxiosError } from "@app/lib/api";
@@ -47,7 +47,6 @@ export default function UsersTable({ users: u }: UsersTableProps) {
 
     const { user, updateUser } = useUserContext();
     const { org } = useOrgContext();
-    const { toast } = useToast();
 
     const columns: ColumnDef<UserRow>[] = [
         {
diff --git a/src/app/[orgId]/settings/access/users/[userId]/access-controls/page.tsx b/src/app/[orgId]/settings/access/users/[userId]/access-controls/page.tsx
index 4305399b..002febc2 100644
--- a/src/app/[orgId]/settings/access/users/[userId]/access-controls/page.tsx
+++ b/src/app/[orgId]/settings/access/users/[userId]/access-controls/page.tsx
@@ -16,7 +16,7 @@ import {
     SelectTrigger,
     SelectValue
 } from "@app/components/ui/select";
-import { useToast } from "@app/hooks/useToast";
+import { toast } from "@app/hooks/useToast";
 import { zodResolver } from "@hookform/resolvers/zod";
 import { InviteUserResponse } from "@server/routers/user";
 import { AxiosResponse } from "axios";
@@ -47,7 +47,6 @@ const formSchema = z.object({
 });
 
 export default function AccessControlsPage() {
-    const { toast } = useToast();
     const { orgUser: user } = userOrgUserContext();
 
     const api = createApiClient(useEnvContext());
diff --git a/src/app/[orgId]/settings/general/page.tsx b/src/app/[orgId]/settings/general/page.tsx
index 7e173416..c2ac225c 100644
--- a/src/app/[orgId]/settings/general/page.tsx
+++ b/src/app/[orgId]/settings/general/page.tsx
@@ -4,7 +4,7 @@ import ConfirmDeleteDialog from "@app/components/ConfirmDeleteDialog";
 import { Button } from "@app/components/ui/button";
 import { useOrgContext } from "@app/hooks/useOrgContext";
 import { userOrgUserContext } from "@app/hooks/useOrgUserContext";
-import { useToast } from "@app/hooks/useToast";
+import { toast } from "@app/hooks/useToast";
 import { useState } from "react";
 import {
     Form,
@@ -56,7 +56,6 @@ export default function GeneralPage() {
     const { orgUser } = userOrgUserContext();
     const router = useRouter();
     const { org } = useOrgContext();
-    const { toast } = useToast();
     const api = createApiClient(useEnvContext());
 
     const [loadingDelete, setLoadingDelete] = useState(false);
diff --git a/src/app/[orgId]/settings/resources/CreateResourceForm.tsx b/src/app/[orgId]/settings/resources/CreateResourceForm.tsx
index 6e33ec79..f62bf8fe 100644
--- a/src/app/[orgId]/settings/resources/CreateResourceForm.tsx
+++ b/src/app/[orgId]/settings/resources/CreateResourceForm.tsx
@@ -11,7 +11,7 @@ import {
     FormMessage
 } from "@app/components/ui/form";
 import { Input } from "@app/components/ui/input";
-import { useToast } from "@app/hooks/useToast";
+import { toast } from "@app/hooks/useToast";
 import { zodResolver } from "@hookform/resolvers/zod";
 import { useEffect, useState } from "react";
 import { useForm } from "react-hook-form";
@@ -117,8 +117,6 @@ export default function CreateResourceForm({
     open,
     setOpen
 }: CreateResourceFormProps) {
-    const { toast } = useToast();
-
     const api = createApiClient(useEnvContext());
 
     const [loading, setLoading] = useState(false);
diff --git a/src/app/[orgId]/settings/resources/ResourcesTable.tsx b/src/app/[orgId]/settings/resources/ResourcesTable.tsx
index fee92999..848838b3 100644
--- a/src/app/[orgId]/settings/resources/ResourcesTable.tsx
+++ b/src/app/[orgId]/settings/resources/ResourcesTable.tsx
@@ -26,7 +26,7 @@ import { useState } from "react";
 import ConfirmDeleteDialog from "@app/components/ConfirmDeleteDialog";
 import { set } from "zod";
 import { formatAxiosError } from "@app/lib/api";
-import { useToast } from "@app/hooks/useToast";
+import { toast } from "@app/hooks/useToast";
 import { createApiClient } from "@app/lib/api";
 import { useEnvContext } from "@app/hooks/useEnvContext";
 import CopyToClipboard from "@app/components/CopyToClipboard";
@@ -52,8 +52,6 @@ type ResourcesTableProps = {
 export default function SitesTable({ resources, orgId }: ResourcesTableProps) {
     const router = useRouter();
 
-    const { toast } = useToast();
-
     const api = createApiClient(useEnvContext());
 
     const [isCreateModalOpen, setIsCreateModalOpen] = useState(false);
diff --git a/src/app/[orgId]/settings/resources/[resourceId]/authentication/SetResourcePasswordForm.tsx b/src/app/[orgId]/settings/resources/[resourceId]/authentication/SetResourcePasswordForm.tsx
index 6a092c0c..fa329ba9 100644
--- a/src/app/[orgId]/settings/resources/[resourceId]/authentication/SetResourcePasswordForm.tsx
+++ b/src/app/[orgId]/settings/resources/[resourceId]/authentication/SetResourcePasswordForm.tsx
@@ -11,7 +11,7 @@ import {
     FormMessage,
 } from "@app/components/ui/form";
 import { Input } from "@app/components/ui/input";
-import { useToast } from "@app/hooks/useToast";
+import { toast } from "@app/hooks/useToast";
 import { zodResolver } from "@hookform/resolvers/zod";
 import { useEffect, useState } from "react";
 import { useForm } from "react-hook-form";
@@ -55,8 +55,6 @@ export default function SetResourcePasswordForm({
     resourceId,
     onSetPassword,
 }: SetPasswordFormProps) {
-    const { toast } = useToast();
-
     const api = createApiClient(useEnvContext());
 
     const [loading, setLoading] = useState(false);
diff --git a/src/app/[orgId]/settings/resources/[resourceId]/authentication/SetResourcePincodeForm.tsx b/src/app/[orgId]/settings/resources/[resourceId]/authentication/SetResourcePincodeForm.tsx
index 1f698c08..704d3f44 100644
--- a/src/app/[orgId]/settings/resources/[resourceId]/authentication/SetResourcePincodeForm.tsx
+++ b/src/app/[orgId]/settings/resources/[resourceId]/authentication/SetResourcePincodeForm.tsx
@@ -11,7 +11,7 @@ import {
     FormMessage,
 } from "@app/components/ui/form";
 import { Input } from "@app/components/ui/input";
-import { useToast } from "@app/hooks/useToast";
+import { toast } from "@app/hooks/useToast";
 import { zodResolver } from "@hookform/resolvers/zod";
 import { useEffect, useState } from "react";
 import { useForm } from "react-hook-form";
@@ -60,8 +60,6 @@ export default function SetResourcePincodeForm({
     resourceId,
     onSetPincode,
 }: SetPincodeFormProps) {
-    const { toast } = useToast();
-
     const [loading, setLoading] = useState(false);
 
     const api = createApiClient(useEnvContext());
diff --git a/src/app/[orgId]/settings/resources/[resourceId]/authentication/page.tsx b/src/app/[orgId]/settings/resources/[resourceId]/authentication/page.tsx
index 9c62b156..0e3dc7bc 100644
--- a/src/app/[orgId]/settings/resources/[resourceId]/authentication/page.tsx
+++ b/src/app/[orgId]/settings/resources/[resourceId]/authentication/page.tsx
@@ -2,7 +2,7 @@
 
 import { useEffect, useState } from "react";
 import { ListRolesResponse } from "@server/routers/role";
-import { useToast } from "@app/hooks/useToast";
+import { toast } from "@app/hooks/useToast";
 import { useOrgContext } from "@app/hooks/useOrgContext";
 import { useResourceContext } from "@app/hooks/useResourceContext";
 import { AxiosResponse } from "axios";
@@ -75,7 +75,6 @@ const whitelistSchema = z.object({
 });
 
 export default function ResourceAuthenticationPage() {
-    const { toast } = useToast();
     const { org } = useOrgContext();
     const { resource, updateResource, authInfo, updateAuthInfo } =
         useResourceContext();
diff --git a/src/app/[orgId]/settings/resources/[resourceId]/connectivity/page.tsx b/src/app/[orgId]/settings/resources/[resourceId]/connectivity/page.tsx
index b3b26a5a..dfd2f66c 100644
--- a/src/app/[orgId]/settings/resources/[resourceId]/connectivity/page.tsx
+++ b/src/app/[orgId]/settings/resources/[resourceId]/connectivity/page.tsx
@@ -45,7 +45,7 @@ import {
     TableHeader,
     TableRow
 } from "@app/components/ui/table";
-import { useToast } from "@app/hooks/useToast";
+import { toast } from "@app/hooks/useToast";
 import { useResourceContext } from "@app/hooks/useResourceContext";
 import { ArrayElement } from "@server/types/ArrayElement";
 import { formatAxiosError } from "@app/lib/api/formatAxiosError";
@@ -113,7 +113,6 @@ export default function ReverseProxyTargets(props: {
 }) {
     const params = use(props.params);
 
-    const { toast } = useToast();
     const { resource, updateResource } = useResourceContext();
 
     const api = createApiClient(useEnvContext());
diff --git a/src/app/[orgId]/settings/resources/[resourceId]/general/page.tsx b/src/app/[orgId]/settings/resources/[resourceId]/general/page.tsx
index 848115f8..43624e3f 100644
--- a/src/app/[orgId]/settings/resources/[resourceId]/general/page.tsx
+++ b/src/app/[orgId]/settings/resources/[resourceId]/general/page.tsx
@@ -34,7 +34,7 @@ import { AxiosResponse } from "axios";
 import { useParams, useRouter } from "next/navigation";
 import { useForm } from "react-hook-form";
 import { GetResourceAuthInfoResponse } from "@server/routers/resource";
-import { useToast } from "@app/hooks/useToast";
+import { toast } from "@app/hooks/useToast";
 import {
     SettingsContainer,
     SettingsSection,
@@ -102,7 +102,6 @@ type TransferFormValues = z.infer<typeof TransferFormSchema>;
 
 export default function GeneralForm() {
     const params = useParams();
-    const { toast } = useToast();
     const { resource, updateResource } = useResourceContext();
     const { org } = useOrgContext();
     const router = useRouter();
diff --git a/src/app/[orgId]/settings/resources/[resourceId]/rules/page.tsx b/src/app/[orgId]/settings/resources/[resourceId]/rules/page.tsx
index 6a961a6a..121e0a58 100644
--- a/src/app/[orgId]/settings/resources/[resourceId]/rules/page.tsx
+++ b/src/app/[orgId]/settings/resources/[resourceId]/rules/page.tsx
@@ -16,7 +16,6 @@ import { z } from "zod";
 import {
     Form,
     FormControl,
-    FormDescription,
     FormField,
     FormItem,
     FormLabel,
@@ -40,7 +39,7 @@ import {
     TableHeader,
     TableRow
 } from "@app/components/ui/table";
-import { useToast } from "@app/hooks/useToast";
+import { toast } from "@app/hooks/useToast";
 import { useResourceContext } from "@app/hooks/useResourceContext";
 import { ArrayElement } from "@server/types/ArrayElement";
 import { formatAxiosError } from "@app/lib/api/formatAxiosError";
@@ -58,7 +57,7 @@ import {
 import { ListResourceRulesResponse } from "@server/routers/resource/listResourceRules";
 import { SwitchInput } from "@app/components/SwitchInput";
 import { Alert, AlertDescription, AlertTitle } from "@app/components/ui/alert";
-import { Check, Info, InfoIcon, X } from "lucide-react";
+import { Check, InfoIcon, X } from "lucide-react";
 import {
     InfoSection,
     InfoSections,
@@ -84,11 +83,16 @@ enum RuleAction {
     DROP = "Always Deny"
 }
 
+enum RuleMatch {
+    IP = "IP",
+    CIDR = "IP Range",
+    PATH = "Path"
+}
+
 export default function ResourceRules(props: {
     params: Promise<{ resourceId: number }>;
 }) {
     const params = use(props.params);
-    const { toast } = useToast();
     const { resource, updateResource } = useResourceContext();
     const api = createApiClient(useEnvContext());
     const [rules, setRules] = useState<LocalRule[]>([]);
@@ -233,6 +237,17 @@ export default function ResourceRules(props: {
         }
     }
 
+    function getValueHelpText(type: string) {
+        switch (type) {
+            case "CIDR":
+                return "Enter an address in CIDR format (e.g., 103.21.244.0/22)";
+            case "IP":
+                return "Enter an IP address (e.g., 103.21.244.12)";
+            case "PATH":
+                return "Enter a URL path or pattern (e.g., /api/v1/todos or /api/v1/*)";
+        }
+    }
+
     async function saveRules() {
         try {
             setLoading(true);
@@ -275,7 +290,10 @@ export default function ResourceRules(props: {
                 }
 
                 if (rule.new) {
-                    const res = await api.put(`/resource/${params.resourceId}/rule`, data);
+                    const res = await api.put(
+                        `/resource/${params.resourceId}/rule`,
+                        data
+                    );
                     rule.ruleId = res.data.data.ruleId;
                 } else if (rule.updated) {
                     await api.post(
@@ -300,9 +318,7 @@ export default function ResourceRules(props: {
                 await api.delete(
                     `/resource/${params.resourceId}/rule/${ruleId}`
                 );
-                setRules(
-                    rules.filter((r) => r.ruleId !== ruleId)
-                );
+                setRules(rules.filter((r) => r.ruleId !== ruleId));
             }
 
             toast({
@@ -337,7 +353,9 @@ export default function ResourceRules(props: {
                     }
                 >
                     <SelectTrigger className="min-w-[100px]">
-                        {row.original.action}
+                        {row.original.action === "ACCEPT"
+                            ? RuleAction.ACCEPT
+                            : RuleAction.DROP}
                     </SelectTrigger>
                     <SelectContent>
                         <SelectItem value="ACCEPT">
@@ -359,12 +377,16 @@ export default function ResourceRules(props: {
                     }
                 >
                     <SelectTrigger className="min-w-[100px]">
-                        {row.original.match}
+                        {row.original.match === "IP"
+                            ? RuleMatch.IP
+                            : row.original.match === "CIDR"
+                              ? RuleMatch.CIDR
+                              : RuleMatch.PATH}
                     </SelectTrigger>
                     <SelectContent>
-                        <SelectItem value="IP">IP</SelectItem>
-                        <SelectItem value="CIDR">IP Range</SelectItem>
-                        <SelectItem value="PATH">PATH</SelectItem>
+                        <SelectItem value="IP">{RuleMatch.IP}</SelectItem>
+                        <SelectItem value="CIDR">{RuleMatch.CIDR}</SelectItem>
+                        <SelectItem value="PATH">{RuleMatch.PATH}</SelectItem>
                     </SelectContent>
                 </Select>
             )
@@ -547,14 +569,14 @@ export default function ResourceRules(props: {
                                                     </SelectTrigger>
                                                     <SelectContent>
                                                         <SelectItem value="IP">
-                                                           IP 
+                                                            {RuleMatch.IP}
                                                         </SelectItem>
                                                         <SelectItem value="CIDR">
-                                                           IP Range 
+                                                            {RuleMatch.CIDR}
                                                         </SelectItem>
                                                         {resource.http && (
                                                             <SelectItem value="PATH">
-                                                                PATH
+                                                                {RuleMatch.PATH}
                                                             </SelectItem>
                                                         )}
                                                     </SelectContent>
@@ -572,11 +594,11 @@ export default function ResourceRules(props: {
                                             <InfoPopup
                                                 text="Value"
                                                 info={
-                                                    addRuleForm.watch(
-                                                        "match"
-                                                    ) === "CIDR"
-                                                        ? "Enter an address in CIDR format (e.g., 103.21.244.0/22)"
-                                                        : "Enter a URL path or pattern (e.g., /api/v1/todos or /api/v1/*)"
+                                                    getValueHelpText(
+                                                        addRuleForm.watch(
+                                                            "match"
+                                                        )
+                                                    ) || ""
                                                 }
                                             />
                                             <FormControl>
@@ -590,7 +612,7 @@ export default function ResourceRules(props: {
                             <Button
                                 type="submit"
                                 variant="outline"
-                                disabled={loading || !rulesEnabled}
+                                disabled={!rulesEnabled}
                             >
                                 Add Rule
                             </Button>
diff --git a/src/app/[orgId]/settings/share-links/CreateShareLinkForm.tsx b/src/app/[orgId]/settings/share-links/CreateShareLinkForm.tsx
index ccdf25fb..aa9cb74c 100644
--- a/src/app/[orgId]/settings/share-links/CreateShareLinkForm.tsx
+++ b/src/app/[orgId]/settings/share-links/CreateShareLinkForm.tsx
@@ -18,7 +18,7 @@ import {
     SelectTrigger,
     SelectValue
 } from "@app/components/ui/select";
-import { useToast } from "@app/hooks/useToast";
+import { toast } from "@app/hooks/useToast";
 import { zodResolver } from "@hookform/resolvers/zod";
 import { InviteUserBody, InviteUserResponse } from "@server/routers/user";
 import { AxiosResponse } from "axios";
@@ -94,7 +94,6 @@ export default function CreateShareLinkForm({
     setOpen,
     onCreated
 }: FormProps) {
-    const { toast } = useToast();
     const { org } = useOrgContext();
 
     const { env } = useEnvContext();
diff --git a/src/app/[orgId]/settings/share-links/ShareLinksTable.tsx b/src/app/[orgId]/settings/share-links/ShareLinksTable.tsx
index 8fadbd10..5d5d341f 100644
--- a/src/app/[orgId]/settings/share-links/ShareLinksTable.tsx
+++ b/src/app/[orgId]/settings/share-links/ShareLinksTable.tsx
@@ -25,7 +25,7 @@ import { useRouter } from "next/navigation";
 import { useState } from "react";
 import ConfirmDeleteDialog from "@app/components/ConfirmDeleteDialog";
 import { formatAxiosError } from "@app/lib/api";
-import { useToast } from "@app/hooks/useToast";
+import { toast } from "@app/hooks/useToast";
 import { createApiClient } from "@app/lib/api";
 import { useEnvContext } from "@app/hooks/useEnvContext";
 import { ArrayElement } from "@server/types/ArrayElement";
@@ -54,8 +54,6 @@ export default function ShareLinksTable({
 }: ShareLinksTableProps) {
     const router = useRouter();
 
-    const { toast } = useToast();
-
     const api = createApiClient(useEnvContext());
 
     const [isCreateModalOpen, setIsCreateModalOpen] = useState(false);
diff --git a/src/app/[orgId]/settings/sites/CreateSiteForm.tsx b/src/app/[orgId]/settings/sites/CreateSiteForm.tsx
index 72774fdd..6df144ca 100644
--- a/src/app/[orgId]/settings/sites/CreateSiteForm.tsx
+++ b/src/app/[orgId]/settings/sites/CreateSiteForm.tsx
@@ -10,7 +10,7 @@ import {
     FormMessage
 } from "@app/components/ui/form";
 import { Input } from "@app/components/ui/input";
-import { useToast } from "@app/hooks/useToast";
+import { toast } from "@app/hooks/useToast";
 import { zodResolver } from "@hookform/resolvers/zod";
 import { useEffect, useState } from "react";
 import { useForm } from "react-hook-form";
@@ -72,8 +72,6 @@ export default function CreateSiteForm({
     setChecked,
     orgId
 }: CreateSiteFormProps) {
-    const { toast } = useToast();
-
     const api = createApiClient(useEnvContext());
     const { env } = useEnvContext();
 
diff --git a/src/app/[orgId]/settings/sites/SitesTable.tsx b/src/app/[orgId]/settings/sites/SitesTable.tsx
index eaa1ca6c..d9d0ba03 100644
--- a/src/app/[orgId]/settings/sites/SitesTable.tsx
+++ b/src/app/[orgId]/settings/sites/SitesTable.tsx
@@ -22,7 +22,7 @@ import { AxiosResponse } from "axios";
 import { useState } from "react";
 import CreateSiteForm from "./CreateSiteForm";
 import ConfirmDeleteDialog from "@app/components/ConfirmDeleteDialog";
-import { useToast } from "@app/hooks/useToast";
+import { toast } from "@app/hooks/useToast";
 import { formatAxiosError } from "@app/lib/api";
 import { createApiClient } from "@app/lib/api";
 import { useEnvContext } from "@app/hooks/useEnvContext";
@@ -47,8 +47,6 @@ type SitesTableProps = {
 export default function SitesTable({ sites, orgId }: SitesTableProps) {
     const router = useRouter();
 
-    const { toast } = useToast();
-
     const [isCreateModalOpen, setIsCreateModalOpen] = useState(false);
     const [isDeleteModalOpen, setIsDeleteModalOpen] = useState(false);
     const [selectedSite, setSelectedSite] = useState<SiteRow | null>(null);
diff --git a/src/app/[orgId]/settings/sites/[niceId]/general/page.tsx b/src/app/[orgId]/settings/sites/[niceId]/general/page.tsx
index 7d17d58e..b1c24405 100644
--- a/src/app/[orgId]/settings/sites/[niceId]/general/page.tsx
+++ b/src/app/[orgId]/settings/sites/[niceId]/general/page.tsx
@@ -15,7 +15,7 @@ import {
 import { Input } from "@/components/ui/input";
 import { useSiteContext } from "@app/hooks/useSiteContext";
 import { useForm } from "react-hook-form";
-import { useToast } from "@app/hooks/useToast";
+import { toast } from "@app/hooks/useToast";
 import { useRouter } from "next/navigation";
 import {
     SettingsContainer,
@@ -40,7 +40,6 @@ type GeneralFormValues = z.infer<typeof GeneralFormSchema>;
 
 export default function GeneralPage() {
     const { site, updateSite } = useSiteContext();
-    const { toast } = useToast();
 
     const api = createApiClient(useEnvContext());
 
diff --git a/src/app/auth/reset-password/ResetPasswordForm.tsx b/src/app/auth/reset-password/ResetPasswordForm.tsx
index ae997818..a87762fe 100644
--- a/src/app/auth/reset-password/ResetPasswordForm.tsx
+++ b/src/app/auth/reset-password/ResetPasswordForm.tsx
@@ -36,7 +36,7 @@ import {
 } from "@server/routers/auth";
 import { Loader2 } from "lucide-react";
 import { Alert, AlertDescription } from "../../../components/ui/alert";
-import { useToast } from "@app/hooks/useToast";
+import { toast } from "@app/hooks/useToast";
 import { useRouter } from "next/navigation";
 import { formatAxiosError } from "@app/lib/api";;
 import { createApiClient } from "@app/lib/api";
@@ -96,8 +96,6 @@ export default function ResetPasswordForm({
 
     const [state, setState] = useState<"request" | "reset" | "mfa">(getState());
 
-    const { toast } = useToast();
-
     const api = createApiClient(useEnvContext());
 
     const form = useForm<z.infer<typeof formSchema>>({
diff --git a/src/app/auth/resource/[resourceId]/ResourceAuthPortal.tsx b/src/app/auth/resource/[resourceId]/ResourceAuthPortal.tsx
index 1aec64d9..5eda0809 100644
--- a/src/app/auth/resource/[resourceId]/ResourceAuthPortal.tsx
+++ b/src/app/auth/resource/[resourceId]/ResourceAuthPortal.tsx
@@ -48,7 +48,7 @@ import {
 import ResourceAccessDenied from "./ResourceAccessDenied";
 import { createApiClient } from "@app/lib/api";
 import { useEnvContext } from "@app/hooks/useEnvContext";
-import { useToast } from "@app/hooks/useToast";
+import { toast } from "@app/hooks/useToast";
 import Link from "next/link";
 
 const pinSchema = z.object({
@@ -91,7 +91,6 @@ type ResourceAuthPortalProps = {
 
 export default function ResourceAuthPortal(props: ResourceAuthPortalProps) {
     const router = useRouter();
-    const { toast } = useToast();
 
     const getNumMethods = () => {
         let colLength = 0;
diff --git a/src/app/auth/verify-email/VerifyEmailForm.tsx b/src/app/auth/verify-email/VerifyEmailForm.tsx
index 8a0ca89a..e0dcbffb 100644
--- a/src/app/auth/verify-email/VerifyEmailForm.tsx
+++ b/src/app/auth/verify-email/VerifyEmailForm.tsx
@@ -31,7 +31,7 @@ import { AxiosResponse } from "axios";
 import { VerifyEmailResponse } from "@server/routers/auth";
 import { Loader2 } from "lucide-react";
 import { Alert, AlertDescription } from "../../../components/ui/alert";
-import { useToast } from "@app/hooks/useToast";
+import { toast } from "@app/hooks/useToast";
 import { useRouter } from "next/navigation";
 import { formatAxiosError } from "@app/lib/api";;
 import { createApiClient } from "@app/lib/api";
@@ -61,8 +61,6 @@ export default function VerifyEmailForm({
     const [isResending, setIsResending] = useState(false);
     const [isSubmitting, setIsSubmitting] = useState(false);
 
-    const { toast } = useToast();
-
     const api = createApiClient(useEnvContext());
 
     const form = useForm<z.infer<typeof FormSchema>>({
diff --git a/src/components/Disable2FaForm.tsx b/src/components/Disable2FaForm.tsx
index cf36d957..3e87bce4 100644
--- a/src/components/Disable2FaForm.tsx
+++ b/src/components/Disable2FaForm.tsx
@@ -28,7 +28,7 @@ import {
     CredenzaHeader,
     CredenzaTitle
 } from "@app/components/Credenza";
-import { useToast } from "@app/hooks/useToast";
+import { toast } from "@app/hooks/useToast";
 import { formatAxiosError } from "@app/lib/api";;
 import { useUserContext } from "@app/hooks/useUserContext";
 import { InputOTP, InputOTPGroup, InputOTPSlot } from "./ui/input-otp";
@@ -50,8 +50,6 @@ export default function Disable2FaForm({ open, setOpen }: Disable2FaProps) {
 
     const [step, setStep] = useState<"password" | "success">("password");
 
-    const { toast } = useToast();
-
     const { user, updateUser } = useUserContext();
 
     const api = createApiClient(useEnvContext());
diff --git a/src/components/Enable2FaForm.tsx b/src/components/Enable2FaForm.tsx
index 57f00725..d9167999 100644
--- a/src/components/Enable2FaForm.tsx
+++ b/src/components/Enable2FaForm.tsx
@@ -35,7 +35,7 @@ import {
     CredenzaHeader,
     CredenzaTitle
 } from "@app/components/Credenza";
-import { useToast } from "@app/hooks/useToast";
+import { toast } from "@app/hooks/useToast";
 import { formatAxiosError } from "@app/lib/api";;
 import CopyTextBox from "@app/components/CopyTextBox";
 import { QRCodeCanvas, QRCodeSVG } from "qrcode.react";
@@ -64,8 +64,6 @@ export default function Enable2FaForm({ open, setOpen }: Enable2FaProps) {
     const [loading, setLoading] = useState(false);
     const [backupCodes, setBackupCodes] = useState<string[]>([]);
 
-    const { toast } = useToast();
-
     const { user, updateUser } = useUserContext();
 
     const api = createApiClient(useEnvContext());
diff --git a/src/components/ProfileIcon.tsx b/src/components/ProfileIcon.tsx
index 1d2e74cc..43463fac 100644
--- a/src/components/ProfileIcon.tsx
+++ b/src/components/ProfileIcon.tsx
@@ -12,7 +12,7 @@ import {
     DropdownMenuTrigger
 } from "@app/components/ui/dropdown-menu";
 import { useEnvContext } from "@app/hooks/useEnvContext";
-import { useToast } from "@app/hooks/useToast";
+import { toast } from "@app/hooks/useToast";
 import { formatAxiosError } from "@app/lib/api";;
 import { Laptop, LogOut, Moon, Sun } from "lucide-react";
 import { useTheme } from "next-themes";
@@ -23,7 +23,6 @@ import Disable2FaForm from "./Disable2FaForm";
 import Enable2FaForm from "./Enable2FaForm";
 
 export default function ProfileIcon() {
-    const { toast } = useToast();
     const { setTheme, theme } = useTheme();
     const { env } = useEnvContext();
     const api = createApiClient({ env });

From c244ef387bb89d204fd623f52f24f4c778cfbc98 Mon Sep 17 00:00:00 2001
From: Milo Schwartz <mschwartz10612@gmail.com>
Date: Mon, 10 Feb 2025 21:48:34 -0500
Subject: [PATCH 29/35] make subdomain input better accommodate long domains

---
 .../settings/resources/[resourceId]/CustomDomainInput.tsx | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/app/[orgId]/settings/resources/[resourceId]/CustomDomainInput.tsx b/src/app/[orgId]/settings/resources/[resourceId]/CustomDomainInput.tsx
index 5c1cf01c..fd754dde 100644
--- a/src/app/[orgId]/settings/resources/[resourceId]/CustomDomainInput.tsx
+++ b/src/app/[orgId]/settings/resources/[resourceId]/CustomDomainInput.tsx
@@ -14,7 +14,7 @@ export default function CustomDomainInput({
     domainSuffix,
     placeholder = "Enter subdomain",
     value: defaultValue,
-    onChange,
+    onChange
 }: CustomDomainInputProps) {
     const [value, setValue] = React.useState(defaultValue);
 
@@ -34,10 +34,10 @@ export default function CustomDomainInput({
                     placeholder={placeholder}
                     value={value}
                     onChange={handleChange}
-                    className="rounded-r-none flex-grow"
+                    className="rounded-r-none w-full"
                 />
-                <div className="inline-flex items-center px-3 rounded-r-md border border-l-0 border-input bg-muted text-muted-foreground">
-                    <span className="text-sm">.{domainSuffix}</span>
+                <div className="max-w-1/2 flex items-center px-3 rounded-r-md border border-l-0 border-input bg-muted text-muted-foreground">
+                    <span className="text-sm truncate">.{domainSuffix}</span>
                 </div>
             </div>
         </div>

From f14ecf50e42d812a98b3295a6e7d119a3337fd37 Mon Sep 17 00:00:00 2001
From: Milo Schwartz <mschwartz10612@gmail.com>
Date: Mon, 10 Feb 2025 22:26:29 -0500
Subject: [PATCH 30/35] add docker deployment snippets to create site form

---
 .../resources/[resourceId]/rules/page.tsx     |  16 +-
 .../[orgId]/settings/sites/CreateSiteForm.tsx | 138 +++++++++++++-----
 2 files changed, 108 insertions(+), 46 deletions(-)

diff --git a/src/app/[orgId]/settings/resources/[resourceId]/rules/page.tsx b/src/app/[orgId]/settings/resources/[resourceId]/rules/page.tsx
index 121e0a58..5ee16461 100644
--- a/src/app/[orgId]/settings/resources/[resourceId]/rules/page.tsx
+++ b/src/app/[orgId]/settings/resources/[resourceId]/rules/page.tsx
@@ -352,10 +352,8 @@ export default function ResourceRules(props: {
                         updateRule(row.original.ruleId, { action: value })
                     }
                 >
-                    <SelectTrigger className="min-w-[100px]">
-                        {row.original.action === "ACCEPT"
-                            ? RuleAction.ACCEPT
-                            : RuleAction.DROP}
+                    <SelectTrigger className="min-w-[150px]">
+                        <SelectValue />
                     </SelectTrigger>
                     <SelectContent>
                         <SelectItem value="ACCEPT">
@@ -376,12 +374,8 @@ export default function ResourceRules(props: {
                         updateRule(row.original.ruleId, { match: value })
                     }
                 >
-                    <SelectTrigger className="min-w-[100px]">
-                        {row.original.match === "IP"
-                            ? RuleMatch.IP
-                            : row.original.match === "CIDR"
-                              ? RuleMatch.CIDR
-                              : RuleMatch.PATH}
+                    <SelectTrigger className="min-w-[125px]">
+                        <SelectValue />
                     </SelectTrigger>
                     <SelectContent>
                         <SelectItem value="IP">{RuleMatch.IP}</SelectItem>
@@ -436,7 +430,7 @@ export default function ResourceRules(props: {
 
     return (
         <SettingsContainer>
-            <Alert>
+            <Alert className="hidden md:block">
                 <InfoIcon className="h-4 w-4" />
                 <AlertTitle className="font-semibold">About Rules</AlertTitle>
                 <AlertDescription className="mt-4">
diff --git a/src/app/[orgId]/settings/sites/CreateSiteForm.tsx b/src/app/[orgId]/settings/sites/CreateSiteForm.tsx
index 6df144ca..98fcc2a6 100644
--- a/src/app/[orgId]/settings/sites/CreateSiteForm.tsx
+++ b/src/app/[orgId]/settings/sites/CreateSiteForm.tsx
@@ -38,7 +38,16 @@ import { SiteRow } from "./SitesTable";
 import { AxiosResponse } from "axios";
 import { Button } from "@app/components/ui/button";
 import Link from "next/link";
-import { ArrowUpRight, SquareArrowOutUpRight } from "lucide-react";
+import {
+    ArrowUpRight,
+    ChevronsUpDown,
+    SquareArrowOutUpRight
+} from "lucide-react";
+import {
+    Collapsible,
+    CollapsibleContent,
+    CollapsibleTrigger
+} from "@app/components/ui/collapsible";
 
 const createSiteFormSchema = z.object({
     name: z
@@ -78,6 +87,8 @@ export default function CreateSiteForm({
     const [isLoading, setIsLoading] = useState(false);
     const [isChecked, setIsChecked] = useState(false);
 
+    const [isOpen, setIsOpen] = useState(false);
+
     const [keypair, setKeypair] = useState<{
         publicKey: string;
         privateKey: string;
@@ -182,10 +193,9 @@ export default function CreateSiteForm({
         }
 
         const res = await api
-            .put<AxiosResponse<CreateSiteResponse>>(
-                `/org/${orgId}/site/`,
-                payload
-            )
+            .put<
+                AxiosResponse<CreateSiteResponse>
+            >(`/org/${orgId}/site/`, payload)
             .catch((e) => {
                 toast({
                     variant: "destructive",
@@ -235,6 +245,18 @@ PersistentKeepalive = 5`
 
     const newtConfig = `newt --id ${siteDefaults?.newtId} --secret ${siteDefaults?.newtSecret} --endpoint ${env.app.dashboardUrl}`;
 
+    const newtConfigDockerCompose = `services:
+    newt:
+        image: fosrl/newt
+        container_name: newt
+        restart: unless-stopped
+        environment:
+            - PANGOLIN_ENDPOINT=${env.app.dashboardUrl}
+            - NEWT_ID=${siteDefaults?.newtId}
+            - NEWT_SECRET=${siteDefaults?.newtSecret}`;
+
+    const newtConfigDockerRun = `docker run -it fosrl/newt --id ${siteDefaults?.newtId} --secret ${siteDefaults?.newtSecret} --endpoint ${env.app.dashboardUrl}`;
+
     return (
         <div className="space-y-4">
             <Form {...form}>
@@ -305,32 +327,6 @@ PersistentKeepalive = 5`
                         )}
                     />
 
-                    <div className="w-full">
-                        {form.watch("method") === "wireguard" && !isLoading ? (
-                            <>
-                                <CopyTextBox text={wgConfig} />
-                                <span className="text-sm text-muted-foreground">
-                                    You will only be able to see the
-                                    configuration once.
-                                </span>
-                            </>
-                        ) : form.watch("method") === "wireguard" &&
-                          isLoading ? (
-                            <p>Loading WireGuard configuration...</p>
-                        ) : form.watch("method") === "newt" ? (
-                            <>
-                                <CopyTextBox
-                                    text={newtConfig}
-                                    wrapText={false}
-                                />
-                                <span className="text-sm text-muted-foreground">
-                                    You will only be able to see the
-                                    configuration once.
-                                </span>
-                            </>
-                        ) : null}
-                    </div>
-
                     {form.watch("method") === "newt" && (
                         <Link
                             className="text-sm text-primary flex items-center gap-1"
@@ -346,6 +342,81 @@ PersistentKeepalive = 5`
                         </Link>
                     )}
 
+                    <div className="w-full">
+                        {form.watch("method") === "wireguard" && !isLoading ? (
+                            <>
+                                <CopyTextBox text={wgConfig} />
+                                <span className="text-sm text-muted-foreground mt-2">
+                                    You will only be able to see the
+                                    configuration once.
+                                </span>
+                            </>
+                        ) : form.watch("method") === "wireguard" &&
+                          isLoading ? (
+                            <p>Loading WireGuard configuration...</p>
+                        ) : form.watch("method") === "newt" ? (
+                            <>
+                                <div className="mb-2">
+                                    <Collapsible
+                                        open={isOpen}
+                                        onOpenChange={setIsOpen}
+                                        className="space-y-2"
+                                    >
+                                        <div className="mx-auto">
+                                            <CopyTextBox
+                                                text={newtConfig}
+                                                wrapText={false}
+                                            />
+                                        </div>
+                                        <div className="flex items-center justify-between space-x-4">
+                                            <CollapsibleTrigger asChild>
+                                                <Button
+                                                    variant="text"
+                                                    size="sm"
+                                                    className="p-0 flex items-center justify-between w-full"
+                                                >
+                                                    <h4 className="text-sm font-semibold">
+                                                        Expand for Docker Deployment
+                                                        Details
+                                                    </h4>
+                                                    <div>
+                                                        <ChevronsUpDown className="h-4 w-4" />
+                                                        <span className="sr-only">
+                                                            Toggle
+                                                        </span>
+                                                    </div>
+                                                </Button>
+                                            </CollapsibleTrigger>
+                                        </div>
+                                        <CollapsibleContent className="space-y-4">
+                                            <div className="space-y-2">
+                                                <b>Docker Compose</b>
+                                                <CopyTextBox
+                                                    text={
+                                                        newtConfigDockerCompose
+                                                    }
+                                                    wrapText={false}
+                                                />
+                                            </div>
+                                            <div className="space-y-2">
+                                                <b>Docker Run</b>
+
+                                                <CopyTextBox
+                                                    text={newtConfigDockerRun}
+                                                    wrapText={false}
+                                                />
+                                            </div>
+                                        </CollapsibleContent>
+                                    </Collapsible>
+                                </div>
+                                <span className="text-sm text-muted-foreground">
+                                    You will only be able to see the
+                                    configuration once.
+                                </span>
+                            </>
+                        ) : null}
+                    </div>
+
                     {form.watch("method") === "local" && (
                         <Link
                             className="text-sm text-primary flex items-center gap-1"
@@ -353,10 +424,7 @@ PersistentKeepalive = 5`
                             target="_blank"
                             rel="noopener noreferrer"
                         >
-                            <span>
-                                {" "}
-                                Local sites do not tunnel, learn more
-                            </span>
+                            <span> Local sites do not tunnel, learn more</span>
                             <SquareArrowOutUpRight size={14} />
                         </Link>
                     )}

From fdf1dfdeba904a9b07faf565f5449f35a252d2b9 Mon Sep 17 00:00:00 2001
From: Milo Schwartz <mschwartz10612@gmail.com>
Date: Tue, 11 Feb 2025 23:59:13 -0500
Subject: [PATCH 31/35] rules server validation, enabled toggle, fix wildcard

---
 server/db/schema.ts                           |   4 +-
 .../subdomainSchema.ts => lib/schemas.ts}     |   1 +
 server/lib/validators.ts                      |  68 +++++
 server/routers/badger/verifySession.ts        | 252 +++++++++++-------
 server/routers/resource/createResource.ts     |   2 +-
 server/routers/resource/createResourceRule.ts |  50 +++-
 server/routers/resource/listResourceRules.ts  |  19 +-
 server/routers/resource/updateResource.ts     |   2 +-
 server/routers/resource/updateResourceRule.ts |  63 ++++-
 server/setup/scripts/1.0.0-beta13.ts          |   2 +
 .../settings/resources/CreateResourceForm.tsx |   2 +-
 .../resources/[resourceId]/general/page.tsx   |   3 +-
 .../resources/[resourceId]/rules/page.tsx     | 195 ++++++++------
 13 files changed, 467 insertions(+), 196 deletions(-)
 rename server/{schemas/subdomainSchema.ts => lib/schemas.ts} (99%)
 create mode 100644 server/lib/validators.ts

diff --git a/server/db/schema.ts b/server/db/schema.ts
index 16d8ada2..3380cdbf 100644
--- a/server/db/schema.ts
+++ b/server/db/schema.ts
@@ -377,6 +377,8 @@ export const resourceRules = sqliteTable("resourceRules", {
     resourceId: integer("resourceId")
         .notNull()
         .references(() => resources.resourceId, { onDelete: "cascade" }),
+    enabled: integer("enabled", { mode: "boolean" }).notNull().default(true),
+    priority: integer("priority").notNull(),
     action: text("action").notNull(), // ACCEPT, DROP
     match: text("match").notNull(), // CIDR, PATH, IP
     value: text("value").notNull()
@@ -414,4 +416,4 @@ export type ResourceOtp = InferSelectModel<typeof resourceOtp>;
 export type ResourceAccessToken = InferSelectModel<typeof resourceAccessToken>;
 export type ResourceWhitelist = InferSelectModel<typeof resourceWhitelist>;
 export type VersionMigration = InferSelectModel<typeof versionMigrations>;
-export type ResourceRule = InferSelectModel<typeof resourceRules>;
\ No newline at end of file
+export type ResourceRule = InferSelectModel<typeof resourceRules>;
diff --git a/server/schemas/subdomainSchema.ts b/server/lib/schemas.ts
similarity index 99%
rename from server/schemas/subdomainSchema.ts
rename to server/lib/schemas.ts
index 30ba2ddd..f4b7daf3 100644
--- a/server/schemas/subdomainSchema.ts
+++ b/server/lib/schemas.ts
@@ -8,3 +8,4 @@ export const subdomainSchema = z
     )
     .min(1, "Subdomain must be at least 1 character long")
     .transform((val) => val.toLowerCase());
+
diff --git a/server/lib/validators.ts b/server/lib/validators.ts
new file mode 100644
index 00000000..ffe471bb
--- /dev/null
+++ b/server/lib/validators.ts
@@ -0,0 +1,68 @@
+export function isValidCIDR(cidr: string): boolean {
+    // Match CIDR pattern (e.g., "192.168.0.0/24")
+    const cidrPattern =
+        /^([0-9]{1,3}\.){3}[0-9]{1,3}\/([0-9]|[1-2][0-9]|3[0-2])$/;
+
+    if (!cidrPattern.test(cidr)) {
+        return false;
+    }
+
+    // Validate IP address part
+    const ipPart = cidr.split("/")[0];
+    const octets = ipPart.split(".");
+
+    return octets.every((octet) => {
+        const num = parseInt(octet, 10);
+        return num >= 0 && num <= 255;
+    });
+}
+
+export function isValidIP(ip: string): boolean {
+    const ipPattern = /^([0-9]{1,3}\.){3}[0-9]{1,3}$/;
+
+    if (!ipPattern.test(ip)) {
+        return false;
+    }
+
+    const octets = ip.split(".");
+
+    return octets.every((octet) => {
+        const num = parseInt(octet, 10);
+        return num >= 0 && num <= 255;
+    });
+}
+
+export function isValidUrlGlobPattern(pattern: string): boolean {
+    // Remove leading slash if present
+    pattern = pattern.startsWith("/") ? pattern.slice(1) : pattern;
+
+    // Empty string is not valid
+    if (!pattern) {
+        return false;
+    }
+
+    // Split path into segments
+    const segments = pattern.split("/");
+
+    // Check each segment
+    for (let i = 0; i < segments.length; i++) {
+        const segment = segments[i];
+
+        // Empty segments are not allowed (double slashes)
+        if (!segment && i !== segments.length - 1) {
+            return false;
+        }
+
+        // If segment contains *, it must be exactly *
+        if (segment.includes("*") && segment !== "*") {
+            return false;
+        }
+
+        // Check for invalid characters
+        if (!/^[a-zA-Z0-9_*-]*$/.test(segment)) {
+            return false;
+        }
+    }
+
+    return true;
+}
diff --git a/server/routers/badger/verifySession.ts b/server/routers/badger/verifySession.ts
index a4a2944a..fc1c85f5 100644
--- a/server/routers/badger/verifySession.ts
+++ b/server/routers/badger/verifySession.ts
@@ -1,36 +1,38 @@
-import HttpCode from "@server/types/HttpCode";
-import { NextFunction, Request, Response } from "express";
-import createHttpError from "http-errors";
-import { z } from "zod";
-import { fromError } from "zod-validation-error";
-import { response } from "@server/lib/response";
-import db from "@server/db";
-import {
-    resourceRules,
-    ResourceAccessToken,
-    ResourcePassword,
-    resourcePassword,
-    ResourcePincode,
-    resourcePincode,
-    resources,
-    sessions,
-    userOrgs,
-    users,
-    ResourceRule
-} from "@server/db/schema";
-import { and, eq } from "drizzle-orm";
-import config from "@server/lib/config";
+import { generateSessionToken } from "@server/auth/sessions/app";
 import {
     createResourceSession,
     serializeResourceSessionCookie,
     validateResourceSessionToken
 } from "@server/auth/sessions/resource";
-import { Resource, roleResources, userResources } from "@server/db/schema";
-import logger from "@server/logger";
 import { verifyResourceAccessToken } from "@server/auth/verifyResourceAccessToken";
-import NodeCache from "node-cache";
-import { generateSessionToken } from "@server/auth/sessions/app";
+import db from "@server/db";
+import {
+    Resource,
+    ResourceAccessToken,
+    ResourcePassword,
+    resourcePassword,
+    ResourcePincode,
+    resourcePincode,
+    ResourceRule,
+    resourceRules,
+    resources,
+    roleResources,
+    sessions,
+    userOrgs,
+    userResources,
+    users
+} from "@server/db/schema";
+import config from "@server/lib/config";
 import { isIpInCidr } from "@server/lib/ip";
+import { response } from "@server/lib/response";
+import logger from "@server/logger";
+import HttpCode from "@server/types/HttpCode";
+import { and, eq } from "drizzle-orm";
+import { NextFunction, Request, Response } from "express";
+import createHttpError from "http-errors";
+import NodeCache from "node-cache";
+import { z } from "zod";
+import { fromError } from "zod-validation-error";
 
 // We'll see if this speeds anything up
 const cache = new NodeCache({
@@ -169,18 +171,16 @@ export async function verifyResourceSession(
             // otherwise its undefined and we pass
         }
 
-        const redirectUrl = `${config.getRawConfig().app.dashboard_url}/auth/resource/${encodeURIComponent(resource.resourceId)}?redirect=${encodeURIComponent(originalRequestURL)}`;
+        const redirectUrl = `${config.getRawConfig().app.dashboard_url}/auth/resource/${encodeURIComponent(
+            resource.resourceId
+        )}?redirect=${encodeURIComponent(originalRequestURL)}`;
 
         // check for access token
         let validAccessToken: ResourceAccessToken | undefined;
         if (token) {
             const [accessTokenId, accessToken] = token.split(".");
             const { valid, error, tokenItem } = await verifyResourceAccessToken(
-                {
-                    resource,
-                    accessTokenId,
-                    accessToken
-                }
+                { resource, accessTokenId, accessToken }
             );
 
             if (error) {
@@ -190,7 +190,9 @@ export async function verifyResourceSession(
             if (!valid) {
                 if (config.getRawConfig().app.log_failed_attempts) {
                     logger.info(
-                        `Resource access token is invalid. Resource ID: ${resource.resourceId}. IP: ${clientIp}.`
+                        `Resource access token is invalid. Resource ID: ${
+                            resource.resourceId
+                        }. IP: ${clientIp}.`
                     );
                 }
             }
@@ -211,7 +213,9 @@ export async function verifyResourceSession(
         if (!sessions) {
             if (config.getRawConfig().app.log_failed_attempts) {
                 logger.info(
-                    `Missing resource sessions. Resource ID: ${resource.resourceId}. IP: ${clientIp}.`
+                    `Missing resource sessions. Resource ID: ${
+                        resource.resourceId
+                    }. IP: ${clientIp}.`
                 );
             }
             return notAllowed(res);
@@ -219,7 +223,9 @@ export async function verifyResourceSession(
 
         const resourceSessionToken =
             sessions[
-                `${config.getRawConfig().server.session_cookie_name}${resource.ssl ? "_s" : ""}`
+                `${config.getRawConfig().server.session_cookie_name}${
+                    resource.ssl ? "_s" : ""
+                }`
             ];
 
         if (resourceSessionToken) {
@@ -242,7 +248,9 @@ export async function verifyResourceSession(
                 );
                 if (config.getRawConfig().app.log_failed_attempts) {
                     logger.info(
-                        `Resource session is an exchange token. Resource ID: ${resource.resourceId}. IP: ${clientIp}.`
+                        `Resource session is an exchange token. Resource ID: ${
+                            resource.resourceId
+                        }. IP: ${clientIp}.`
                     );
                 }
                 return notAllowed(res);
@@ -281,7 +289,9 @@ export async function verifyResourceSession(
                 }
 
                 if (resourceSession.userSessionId && sso) {
-                    const userAccessCacheKey = `userAccess:${resourceSession.userSessionId}:${resource.resourceId}`;
+                    const userAccessCacheKey = `userAccess:${
+                        resourceSession.userSessionId
+                    }:${resource.resourceId}`;
 
                     let isAllowed: boolean | undefined =
                         cache.get(userAccessCacheKey);
@@ -305,8 +315,8 @@ export async function verifyResourceSession(
             }
         }
 
-        // At this point we have checked all sessions, but since the access token is valid, we should allow access
-        // and create a new session.
+        // At this point we have checked all sessions, but since the access token is
+        // valid, we should allow access and create a new session.
         if (validAccessToken) {
             return await createAccessTokenSession(
                 res,
@@ -319,7 +329,9 @@ export async function verifyResourceSession(
 
         if (config.getRawConfig().app.log_failed_attempts) {
             logger.info(
-                `Resource access not allowed. Resource ID: ${resource.resourceId}. IP: ${clientIp}.`
+                `Resource access not allowed. Resource ID: ${
+                    resource.resourceId
+                }. IP: ${clientIp}.`
             );
         }
         return notAllowed(res, redirectUrl);
@@ -485,69 +497,123 @@ async function checkRules(
         return;
     }
 
-    let hasAcceptRule = false;
+    // sort rules by priority in ascending order
+    rules = rules.sort((a, b) => a.priority - b.priority);
 
-    // First pass: look for DROP rules
     for (const rule of rules) {
+        if (!rule.enabled) {
+            continue;
+        }
+
         if (
-            (clientIp &&
-                rule.match == "CIDR" &&
-                isIpInCidr(clientIp, rule.value) &&
-                rule.action === "DROP") ||
-            (clientIp &&
-                rule.match == "IP" &&
-                clientIp == rule.value &&
-                rule.action === "DROP") ||
-            (path &&
-                rule.match == "PATH" &&
-                urlGlobToRegex(rule.value).test(path) &&
-                rule.action === "DROP")
+            clientIp &&
+            rule.match == "CIDR" &&
+            isIpInCidr(clientIp, rule.value)
         ) {
-            return "DROP";
-        }
-        // Track if we see any ACCEPT rules for the second pass
-        if (rule.action === "ACCEPT") {
-            hasAcceptRule = true;
-        }
-    }
-
-    // Second pass: only check ACCEPT rules if we found one and didn't find a DROP
-    if (hasAcceptRule) {
-        for (const rule of rules) {
-            if (rule.action !== "ACCEPT") continue;
-
-            if (
-                (clientIp &&
-                    rule.match == "CIDR" &&
-                    isIpInCidr(clientIp, rule.value)) ||
-                (clientIp &&
-                    rule.match == "IP" &&
-                    clientIp == rule.value) ||
-                (path &&
-                    rule.match == "PATH" &&
-                    urlGlobToRegex(rule.value).test(path))
-            ) {
-                return "ACCEPT";
-            }
+            return rule.action as any;
+        } else if (clientIp && rule.match == "IP" && clientIp == rule.value) {
+            return rule.action as any;
+        } else if (
+            path &&
+            rule.match == "PATH" &&
+            isPathAllowed(rule.value, path)
+        ) {
+            return rule.action as any;
         }
     }
 
     return;
 }
 
-function urlGlobToRegex(pattern: string): RegExp {
-    // Trim any leading or trailing slashes
-    pattern = pattern.replace(/^\/+|\/+$/g, "");
+function isPathAllowed(pattern: string, path: string): boolean {
+    logger.debug(`\nMatching path "${path}" against pattern "${pattern}"`);
 
-    // Escape special regex characters except *
-    const escapedPattern = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
+    // Normalize and split paths into segments
+    const normalize = (p: string) => p.split("/").filter(Boolean);
+    const patternParts = normalize(pattern);
+    const pathParts = normalize(path);
 
-    // Replace * with regex pattern for any valid URL segment characters
-    const regexPattern = escapedPattern.replace(/\*/g, "[a-zA-Z0-9_-]+");
+    logger.debug(`Normalized pattern parts: [${patternParts.join(", ")}]`);
+    logger.debug(`Normalized path parts: [${pathParts.join(", ")}]`);
 
-    // Create the final pattern that:
-    // 1. Optionally matches leading slash
-    // 2. Matches the pattern
-    // 3. Optionally matches trailing slash
-    return new RegExp(`^/?${regexPattern}/?$`);
-}
\ No newline at end of file
+    // Recursive function to try different wildcard matches
+    function matchSegments(patternIndex: number, pathIndex: number): boolean {
+        const indent = "  ".repeat(pathIndex); // Indent based on recursion depth
+        const currentPatternPart = patternParts[patternIndex];
+        const currentPathPart = pathParts[pathIndex];
+
+        logger.debug(
+            `${indent}Checking patternIndex=${patternIndex} (${currentPatternPart || "END"}) vs pathIndex=${pathIndex} (${currentPathPart || "END"})`
+        );
+
+        // If we've consumed all pattern parts, we should have consumed all path parts
+        if (patternIndex >= patternParts.length) {
+            const result = pathIndex >= pathParts.length;
+            logger.debug(
+                `${indent}Reached end of pattern, remaining path: ${pathParts.slice(pathIndex).join("/")} -> ${result}`
+            );
+            return result;
+        }
+
+        // If we've consumed all path parts but still have pattern parts
+        if (pathIndex >= pathParts.length) {
+            // The only way this can match is if all remaining pattern parts are wildcards
+            const remainingPattern = patternParts.slice(patternIndex);
+            const result = remainingPattern.every((p) => p === "*");
+            logger.debug(
+                `${indent}Reached end of path, remaining pattern: ${remainingPattern.join("/")} -> ${result}`
+            );
+            return result;
+        }
+
+        // For wildcards, try consuming different numbers of path segments
+        if (currentPatternPart === "*") {
+            logger.debug(
+                `${indent}Found wildcard at pattern index ${patternIndex}`
+            );
+
+            // Try consuming 0 segments (skip the wildcard)
+            logger.debug(
+                `${indent}Trying to skip wildcard (consume 0 segments)`
+            );
+            if (matchSegments(patternIndex + 1, pathIndex)) {
+                logger.debug(
+                    `${indent}Successfully matched by skipping wildcard`
+                );
+                return true;
+            }
+
+            // Try consuming current segment and recursively try rest
+            logger.debug(
+                `${indent}Trying to consume segment "${currentPathPart}" for wildcard`
+            );
+            if (matchSegments(patternIndex, pathIndex + 1)) {
+                logger.debug(
+                    `${indent}Successfully matched by consuming segment for wildcard`
+                );
+                return true;
+            }
+
+            logger.debug(`${indent}Failed to match wildcard`);
+            return false;
+        }
+
+        // For regular segments, they must match exactly
+        if (currentPatternPart !== currentPathPart) {
+            logger.debug(
+                `${indent}Segment mismatch: "${currentPatternPart}" != "${currentPathPart}"`
+            );
+            return false;
+        }
+
+        logger.debug(
+            `${indent}Segments match: "${currentPatternPart}" = "${currentPathPart}"`
+        );
+        // Move to next segments in both pattern and path
+        return matchSegments(patternIndex + 1, pathIndex + 1);
+    }
+
+    const result = matchSegments(0, 0);
+    logger.debug(`Final result: ${result}`);
+    return result;
+}
diff --git a/server/routers/resource/createResource.ts b/server/routers/resource/createResource.ts
index 9f7fa1fb..39b07a57 100644
--- a/server/routers/resource/createResource.ts
+++ b/server/routers/resource/createResource.ts
@@ -17,7 +17,7 @@ import { eq, and } from "drizzle-orm";
 import stoi from "@server/lib/stoi";
 import { fromError } from "zod-validation-error";
 import logger from "@server/logger";
-import { subdomainSchema } from "@server/schemas/subdomainSchema";
+import { subdomainSchema } from "@server/lib/schemas";
 import config from "@server/lib/config";
 
 const createResourceParamsSchema = z
diff --git a/server/routers/resource/createResourceRule.ts b/server/routers/resource/createResourceRule.ts
index 24b08fc9..304f4bd0 100644
--- a/server/routers/resource/createResourceRule.ts
+++ b/server/routers/resource/createResourceRule.ts
@@ -8,12 +8,19 @@ import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
 import logger from "@server/logger";
 import { fromError } from "zod-validation-error";
+import {
+    isValidCIDR,
+    isValidIP,
+    isValidUrlGlobPattern
+} from "@server/lib/validators";
 
 const createResourceRuleSchema = z
     .object({
         action: z.enum(["ACCEPT", "DROP"]),
         match: z.enum(["CIDR", "IP", "PATH"]),
-        value: z.string().min(1)
+        value: z.string().min(1),
+        priority: z.number().int(),
+        enabled: z.boolean().optional()
     })
     .strict();
 
@@ -42,7 +49,7 @@ export async function createResourceRule(
             );
         }
 
-        const { action, match, value } = parsedBody.data;
+        const { action, match, value, priority, enabled } = parsedBody.data;
 
         const parsedParams = createResourceRuleParamsSchema.safeParse(
             req.params
@@ -74,6 +81,41 @@ export async function createResourceRule(
             );
         }
 
+        if (!resource.http) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "Cannot create rule for non-http resource"
+                )
+            );
+        }
+
+        if (match === "CIDR") {
+            if (!isValidCIDR(value)) {
+                return next(
+                    createHttpError(
+                        HttpCode.BAD_REQUEST,
+                        "Invalid CIDR provided"
+                    )
+                );
+            }
+        } else if (match === "IP") {
+            if (!isValidIP(value)) {
+                return next(
+                    createHttpError(HttpCode.BAD_REQUEST, "Invalid IP provided")
+                );
+            }
+        } else if (match === "PATH") {
+            if (!isValidUrlGlobPattern(value)) {
+                return next(
+                    createHttpError(
+                        HttpCode.BAD_REQUEST,
+                        "Invalid URL glob pattern provided"
+                    )
+                );
+            }
+        }
+
         // Create the new resource rule
         const [newRule] = await db
             .insert(resourceRules)
@@ -81,7 +123,9 @@ export async function createResourceRule(
                 resourceId,
                 action,
                 match,
-                value
+                value,
+                priority,
+                enabled
             })
             .returning();
 
diff --git a/server/routers/resource/listResourceRules.ts b/server/routers/resource/listResourceRules.ts
index 3364aa4b..0d29bd99 100644
--- a/server/routers/resource/listResourceRules.ts
+++ b/server/routers/resource/listResourceRules.ts
@@ -40,12 +40,14 @@ function queryResourceRules(resourceId: number) {
             resourceId: resourceRules.resourceId,
             action: resourceRules.action,
             match: resourceRules.match,
-            value: resourceRules.value
+            value: resourceRules.value,
+            priority: resourceRules.priority,
+            enabled: resourceRules.enabled
         })
         .from(resourceRules)
         .leftJoin(resources, eq(resourceRules.resourceId, resources.resourceId))
         .where(eq(resourceRules.resourceId, resourceId));
-    
+
     return baseQuery;
 }
 
@@ -71,7 +73,9 @@ export async function listResourceRules(
         }
         const { limit, offset } = parsedQuery.data;
 
-        const parsedParams = listResourceRulesParamsSchema.safeParse(req.params);
+        const parsedParams = listResourceRulesParamsSchema.safeParse(
+            req.params
+        );
         if (!parsedParams.success) {
             return next(
                 createHttpError(
@@ -99,16 +103,19 @@ export async function listResourceRules(
         }
 
         const baseQuery = queryResourceRules(resourceId);
-        
+
         let countQuery = db
             .select({ count: sql<number>`cast(count(*) as integer)` })
             .from(resourceRules)
             .where(eq(resourceRules.resourceId, resourceId));
 
-        const rulesList = await baseQuery.limit(limit).offset(offset);
+        let rulesList = await baseQuery.limit(limit).offset(offset);
         const totalCountResult = await countQuery;
         const totalCount = totalCountResult[0].count;
 
+        // sort rules list by the priority in ascending order
+        rulesList = rulesList.sort((a, b) => a.priority - b.priority);
+
         return response<ListResourceRulesResponse>(res, {
             data: {
                 rules: rulesList,
@@ -129,4 +136,4 @@ export async function listResourceRules(
             createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
         );
     }
-}
\ No newline at end of file
+}
diff --git a/server/routers/resource/updateResource.ts b/server/routers/resource/updateResource.ts
index cc48894b..e464b4c5 100644
--- a/server/routers/resource/updateResource.ts
+++ b/server/routers/resource/updateResource.ts
@@ -8,8 +8,8 @@ import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
 import logger from "@server/logger";
 import { fromError } from "zod-validation-error";
-import { subdomainSchema } from "@server/schemas/subdomainSchema";
 import config from "@server/lib/config";
+import { subdomainSchema } from "@server/lib/schemas";
 
 const updateResourceParamsSchema = z
     .object({
diff --git a/server/routers/resource/updateResourceRule.ts b/server/routers/resource/updateResourceRule.ts
index 0eaacc03..ef23b318 100644
--- a/server/routers/resource/updateResourceRule.ts
+++ b/server/routers/resource/updateResourceRule.ts
@@ -8,14 +8,16 @@ import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
 import logger from "@server/logger";
 import { fromError } from "zod-validation-error";
+import {
+    isValidCIDR,
+    isValidIP,
+    isValidUrlGlobPattern
+} from "@server/lib/validators";
 
 // Define Zod schema for request parameters validation
 const updateResourceRuleParamsSchema = z
     .object({
-        ruleId: z
-            .string()
-            .transform(Number)
-            .pipe(z.number().int().positive()),
+        ruleId: z.string().transform(Number).pipe(z.number().int().positive()),
         resourceId: z
             .string()
             .transform(Number)
@@ -28,7 +30,9 @@ const updateResourceRuleSchema = z
     .object({
         action: z.enum(["ACCEPT", "DROP"]).optional(),
         match: z.enum(["CIDR", "IP", "PATH"]).optional(),
-        value: z.string().min(1).optional()
+        value: z.string().min(1).optional(),
+        priority: z.number().int(),
+        enabled: z.boolean().optional()
     })
     .strict()
     .refine((data) => Object.keys(data).length > 0, {
@@ -42,7 +46,9 @@ export async function updateResourceRule(
 ): Promise<any> {
     try {
         // Validate path parameters
-        const parsedParams = updateResourceRuleParamsSchema.safeParse(req.params);
+        const parsedParams = updateResourceRuleParamsSchema.safeParse(
+            req.params
+        );
         if (!parsedParams.success) {
             return next(
                 createHttpError(
@@ -82,6 +88,15 @@ export async function updateResourceRule(
             );
         }
 
+        if (!resource.http) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "Cannot create rule for non-http resource"
+                )
+            );
+        }
+
         // Verify that the rule exists and belongs to the specified resource
         const [existingRule] = await db
             .select()
@@ -107,6 +122,40 @@ export async function updateResourceRule(
             );
         }
 
+        const match = updateData.match || existingRule.match;
+        const { value } = updateData;
+
+        if (value !== undefined) {
+            if (match === "CIDR") {
+                if (!isValidCIDR(value)) {
+                    return next(
+                        createHttpError(
+                            HttpCode.BAD_REQUEST,
+                            "Invalid CIDR provided"
+                        )
+                    );
+                }
+            } else if (match === "IP") {
+                if (!isValidIP(value)) {
+                    return next(
+                        createHttpError(
+                            HttpCode.BAD_REQUEST,
+                            "Invalid IP provided"
+                        )
+                    );
+                }
+            } else if (match === "PATH") {
+                if (!isValidUrlGlobPattern(value)) {
+                    return next(
+                        createHttpError(
+                            HttpCode.BAD_REQUEST,
+                            "Invalid URL glob pattern provided"
+                        )
+                    );
+                }
+            }
+        }
+
         // Update the rule
         const [updatedRule] = await db
             .update(resourceRules)
@@ -127,4 +176,4 @@ export async function updateResourceRule(
             createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
         );
     }
-}
\ No newline at end of file
+}
diff --git a/server/setup/scripts/1.0.0-beta13.ts b/server/setup/scripts/1.0.0-beta13.ts
index 26dac8f9..ea47db57 100644
--- a/server/setup/scripts/1.0.0-beta13.ts
+++ b/server/setup/scripts/1.0.0-beta13.ts
@@ -9,6 +9,8 @@ export default async function migration() {
             trx.run(sql`CREATE TABLE resourceRules (
                 ruleId integer PRIMARY KEY AUTOINCREMENT NOT NULL,
                 resourceId integer NOT NULL,
+                priority integer NOT NULL,
+                enabled integer DEFAULT true NOT NULL,
                 action text NOT NULL,
                 match text NOT NULL,
                 value text NOT NULL,
diff --git a/src/app/[orgId]/settings/resources/CreateResourceForm.tsx b/src/app/[orgId]/settings/resources/CreateResourceForm.tsx
index f62bf8fe..d27f8831 100644
--- a/src/app/[orgId]/settings/resources/CreateResourceForm.tsx
+++ b/src/app/[orgId]/settings/resources/CreateResourceForm.tsx
@@ -59,7 +59,7 @@ import {
     SelectTrigger,
     SelectValue
 } from "@app/components/ui/select";
-import { subdomainSchema } from "@server/schemas/subdomainSchema";
+import { subdomainSchema } from "@server/lib/schemas";
 import Link from "next/link";
 import { SquareArrowOutUpRight } from "lucide-react";
 import CopyTextBox from "@app/components/CopyTextBox";
diff --git a/src/app/[orgId]/settings/resources/[resourceId]/general/page.tsx b/src/app/[orgId]/settings/resources/[resourceId]/general/page.tsx
index 43624e3f..301354a3 100644
--- a/src/app/[orgId]/settings/resources/[resourceId]/general/page.tsx
+++ b/src/app/[orgId]/settings/resources/[resourceId]/general/page.tsx
@@ -49,9 +49,8 @@ import { useOrgContext } from "@app/hooks/useOrgContext";
 import CustomDomainInput from "../CustomDomainInput";
 import { createApiClient } from "@app/lib/api";
 import { useEnvContext } from "@app/hooks/useEnvContext";
-import { subdomainSchema } from "@server/schemas/subdomainSchema";
+import { subdomainSchema } from "@server/lib/schemas";
 import { CaretSortIcon, CheckIcon } from "@radix-ui/react-icons";
-import { pullEnv } from "@app/lib/pullEnv";
 import { RadioGroup, RadioGroupItem } from "@app/components/ui/radio-group";
 import { Label } from "@app/components/ui/label";
 
diff --git a/src/app/[orgId]/settings/resources/[resourceId]/rules/page.tsx b/src/app/[orgId]/settings/resources/[resourceId]/rules/page.tsx
index 5ee16461..7fc16b81 100644
--- a/src/app/[orgId]/settings/resources/[resourceId]/rules/page.tsx
+++ b/src/app/[orgId]/settings/resources/[resourceId]/rules/page.tsx
@@ -57,7 +57,7 @@ import {
 import { ListResourceRulesResponse } from "@server/routers/resource/listResourceRules";
 import { SwitchInput } from "@app/components/SwitchInput";
 import { Alert, AlertDescription, AlertTitle } from "@app/components/ui/alert";
-import { Check, InfoIcon, X } from "lucide-react";
+import { ArrowUpDown, Check, InfoIcon, X } from "lucide-react";
 import {
     InfoSection,
     InfoSections,
@@ -65,12 +65,19 @@ import {
 } from "@app/components/InfoSection";
 import { Separator } from "@app/components/ui/separator";
 import { InfoPopup } from "@app/components/ui/info-popup";
+import {
+    isValidCIDR,
+    isValidIP,
+    isValidUrlGlobPattern
+} from "@server/lib/validators";
+import { Switch } from "@app/components/ui/switch";
 
 // Schema for rule validation
 const addRuleSchema = z.object({
     action: z.string(),
     match: z.string(),
-    value: z.string()
+    value: z.string(),
+    priority: z.coerce.number().int().optional()
 });
 
 type LocalRule = ArrayElement<ListResourceRulesResponse["rules"]> & {
@@ -181,11 +188,23 @@ export default function ResourceRules(props: {
             return;
         }
 
+        // find the highest priority and add one
+        let priority = data.priority;
+        if (priority === undefined) {
+            priority = rules.reduce(
+                (acc, rule) => (rule.priority > acc ? rule.priority : acc),
+                0
+            );
+            priority++;
+        }
+
         const newRule: LocalRule = {
             ...data,
             ruleId: new Date().getTime(),
             new: true,
-            resourceId: resource.resourceId
+            resourceId: resource.resourceId,
+            priority,
+            enabled: true
         };
 
         setRules([...rules, newRule]);
@@ -255,7 +274,9 @@ export default function ResourceRules(props: {
                 const data = {
                     action: rule.action,
                     match: rule.match,
-                    value: rule.value
+                    value: rule.value,
+                    priority: rule.priority,
+                    enabled: rule.enabled
                 };
 
                 if (rule.match === "CIDR" && !isValidCIDR(rule.value)) {
@@ -289,6 +310,28 @@ export default function ResourceRules(props: {
                     return;
                 }
 
+                if (rule.priority === undefined) {
+                    toast({
+                        variant: "destructive",
+                        title: "Invalid Priority",
+                        description: "Please enter a valid priority"
+                    });
+                    setLoading(false);
+                    return;
+                }
+
+                // make sure no duplicate priorities
+                const priorities = rules.map((r) => r.priority);
+                if (priorities.length !== new Set(priorities).size) {
+                    toast({
+                        variant: "destructive",
+                        title: "Duplicate Priorities",
+                        description: "Please enter unique priorities"
+                    });
+                    setLoading(false);
+                    return;
+                }
+
                 if (rule.new) {
                     const res = await api.put(
                         `/resource/${params.resourceId}/rule`,
@@ -342,6 +385,50 @@ export default function ResourceRules(props: {
     }
 
     const columns: ColumnDef<LocalRule>[] = [
+        {
+            accessorKey: "priority",
+            header: ({ column }) => {
+                return (
+                    <Button
+                        variant="ghost"
+                        onClick={() =>
+                            column.toggleSorting(column.getIsSorted() === "asc")
+                        }
+                    >
+                        Priority
+                        <ArrowUpDown className="ml-2 h-4 w-4" />
+                    </Button>
+                );
+            },
+            cell: ({ row }) => (
+                <Input
+                    defaultValue={row.original.priority}
+                    className="w-[75px]"
+                    type="number"
+                    onBlur={(e) => {
+                        const parsed = z.coerce
+                            .number()
+                            .int()
+                            .optional()
+                            .safeParse(e.target.value);
+
+                        if (!parsed.data) {
+                            toast({
+                                variant: "destructive",
+                                title: "Invalid IP",
+                                description: "Please enter a valid priority"
+                            });
+                            setLoading(false);
+                            return;
+                        }
+
+                        updateRule(row.original.ruleId, {
+                            priority: parsed.data
+                        });
+                    }}
+                />
+            )
+        },
         {
             accessorKey: "action",
             header: "Action",
@@ -400,6 +487,18 @@ export default function ResourceRules(props: {
                 />
             )
         },
+        {
+            accessorKey: "enabled",
+            header: "Enabled",
+            cell: ({ row }) => (
+                <Switch
+                    defaultChecked={row.original.enabled}
+                    onCheckedChange={(val) =>
+                        updateRule(row.original.ruleId, { enabled: val })
+                    }
+                />
+            )
+        },
         {
             id: "actions",
             cell: ({ row }) => (
@@ -434,14 +533,14 @@ export default function ResourceRules(props: {
                 <InfoIcon className="h-4 w-4" />
                 <AlertTitle className="font-semibold">About Rules</AlertTitle>
                 <AlertDescription className="mt-4">
-                    <p className="mb-4">
-                        Rules allow you to control access to your resource based
-                        on a set of criteria. You can create rules to allow or
-                        deny access based on IP address or URL path. Deny rules
-                        take precedence over allow rules. If a request matches
-                        both an allow and a deny rule, the deny rule will be
-                        applied.
-                    </p>
+                    <div className="space-y-1 mb-4">
+                        <p>
+                            Rules allow you to control access to your resource
+                            based on a set of criteria. You can create rules to
+                            allow or deny access based on IP address or URL
+                            path.
+                        </p>
+                    </div>
                     <InfoSections>
                         <InfoSection>
                             <InfoSectionTitle>Actions</InfoSectionTitle>
@@ -661,6 +760,9 @@ export default function ResourceRules(props: {
                             </TableBody>
                         </Table>
                     </TableContainer>
+                    <p className="text-sm text-muted-foreground">
+                        Rules are evaluated by priority in ascending order.
+                    </p>
                 </SettingsSectionBody>
                 <SettingsSectionFooter>
                     <Button
@@ -675,72 +777,3 @@ export default function ResourceRules(props: {
         </SettingsContainer>
     );
 }
-
-function isValidCIDR(cidr: string): boolean {
-    // Match CIDR pattern (e.g., "192.168.0.0/24")
-    const cidrPattern =
-        /^([0-9]{1,3}\.){3}[0-9]{1,3}\/([0-9]|[1-2][0-9]|3[0-2])$/;
-
-    if (!cidrPattern.test(cidr)) {
-        return false;
-    }
-
-    // Validate IP address part
-    const ipPart = cidr.split("/")[0];
-    const octets = ipPart.split(".");
-
-    return octets.every((octet) => {
-        const num = parseInt(octet, 10);
-        return num >= 0 && num <= 255;
-    });
-}
-
-function isValidIP(ip: string): boolean {
-    const ipPattern = /^([0-9]{1,3}\.){3}[0-9]{1,3}$/;
-
-    if (!ipPattern.test(ip)) {
-        return false;
-    }
-
-    const octets = ip.split(".");
-
-    return octets.every((octet) => {
-        const num = parseInt(octet, 10);
-        return num >= 0 && num <= 255;
-    });
-}
-
-function isValidUrlGlobPattern(pattern: string): boolean {
-    // Remove leading slash if present
-    pattern = pattern.startsWith("/") ? pattern.slice(1) : pattern;
-
-    // Empty string is not valid
-    if (!pattern) {
-        return false;
-    }
-
-    // Split path into segments
-    const segments = pattern.split("/");
-
-    // Check each segment
-    for (let i = 0; i < segments.length; i++) {
-        const segment = segments[i];
-
-        // Empty segments are not allowed (double slashes)
-        if (!segment && i !== segments.length - 1) {
-            return false;
-        }
-
-        // If segment contains *, it must be exactly *
-        if (segment.includes("*") && segment !== "*") {
-            return false;
-        }
-
-        // Check for invalid characters
-        if (!/^[a-zA-Z0-9_*-]*$/.test(segment)) {
-            return false;
-        }
-    }
-
-    return true;
-}

From 19273ddbd5c7cb2439f02675e4c3b5054111216c Mon Sep 17 00:00:00 2001
From: Milo Schwartz <mschwartz10612@gmail.com>
Date: Wed, 12 Feb 2025 21:52:58 -0500
Subject: [PATCH 32/35] use zod for rules ip validation

---
 eslint.config.js            |  9 +++++++++
 server/auth/sessions/app.ts |  1 +
 server/lib/validators.ts    | 32 ++++----------------------------
 3 files changed, 14 insertions(+), 28 deletions(-)
 create mode 100644 eslint.config.js

diff --git a/eslint.config.js b/eslint.config.js
new file mode 100644
index 00000000..71dc862c
--- /dev/null
+++ b/eslint.config.js
@@ -0,0 +1,9 @@
+// eslint.config.js
+export default [
+    {
+        rules: {
+            semi: "error",
+            "prefer-const": "error"
+        }
+    }
+];
diff --git a/server/auth/sessions/app.ts b/server/auth/sessions/app.ts
index e58ff815..18ea072b 100644
--- a/server/auth/sessions/app.ts
+++ b/server/auth/sessions/app.ts
@@ -95,6 +95,7 @@ export async function validateSessionToken(
 }
 
 export async function invalidateSession(sessionId: string): Promise<void> {
+    await db.delete(resourceSessions).where(eq(resourceSessions.userSessionId, sessionId));
     await db.delete(sessions).where(eq(sessions.sessionId, sessionId));
 }
 
diff --git a/server/lib/validators.ts b/server/lib/validators.ts
index ffe471bb..0aa590e6 100644
--- a/server/lib/validators.ts
+++ b/server/lib/validators.ts
@@ -1,35 +1,11 @@
+import z from "zod";
+
 export function isValidCIDR(cidr: string): boolean {
-    // Match CIDR pattern (e.g., "192.168.0.0/24")
-    const cidrPattern =
-        /^([0-9]{1,3}\.){3}[0-9]{1,3}\/([0-9]|[1-2][0-9]|3[0-2])$/;
-
-    if (!cidrPattern.test(cidr)) {
-        return false;
-    }
-
-    // Validate IP address part
-    const ipPart = cidr.split("/")[0];
-    const octets = ipPart.split(".");
-
-    return octets.every((octet) => {
-        const num = parseInt(octet, 10);
-        return num >= 0 && num <= 255;
-    });
+    return z.string().cidr().safeParse(cidr).success;
 }
 
 export function isValidIP(ip: string): boolean {
-    const ipPattern = /^([0-9]{1,3}\.){3}[0-9]{1,3}$/;
-
-    if (!ipPattern.test(ip)) {
-        return false;
-    }
-
-    const octets = ip.split(".");
-
-    return octets.every((octet) => {
-        const num = parseInt(octet, 10);
-        return num >= 0 && num <= 255;
-    });
+    return z.string().ip().safeParse(ip).success;
 }
 
 export function isValidUrlGlobPattern(pattern: string): boolean {

From 06ceff74271f519e225980fe6968ae0cdb7017b9 Mon Sep 17 00:00:00 2001
From: Milo Schwartz <mschwartz10612@gmail.com>
Date: Wed, 12 Feb 2025 22:29:42 -0500
Subject: [PATCH 33/35] change migration script text

---
 server/setup/scripts/1.0.0-beta13.ts | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/server/setup/scripts/1.0.0-beta13.ts b/server/setup/scripts/1.0.0-beta13.ts
index ea47db57..48b68cec 100644
--- a/server/setup/scripts/1.0.0-beta13.ts
+++ b/server/setup/scripts/1.0.0-beta13.ts
@@ -1,8 +1,10 @@
 import db from "@server/db";
 import { sql } from "drizzle-orm";
 
+const version = "1.0.0-beta.13";
+
 export default async function migration() {
-    console.log("Running setup script 1.0.0-beta.13...");
+    console.log(`Running setup script ${version}...`);
 
     try {
         db.transaction((trx) => {
@@ -27,5 +29,5 @@ export default async function migration() {
         throw e;
     }
 
-    console.log("Done.");
+    console.log(`${version} migration complete`);
 }

From c230e034cfd2f9e16ff87b8233705ab1e8389ba2 Mon Sep 17 00:00:00 2001
From: Milo Schwartz <mschwartz10612@gmail.com>
Date: Wed, 12 Feb 2025 23:01:00 -0500
Subject: [PATCH 34/35] update readme

---
 README.md                 |  43 +++++++++++++++++++++-----------------
 public/logo/word_mark.png | Bin 0 -> 64948 bytes
 2 files changed, 24 insertions(+), 19 deletions(-)
 create mode 100644 public/logo/word_mark.png

diff --git a/README.md b/README.md
index 2c887483..81dcfb9f 100644
--- a/README.md
+++ b/README.md
@@ -1,4 +1,5 @@
-# Pangolin
+<div align="center">
+    <h2 align="center"><a href="https://fossorial.io"><img alt="pangolin" src="public/logo//word_mark.png" width="400" /></a></h2>
 
 [![Documentation](https://img.shields.io/badge/docs-latest-blue.svg?style=flat-square)](https://docs.fossorial.io/)
 [![Docker](https://img.shields.io/docker/pulls/fosrl/pangolin?style=flat-square)](https://hub.docker.com/r/fosrl/pangolin)
@@ -6,19 +7,23 @@
 [![Discord](https://img.shields.io/discord/1325658630518865980?logo=discord&style=flat-square)](https://discord.gg/HCJR8Xhme4)
 [![Youtube](https://img.shields.io/badge/YouTube-red?logo=youtube&logoColor=white&style=flat-square)](https://www.youtube.com/@fossorial-app)
 
-Pangolin is a self-hosted tunneled reverse proxy management server with identity and access control, designed to securely expose private resources through use with the Traefik reverse proxy and WireGuard tunnel clients like Newt. With Pangolin, you retain full control over your infrastructure while providing a user-friendly and feature-rich solution for managing proxies, authentication, and access, and simplifying complex network setups, all with a clean and simple UI.
+</div>
 
-### Installation and Documentation
+<div align="center">
+  <h5>
+      <a href="https://docs.fossorial.io/Getting%20Started/quick-install">
+        Install Guide
+      </a>
+      <span> | </span>
+      <a href="https://docs.fossorial.io">
+        Full Documentation
+      </a>
+  </h5>
+</div>
 
--   [Installation Instructions](https://docs.fossorial.io/Getting%20Started/quick-install)
--   [Full Documentation](https://docs.fossorial.io)
+<h3 align="center">Tunneled Mesh Reverse Proxy Server with Access Control</h3>
 
-### Authors and Maintainers
-
-- [Milo Schwartz](https://github.com/miloschwartz)
-- [Owen Schwartz](https://github.com/oschwartz10612)
-
-## Preview
+Pangolin is a self-hosted tunneled reverse proxy management server with identity and access control, designed to securely expose private resources on distributed networks. With Pangolin, you retain full control over your infrastructure while providing a user-friendly and feature-rich solution for managing proxies, authentication, and access, while simplifying complex network setups.
 
 <img src="public/screenshots/sites.png" alt="Preview"/>
 
@@ -28,7 +33,7 @@ _Sites page of Pangolin dashboard (dark mode) showing multiple tunnels connected
 
 ### Reverse Proxy Through WireGuard Tunnel
 
--   Expose private resources on your network **without opening ports**.
+-   Expose private resources on your network **without opening ports** (firewall punching).
 -   Secure and easy to configure site-to-site connectivity via a custom **user space WireGuard client**, [Newt](https://github.com/fosrl/newt).
 -   Built-in support for any WireGuard client.
 -   Automated **SSL certificates** (https) via [LetsEncrypt](https://letsencrypt.org/).
@@ -37,6 +42,7 @@ _Sites page of Pangolin dashboard (dark mode) showing multiple tunnels connected
 ### Identity & Access Management
 
 -   Centralized authentication system using platform SSO. **Users will only have to manage one login.**
+-   **Rules based access control for resources.**
 -   Totp with backup codes for two-factor authentication.
 -   Create organizations, each with multiple sites, users, and roles.
 -   **Role-based access control** to manage resource access permissions.
@@ -62,13 +68,11 @@ _Sites page of Pangolin dashboard (dark mode) showing multiple tunnels connected
 
 ### Modular Design
 
--   Extend functionality with existing [Traefik](https://github.com/traefik/traefik) plugins, such as [Fail2Ban](https://plugins.traefik.io/plugins/628c9ebcffc0cd18356a979f/fail2-ban) or [CrowdSec](https://plugins.traefik.io/plugins/6335346ca4caa9ddeffda116/crowdsec-bouncer-traefik-plugin), which integrate seamlessly.
+-   Extend functionality with existing [Traefik](https://github.com/traefik/traefik) plugins, such as [Fail2Ban](https://plugins.traefik.io/plugins/628c9ebcffc0cd18356a979f/fail2-ban) or [CrowdSec](https://plugins.traefik.io/plugins/6335346ca4caa9ddeffda116/crowdsec-bouncer-traefik-plugin).
 -   Attach as many sites to the central server as you wish.
 
 ## Screenshots
 
-Pangolin has a straightforward and simple dashboard UI:
-
 <div align="center">
   <table>
   <tr>
@@ -94,22 +98,23 @@ Pangolin has a straightforward and simple dashboard UI:
   </table>
 </div>
 
-## Workflow Example
-
-### Deployment and Usage Example
+## Deployment and Usage Example
 
 1. **Deploy the Central Server**:
 
-    - Deploy the Docker Compose stack containing Pangolin, Gerbil, and Traefik onto a VPS hosted on a cloud platform like Amazon EC2, DigitalOcean Droplet, or similar. There are many cheap VPS hosting options available to suit your needs.
+    - Deploy the Docker Compose stack onto a VPS hosted on a cloud platform like Amazon EC2, DigitalOcean Droplet, or similar. There are many cheap VPS hosting options available to suit your needs.
 
 2. **Domain Configuration**:
 
     - Point your domain name to the VPS and configure Pangolin with your preferred settings.
 
 3. **Connect Private Sites**:
+
     - Install Newt or use another WireGuard client on private sites.
     - Automatically establish a connection from these sites to the central server.
+
 4. **Configure Users & Roles**
+
     - Define organizations and invite users.
     - Implement user- or role-based permissions to control resource access.
 
diff --git a/public/logo/word_mark.png b/public/logo/word_mark.png
new file mode 100644
index 0000000000000000000000000000000000000000..14da644ba8acb0ee4e52926e2ecf32953f3d8a36
GIT binary patch
literal 64948
zcmeFZd0f-i);FpmpfZUd1POzTTE@r}Aiz<vhzdA?fCz>#hzv<UAt(ZZ5FjD3p$ZDZ
z(|VLsWL6+m=1hlza4bg#LCBy`3rM0BV?n$twpDtc^E~gl@4fH+>p7pEPeZbQd#}Cr
zT5EsTcdcLZ5BhqkY}m44)v8r0-g`X{uUfUiXw|AU)O8B*O&oTI1pc+2us0}a)hcUa
z+5cCQZh0ibD9xCofoB4J4!Gd(@z&S~e0ZcaDV_kMSFOT$kO){@Y~&fk@W|+x1UIAk
z2OUO+F%fP?#~gfYeF(cFPsQv#ml%2EobOTGxmcWYgpr54A%^4v6U0ZJ!5Wg{;}Viw
zNNz?S=XHV4vafB73_lJz6YFNQQ?{UCpwB_W-T1^vLq}^{E1a#ZqoI?tbp$pXiwh68
zG~8jk17%}tZ-cV8vbA-wb9S+}H~js7MzCCBM3l>6&o6&p4E}O6I(6m@!NtZVB_+i=
z#m*X^7;S@cc6PS0-C?t1hZT&lN=i*QgC$udBpLrPgJ)zCE-{91CI+8iD4P)*jz4?G
z%?L#OZ4dE;PtztO{jMj_m<<U_ut8bd%J%eeU<B^dIKtV)xQ~lR;A|q}BI6?y&LqKD
z)Tgn8Q}{FZq*M6+V(L#n|7iixt&h*AHU6b6@$sLQNIJ788Mg7eLjL9Gq@$^XNSniv
zN%*sgxX3-pAg1vjyGc58IP$YT|Bc6C_{WC{F1r&Wv1jm!NAdW$KaTm}ANw`jvBTQl
zaGMVn7n2~<z;@YszdsV`i9HkPW(0@sU}d|*3bo_tjvX$xJ6s&>tZW@zY;AuV>VuDn
ziAw!fLwDG_piqAr3MLnUJ%jyU4vxUNMBx+Tv7oP*cx-f}4Iv@g$neuCxa`Kq;S*tD
zkj`%9_ujjAA56qY#l*o6Nr%058G7&8?TB)AbhO%Gjru6AkB^IYLed#*0xr_q)6EF>
zY8?|3;bMz+#NwPHovotm9HXr4ZJkh7;SRP@R*|;hIBYl$?c`*)<B#V(@wl@x3z9wm
zn>R(^aWKbc@oZ6c*eJA}gB8jii?*^w+ecW1+eO)1VbS(G93pL_?46xH&E}UF0}hRi
zTRE#tstA}d5{unoAL;C16&dMhXJu~(@}V6ZoUI~pD6E}xWQ4;GT%^ovKCgT<l62+(
zHZ?La>34VBg^m9GQ(Vjn1%4dki;V|85wHo-__&yam3sX6vuv&vKij}OHZp(wZAzQ}
zV$qLI;j%X-2`n!4_oa_S5<d&^(GOg(IGKOD8R2BM85v<@_}kYp|Ke=^EiL^1e9Eav
znDoD~*x!~(!bhD+!6ruTjD~akH+(|2ciGlKhkq7737h=i3y*ffMSvxst*|H@%F5m$
z9IRl69oi~#2M%o?j&nviI6M8Z`F|z+4m%eIr$2n?e^2<|MaG?igN}q7!^Y@;e>-5;
z_Ks*rXDdf12YV}fl*~^euufJE;SS;9=%@%Z${GFNZf9jk_&>fK96ljAGI51@5wMA1
z^Jl<4+>D|U@$rUO0wFF2hn3l)O>#oS@3+Y((>6SVH~buc{!6t*L?*_pu!EJWd=kO%
z|HJkEmsa=hg|pxE|1YiX|I{&k3?RRS1DpSQr1<S`&);<UrR;P*-gz$nDkl89b_kcC
z3q<En@%sN!Wc_`8{Quhs{V8&;KsJ8_Q-DjdkDq`V{P79uMJ9l^CIXN%8C-W`)vDKD
zdVB6XN?JWDP+Xc$-8u5kBV%$B|3iOYf8WByd7FC6-tL!;O6#)r+5de^f8hFggu|CO
zUmH}pw{?%s&F@1nhpCkl@80nOcOJZc$H;2$6|?$(&gINSCP$@bw7r{F`)Q49$BkDO
zb<;@+MB*WaiT8?sdJgyf>2Gg_<)Z^DeuuF=n;!npkpI!kZ&vd^#_&-O|KlXGknsPb
zF<1p+lb6Jg7|-fTUgv1lSic^j-XuC&a|dndDSRK2&C4qhdxAa;rtJM3yCQBKzieVL
zCK$=|5*sE5yA6p5aXb`SewvR7p?Zn8BeR@;v+3V0duP3&cfjp8XnAd{u{-rGuJTH}
zzHa^IN<OkIcaXS)){RB4X&J#OChz;ahKaXomb`akV_&__G(R|mrbj{=u#s9d$fOdU
z8M1&yK>D)3M=MqekH)>unG$c)@ACc6YhJZtBExc~MSIgW;JJN2+*Rj^BFZR9#0|7A
z^^shwk)P_u3Qv%b4@_4+s@Rof5~MREQVyX_^A*Zs=!y;NUtjHzkK;Ka^9Ko9zTH7+
zJ+E-NsS7a=>g8M;j;|Ctaiis4#`E~qWIm>K;{YcJJ)s>;K6|y;xeuqWG*X~JQ1E4q
zqUCs4rDklAIbK_z=R13K<t2bztHg+S_ask)Xja>GjK8b;tuv*BbuR8+S~V*QnLCF@
zR`L&&(d>v{sIvNgoaI{2vcFyV{4>MA%O<_UF--ko{^7DqZ<g=B8KL?FlJ!(;RnS{1
zg=uBkMT8Bs?x?t~FZ+V-@4?V+j99JQzVkXQlb%;Q$T)&(E$1v#ll)FNgjG`IoSP+_
ztl=fcalS&YHy0c&qu3ENRh#g0-6B%RpEPh;rU9&~E@4A$w+hL{m#r1{1k-#{*O9+-
zaR3=r!dufU)GRAJLIh2!j}*+IHSHEBtY<q#D`#P3N9<%+s*MpGYrC6Bj<n7)n|M{F
z5o%2!T_<_$ZPW-gek2!1_@cl28d{~2Z`+6M*H2oYKOMPv<3CM<OdBI?4!smD^h7@I
zDHUu)7O0fmoqs6WR(A0<oCmK5jU)>X#u524ZT{(Lq=^#a8Q)oRS{RNo7~o1u?xsvN
z$dA>l+s(fEXI!Ua9PbcX-&|w~IwjgSqe;mk;=h=n^Ezvdqd<p*s_k|jiHgyxmp|UH
z+U|U`s$Cy0cQ<i^FYg*!yHd0cd9h}M&mYU-HSAw0MWRfha<Ov0-0w;H37yvh>(AK5
zbw*Y5%G#3FHRD`WdEcRRD+S7BG?pz(Iq53-1_?=7Il)I=BGF|2j`7Sp1a(@Mi{HaF
zvI9BUUvzi9m+%anB}l<mM{6E$=y~-EI{9SFpG_+0a)d)EOWAI=J3*1BfTU0)m=N;o
z`u=tlODm4!(uZkyIFc2Q-oz7}Da*M_{DQ_&=$$mu@0J_c{wLGgt7Q^Y7&Vf&yJ7tU
zf{lLXw{p??y2LHDtT#+eUigg*(W>N=8bj~OQv0y_$BA2fyGPMV=0XyZ_Hg8qyag)(
zQ=nJEvj($uRvapmi|(Jc40lS#{Rw!LH_Cel+>|fNq7dz0vR#QCumn$-7Lq?LJRHYq
zy?~c<#IAOoBO;rHaQ=6R7++otT3M+Co9k@BOF(AbB*OM@x<!?MK~dUUb*5~i=PggF
zQp#l?Sw>nHVv<U*Q$0cKGPkLQOb}G@C3lXrA~>3O|0aSDX-m6mrEq{?<DPp$m8wCs
zYF|?<GKp*c(1%l^bxTGvqxo@V`E~?*)vl<x#>R(&z>s{F7~yzwwNeSM)lKU{s-5M@
ziD}Do;Sd0nXKYzz@EtK}A+U4JRD&+1{hrPgitg;!Zxj_swi?Ovl6bf3sqwe2RCwwS
zpzwG{K_XZ$$1$#JQ5-s+`*eZsjHKNq%7<n~3v3rBmAyo#kvY4G&i&oqBhTuNv&*i;
z<Q5U+tXZmkI6c^;b079mu@h@elza4}Vn=#vA5NwkCVaj6bqUW%%dKJ0`953tJ~dGb
z#d3+`nx!Gt;9yop^B(sG!=BTPI@+Q;1eNAd(YlbVw?g%_p>_wd4vm#0UK4U@kXRx&
zO~M!)!^x?#z6qSpe;D-r6ah#kbFDcPS!Ze%McxxOp_~->%kzg=^`sJ3-^4YnD(FM@
zchr0zHi~{jYCl0!<GZia!KgXtz-o%<Qp<aT?wXF{>>)Y2XAeASaTI7`G;F%Bpf~9v
z5uoBIWY$wKgKLjtRA=f{DeeC#lZ)+t)tvWMq(U-($xissllt<MBt~VFv+mLQm7?#Z
ztK4biSzRxF3{z{MD+k?o(TVKbSFM+{P*P+Q<>a0f#={Fmq@yccbKx3T>wO(s*Bj{<
zAyf#~57F8KY_i0Cw*Jg<BBr+UHF2{q4`wodH<K(VBI%`T8+^UeH!mdYWL$~MH70B>
zr&Ah6wOizi1p`Di_re<s6J{Zq)53R5#2Bi`(m-~X%O$K_oAEwe_N+xYO<VLu9H-1C
z!L6Tnm#C4z^7Wg*(0HaK)!Ht3^wGvvOje5M4d|eF<;owQ{`p`Ct*-kGdZH)^UE9eM
z9~!@OqrKG%EjKJoWv((mnH`aux^})RmSCK~{j&mX;8gOP`H5+p%PB`@Z)ivkq^(mE
zM1_r?L(*T%cGFwGvvCPi;K7?0s7UXvTzU4G5~JFaCvs-$o1g5T2%--X9o%VS4TBo4
z`U9LKqK<D@Rz&K3jrq<BzS*BnZ5|el@$FI)hnHo)xjKcw$j$S-2oG$|p!?YlBzJ4B
zdZ2kwxjRKyvaeN%{wMoQZ!zrIm#AD$>A2Wi-}R$j)*wNCS^2FHbskB+L)0tJwrlWi
zOmm~92(OSdUjFGymy_vPXd6<fEl7;(G@7z}3MX@ipyr-E$5aT*w;(biQqOA|aOVXz
z%s+t%)e^9dth3AwVf1L+9k(fr!wf;8mMbSkTXQLd)v8x4@ed^4OV**}<16*^EHn6W
z#P?&FO5$B1l$)r#_&%(zb=R7gozBd4x~9EjEa|q1ykUO!$e&@)KeJ4FN43i6b==p)
z>i43+xGvQ=*14WnDHhACI<ix+<dth62}%shW4Z+Q_Dwe2poNOmxT0$01A?nNm5x)K
zs^7L!?TY_Az<B;M8lyDKx9{8ks#vQ*<3asuFCilC^2#aYz?7f=v<{<a(;Yct))RKt
zq?Ub%Y0x6j8mB7~3|{hBe-?O=0|NITX&is)X^h;M>ASR~K(a=I-aw}>CexMRn$Tq~
z(HW<?5<HSmYA55IlJ_&ru?Y#jzxzPMhb_3cuB<C_4KdgCziQjTEn!W;r>{*c{w@@L
zI}70|u~Eg3M<H%*-v7!o3av^0b(gCoXgqg-uQh)0I6>)U_j}StHQ`Q7*3-bxKAHW(
zpE>lyLXvdnyEQoKL*|-+&TDABO8z!v)|=&S1S^b$pbL`IkQLx9j!Q4>edv1`mad>o
z?HRy2th>Z&lk>5w$v8V2%b298#=pyyYZ2N>*SZ&u5!Cd%R$x89QH027$)^=j96kZ}
zcqswV|0XAyhMFimCUmNdIaguQ(^zlVQ@n$`2ZFpdKUTaMt@oN?$-y{ci)?;D>vP?h
zdM*5b@r$KI-IuI3ruJLW))nyOS??AcvS7aRtq{35v8J3>DKh6F47eHWjFQ_gAjD=z
z?PS<Q>kW+p=wW|*A==Hiiz0DAtJ!%kG@TvEjYq3%^VKoA4~TXNtV+rDajGlPLciO0
zmYV=D;<J5FQM7Kl@In3Ki%F`>PD^Zr$U{`&H+Y6((z6<TuDCJpCh@*o0_P!#4RAxk
zR2|?2m3TLH)WA*Cz{^MLridKJv&M+#3EYQLOa0Dlrhyv&kmYCR9r_Ox_gtF6vU;;K
zshK~|f51h2*z_Uo`fV@BF~GyxzfKLwtYe>RRm;evpLEi4b0CXGr7jqi8B^!WQ)&HX
zaqO?qa`bRTefABej+00$ZH<#ie>_LA;j@(o8FLW>Y#Sl6m-pq8aau1zg!dWz#fxF0
z$j&ke>qFAIZ;|v>Svpcn_Z+gD!x&Meeaiq_%UiWsN40Bf`#+4_DKd-Y#xoUVCqh;f
zuX@Q_iJpS?a1pPiWGT5MsN9!Th@)oYR+QY1DK_azZ!+xBxW>XV*B0|N<GQv=H%^dC
z#d&Q`<U$A>lsm+~fm<V0dEcN{Pm9zs1&go_%Sx*3o_(C4s}G2`I{}Vlg}wqVqqxaS
z8R9j)lgM=B00Nix-rnc!KE|w*5(D!UWN`!B$dNdDJabJ3?S^z)@~A7BA2Oa9Eeh;2
z30e>6wzT0CeGjJK0UQY{o~hCz3>Yt5lx);zUmyj3x_}yYQBl6#vBcUd&)-RlP~2k&
z27l4<{&**uH-e<2XxYUnSkt=ht-yC&)N{PknS?5*XrPKBZk62SmD${rC-b+J<@3ZF
z^*iBQAWWofso>5r<>;Sn>uLjvdyT1X9(b*v2RfU%9rG*Iq{ki1D(vjKex5&CO*ieE
z8j`}xE<KWl{=)Mb*7wqVX`B05ttJ*vjizkrJ|oYR=DII1l~UkTvL1+I#&Z{m9xplX
zN$XZ5jf&ujN5}Its^g;hTom_iWz2maMnpyM<!7%S3X}oSoGdj@UR$2yN>rQ3InmD4
z@#U(J)cbi`8Py6&?e|iVw0N`*U2q7Kd!DG9z^#;cr)_BACt&h!j1=yH!}+wKp4GNo
z^qM-(`T(+>_yLX@dpqXbURWszR*LUTWp1d%W}7>*yqOyex+)3gfXs}=_92wlgglej
zhnT29y43<&t5Rewi(eKAym;p36hS&B@4RGH@~1Vt7jB}sYtmJsgHBlUGP*CDj7Dpj
zyqg~q*oWjmlF|q1peQYbeq53~p1UXPCj?-qE`M|gqv^D25&)r@1|2Wa0SuKa+4z!c
z#guR1Ye?;1a^*;CAJpqoRs_mf-49CTv1iY{Lx|L18#!<;5Oc$>gNrK+a1WK2#WOdk
z35iQv^<O!Yg*wtwrYdhQqa#7Jw0=E#ahJ?0Xr)Am!Zl2}x5Cxq^hMwzKI8DKr>GL-
zlH8rK0V*og$!E}qVd6KMWs>pYU`U=Wf!3B}RLikqt~cNsO%WZ-$<xBM-i>dYu}Z$3
zIV4TG(0V*;fbW>5P{EBRnCo{YSca=p0#{_(&nO67TxSNm>~XwCx_;PJ?^j=2?cG5x
zA~;*Kwa(9@F>(go@l5SXzCuVg&ZOtZhd5(L;lWvM1A23cO#fpbdFLEc>8)V3%-flt
zF2ZM&#hqpG@uV(<$aK)YZ6D*=b~s&hNX{MNrl^I9t<1GHoo&)}wOtgVJ|yZ#?4s$;
zef60tXk~LSpaL)P#+U3$vCepbpGa#w=e)!=Is9{e^h%qH7?XGe9Zx?^l{^@<x7x?B
z9L<V|FBR;<s1=77-E!SB(2aD@wIHl_+{<_$ox7Wm*YPr8yucOAg>{0dlfrk$P`zZn
zY`ikbY#d7SXbw7V&Dk&B=glxZe!2R@Yc#T$pNJHF=el}Wv@ecl=A9^xV{JvNyNVIA
zn@6Js)Ig()a7_8P*v}FUQBholw2Gz|ijqHO8k5+ET-2D;)g>xJdU1e(#3%)JZVhA`
zX%RQ*^F&Mo1D1j4E>q)k&f7TDy4EYGwAKJuhVdD!H1WO~VHQ;C$d7AX<;U8(a3j_7
zq?z|s0Oz)J`8f7BXr#Gd8vwJFni{%}uWxQUz=-IHVl+kPiX;a@C`BecPa1XK3gk$7
zq2v^SBgW{H)5QLO5FKnCd9ttrwqNQ!bk#YIn+n_q%f-9#zSXZ~d&cuygdeyA{7JzZ
zsj`02r{iv#0&1uEgfka?m=WQvWfI$K<lF5}+S0s_@fhE)-y$$;)x~qp6E*Z#7+<yj
zz}1dlESG2|J)xj$y`&ME1yRozqE^sTeV(yYb0W8ee?n^VlI8nJ!l0RQtBe;xQax`*
zTeD%1YqMZeNa5@HP)2nq1#YFnQgJ28VuI}YNivfREEPqs><PQS>o>_*YkWKHi0+Qw
zjK_0Z(>7-0wFuucHCCWx_i2;rqK-57O?nu8Cb2BDGI}h*-4QnOLUn2TvPHU1M~;)g
z43o+Gj5{lm?k}a77oxOGyceEiMZ78Hy&#!ccR7OAEQRXhSuLUt!JHKFvTFr7WS$Jq
zyhiIdc{66O$oKs0NX8L2*Rs_a5pPBcc|;}mtQ6rK$sl0`$ml6<KH)wY@Y~j(Y7x}S
zDU^C&Mzt!1w9$Z7N;ICJoClcrnRbC3=GD7qSfB|OXv!=inp*P$yc=Ixg)6#W^5}9E
zW7F2X{Tyr-`nBGr>HfBdv)5TfCb-dhnLHQOME+8ZahuP_a9#dgTB&U0fku~jt~^s;
zJN%|eklRN>i+Z-?vt`V-c|CvaX6W5GtYva%P@Rb=7H#uxJl7}K7*gOxL@%#3=wf}k
zO&M*k|CZM7W%`>IM{_Ghr^~X=G9u1i6ObSWAev23Q-nn;@N;V7%PRwKFMl*3WFT<9
zRwU$GEcrsTzBWIVw8e2h1JYnG;S011M8>79?)i%KM?S6g>ef@Mih0$K>U6Gm6m1I0
zU6eScDZ66M+95CQmz*gBzPDpH!AO<!B@!~Cr%WB!&u1Ps?(=HWE%*3GVV`xnY#QM1
zml!$<52dZ4lwY4i8x#v7yc?V2Sc3%RewKh_>|Xfv)6xv{<f5e%gNoZRhZqrcR(n;;
zYM96Y?yW$!bu~{{ymhwG{xw?8hHXb=ngqFOp~y981D<GaS!N4gj_LntnpXff&deZ0
zJLA3r1GenRde-TzI4s;{c``Q|tKo>t_2A(aCIn2R6W<cpw<cV__7hqxaYH|EM(hQ<
zssEg(y>iBLm7ZBKO!hY#I@>x5<3h4<sJlF~ki0#X;ra$_956?|tXpXL8B^~l^m<*w
zwq}8qblb}nP(Fh0(e=j^qaPfFnjyJ&>nEmVX&dXyxXyE6Ym2X@fG6v+BcP{DyqAA;
zL6WV|tD}X5B;5qo3h>qw{Fc|KfiE%%V#xO_r)ZYvSP;H8Z`LWs>XTuxlKaelS4}@w
z5>a)^)Z2Yhd5oY#V-wNq@hlzz;^go8sXmMEev0mX@+KD&qN_01wTKT-sCE)$S$1mJ
zIHsR7%%35cHlLi(7|Xj$FtzTC@@CjPUpt<OXF-Hm<9PCq9LvOe=&vvZFQcjXeHDZS
ztGx?#Hwo(2+^^bO3(=eHFu6Jt*~c5kv|ZE(U~knXJ;ipcZ_oyi%lLA~BwI0te~4rf
z`?yYczS_rC44U8HY&e?XC<?)-m}4i3oyfrUX#=4ye8cRWu4bi@^!s@V-VAeGt_oUi
zjOggwbw{F#`3%-$9~lU;(F0Fjhux03@Aompzn?Y<DYU46I&qEn9ZA1kKkVYo3;jLJ
zO~pc6u=1u%oLD(crG2$c*SnDw^Za1%Ly=Ba`*;|`^>4X%q0PCEU|q|;78o5v<0cW;
zX-QoA1RF4VW2WBa1v>rgfU+D9Zmh%|ll3_SM$||nm(cz7$x9RVKJyHd)O}heixXcW
zDN2M5LqYdb<2bjN8e}j_zGZc>NorLTdc$!7T9t<)8Mx<u_KU`!eFpC(Q6(ONjzHaH
z(fob}Cep5_-GTLpWL8eYxq)M5PYW|TTSN*-`ZbfDc3Zj?b5$6nBS%}b1Np^gHFw+l
zbmR^P>87V&zx~!5W>I2Xh;{2{D-m>>N1UbzM!ub813_P#j23GVFwLS<WfwiV9}w*H
zzxrf7k6)e_>myIU`PDuh?$3%6?}eIpw6-5Bzhty!D(xF64ZX)|So3-%bEK{PT(iDU
zYxh(+_zdzSZ2@&prB`FF1Kl)g9>su=RLNh1B&T`<S*1r~4~jRX0o`K!DWF97m)?Hy
zq3c7!*<ULvV}9N3&A1S?vvIzRdPia(cf}+~Wr|>5o-;^Ppmjl_3km)o3qJmNUZ|XQ
z>#^vVcmRUYch@2&NAf6Qu=2AElRG`%pq0Wd;<>#NOC;smr-!Ot2JPp%d&P<Y<YOY&
z+cCkQipnTPWrDt!jLwaR2p&|Z%JL^Uhvv#sqEB~9PnDg|Ad9qqx$}pG;MTb7xAhn%
zi{l4g{Zp@?mmu#8ZuT&0B<rpilV;JrdZ1JNQ><$I8B!zL(7X@fk-yqVt3JBqs0}Rn
zG6JJrj4d_k39eVK6rO|U)SdW8Azb|~Y){n=pFvgSC7fljbNU9{Z!12`diLEYjY2T>
zy=)Q`>nI9G7HANSme(0{$*rgZ-2pS8NPAG+<Kq2j?yIxf?Pssw9^T8CO|k3w(TcAe
zl3PT~gN4r;m6P#Z!=e}HU4N|V9dIM&dMHIn+<Ub$jP(vM?3avZnSqxrpFSeFlwUMP
znR_<|K=K}v`3AkFQe-9F_?al~sY3Y-K9vrkxE-tk;XcL5MX~Xq{rh&H0vw7gA1aiQ
zV+mUUQCvEU*0$lc2xf?zX<Tsi-!~lO4~c|DZTEf&PnFifpCJOh(qZGB*a>k57)|h`
zwPbI`v!p1r0vV@E;~bYHq^(t3fsX@nVy<gR#-wv7?x3WNw4GM}VLW@XyQAXvi+IT8
zA7@3(>*d}hy3?+j^k_gvidLxP@3j<WuOM}0yPvo?kHn>^)v}I>z6i;c-`^rP&n=aF
zF^={bwDx91Vs|#COc5~UIs1tvP%Rii4hgn}T(m+f;JFXP>sOQm{iCnnK0%V3;M-79
zj)EO!7Y7MjnsK_0!i@l;#D*`~Jjwbr&G~D$U!Y*x7?@U-lS*>z@60msZf|7~oP7a=
zx=mbC6Rlo3YwY#gWQn;{!<*qBz4O(xhlEYmT|pxNX3g=&zHICWt%zVek#oFZ1)_$E
zbU~wGYT^`Ot#x<KNG>?zY?}{rtvMfP!cwB$io}ayV(~-PvmRHyVZlCGV7YY-kRa6u
zjhq%*Nso+!0zUf^LWyC6SM}nDW8}Q{Ga@F@n+7<kXeF}1im9>kTo@)nLs}+b6Ivme
z`+*>Xh;kOaet-*9af+~wsq`87gPe^`hVOoyBJ3zH+)n`YF3@pAx&H2;k%AUM0%j#0
zY`Gs+k6#@va7JtEntC^8^x-V5Asg6KDbynwyu9*BOvoQ@$oFVFL1wy6n@{j&AQ9$*
zb!D`{dcAq}Q<CzZm#;TW4YxyrPdn4tWxy~|bsR;=YA6)S<GB^0oh!B<5fpeC(*SJs
zW2Pnuka+ST*0{eDGDI)IS?R`?pY;T@+?Vgsa8)iATth>yq&RS{nrBDY=G$2z^b=$M
zv@4{&5+upS{oKuHIVFaPvos2Lc&G$t9)na%*Y#7>gxvw*`f50y7s*@)7gS?w94B>Q
z<dO%cR6<-K<g?7<m(#v^!(27Y4~hF)RvBgid(9$lrF9ibHTAo0t^k!_6e&s!x2bxa
zN<nZ4P3G#1=P|~<EN`^Fwm^^M;hyEXBGonVZVUs@EWx^3b4}5klHionwdR04k`Kuo
zBv^-1o|4u9@AUZ`7Qq4OIzu=m)h^|aqm#qUAp;yK)JevI<$8lW?9UmGHzT4W=<;ks
z9*?L!L3b{r8aJ$;u>~l80k~kSdGaVu^+AK~g9Z)P202+$%3+a|>3sFsPF2fr^Os$|
zmM8Te{E5h()rQR_i`<uV+$kx1lQP;70+I$L13=M7?m}Lu0l*OTu}Dc;t0q#%WO+eb
z0tW}P3W%7jJ%BC$oMb@!mu+YdCa+ZNUCoPv!Uu76KXf%{%{1uG*h0EF5yX}wX)kZA
z;3!joHwHR2OK&8fC*#kR9?Ui5?Wwq%_jDv@CI1W-Un<|D4`f9GhUO(PeAyK*wWV=&
z(2BC6Jq>7(QP<b#wXWhrY07k5F4T%2z&tW~V_^k3116sXCf}k<7etL;d_z*C@kW^&
zi$!rrn$HM;G8;T}B5XDn6)`{EZ(uV)L@g7)eh~?&CU8vKWWaquH0$sF4z0vH*#-gW
zULjNSE!J%!@Ayh1+#I>H(LP0#p0@Eg@e6D2W2UnCNu?pIs+~7u>8v^b-AEo;tjIL@
zlaCeD8wTCyNznS7Y^JW0=sj9-nvX<67lX~qbr_`-L2~OJ267dS>WqY52TfWR3cY5m
zL1nB#r<AzP@ub~QYB*h>j=4kzu7rDnshh(8NFCO|#eOxS0!Z&1xDjbx$#Fc0g>z`-
zQd@God-Q{jmpf<g@mMm>KOHI(z;5zRFjZ27c7yhirZK8d;i!dZc_>$xWf~JqXx&;s
zdQ|fQpg68ruk;oREYf?R*oFGz7hQ=;3B1bNF;BL7mv<sW8<CK~V!)E14?$!b$1#J>
zg7a~#GV=w)WFZ!lyC`1gP8om)v&VqD<$#<|EkN6`Ls=1%B!m-e*T7sD9s==Bvl(|2
zH2n`{o={=D;DKa2<_qugZ&6(3N>Q4uFt6py^$wipKS6P&+uRH2`~h)j+DRb7O;dN_
zsAti-)BIg!`9*;7x)m0O9QWIEff=~y2Miu!g0AK>cm@*J#yBACyY?_QYV!}2<!j8j
zj#&a#6#&Q0su1m#CZ!Rs-{zSFJ?0|Fux4Qr@e5zhcjzD5TOMwrqV&6cpptQsF4!%#
zb$9j|lvOjTgOex}N&rL8Bkf-GIy+hQ4`AUQw5}JBGz^=28hBnEQ~)>Xw-nTTc;Olm
zSyEbB^c+t`vEGr)YCBDt8%t|24<tKVRX(WTyB0yKRzWx}!i%rN+@uX6T$Hz%jFv=`
z43;(VEHeCT+H>8GJCeCOjrahF+Azk2aB73f0DCiY(=k56V!$_T<2=_@qScxN8!-(c
zauG_9k_r!p6i^6%y)v&Z`}u)HzZGs#MU#qXD$%&Msqy`|y^qH>?}fX-ULl2)F*l#V
z_YmByt$)y8xjQIYyC5$Pijm`)N>JI}3s^*p=(Mcak$X&#d}rj>iuT<Bx!-^99Fz`h
zzbyH52`RJ+s9O}9jpq#uFUSbHfUn><i}^vYcXrUwRkFl)X?+5_6oAh`#%3HaHX_0X
z-|k0fEid4-pk0R-P|ecvn=mG=ean|w5YYm-9w_o&zx`sX_i~u5M5R9r(HiRBFAlZJ
z;n_2i=9ufrdmCqEg_+094abBV;u@1@xr&mgRy{mCw!86mAu5606wq7&z+2I@r^udL
z!Xtv|3r-;^H)TfX+KjUp!cxrVAz+;+sJ-l(V{WeCK4h*3BKDWdvsXBrJ)<~inSHdc
zQADO+-5g`*%gRA(YYPsSWyzpLgKmoO%Oww~@p$Z&VCX&j`wzBGPUgKVgox0((WXm@
zSkg2Tu%sWFGYQCSYtIIIE?Uc`Q%SrAX<C8Tp1A1I87npicV;~M4_#aw>lSm>G=TH$
zqWY7mOceumh2TBOe8Sad5XW#hNhO+v7HA7b1M%_a*444_B7g8N)1I9u?nuE5QLmQ8
zDJdFAaZO+slIHAvoO-VB;4;;RgGbXrg;0yn;2?0i)*N}XVzdZZc1gaM6)!bhR-Wg%
zN+tlR7n$E<GPj-Y15*h0mi5^+hCi&=@!}hWWJe2>k-2XeCRp_r{#(f%lAV6@hR+tB
z9ZhZ69F~1i`{d5$Dlf^R^z71<y^q>HSxIA1>?AP?F*+~0OHv8V9|kI;!esF&0%u%K
zix%t)p&h9?;0hM1gYPzwIc>xh1TG}=VzF@7yF1CEFPA2zZy>uWis;ya3(3<K?O|?F
zYIIsg)<KzG1og<CD#w*OjPL;!vIixWA^E+;sw*+(6WLB8AL-4Q>j_04hGnHvR11@N
z%5+r1^6D*eBs-tC41e^Bi0Eez66LKq*G8z2JTcdI(84%mah`wFd%wx87A&VUmQzT<
zTtMvrBsYgF`Vb;#sc)+?`R_$<wx#QKWKDuaS4QZ7;8aM#h>f#KuHw^6UxY%?FmC*U
zin8V;TMS1-J?C$mAt2E$#A#50!rpj1BO_-iPQHV`{4GLW2UnJdXFCbPQyY`{!;*P$
z_eUG-z*eS%zjt@>8H|p2tb>CLJ<Y0JE4rsW(IYfFj3=w991OUD;ue0a<3jrJAO2BP
z;`Zj_qwbKwdDTFu+~4r@hd0+^uDhR>*TwaTHed{#_(6fuZ+=}BN*)##!i8|UFgPUS
zYd5Wkrt4Vap)n|tc3RISi=Wcp@}tt$R&=QV$<g4;h^TR0KhRw%Hgqr8)6*rn3roI%
z(y>J+9A>+YN1jr|c1PiJl5>I{ZfQ+A_WJEo6U7mPXkD68yPkG$d$Ya`XTOAx5IKnr
zAoaxsy-3#@4*ot})#Fr-4%8=<B!__s4|eV6y_2rS*mI$OM6Lriae)zeirSD_%y*R-
z^+n)ocuss>F2aC4AS{O6|MLg&uBB*;;YrTG4^=2G+F+83XK!!xh~xB15-~1ZlIb$O
zHA<FF&f+~Nu{CiXWP^Jy?=5Sa65k`!{{b2v$<!9!BCV(0OD?0omdKHy7UQy{kPhk0
zVuVld<;Op7D<j*X=%o_x@f_Fs-mWI42T)Jv%}LSag}sE;L;D%kku!v??VHpfW?A)A
z*>gv-=2>cjZKKC%EV_utMRbrWI8e?D{(9C6M~xOPO3nt_D0XW>4t$m>*|~&CPrZKo
zyy?4dxrijD>g1(j?43AZ84u4QaIG6U3MQ}Jjv+rY)WsnS=es7k#KyWZ@-coT6o$8a
zNQSs>`i>zhlvqiVL(CL^{IXTqh84|2Xe<xf`(!{$^ZpbSMV=A+kaU`Vh-%fe;m}ar
zJK{T1Nd1!ke!ao)&Lb>yjSc&GV5gU4b=npK-b2zlx&VcNJ}{c1#63;HfWsqbTXU14
z0V3#5v)~%wT>h6BLr8zQBYE?@NuGLRN1tF1N!=aIl?E*d?R{KL7XOaG<rWL(1sj}8
z`dJ-a9SGc#(eh(^AA_Q2AMjKnx?OLw@a}U;5WS8wEPRRL*6}wF+Fv-Bm|2Lj?xgc|
z>q8fcZ%R6ZWFF$f+B&G=t9!Qt`f!#ev?}X9JL#&Np__4@3ipZm5)fN&As;i)!69jQ
zUWzF0UHFhFR?@_T-z`WSSo3Rt{LX+<`7*LLUml1&B>gTyErAma_=NS4DWAee%{KGC
zm7BQ>8DAk?v;`v<jkSvc%<>3J(t63sCRylnzBREJLf}-x=oz#l&;R10R@doAMWt`~
z09LMO3fLpC(@Df5-nKL+^YNkwAoS)BiPvwZ>>H{_aeJiarK)jP+lXt^S9#cSNyf`o
z>F2NCekwZ}$$=$5>1pT7w9XE$8q9d=`t8ZDtBE+Oid11~mGzb9KPQIJGTgb+0ci^;
z$P@TPxIc6<)Fv-JY;>Y^s__-M2t2!kgZCS}cRb*hd{8{C`wCN`GW>=cjq}w=jvmt>
zMW7)ybkCHbV+s$jxLzQgf0Mb{NtA%0Dm9z{zjjd=;J~eCz!EX4_u_y&-4J4<I4F_o
zEJ+cf3c)lqXn4LdDMUF6@d6%!VHy1z7$Xqs#F7+vz^|&e;;15thE%n$_sChdTAmjd
z;ZYa{x9_1IckpAgWmNkv)!RoTx;W~v;5@`ZW<(*JR&Gc3JnK;7Vd&f7P3quUw|oe{
ze%k}s3b>=u`W_eOJ6kdS!=iI(5md>b^cGxDSNtP)1{B>S=#`U`>iehra1;8a^?E#!
zXW7MGf`xlN9d>G;&}FUIZ<KseapEFb;vGVc7DT|yEkoB+%L--)=Aqg2lZQTn4{*`S
z`a@SK#^O4$G4v=<KiK;W`u1p}xFv!y@e%aSfa}^K3m&4Q0GbzG++_I2Q5$qVZ1l)1
zY^=MHbBqrSCLh*#c*rj1O1PNUFRu?Z>g{<gX-9GC!bxB_w*@`tB6tF_xTPT|pvt)w
zVWW?0)%jqNo^t*69$+gkqPS5@yO&lu{?MMR6?(A(iCa=yTKagY*%mz(9>nO`a5j(p
z)O)=15OdW4XIL;Mxq*Pbg2E#Wdb)anY9cqO)zYSP-FbGjsrS&gvc?by)#^!%>UB7(
zhUDB5eq>wkqXwymBpOF8-YY}zdq_^{tIhwu&w-3*gW-5U^!p+xhl{Xbk;OMhwk-}e
zNQb3=M~I;9M2XP`$AG0uDkRpeo>y-^l(tCQP~1lh|I<_=T!GO<jdVn5WD`j%G(Uxg
zYX6cUgBPMm>Be+T-N+0Vtq)tkCDVoxxSav5@<A#?0!#?KQnbx)0;yG>xf_m+?-^3y
zC)^FKh&gnD`+3VJAM|-Qz}Y&Z32wD)tc;x8-z+*jPH~0I5InGV2qBu0WC(48*7tY8
z!QeaJ`VIcFI_NbQQOpk$C<OTo3Fd{Ru&u1Ha;Uj9b{7IFv=BQz`-|)P5BlJG(nm4Z
z(~rH1q@q;2JRr<$3|b$W`4)ti5r+E$@=;u@^iZ0CWAEwY?dh>piQ^LcBPk~Xk^gF@
zfNI#7Z|7s?7O&Kw9U*1Sq!64Zveo$Uuqg^z5B*kjf~lkigm}1&`MkTi7<@3xgM))E
zDgd)m4{?0srl*-HbX2;62k^<e8>c`tj-PN5Wpn58BWZ{DDULc{1~8Vf8H(UWOPgq4
zXTMm}3ZGA>fw>wK$&BcjXqr$}ZO`Ms{n#ud%V|t4{)xc3Eqg5)Bh6xauE-8fSNs;P
zOS*|Hp&+TJulM?)>&)s<2QJB>J>&XqdQX8}5%gwSkrYBRDfOf64bZxvH!Vt)x}>SK
zD~3@jv3KNf>X3y=wk#<w9ZN&d;odWSjb1-2%0U~D_cm5jQT^=WlK4hO4T~<!#!<Cp
z=u@gIUA1gI6=}uXGOv$Yf@>kPF^h_t0^iZB<9^i`l4d&L!IhD>3OyeN5TZ*c?mWMR
zSXF&ANqT5WfDoZ&fLW?b@>q6IEo%B%p%sp$f`{NiF18*=eTU+DaPAQQYN;KT{}!~E
zNNv~|@b$Ioh%usbLg!$;yxk)25K}X(aGsrl<$sUXCF9!UL`MJ=XrwF7cV`2O5M(h$
z)M{T7mVei_C?W_Nh#V#^Dn&M-*Vlo(LVz!_^w1navtq|ZjmVnO%#3`GEx0n%pw%+x
zE|j8zXpVdX!3iAojtqVF6{6a;4cNzeP7^mzICGi%WW7WETX0MI>2lHgN?4QKaHV;`
zg#pa+X|O7mt_0VJjPHcP1Q&6vrvO!S<+PqJ=QY8UMmSl`dIT*L-7SJr38ch6s#M_m
z(iJ~!#&a&f_0;21Mwu3EKyK~X>A)>9z%6MkIX3s4{v}=tnH?p<e+#Zvd7g6&%50W0
ztvzH!#!-nX6FIRF-@B^eK_m)jJtzrwCn}VtBEPuvutCZ~aZ~ooU^}!1eaP})9oxHn
zf48JgT#n+(>J0q|(Uw-F;lC%Q=ug10Xv00#IQuZ-mJ8C4_Xe$Dr`V5a7FdSRFXGw9
zL^|lzrE?i-!lw|X6qa>g%6fyEga<<kbj4?o1<u~8Ocd8_X-j%YzyqA*XIRgjJF@Lg
zHv$K>&SG&Gff+%6D1DCNW*~7$qo61*Vv;s2LIiD(k}i@Kp`9?u4!(lUY?q*iLjp)A
zkAYp8_R7#X$!U4((Ej#&uf>WG*gd!-*4{E4-mX{2Lp2`m6Tg)#ptyS)s~<*~KDksW
z0IL3>D(%fk?p=aayZU5KM}D;M)Z%2ebX{m+7;8on19FF}juG_Q6^gOhCW`+=h)%Vt
zXY3wg%(E(JsQxRP<EfIkR_#fn)bPoREp$}>*Oqc0jkAMobMi*Dr?zMg{P=7Ccq;KH
z1g_f#TUxz&vhY|Ts(J5KaNw)3cbW&=84BYkNFNZQTR=+#+DNBLY$Qs7<`$1Qvi-V7
zj$ZHCXGc#W$knp7dRdMkd39Y*f>>y#;6+)EbhzhF0{QS|+7{qVhYCalxzN13fZFB4
zsYL6E0*gp17lU~)@1klnj`}@{JIONOYxWc;Z=HY)Dj;zq-0lJ=v2o*%@$3vhYp;On
z2|5drRdj>&ef1t2wgC-AyMputGZ!bM8BCe%Pr{@_4UdAO*2q|N1WqGe&cn#!>6c4n
z6xW81QvE72+RUN{8uk;RBc{IpRpa_;fkK)_`|4vNQr}odLf3K0ap>~?3ZlGkcamgR
z*%v+OPF&_DJU6ECYCN}&idv?lxGq8JTtulPRvKfux4eucxsT$u>{rb~aUEN=!mRG}
zKzfIx9*KAiJ9C=IvWv8OfW+(J$}F5a;R=)8>K<Gj#s$%scml<B071dLbVDh1S06ts
zmE1;gw>MVzMVLA(53t{$)s#x^w)R0+74NLnOgT-yzw6xMfbV#Lt|UyNkOqw<H6zfb
z?9bHl@@|}@qH1|F#F7a52lYCD=G%LpKwDj_PMG=V`5CcnVd&8<LK@<zH^pRTaKO!8
z3E=L>jo%ichUlnex6q4kHu-iL&{5V5*&q#~ar&Cqj0-cGOF&S;*HH1kT7%*qlI{+%
zy7TBciH8uK4swhF;}s!W5ywR9ddFOV1D9?{vul?h76kUq8ayD{Ok4_M;rT46jWuc^
z3-(LGF^XP$8wUzO);slkUggwsT)7DCo<;y=3KO{$Q@@9F(PSZN%489m0zF%GivNB(
z*<`|YIZK8DZxW5$_rJ=av2}Tffy=XiA+!ZgnZb=8`otQfIfN(>$~eF%8BI|4M>x1{
z!Xq+vUd_2yz1FTQ^Nu*K?2@wuPr}?Xc?qhv{5W{aZjpCEssUMXekpWkL|BbvRf;$y
zmuBzA0huoE5b~bo-^g+*M3tNOLW2@?;nS|p>P}L^AnV<~08N+qO!ep=g6mgzxNxOg
zgAQ>K(}H;BzE^A-dj=xszJ+WQcN`(A6rV<Jb+)bL0SF(4ZVAAgpxpkin@-B5L$<X$
z@gLyyXiYz!16tkAVgN(qB}r6BI_0?!7b+AbTU$5ObwRyb=0BUubB@^B^c(^AP^jzP
z3gs7zP&cmBF-S`mi6%R@!g1+JN^w;A9(P9otWHAZpxEWd0GNL$u;nsW<Ga55_>3!;
zlpA3H{o5S8DB~)U#N)rgQ9m5|NcSM=y2RXShYxU}`#t}U>ph7rs?&U+3LTGsKSi{x
z<@SmbF^W8FS9^=Dnov)AwpFzPm}@0jdj-5Zpb!NeaR^aj>n1Yz##t!`y!uKu%#|Wm
zf=V{MuKNRA48^m6ZsVmF%C^QnrWc~p)2S%)-=Nf%xFU@6amfQ5^|i?&pu+>Lo5M_<
zNm}9z@V!9<uFd2lvy?l@(`gKN52^e#50R93urI>-IK0N7S6+CtMwKiyN>f?ZYF8}|
zr@R+!U2<A73(cX2L$B}Y7IkgN!!Ss?Gj#eOL}ywRj+>sJj|P0UT@jF?0e^DuLI>n7
zdbqxi#IM4Vwe{CcFV9QnArY2QdhOaB1!oy;NhYCAT(tKqO|TR0aYA`Ss?<Qdh@;Ly
zaS33KT)MXQ55aHSq$xn6JM*I&%k(Jl-i~k6uVt6CMaRWJhQ^n)%)3!P<c6{4MT0W$
zc%qjZEzDuAA!E&Yis0~oPkO|-wde(YYb^`!WO2tn)v|exM-fIIW?eF>y*evtlRC*z
z&hqMXeJCuKWe(F(w6A4^GG6!weYmkTgxmsc!bK*|h9JLmPl(m1=)45~EVHyH(SfY-
zK4UanZPmd1ec$ncujd>h@AjCDMjUZ$GrzQI>o;F)+q3rl-^>%sC-Muje$`eo8u?3q
z);ZxfiAIMfHmu3IXK1={-NwCZUbGeaj83FPPuaAPO>WP<?CbBJUp()oHqH0!d*pMM
zs9a7rU^@q%90(-ek?4e6I`8S}=}|(n6Ni*#zAy@}yf<`PBo}BMz7#qZeEx2UW=&H?
zmjR_Dtz#&75pR?{Ir9%s%=kddQ2Mb0>uZ|ASf!rS$;7n!CdU(O>r*vt8|HZj)Q>=p
zurGE_Q(YaU6G}D{3eww~79NBjRw?-I=YwV0=D76=X9ibk@jYADc~GNqIto73hsNnP
z!Z3pROD%Qv_k2T)+yHMqLQCCM<R?*9*O+dqX>y{tRW&UfUb>anHeDASJ53qcQ`0oh
z)7^u)Kio7FYP?W2^aRiMF*57_UaF+-`d!n)xux&(zMEf__D$1*y}Eh>@7_?m0bWz`
zQ|NH;`N9(W?C>w1sQIz%8k7gmOxjzrk|bebBTL@pe1}{`vFVaUd)^}GW>|&47o#}9
zQa2J3VVR2+n^6*(YT8DOK?s2xLbKuR0hUM05KXh8C^%M8bOW(bGP2ABQ5%lk8w#aN
zYNI5}=VRxl;nmckCx3~Z^OJn3-iC7rZMlVcdLCd7J?SEuD|lj>JrZi#jvgr3iF$m1
zmsmzVV!Jydh?)d+ljGI!+xc%-wL>a&I1aRW!ij1u3Bhbu+QYtix<-%Ol0T9(F%rC(
ziuxuvwpX(CfOf;%IZ8%C%|lJe+ThsTB&P)piBv(XR@0Qk{_E+QwoQ1ghUwO(rsUc@
zuSdbUonzwD>TS_l?&HDdzsbuhv8`#^+N!&lPfC-Ml82r+htqX6kMtO7iO!VKI3>3`
zl(DOQS-s-jXq~|W)zA@N!Kx(cHB<8PYD>vSpx>nMf+w4GZzzi2R$>}H@GE8Li5g}7
zqu?<`1CG1VZQ2pBxl#E@oghu!HQLPmpTVx42MUIs(1r0v3)Nd&E1R0>dE`?yDv%-R
zsJF##asS6}Qf=$VeZ6P4?3(mo?A*o%FEFNv42+H+?+}8Uxonr2O4_s~eN|<6Zhq6|
z7Qvu&Z7s)9UHwty?h;5T6$xfj`FZ4DFO+=|p18C-b}j^EUDLF>RjGH+0k^t1&^sG<
zs^-Qer@RpdibOE<#InJwX{bCWrJw}frLEh88LtpVd;ZcMBZUKeXJix}5*%wTP%%n=
z7@o##a@;?Q$_}qWbQ7ieW%=*I&3wC+B)ic{O17uMPmqCeV9FaC8GSpW%DpRYL$9{;
zyfpMAN!)8>HekQBKXwj*((lNh*G8RfyV=xyl%4UT>_kwO;lnpBc5FO<030c8<Dln(
z^5W*9<p+5g!@-O3OW)?bEXh^7H&kwIWR$!=HhvYJSD$wxMPYf@M^OSV4T>X>)SZ&}
z-GT5r+%2?<l23IF6p;A6Og~T0U$RX}Tl#rlf#&ku9|xBfcBrG?Ep+jY$1WC}7z#eG
zI<YPMbSb@KlVq<)VUp);`v>?kr-V?`Bqur4r;U0C_MQB<pJHp8j)4;HgXKI4c0J+g
zIZLbHIzy1ih^=YcHLDIDR#G@9IcmvKmK<cEk(1fQ0_8s2h9TjMbe%OP0FLJ@ys=uI
zeYasF&gj=+084poqIFBS*!aD(_hf!yps?q_g#mm`TL}BZVDOj$UJI3;F&gaZd!S_K
z$$>NkxnRU~N|=$~{y2DXE4cg1>vX^7A=*ZDb=R7vW{(NW@TKL(rsT2`LUuU5ly*}b
zhtWym+|=PFrWu50CD{(Mg9~l=A|_H-=IReQK_vI`f;~pRf{B?dHRiR=j7lqHF;PKm
zJ!}4L%2G`1++WmPmo_Y@qtfq6%7>nuK^<Dwil&S_2ptJNpZ^oAS}8nXbRVzo4)zY3
zo~;h+ayR1Q9VZ5ZORdfRSwB*$P>=BAI-@-?<vT4oZ%?kumTqvoj#d-C9#NA+ueaOd
z=~?`cb);eS7(sog;HRsi<FR$(k<fgs`uWM&;MlO5stirPXAY#>c@vE`6VzjQ?L)z?
z>*_Y4h`y|OVUx@<J2DM4P!3C}vGMJ^1^Y+aYnq-*wfi<cGPo*Y)igyPdkjHVQUbwB
z;1A(4MtY((;6Mqs!RcX_1g$~Nzk$lUMY0|e><r1SG3)n{A{Tg@kd{V9_Y+X%@cNT$
zt>z=EfvzOaUvfL*Yfc3FJLP#j4t8CiVVKNOkiEI27{E`*WS$+#bU?7y4Pn>4p0$;`
z+ptQBuu3*j?k%)twlKf7wP~T)|7`wG(RG|Sb&Z*0!LbHaRdsn!e+)jqVR<k6pG4bb
z-(PZuo~%h*yO{rzjUOvaWbWz77NuH6QAz?kehgkb=zn3)fjp4giepDm)ylu&aET=j
ziR<nV?ufHPHS@Qm>GaxaE5XSYt3Zp9hDC$A69lO?thGBF)?xqnO=@r`w6`a7NtVz7
z%0w26eyzGcs6P~3dJ#vk^yTT0Hce5;TRJNs6a@R@zP%GV3U0u2^kcJi*{;W9D~~?b
zYS<5Y<i9U5GYV%k4Jk<Uk;dP8w6!)Rr~1GDE-!ES%@0FQEHKTfMrIR+6JWWws+#kN
zx?1O1tEQmfOulJrnanYSH{EklSr+w=*?~EAxG>Ak(UPs8?>GhD?sY>V7E|q}(YH#D
zeCulN7uDRT>aG&6>+~0ac{zc3a`k%;<Z4KG(jZAio0fS#`M!QdXEgDUf6YB@kS<MW
zvfJZbN=?(wGU{s}2*@vlNc&d5Gmp<4057I>&4`bOSAy7LUrY5Otn14zxxnnlf!Pm7
zX1~g{Rg)cB{l@*aex6QC`t5$68H+cEo^1AigEunzb#TQD<GGv(TWxdEcJ!7(4#cJB
zBz;G$MlCB(qRY{fVy^NxT5{_1@_uR@Ma#nrA|ZK-wq{1>y5yLfhJ`L6<m1E?{~FZl
z;8?r*wThxs$ZQ+|x(6~#wn1RN&|0<ZzZ533U>`|*vGBe0FaA$Y6;xFn3ZeB%hK8Pm
zU<^D8rm^>z-#n;k%BZSRSC<*n@!0v=su_0wIhAsAvmd_<xfn~7lf56KYf*K&Z|$j?
zhup1bgcsKNs)&TlU#)&5Bz8_-dKUFnGymN9r3XaCm+b7oLjS<RhslA*{ckRxh>h3J
zwFP}==8R}7@()^ebp_IPqYTZu4Xc`xPy0XJZe(O+Hdxm@G;zXzIG?DaRTPg<6!xH1
zl2C@p!yDm^aH2s#xIC9S={Qc^PuQ`*+4WoS+Y)fn!J4a}j(SW53)~pS8@}_i*7-pH
z_%3+YNINxe=n1AQ*G{5YMt;vBEmaIX@%C@pRS^rf<6Ox%88zLLB0c}JxAc$t&q(~F
zl|xV3N%EojH-D)xmhAXCZz4&t7RnbIDI(vGmNQiqJag#Y&=gjG3cFRcb0>OZZ@sdY
zaASk(ZBabwDrr|u(-DaoD)gA(wRD3utI6LXT<uO(Ar#a_N&4S5IjU9i&tT;Jcsq@5
zUmkjLc&QCRe;{^9lPeZ%84vKknY`P-=Jg2+w~KInT0#L`E}F00r~LruaWr;L$G^$P
z)ALM^9#hpx<U3yI+OXwL{g%=@r)vO!l#)|R$T{d$ih{pbvUVWzce7uX&{_mR;UT%4
zh|)q4G$``UDCa$O$kc&0IhI12dJC>kO2sO*7s%DG^5ZJY?s+*hVj8D61ir7Kets+-
zE||{gJEz;W|FvpJpd?+h{MRPOObxMe>nbpok<Aowa%<qy+Wz5+1a1ZYhJVveucMFm
zEqTYz)sVKPYefHSQ-`m4f5gAApyc|OMAP=%{bH4nWBxORut%1Q-+weUuQC_HfAzy0
z_x*^@004-;R=ID}KN1_Su)KPZQ+r?A06NgI{x$ZTqmNxeE>XnOU_^7<%INc~yQpLA
z&>w?Kb2HfP;m5{l1MoU*n*Y-no2n`wsabpetNGwqIW)X72=4lx(|_&@NZG-v+fHd7
z6UH*vPIjL4Z<;{EwAHTx+$lkKOV=oA$5qM=N#D?u{Z&6_hqtIudhCH!&@9XPKKxsV
zCI}Y7y7RpmcSD-0A`W#GcMy(Z)Rxxy_N3d8Aefq;*OP1voV5RAr#F|Ywy>@+H)Y69
zWuDV3-qp9!RRl=e;7--spN`ZtrAl|dpH^M6UaqZbp7~qV77kekm(=(V18Y5yWP@G#
zB`&qBN^wwHd)3g${;Ja|?U!r>@iGrmFE5N1rK0y@u6mrVxlj#pkoQWVY+LdWyxiiR
zi9h<dME{7t6ZA>M$Hu#q(~5=UdU{^Z8&^`}h)x)fEU^JY-(FkAC79N-Kb)>n5yI<F
zHr*0o{!(J>TvpZnzW}bunh|eL)2gVea#&zg1!vm`_LE8hFde@XEgFRvRyWa~)8U@E
zQ)Lz2qD<*IW7yv{I^uWWo*Y3-zw;>*aU6AeDS*ETng70iFR19LJu-WmpD<2;JYsFM
zaPKThZNlGQdnT_cnEY1szNSf@v_14<Wxn~V=$a;_s-M%}zi=Y_Uu?YzRFl`%1`L9r
z5{58_Sy4d+frtzWNL9e9pjCJwGAF56WlFA0GAjsygm8Pk)hGxSThx~+DFP|TnCa^U
zMM?=#Kp?p)f=rdEAn@;azu{m1`dO^DbV1(pp0meiKYO37b<S33CGzjLOb3zpBWQI`
z#@4uYo8hI?d$6ekKLhCRj||-Fgx`LqIRknOZ=tJxntyyh&u%oc-~<Grh2eT<zjc3;
z*Cx7CdBq3BGT^iEdUgHcJ~!hHJv-q+Y$`-2A)nD?H)pB&tR|8`Hv{G4;tXWYK~W-E
z+o*``?{>Q_s``EiqFF$rJsCfrrU1S*%9n^Fc)ZD50((z&3M<InE&cKKn8B=vAQtS^
zMVv?)QbM~xDpx1rUv#(=3MbjU%Q2nKoGq%d5FZ_R)?sP|BqW_XvM`Vs_pzYQcF!tN
z@dq|+bkeA4b^Wcmx@Bs&eo>^y=R+BuWtXc>nSqn$WumhI{rgw^kr+`h?0tLltp9Lg
zK-AQ4$bugBR@CM<g>98+<@^H>B>@-GrpjcEjBR$pzb`k0g9iE{)%qJh);p<Z(vQv&
zYWU$}!$^IA2<dl9+f?>lwP{x1=q0ufUpcD!xyU2po6na9=X#dIk%aG=C|WsZTwOmf
zmiBC$UHjjYAMaj{`uqU0n|%SJ!^_QR(<x247h%wYquL7Ik3O0uVe;cv7sRhe{QIwP
zy1??_z)6@|5j{AMFtYF53@X{%8jaepL)msRf=Q782SH|Nqt;oT3TE_^WRHdA?}5N-
z89<HtE};{_%Xh`EYsdPRuYI&yuUnh}ZLxhB{wC*cQ=Ij>$7e63a4V8<HEPQ3nOWOS
z#o-0D<pSDobLyY>z6nQy6FiZ^(Ob*kM#b#SFstQ<ti_mr-WFzMHW5fIPd;cc=DQ5P
z@ZmU;VEzW8Af3<KGxQ$OSuUA3c>Lql9UGnDNPp-G{ED=0Ia>Z1`X1SvrLJIdRyk-&
z5sfA(ZoTdySgpKL$$X4r)3nQ?tM?0fWIwPf+orO^J0|(I#yDf+zS9ls|58lpR?r{2
z@STf+8h-oYPYc{FGtfX<n~zr-$=hH$aO_m%@BvqE<HpixvE)ig#YS&>x%21$D*F6i
z@2RD%@8HuaC;Frw;B=(#XDcOvZh!c?a8Rd7rRw@V%9H74J-cc&P98s|V&4@0+H~3Y
zc0hlN6x2K2?0tTI{Eo12B>bfnn7O$tpS9n82sfrABktRuikU(^)(*3YW1l0D^pkGK
zqNY;kTwPB4{50U-AH49r_;uaf<vCO9IfLXV5TGxA{%qT7L0oV?xpE>Sy}W+$TFIlv
zwF^i~5WoUQiayOZcvPZ+lMlqN<?H_1K)Qe|Y=+-!(5e;M5lh$W74ri7l@dE85|)Jc
z&Bx1q)GaT73#6(<I$KP4fcYEDyOu)zko=yplxQ&4Yto34qW4k?7H{S}b}{)Bk{;yd
zgH+d|9{lf<)tu-vF4}DsnV%b`SG8Z%zy^r?k&PRlX0u}N<(eCCE`{V=^6&pkzJj07
zfWUrZitf76&Xqos&o`EtZS9yj(-Hos%8AeD%0H6*k%f~bh35Qvi^StmF}Ca8X@il^
zwsxTt>PUUi=WwLH34N2rn_HFGED8o8e*U&;OV48z{#tG2YoxjcbspXG+0lFc(V^wd
zoGukXsgs&WdeBDy)@2Vjy|W^s<%_B11Fbh5A$<+^;o*Ud-(i8}R60omscA_1160T-
zqi8>}5M)Bv%%4dH)BS`AmM7QXLxbknT_m9_`52P07t)6KK1j8z27A$oA#~;0kpN@~
z>ECEK<a%bVK#-r7UQ@qlkyf<afF$oeQ;VLZS@|PmWZ`H@PIzY!w)tHWg_~^0tVTy3
zqxI5rNPiQWV#*XY^G^py*?}UazMlFHNr*+#!@#(&q7#|W(oycQb__Bg$?j~@*?ZZ2
zR5ND#-&sD{E?au|SJ}G9g>eow9Rn2i1~8Esc%4UMs}wVRI_>_#Ig@Z?qYiB-xF3Kt
zBK@alHw{@vN;4-~N5nBR9bM>^O37s;0r&-~@jdwvF?lgY5<i>4+A?)FeneaIug;#9
zl(*TmpPeLE*I!7kTyAI+_96>yl~?>f{sVm-hGZ7JO>U&!e;MSux$QyQFzpi3Uxf6>
zkRYA7k1Xi8Xbw!o$^Gws3yZ~^sbzPQU}R&@`f(&(=l$p%wpZqbtTO%PZ@>9?^2Au`
z>_Ho?)Gq4skrH~kFT)Y)m_k!Ht1_E*zgd#o)~jB8*@c_tPf&vZcmTXjn>6{E?`Loz
zmk&eadLZnl<~Q^*umT*A7@&O>$M+P`ab<DRDs-h9eZ9-<N7NggI7_vx`8_<WKgjs^
zwhV0EWL(ndU1Y%noj8iOMe57Z43m+fW-qr~@oR;3?c*zbTi)c{LMQ4--~|mR``%<t
zt@II>eE|*ZZOyMkCmPW!w~}*EqbI0`;4b%6<~8I?zJHYSsGE;>QR=ck{&D|Rip7i0
z^WF9tgH#<`p`&CUq#VD&3!N2wZz1J`WZjw=$=`YoF|M3=Kik3$&P=6GrxZ@FoOt#O
z_2$P`qNiv7HvH*4w)qk!GYcO1x49g2;#A4aq)GF<F)v8(V=_PATVK>DAs}TsIw*Q1
zS7$aBTQqGo>%aCv->n7Bc!)aDsZY@T$bxrC_T<8&aByb;;#hX#))nBu-b%M3{Xe*<
z&4@iTcy#_5W8KtFjLA)_G39RURKPZ6CzH2n2p-HCLSxX)E~=dz9m~Koc(ZQLaE~IG
zv}Gptnf^#Hl9azS5Gm_Cxtz0}a3*TX>u^PV1I`02wr%gKyyD3SM$#4H#QQ<Y9~DR(
zmt?7x6V8=aia`MDpTM@)c0696y}HsDN4&oNRKw#u;(;Jh0<&{SW#xouE}U~tj+zu_
zd%P@LR|M(0BglaiTNeMhdfmY^4$PD+!K1Yi%>ZG~2VpNp;g5_M6Pg}YiLW0>bo3zt
zr7Q9M?bSt6=wi9*%Sfdd+KSe2dSKv4htCK##{@3gbzb~!Zk6bp^9Y$#^aTB3`N%V~
zhbw*N0GcFpS>r>OLT=tc`UCLahvm`ZyVSfsK08ghf`o2Q3`Sb??0AvGOAPUA?8?{R
zsluLkgfjc!WKW($X85-#g*4N350jtTqIo?5{jeYRB|Fh8$C0&z8QQ_~cMKZDFAT8Q
z=1J|6AjE(+9Du|Ly4V+%+#l8_=1BHtlggh9@Gb@-;x|5eYQWs@IDj#1d(PDe@AQ>G
zx|Y(hr6FRcnC$LE(t&LC|Gr5(oyf{vv)`6vt>L$qXQrDz3h2K{I`7|4K-O$ai|SW;
z=9Y=3pr6;v`rS39;76-j-yn`R?vS&mlYgY$_j9R5r}bq4h&lf%C!kS%^wIpCk@kaY
z@7IzcQ`}{VAfY#{WU}(wdhzYijlS?{!8K$dQ2v0Cv5=u3+dfmHVjw{Oh<08>5*l%h
z=*sp|dVN!jg2(Q}e?4G*t>m&rH1>73p5Jc@?_|m)*Ol<!rg>AWYz5U40BI_k@X_t2
z+--M8&&y{lIM#F`z<D0q2R~5s<Ue4ONSHhlwt_x>)|?MdsAa_?3wuklgBQw1AgZ3o
zHE*{VK2QKQBUmm;jidEVGB}~@7G@(e(i4?eZn5l<1uwa&7%XZOt1LjacmDHF>z@Xf
z$I#b%77NfIx`DLF%Oll2a?(6ddJ;+Cu>6sPtuKUcS41C{cK{M^onhb+gcS30o}hNp
zza&2mW<0BR+Ee<H&H8$E6sGt6jMMUajw#9cM70x>?$2F-p)YzbI*$PCy3e@XX(&HV
z8W7D(!@MSTla1?m+apOvPQ=~b_&wztpSNcG3_dB$4+(4(zYw-bZPsKi&y>wyuC5nP
z|Fwp$JeBmVZ`;tjG@kqEoQ2tN6gp8&Dte6C)kAHdjDK)A9^CrPrWt2@-wjD_SrwW@
zZ>d4OXRWL22WKzgw9)~g#dti)Ow+e}f;y6FAET*3QD;S}vmt9^3)S_S{{4vnt$D)p
z<MdKJk#wj+tS#@V_)u}2Vr#2g6!neIPrTXqlI(PWfBlwAW4{q@D9RjiRUxJ6JPbiK
z?Md`uC*bdDZ`{z7W&<NHM-y5LwEpj3<<Q`u94>H|*p|0__D0tJh7{(*0;hR(vxnB+
zIxj#m;k?`F#t_B`HZ=qyK!XI)UlwMUbzz~61@2(y=w*MzcvQ%OqUdwm*2p?x1Y}0v
z?-a7OIYW2Q)8nrgpFZ<9MemV*BTgXFfB2cgOuspkmkFk#=+gh^Lo7>QK45K8V&wxt
zUqkqJ*1t45_qrIa8nxkva%v$8f{elMm5I$$-nOCqNs4++ha*>IVALoiI|_af)N@q=
z$AY<-z|pX1onDWO8uZPsihn|4HN!ixP~;aJ)$_+-*mcEW&Q_0e$e`dSIHIwgO;9o@
znjfj0n34aFBw13z0HANjo2C%fj~-P52Xx{V=@goocZXCw{!IM(+_K#YFLiDwQjhp-
zMe6nJM5zmTP%Fyy^5m2Mnn4zp<Vx2(*W5I@8!8?!r$yk&D$=1CY3R2^XfQkcI3~x1
zmt13oKXb9c@HhTWwB0WHr#<=8%dgOsV%9&<D>`8XMHA+2KQ*?5G=5G*hPPV|8preS
zfRlTr4S>;d<$s&H^GId!BJWr5w@#|Hf0&D<zak3={%55B#O(QKozNv~-0$g-X@j}<
z*(*0AvX-Wqub=sQdb-^!t45P(zb$&F1vpRTT@}cTbY+e-rCEQst#mItNKcZD&Im(5
zfc67}pHvUI&BUVUiHrIwofbNG4_&dAKPBLqZdsps=}3^Px8{}V``33Si1e2I@E_2L
z18Jw6-A?i~;vS=I+PCCl{*drvamH6kYc7lZ>65b%sG;Lqkp=8C-9ay_da(xo?09RY
z@XJb1epxB6X{O%7Lh6wUM)?P@BaS!B1>1(_m84Ylg1LKu<JmGrHoeyGMhPX%o%YX{
zhhc(-shB30bA6@|W{l=~@?R`hqbZf}oO->HB6|FYLPl6z%H7y&2ohtE+Eq50+vhoJ
z`<W?;La%HN`?)ymL34)pQj7@VmCADPX(whK$}2Ol4he&8V_=;;eJ;ya(Q&hB>JKQg
zz^NrYQ)}C~cn=M_9{8ccfF^R>BP1)FrtCYzUoRi%2E^Nx4hGaoY8g`Ciia?x0zLYX
zE~D&<B!2}EeUg9wOn&Kk#CVQ0^wX-`P6f~Wb#!>{N3`jikG^I6{V5}c<s+fAvKkaG
zSDDp0#o@ZD`oyQq%hm3iAC0$egdt_x?oZG+*GCNQ1L{+_@#CN^j}FO~{FM#uI+3QS
zI}n#Q{{MVNvQIY2?VX&u>Qx?Sn(shWj>MIn8@d@cX7=CeWm0h5-hd1dQJRK_b;^0f
zoi@X}GTflx@l)PY@tMwZO+@83+eH*|Ymf2tOSFtc%^)O3&reXvIk)6?cInyqrL{0*
z?f!T|+fD7zKgp64NyBsq6;*ou0J#aH{m?WC_U#0nHXgV1K<>nmXGX>eJ)ihwkVL8r
zWI!ytlzxknn|<uExm2yd(V!|QE%?3KuF>90$US5s?H$T7uR^QKA!15cKFXMAC=&-e
z$)>nxXHt`pP^*d?OCQqZ06Hz>;0;I#3idukr#m4Cbx44C;7G<djp-(}2JW?}aMq7|
zDqhetS+jrnI@;tn{}b9|Xvd>XuN;C{Bucp&o!0a7Muu-Xe<;0FAUe1wQ3TG>za&2!
z?>mnYZFrXnxtE2Ptf%??TpbAGNc)NlA5sqJlfU+K`$PZPQ#2sI6yh*J+++h(dzj*#
z=tM5MVrY`{NY+Eid*hHhqT_cA38hyqw359%QXm#T>f@EkNKNSK3y#WelKss3xj9yt
z`2@xH!l}Ysg_Pbta16ZPnkL_)6V~OAkp4?^lTDLt4dQnIgr5bKvjbqJh*}$aEd|`Y
z8+w%E8Y#t<+yGQLW!T0fUx$)4H^>;I>=cuHph}ED-eNWSO}8#qb72B)3W@*Ce00<B
zB00qeDGca0sGR6`!JO?hm#Vak@sNavtW)dAjBC(*ajn!BOd<e_$A^E>JR>%>8wd@a
z`yCD1efVdzMszkmY{{=_G96ja=+(>2QH$?Odj?P2_-h|n<DbyiIUaxPUmg8+?y-ts
zTB3PYc#HC2{Dz^6$)!<>tWmE~W;ApYTmv3~@=8h8alEf*n#d!te?$NNdF0_TzUpPD
zM@1e2aZ~7dq%8pHq8@mYW$hc9X;X1eZN8Q4>G6sY=-*Fc{p$@=ujy@w>C2$tf=}@S
z#$cLyPa+FN%O`rFr2c94{BXR(dfqq#pvf+3S?o$JBm-TM&&nax_g_q`db$67!3oDb
ziT(CWXg1a8^D@9l6-utl@S^2t(G;|u5doy|L6lfGFS=}knt7vpR$##y6jhydXqtR1
zetio7m(X)aTornYaxlX*+#w;Y4sG34agWaNjSIG2`3<s+Ah{{E{QPt5p<w4{K1u0@
zaoEtMtK1Xw<#&k8X+r@daEE*MBK4a*s*6kC1i7AvT}&n;q1F{oVH?~2*nf#GU!q{U
zM#p6rvsIeyT_%sR={89+ZOjWA$_i$mge4}ZQFq-YHqpSnG=;|pAnCZ7{!ov{+3182
zO}UEPFXYYAxmzACmbU5pok3#w7gGkmFAopN^T4)9rzEIr=}*RC6~zssdWfUN;cC>3
zZ|!BbvUPa=JwR>p4aI(b7@P7d6s0Jp>z?xkjpWMdWIzzINrBzGd>0+M{r09vjoZXS
ziyc{W7YbeH6uiH9J@wO6liLwrd2XykAT8nZ+2QTkO&@k2u0dk~&!|POQnkYJ&k~z|
zt25nQfu3Gy$o6VW2J5Zo{v!k?s|ljs>iU~0gs7OUr9TzF34wB9>o<UQ6wyn2gMx2d
zP3ZAm_U%om?L0O7i3bPEtAq?2Y$KpswXV$A>ixP!_ONl<Zt7<RN6P6HWWzI}1KsvV
zCgl?n_k9VPuBhA|(>2N6fnB?-6Si~Z7?{D4KYUMs1r%GM6RqgV2(r*ZV3f7Dk?Pzh
z{gC?eKFFO9F{?mPD5zQe4#1iDdr2Q|`z<t>w`WcNY8a=#_RfIqHD6#Z%$ok|R|soi
zH>X9lA4<tVkciR78;Sz@A9>YYyAyi|aqD~_F$CF?QS>!L2YZpz)Wb}njjV2SlJv?D
z{Xgm<`>KTT&|XK$Vx`C2zkjN{?6bOUpRZkS9(v^>(o%_rWqB=QKksy6C2#Dh_$6wg
z^|<Gq!m)&MgEix6v8mN$OwWLCZ4LUoyw<<pcX?;8bp~N6?J0U>_lm%E)_1rMu<8L^
zm{m$|+gR){^_S$Fqa26GvF}Ql7t1I0N53{<{wlm=958x#h+h50_Fd;ubr*p!u>Lpe
z^{?lD0QXQC-}h<$S2QTx^`H%q7c>bMKQ~BslJ+%+&A5IO{|X?L;PUtW{d?d{&WIld
zMb*vv3|~Emr2EfTdUT$`{|wPV$E&7`#u*pp3*{e|&;!u(c+C>h-{{%%1U>gGJgLOS
z43IO1my6OP^7rGatFnlXacSNh?Z#0vIb`NHe9YuJ&;EpG<~1@Bqo4i=ZOtkAP+Auh
zwMyTpM4cdBs+@RBV9W>xscplb;*ff8p9@HWUBh_HY0tpIG4=90>4YSc+9Y=+hlHNm
z{8j|1oYTkmr?*XC3x>#S1wc46^WOcy>tO0(d)>*&+2a?@#ik<q37qcPZ=v{f(nawq
zaG`Eyb1-W79L45Krm?(X$#!{8b=L)BB~`%Wk83)Q4wsj$-JUjVzsld~-`{`&vb~1U
zfQG{NT;7Y-r{kNGCS%k*1Jl`PtX9iMI^l^iv$wglGWAFp60W^A-9xQq{VVK2u+ylf
zS6fQ<^tJ0W+Vo!$u)vg82AuQGCOcu5+)5Q~g!wL;>G<s{9rhXmnCN~y5lV-7uCv>P
z5G?pN>RuY#(yiTV4*2Mx*9eMs&Gt0CPvy%{v=?0=A!`;IyjRP|hsNj9z2|SFE;MW|
zuY6;X5(L0<UlVae{5m70@2{r!nw}$-;2YHNyX(d8M(;Mg%|!a$%k7Z<i^~SXf386Z
z`u%>n@7i*t+ITUhddkWy64rLX1$#;MjgJ9f02;!RE|@+>k2mzaaj*~N!sQBuu|3^-
zz3GjkWuCK<!&h4Yt#AxL!Yfhueh5B*X6-(-#yvlOqd#SEQ?Hi+(m&v7kQR_+^0Vlv
zcv19Q)7vg&VK>k$^qjy)8nT|aI!TK>+g447{{&LVCM<Rs>f7nQ@g0{EMCYVL6@l!P
z<|FCBZc)~_K{g@lICXmkxm`mkad=OF)V7NM7~<l8<x&)GlftpXOIC>EzLhW}-PB;>
zHZLeDk3M`J0Vf1LXP1qrR;Ha+feJnC2oD?g>xRw;mRldGbiMt-{XO}s#%Esq4L_uE
z)|s>~r6Km(CBUIqf{@UHo=N7>5<81>*L8?cU`Yq&?6ajDjC70JRuPFg?(9I>q9JM(
zUQ)KEs0Bnc%cFGth(k<48g{sT+l=m9Xl7OF3j@Floc;TYD<@7S|2nQ0Jl}AwJj#sk
zK|k{tHRc?1HmO*0LmG#eMFq*+HeJ8ox_A+8Jp^L+{{21r*j{x_X_=Rme}5t2M`H~g
zO@}>Z&$To<Pr7JawcoYUd(1}A!6N42n`1H76o-HaxjRg7pdLIUI*%P*V4^{G(&i(%
z#SqNM0iu}l!07(LT(5!8=|~JV^v{H03hT|MZ-@VEgsqeAKqtII_EZ2OKq`6c3PL@Q
zFByBty^!Q~+7oC3|Mw@!tfO<^>5uLzVXS$17z-^-3excrOVu62$y$SQx8ls$?V^!K
z`pVOJt(uni7(Ms-e(behXzTUo;)<=C-rX;cYDJAT#K(aaKxvxBb+~%EHML>=e*3HG
zZH&cw85o(7ai&ZjJJQC}XLLh9A;T2*mxpR}9)cXGAj65FL{Zi!-Wzr(IOmq7N3fD>
z^3iS>U4p6ejPJRFP8^1GG6~mjDuS>~&J3AqLYt1oKX*>xky_sR`wW-@0sz2fQ>HKo
zkGOdy4Hcfvhy52lo=!$-v^R;NNa&8Hcg0Oaj{L!8&)d%>!|fmOy*(-v1!m__7BNjM
zwH+#&0=+<u`A1!hVDJ?!_Ad_$GcSl$&wgMkx}Ef#FIVi{J);vE|8p#%s<Grr@cKDE
z`7!!@8A??zdQE5KoCeKv$kM1^lgtF_z*Fhv^qN1^=>i_6AkT<@zNFwSVf&4nE*Mo}
z#oQ~#D#h6eAnh=F)f3X>k41{uVYc3ejg-@Jwy|WlMN03c-rXC!n#Kd7e_z%3Blt|e
zY4IFn_cLXDphXrJ_9cj1;f0evFdya9#$*2XH+4a#TFDAmsoH0F>o~0r8<Q+A*5$MY
zqWZMR2+Hqjk)sd-X4{8)I){9NL;;(zD57%O1pyq(*Ez7?vHU7}MR#B_-61&2VV>z1
zFA`N=DWr*#6vYKCQwK30a;+=nr!gJQx!_zP4l)LrE{?51qdetKr)FR^vOye4+pvc<
zU{25ODk*qn(HdoL(*bJb8X$`WMvPpoaw%KR2+nuw_Nv1RQ~mpmLLRuDfrKQrPvm)L
z7&Tt(RRXxc<z!NtKVRoDx_|j6$>58ZrW?DYc>n&CkO#(*(q!1+59IQ$*naiZ|2z*;
zSVI@(Y<QlfMyGZ+d$ob=INiCA0a<Jq+ngyn$FeS8DjeMjltzz9=39XL;k4ua;*S3k
zoWMKQ0!ZB-re(UEt4DS(Ho)$xdbzb~jx)h!&sP-DZJQBi8{G}!H)(?hO>R0+lyiYy
ztF<WlQPMMQ+z~XCjX>oYph|lUKGtQ+ahz6fbL)A;+RKdt!gI6)eA8m?{^e)mzYNCn
z(pts{!*kEkra=CSzu?Wz45-7-BY@k9@D;`{w6MLY4Wpmn)%w&w2{LiIBMs&+_?HR0
zq~GUq6jX^GnAh$P33;k)eJB%o*0QpBY?D>e*Pb&?U-7{RrBZHAyPSdJR0k{myu53=
zSG{f__idBxmPO)uWVq0p9|n+Ut}KD~$kXjQnxb`QBKMY;=X_}`(jVD-acMmFmDB@M
z5a+6ONvhnfH}^G<kd@8WRQcFi$Tg2*136^A;IfOhl`H}zd=u7nX45by<jdo<LYJ~)
zSr45}9=Y1;a-wXtQ@j2K0&|uwIb<-Ns{?;nYDcR{{mQu;3mchf+#X_*cZ-cvs$gQH
zJ5s86D$yM@Ry0qddYWyXJJmWx$XDe+v^`&-Xu|NL9E>a&_l=_F)9x?DHOX**PCBO@
zjUR4lA~wCDJdMTi1VHliBE=o@c4my$StP!Al)!^(d^)_^ZFp>RptFy`29dB~)Q+(M
z>;-pxu@!ni>IvD7guECQQ%-ClWW8e9E<RQ479Evn_ObQIi9IS+{KKF%)++YKU6fsm
z0!s#Me1G^8&~(=s5`*~FOfVd~<si;hKeX|@v&~CmjRAE)7p_1htP9q1&N(Cil<Z?k
zZG>y?LaWZ)W)NE<#(-WE{KQxv<o0o<dc=`4?fC@Sj?|G;A<UxDjnS!O*Eh^I7(=L$
zrW_dY1IvadF<&JfR{2<pXAs@RWJvtx|FPKxM~6Ia=2sX%`51NN205Dmx5;vF0jWO|
zKb(T!8x++?VaG22LJRdr8l`3&XPW_a1G?lSQor@ihupUytfK$^-QGjlD+5}$fdyrH
z6(2EkA^Y?!_L(^l=Eum(&S@HDfX=QZ+pWXM;sMSXx9{<c2-gOpwG&wlz8grc-u4sU
z>&vuk+8+!%-{|L>8v|#|B1Mp9QmDgjqrLfb5!*c7)kKVqiUD>E{;sXg{XnRFe0vC&
z-82S;pZCS2IG1D2AwZ)|^Kv%XVNsqGVtKe06&JiP6ql*6HJPHzE-&BI>l?_zsavNz
z?&Cg5rg@>u+iE)0DEjY+Uu7Ec_ITrOV53Em(L()b-WK@}BaS&oF+|*P7SoWGeL<3Y
zmqjN=H>P^C^_R%%kt70a;f=d4+Ly*shUinU6@gwKn`)&XGDL!W8@qlk53dr1a2}af
zxVG*lEdf2x+Hw%vG)97hwNC!wO;QfH73!05gGqc~ypX+qP%Tfk%Y-x|FC*m_$-*g*
zX71%4V%<E-h){Eiu%2!=CFCFV5uGGFZWeyDzfmnIh>^hMGK@kAtx%G)Ajzth<W9lR
zADm#13O;8CEWOWOy^gJ=8UaJ>_ki+2vEWK{`xbyiJ?(IO3zH%qWjC-+)f)i<h7B%m
zlG%q?ra&E43z&dvAK3~@iLAUGbIHJVPYShN5ztr|)epJ&kR9+cem+3KkG2u7Ldm)s
zwB}+H@vi)JejPX1S?-s+@MsNCH{p@R(n2mwHaDOY&D^_w(Zx)a>?D?jg=8CZ`ZXG5
zw{V>{B{wcNUDl0aYg<!10?4}qNTy<vsgqnbtiACCcm_$AjN>V&*wYj-B&}?m(5G9V
z5HPC9kff6(w0=nzmSa`;ir8KQ#epmuZRTDckBw2|1bD`AkMXB}HF}8qV^u>h6(~vO
zCi&SM<vh~X+oNCE@Q-!tU|XgS_u4fS{6_hEEca(rOqaL^0y&BsyL=ni)k+N!xo;Xk
zPiDAh=IPa6-f6dsj)>UM@;+8R1;G)=;aztzeLqStVH_e9HNzb_j4q0KgY2-6Xoti+
zZ!&!+A+J!9)z8&jl7<b@S2;$SBt016)Id^xh!e2#j6X?K+=k%Qa*n!2iyjX<=l;M|
zt+cmT{7JDn?ki9JPIZ!p{B9e~hJ4lvNDzdKLh)-~m!KKfuYK-`U+-{HIw5nh5#b5D
zELJ*l(WcOOdLik6$z$VKEzWAJ?yV`UVaiRp?hXb=4M=rcV$Mayq(H8Y#n;C?MhCsx
zBzq2DBy8L*B2zZ$6JNgJz}P!A?zUh&Ly2k|mgB(Dx{6mHq+rendL^0$(pbi*Wtv7F
z5&Lf3l#CN>@n&lz$pVJx%@l)aUN#{c<Z!=)QEe$?ooF298}eWjls+Rr)G-(D${=FM
zi6EEW_*~GjL`H<MxBZnoMG(<!R_<k7=XM}m9>qjJAP-ENwJR#j_N_3TitNw-Bk>2?
zaMEt3cvYY7US6NLy)?&xs`8?pgzfFAF~I6feKkyZNE`M?ii4t($oVWA)rs7=e2M!=
z=iZc&>)cRJ_=FbP_yyid*Fh7Q4z(qB%9KpVH>RjH3=%U-3W0cMvq*8UH(ezjX&|dR
z$ugpaddvD}Iu7`a;2KCuVzPR`*qI?(F~uO3moB+6g{$YW-Z&bplFU>DFN`{zq6GnP
zw^}q0zTs9f{b;xjNeBfir)Uvt#;EfkhNu!L|JH~kt3*Z|u7Lk083B)`%}_{m**q|+
z7_E=5AKp${8h&i7p{)aNs8E{!2{@2YS)vTkY55IhvD}mV<srsy(l0i>>H{F8&f~ee
z|KD#WM?b$U$xX+9`)46>=QQ7xkT-?nkHNr7hL_oJmg%BktBa~8D3$EU(Dfe(70y-d
zzFZY&DKIltIV#0$#ld)yf(CD|i-`mO1x{d8CCpCNnq(VAao{c?#bTH|#x@LQZ{8_k
zp3`*B+JPa#J6J{%ZS^BG7J2IubJYmEMteNAH!hbAGZn#vkS3Zh@TZ$kI@@SB|6K1x
zy9(?CO)DBLIju1t-l*t5Z<O;W|F>T}ori2lOG8!0w;`rmiPgcnM-et~{0<i#E0U9n
zPwTlVktx@>_@lkf30bs_;DN}Qah&QDD^v%w2YN+z&GmJk<fv3qRBJ>F+-=U}-A>~*
zfa&{D4r}n)$&ah$wh^w7qpN~-kzW^(K)C5hpfA9UUvf*?vBmpii6Vx)g~wuEU}dkd
zx6s)*)zJu(oOFAGPxh*PUY-NKq5~#{>GFiPqM{yIcmVQP7b^*u_bk}JeJ{c#^7k~_
z{iJ3Z>$}zQ+-5IE&oJqL>4T*h-hGS2p65+t3V?TvOj(p)QlB(e18r(o#IchYM27&9
zUc+mmlLlWKGkEAK)#Y}C#<XaUn5gbVu4#$GJe1_>L8)idXy`^NM_V%@JJz`USV;~{
zQO;dxJjWm^2Xl;;AmhkhmEX6KO`!Wqa-K^HKn3^X95TpoiHTXPLQ;f&B-tsFtf<l6
zK`7vHbXCdbK6ShYwDIzE3Wg~>T&0b79JV2)#r8rBECSX?d*AHeK5IdSByn$)%O9Lp
zFv#Cd%f8l>k!r{azZ};h7?FixTZ<Gid)*!|L$})z?Qb0An~HbE5JAqnUl{T+-R*y$
zG3o$y*rPJ#P9_vBa7|$%SIEsM_9igutm$It4=@&yOV=AV8?&*MROjjTP|*9aBW|=G
zBn&Vcf7QT0UeyWNhQ*xMU>w@xZG`6mIikW~JnioGO_+RI&E1<nyC^1+)V-m*XNiU@
zYmVpLfZi)8mgZfq-p@Nb`j!BE{m;`{Se=;GSngT=a+TJt%jPXJPT1xrXuwl(1F7i^
zv>`$Jm<G1DE_VUg$!1o>?_1&&vT>bRrrsQ|cI;1bXH;}BVkS60Zp<i6X<#&?ihqSM
zVdp^I^+Jfn{n6$$svnZ)N>PgyC=v4NC0QVM=lpmqQ=!{X;?Q-3tM`dx&g|R@VJ~s7
zikIgd40$V4^p?9h7}lLc$K|1~{|E}E|CKUwtV(+$Fls98nUNhITv~qJF;AbTuTn<R
zk@`?LiTz(rBHcpx{)kC=<CL`pX(D*XmxG{ec_G}(x-?_d?qky)f*B<4G;3EP<QzR4
z4bAo~lF{Z!qFE&A<-ddTRH>S+H&0U>Yj~&DqM$%_;EeFt+C??ckfA(qWHlY8T<D-s
zC#Uo!Rtc}TVx+-b-7f03GyET26zKLg7EKXYC^&Jot>t^3k84ZChtC9OAu9m<T4pHM
z3V(xKg`w)n&$(RvykFfKSX2A(cNcqCr}gnimPWN&V$9__q4Y&3T8Sq4e$+h`ubNft
zRaM6ny7`BrJEyots-p^+<Y+S2{EqB!RXs2MW1bg__$Py;TuI#wi>L0M7M_ak8+kY8
zQo<16UdDh#B}VgoxkiD&>!+`>w;8j2ml&koVyRO|E|21NrsD!3*ANF=I*!z_F`_YR
z!c9EZuge`eb~fLhOuxGD1T^}y<}-cO0-EHi*uUQii~qi2GPfRnp_=9MX})z8lzS~@
z#0?fdcn^IIeGOuEtTCTtax)wM?Tj%$+Jv#2byJZc4G3YR!<h1v=t-)2>vgc7N`$Q4
z5_2WXo>N14aE+m@2pTW2j1O_yE;y?Q!-@~B`w8@Bs!omYEmu2<Xe<}D;e!!*Q(&#Q
zrp{vlRqYpCj8;iZSi2I7&ZFRBA&mg~wV5tHLvtec!-@~^s56XedDmg*pRIcGJ&S9N
z#Ra&wdeZr);#~WxrC~c#+H~J)WC4x!dK&C(3?WIKwBrmE%NRTSc=j5de>1tU%7#la
zHbsl#OY#qyU3Rw>Sj~D3-Nf6p=R+Bz*kq96(3)Edm3(!uM$1e?0<(^yTk)YmmEvv-
zbLzG(kv9hr{WEc&LLt6M9Afly^}{=EQH;*;z+G2H!kvW$!4!9)r;q6*G?E$(+lQN9
zu3p=|u5|(y<rd`ypbzZz6IA?E%>Rk?$T%P$SLXQN+Z}}M?aNIV&;qiR%jT>05fdz^
znrQ?`;l{ptFgindJdQ#iM{g3w{uK3$sxTzPy)Sr%thk<_BCw+2f<TD-4K`jWEOy{s
z^smPEISmyBQ`KwuffPM)ex4BzTprx-5JGpQT55E(;&ibs-)`xm9Ik2i#p&S_s`T&~
zQSm&V^au5c7VDed(`l@<NiV*q@k{kdPanAYz-sa7t0rPKZSF$l(sO+Xu&NEdZ1MB<
z9RPeqwEt13+tYrks$&~N3ioFXkPS8XHqrbwuF}AmEh9pUPT5z=fTB6y7@DYL`_l9b
zWLK)%_sxA5Ii_X8yxDXSya9}#bqvX=WN%uE$WC^HVxd|4bFThb!3W4gA!=%gP*9^P
z-zI4U&{>DYG+bLk6R|=AsM5m8xi09g<s?->w@l1+TJqy_cta5D1PkG%>Nn2v5UIi2
zbN(rDxE^}ODBVtu&v_pRMUKmx%-Z#buIq74R>_u55qeG}>jts{eNNX6Og1y$IX8i;
z7C1J^#RU>g8_52jFDXgPyQsK#<F~Ox^eE6#TCFUD5z#Dx$))B2vM{$S)wyp?uD`M<
zH^4}U9wr4!9J4_$AN44(4p4Ec7rzi}bese6tx>lCwoVEbdn-=9p@8HqK2^6Uf22NH
z0Yj^;h<Ftr-)tAH_axmu3O-h}1=w6>v*Rk1Jud{Bqk9QCiaIl4A^G%KJ(wcOKI&F_
znQ-G4bxY(pb3a!xyxoAJ6w8AuSRqllm;(3OSPtEo>DWuy{w3XHKAhWb)((w{asK>e
zsGXmeYn6E$LlJPLkpO_sVw-9C9DOx@sncoaXe|Cn@O&#kKot$u|5=|B)$$DQNJWF9
zO-G%*>S@ZM>2{T9ek3DeivwOqjjd}ndN<i<(UBu$8#x1K>xP|7g+aTIhoRBBCOJD=
z;*6&|`<M3}$?oDD_4#KrRWl%B_jHFLp#Yk-(c;3LRF!Grm1rH#QVbS5g7<^6Kht|G
z9;}fl2#PAH;>RqEgQsU;x0YN0_2dG$gc<#+B<C%w(%Gi7j}5mcIC2e_NRCeA!}=ur
zZJDx3?s3jbh}9E^^5}Dy)0C2Aim)I@gVRtm5@fxB*nKGH?AWmom~?m2=P7=O;S0A_
zL1Tx$T;%-vF*brH%a%1fC)gfKtgP{ZbN3%u=pShxA(w(fy$Hk>5HHRJ{&KXooVfd#
zHh!7cbWy>9x<{iUq=l@o8X>Pi#tPG+4~@m#Okg~u?1_vpQt>TG;9~EL)h!>G?nq?N
zLOBYj*><_}4eD^`h*W1;MNBM~_<2(_#Synm8;FOX&i*9Y+@$b0UTxCLGoBZT-!1Rs
zOkGxoeSxnzPbXly0>>5zEL8PLree47fE>ZBYQ#i9TyA?i0`ARF&SvGmBG8WNMCmS#
zMlGAziW0bIKcYvwJBcpJ4hs#)veA)zJE=;Q-Yuf?<ZME8=e{(}GrTmYiTjFnxNK9E
z9%TR+%TlPWf0e8m2K>DL{UU9{iA}R5s*hv`KNjIJ<G#lw1OLW#tZ_~6jE>AARqc-@
zrpKW}i)yd3P;qXEZYPs1V`2?bVO({AI-yA2MQs%rDn4FUsRx;Y`-JRs@J=$Qpyw2g
z*~s7Tf4=<q>}g!*5f`&A&Q~9+Rw>xlEIL)mDZ>9_%?_K+^B;?Lv|Q4)p1qu=b%%6Q
zQtVAtvu!tu7C6{zW`l$o^3R(TMX}AGv}2Lz2aVThDqVmT{O^~~4qg)(r#gl+u}Bme
z4HcY*DTf7v952QIpqS@vIv>0_kQ+?FAEDVrn0oWyG#EOQcSe$I&j{9`RCHL`N@~nC
zl;e#bfjoR}*+k<%s~&OM^`CvJU=WAxvji~xm2?{n9M!;9bZJg+C|8eE-VJ!V?kD_%
zB*s{Z{QAKGwztpjL5k{;n=yp^Pi%sxkK-q*4U_jX^k!I)44~@Q`JM`0h=52q`||lL
zup#oVFHcZAA=_o6Uvv>ON!i(YgHG8ot*>)g;VMU2HR78YoS+(p{ASgXD_LkP&x&ov
zOSaT6pgoC%MykDL?O+1r(*_cu->gIaflWlF{2}l)UIL3ZKQa1UH@4`ayRFEIx+9jS
z1PwMsvqh0f3mIcQcMYI8QZsA9jK5o=sy62jYU=l!k4*=jtG)yu5DM-3m#e4fXUPDh
z(6#_`D$hut^XXkgJ#E<eg!~ZPYKX&>?JyvhwR^oThHH37Mqf6G6+)7o?_^BpY^j?E
zb!FO(9p@@fdf7>GUFQtD1tuj~zrxwFfC6J#BXqY|WL_ieC#6+<$X%!a2BA-yvIvBh
zCL#I&IE_C8+_-Km=Til^-plegl&ecRkB}>)D5waI$F%oz6%3?7Lpv6Ky5^##hOcsV
z%Tk+D49Qt2zY{I;<to(SbNlR%d-`lXPPpMW=M}<?v9KKZJ5ZpfD%f($xMnHPt}Mz^
z-_dbxf02HP*20Ezj>5a~%??&Is>`<9h_o^E8Oe=i%6?mZ+t{{foz&kI-T~$i@$wI+
z+~-_nbKV_x&^%f^d%3$k%_MsV7LNrqEMlo!_@m3FRpMp{FKUQbne%C%+yUu-wrxlr
zYVeo$Yu&n79Lw5CN_#h+E|){kk4JeagC-_LGEQys<6?^9k!)+KM?=1Qj8+}T;~nw8
z{%Ft(=jF}quF`9XcBm2hn9$NW9=TrpWJW}>X=DU|PVGlrwDZV%4J04_zwg?SKEKPC
z53Y#*+$xue6R%MKXmM?u0Ut}l${b(<g!~YXw#1m7>6|0%X`RYQ!<x6}L6B9TPC9@g
z+JdNH?lv_@BjNHkQK-Z=<rPjmb|7t&0r>|SuC|)1XE1gwO=l_M;eF?<S1#K`<V;Kf
zE94V+P`6?B8(l~sZY+_2PwdIh1R7gB&jM^R!RK~i6S0&wclXg!3=EXOa#YnPLyr@3
zWE7W*4{^m*=hmE_(Mqn8G5=d5zRAbDUvc)1g`)w`TF0v{KP{G?X60>mQTqf`$k#V2
z=k~&7V<tr~DS5FYUXI9_4FePB1J}%&bCUn>3)^7}KIFz!K*zqqo10#82{Ie>?iLT~
z1OEa@HQ44E1^k7E@!Y>4`e=RAC^s+iqfdI?@uLeyZNBzgRp$a1SH=@0fAdlOIID0o
z>*7QZq$-Lvold=u*0WwF%r&ZoiWh$xC)k!|+DO!A$|JfH5qN!)**mhOireqkUABgc
z3MIQpe|GEOGt?4zMt(hZQgG9-mJy?F@v27WbC_GuAt!|16W`My>>;J;Pozi5Pe(2h
z0~rJ;Ush$tw7*@38zZI&`xkE$yW26C;-+c-&&&E^T1}H?xUd6ySPN*wc$y(AcZzFZ
zOxbBG+~K0#MO9`BcHsW}x{s}#7vV8vP5RSD8=pas=LPtE9W}M(GjITCG^>Vfsvpu-
zrIFa?I1bCF81EP7`W1iK1YiSjlwXd>w~nIB6t&`BW;%^}hZOdV9UHn4Ly9vJMt66z
zpIpK;f_L0BEqpwVs&g@`(r-%gE?AHP)rppoWUWEYwn~a?4G$sY^1x;Ap%$@9RIC^z
z;$O6H3)u}zg4qhNq!hod4dE9LayGg?mXK>lm!#+A|MpY^++DUOqvvSK2$U|sbH8N2
zdFsIw%n=^6F-S`C!~h8?O0~CKY}nDw$6)TIh{r6_Oah6O<G<kDvT8|t^<~OF2H0kj
zLZ7`(pW6`5Ng4^64@YZNre$(n2KR;w*I7(5+bnbEe-;D4a(@L){JLuv%AR0kFZ~ef
zatt<Pw`Jcxo8JdDwD3n%$I~nS=Zt#n7kOAh!K)RKQ&qboSD~!aQDR$Bu)~K3TLVye
zAa%1-eg@T`HHXK+sS>~P{8(@lLpD;efA>9f0ZexQWcE!6olH?a)2S$7DtY<TD0wlU
zr%M0bL^>I%7wf(ZD$Z}D<^SUCcJBfU>N8E!jA6<@X>*58`BeOnGICVzAffGhJl$F@
z!g8_c39;$?(M79oz9@M1LI~|N)vAI1<XbHs%-wiG#w5wKLvH?1UKY*kU)DY&%z&Q%
zM1capo{EfXX=Fn7RI)-~#10L(Z35E=tJw|eksnKlnMl^tFerMj5mFRI)tMG3aaEVd
zP<GcU0<w9)hDYkGV#L-9BWkOME=4xfvD<(DDgWS6tsj)N)Q;}H;;%hv?C9;=>tDEc
zAo<~MjxBeJ%kxhjy#4v1Ft=rU!RB*{=Tg3Z(Ye^_>gw>muZR-!&*6(nkuMIly&uy9
zFZ#_8(cWY)NzMiC+=Ra$FqxT`FS(XygsJ@U#@-KCde&W(RY|R5>}_|(LejR4v|qs+
z7e-*n<1BZ$@g;3jAn_Qc*paJj5RvJo9E#<%G~teln6GGsgm<<h?ama;Z5k`=1T8tj
zEZV-xN$sgve=IY9CQ-E&#;P3(Igb>>&hnF*ha+6h@L!}pX2n*{w*f@}s>>mKrfX*e
zVK=BW$=RqsQ-e1~Ah8$hnaJ{{BRM@|meG23{ZPaqCH|^pAnW4#VJZh_4NV{i5A=*K
z((ty=tx=8CscD}gY$v7czf!%w8hs1pKCB9FTOH4iY(A&=%-sAjdK%u8zxFFHLQ+|u
z_#O0fkVNhwK8=I(Z5kS)ev8B*_=6a^T}ga+ZteXyZd=sU<q>K)&uR`XTP<Zx9gZwA
zvxI2`?FV3XMLqV8^c$1xbT9tmcm$LHj*65T^`pFe+IF%-_%E)pJ1CC~VH^cL&?sz#
zUp#voZGwur=SNzwI$UaVi)Nbi4_0g!CO2>N3f6UchYIh2Tv3{PAFp4<ndNL&8AwSp
zG#72=Zc8Ga>Q3}y@&EaXs68M%7INK}#ERj?aB+{M$=$~TJ%{dS$Z`01H;OyfLH2dp
zN&bsN|BB!acc)?(ozq@)jL2>wj`FQd6c(z8cyo&IxG_@GaIC!vy@)2Eii|LT3_{3I
z=)F(|1e|xqZoyOsTY+fqa!B6EUb_nW>nH1YF0D+v(IB4!qVx61S)_#akp0zvKlxm|
z*L<xEdV@fgx}HA^KM=BRTw95D34B;~78WYMRkQfC^`rutDY&y7nIK*+0Ow$h=QfHv
z@Be4FYu4*@Q^_?Q_<V2{8-*L~C#de0ULJS(%9bx3>MGdUfzo|d2Gl$C%SNpXz43h7
zY9ACIJm(vAJU_xb9upI?{m>Padhr<nPd!hKdJ1uGMr{ooF4oX!I2_`bAB@R8(I`G_
zk=XqNhwYoP%pOz5x<0ONP}LaNh^<CXe%bkRfg7)s)bLmA=h@o~q)N*QFL?V|x@(c!
zbXe{Gyj#E3c{HU;f6i3K)i4+fV9;r+zaKStI9@OwXGN17(iG4-D0O!i&S%HDhcWxm
z378Q9y_Ulf_BI_<crKam!!`6<8KG9!gEf4ooIR%U<)Ie>H|}O18iykob4WIRQ+S%K
ze``EH!{H`18eW`YRnxv-vPbHgLSRNwl$^f2_?D(|+IV<gy?9ZVBRga75_?dtL~|k8
zQ=gIvNDBw8;77yZcw+8Vsxw6e5_}Q14;uc*BG=-MFbz25Gfp@twZQ6%6Bf#Bn^s1G
zLTE{2rt*7SEqi+`p*VoQ_%2$IuzVnv&!x@OZ*CktFq9KxA#IJv7uX)QSQ*?4s-kIZ
z;(YheSwX4FK)8&7Hl6IYOohPn=+&P)sJCfTaMoEO+TFipcTn!pOt0SSpk&Ma<ZzXB
z#UOM6*-1TS<6I1qXh+%VaEI<-cZoVQck!xOT65U}FeyPd%9G#n0kjJCHxt_DsE>>=
zlfXK;`$<QoPdB3#4MPweQo}31|9(xY2C>jHy37F|*!|B*47445Wc6WkC%?Ft$k4S*
z+itD&?TT&x6<YZ7E7@U~f|Jo5-qDU%#j?nu9AAs+S1QnB#XjXZRIJg2^D;2Su1y`p
zx<06PGB2{n)i}ZiKTN*Y;cyf9Zf&$zSL~o_{auZ{%VPTni-w+C0-vU#2p3;|A`JAR
z@i4hv|NC4AVQ*i!)2Q{b-LtLG=Zh2l6Q_Gi0%$m`^g};Se<*8`t?dVo4;aenqN=4>
zNK51GZ=7R1*je6o|8>x0fh41-^Kl2I{_fR%w{dPB!AP7z-Kz|+k}uPAjMbU2Ge<lu
zBY*!vg$G1k)qKg3OGYMvUzGWI(@IZJm595}-W({?Nj6?rdp{QGQ*hMb<^qAaz&g-k
z$u<cb^Y)=}ll&wF#T54d@_EmpTUf@A*5w;hH&4(c8S>A9BR-J4{s3JM?GAzg5(Lm!
zl~aiC*rdvd)!R(ks=N_4kA64)*Dt4j^>zov58T=RNY`7!&FaWnvkLhdc*zcL@}lhb
zs`TqRMQnB={XYLXH<;=kK$9Gan)MyZ^0knzCcK0)<V$StMutCsG4&rER5)<u?6<Py
z`>ZJqAOmGjXlKi`N<b9d1G}FZbAF3R{s(R9)2{5Xzsa?!??L6p5Yv^@|Iv|IJZJb!
z)m*rlYZ@%rUd&Ii5vBOt3zKo7CVB=tcxiuYejF*A#<kiBl~0iAkz1b8FfPr^rGJ#$
zje#LEg5Oj`r=D@q6jDR#-@%OdhdU7N(NcSZCZ&f+-blZ$tt0NmmFhwo7bdgi$-c@S
zlLvZVmH_2&cE`u3`gcax;KH;5HHwv`z@9)4W~=B_3`7nwVER3O@j~7tK$WCZo@tHX
zzf^aEPG>%96zk`6GcS?;h+y&cB85Bg1Ea|a$gu57N3Yz2rwbykWkkg=X{n1lT|B#0
z3=A==qrDc>gRfLXUt;r$qk$X0ZVDv*{OVy|0(X<Sz;*6Sn(hF(1!q~z#w3yIKJ@V*
z(SJJ*k|N`79w6yidhwTxJ8<5fm|VP@FMrK-aFpAGHn0pI;o#2XaIZEOZ%{GxG+QuA
zC@?pm_JmnR(obWU?+dtbJ$M&eI20^i9b`?NYt%^U>;{w0-7*92E-cMdM#A|<sNW{G
zd~jgu5psRO3|<*xAQDT9)^LNJ<K;U^_HL*7>EBfsj)~NnwZ(_53{7gEprzvmC!n3~
zx<8_`jCTBa06X%izQH^rq+37S(WUfN&?JqkT3t_`wa+G+)<CD)f1bZDB%4lAujpo+
ztZEOO&3I-!BQl`sh>52#56zrL6NmCkKX5b}NrxK1AO>?Vjl^5D<ycd&XiQqi+&`g<
z9lJD5C6Fi~(eFyWwNFzr*IWBH7B>Cwp%Ls7nEe#QUs}1q$bSV>{0`tWI?0|xb?=Q#
z4Ezxo6z0i4I6mQVi@W)~%xx$(Wr1xLC?zL5tn1B)1~}MTBuPw13>O>aQ>3?S89+M5
zXMP~=kL^6*Q$TB$OMH`sis+bID8D7OwByf<4iD<Z0*(sL13p?lL+iYWT<2cB$CQp}
z&3VWzy){Yv7~LB39p#xPf9Y~{!YnCUrY3i!6(<8TUo%e6QPUKyr^4K$h5NZ%%z3VJ
zPR~>gr23%hUAtm=^<2GMiM6mxg@o*rSl3wV*v>+LSy~6Tc-!BQZ^n7-l6*u?kAq9f
z@-KI(d)`fC%J%f0HG`>ED#MrX7unAq*C#%pHGe*+p;h<XK%M!%0mODW?9%9#Y#IH(
z*Rc_FvsU_$yQSEj;y(ZRK|dF6FE5^3f?Hqn^ei%7Do?jB5OTLR4=9UA6RSFMXr_&u
z8)b=A2H24pF#0r{%~`OeHd0l09lAObx(e>!rT(*H_6ZuabLF>(KtcVg5=FR@h`aPa
z+K&UElg|9;`9s;{9i`UN)E53ItJ6Rp)%x73S?}i^C@ESR^INtQPCe5&EP?yO^<MB+
zXKkMuK&u&dtFirFsj4q=bB%C6>uIWQgkvmE1@aZR73%<ioFmnATky9ylh9`bzGg~(
z$KS5sy~^#F-O(EdtUN4l)Ghn{onWB36PGMZc1J$!A^twPtcTrzUQ_eZOO&*F;Guxu
zV_Al-#Td)y3(O>&w=!HghB_?%t_u5`dwq!7w^;2iPDIDp_M6Ll)^#>=GCMP2n10^#
z@qBKQdo<6Nt6yn<ap@J!m17bNLln2djqRK;up72Q`+^!;$DhB5U$bZ%y+NsaUK}JG
zA-^+;womh(FO-j;0&pg`L!@4MbJ-OC6l7;M1#b=AE+9K4FuU<MKQse-6~jC$M~qmI
z0gNce3WJ8OPg1otL~mF{hj3n^Pze9FGRV-%v^!Ry&c!-IiAJ9Tjx!~M?#_NROx}N+
ztdwGrct$gdY9%IZ3&qaGgfd8;{Lw?W9>Jj3(AytWdfs=JWY4!PaDC=)iAeIGOr@;D
z(#D<;27^f_(WWrW!*Ko%l9Q{!Bd`FS*GP|n(mrOOe)}xg0r|pIMBX9H;#obD>&H2|
zs}YLc!xv48IT}$EtLgUp;LapB_TvmVpM+Ga8sSkw4z^jW3u&R{OC8SD6jnQ2TdWL-
za@=HjHpusURB|&e1z3QyekxtnNJ919y0-PC%gBPK$F+N~v~5Uzef{EIx8VpwxJB#&
z=`rxy1(W>frLCXivSpX6>t!&K0N)+P_*q4ypBDB-`;8o3EMX`XRkcR2E-_9e9f1WJ
zH$*6jiF)D)wT5yl(txBOPI?-6zU1qnkMgRa4k*bjrQILk1yu<Hx&i(dLqPiyi%&L#
zX^7uLuQM*O?Z#g!U5}nur7yHud$nE5g|%6l3;WbdFExluLlAR4-oJa;p52Mz?Li+e
z+sDryK8XLP{D_UR-wvU#<$6dmN>Hz$R<-Lb!)4J{U>4xs%QSf^s|2fpGrNCs2yS21
z6ThmjfO0*@Ovl2EyFj?9&H}l2DuB~J!H-xuj{hSlDs>D_(W<+uWxmbWa|EWJZp#C)
zCjO~7kEv*jtA4I?{Kxu4qcDre7W8#)k+DrrO!fUex&2)fTF2kMK&qF;j*<$tVHC&6
znxkFG)-SdP*4gVD#Z*wYf5MLV67qb<^OHv#BKC`k$2`-54am5o@c6?pJn385?R<Cj
z(xQ78)aKh<;hbR5DQ+K<V0<Lb-d(xPN+k?tyuI1A^4lSm)2f-<bI(M@><A;zrokL2
zFwK*I>Qv_en`ETjl=U>qhqO~1u`>l;HHJ`>z|xX$J<huqi|2-ofN%K`MpYWu9!$2a
zL0z9$;n(7R7*~Us9fr{28E>K}Ymre?y`-0GicFogfAd%e2+%N=dIRTFD^yhJ+KnXq
zKWx1VJk)9X2OL6jn8tB1*bs>@2~!5!MzR%K8t3CEwuqSyOgSZo!8q({w-m9hr)=Yp
zS?jP-j5$4?L~ReID0A4-LCjQ`N_wx~RL{SC-`B_EV|&c+zJJ$!UDtgbzgHVDY|(*H
z1N7ZEYz%*jtZnnc<a8*2P+614F#OF;tga$?hvVZ|eJe|~F_g%cgn92Zzme)idc6L>
zAKXf^W$}2#bgxgpnCN^=c4qXxCGLmtqzZPU4^)``EYD}Xa&K<mjnjwj2Z_5@?FYo@
zz^PobBwd@xb&@oOme;DMtTbh+nc~)nb4_7Eu3|yNLoQ;?+cvjzN#8?nRo_jm%M0g^
z$G@F4yyKJ&6}4KIpeeHs*HzB(F3JTG7^QCYdtIMyOhB=3a$4m_23@ER74Es(QD4r{
zYsN+r)6l8h>i&e}zJ%941hSqWUmIwd{`^;alGN<vSV`PVcMOi2!V0<7qiT713m~OJ
z1-oV8y>YD$i05ZVYe5&niif#deR@wg*=W^zr!<?bQwvXe!IvfHP5sKa2Ia~=9IYoM
zMNj`Q4-sm1p*>MMQ4vfH3Bn~dt*X_yHI_4@i0!5}31|!fhALOv=SejOoUdO6n=M2T
z^g1sDv`5@RN-|Ecl$!KnA8u_l%~sJ`B-O}EMD^^}Y8t&CEw{~k+6!y>4F1qkR22Z;
z-IR#bw9vOR4qNT)NE)l+KoQtaMO|<`;w(whGU2V}_CHCn5Jl;WF^-&d^Vs<;N0ZwG
zIG+086`;2^Ge*S^)W)$rz3pj5Pm*3lNH^nFJWO`>{Ih*t7x&wep*n^TL~TUa#P}~@
zlS8gIa)%`wlG|ThZZ(Kdtk{p|;p{ALH0L?;ZX4jR<^1QIuQF85V0Ly2Guzl|?^7*s
z<JZ;VLBQpSd9z;ufOALa>r12e<E4hUwGS&s)b36~#za@;QkG`)K4*X-N<rK`+*aTc
zo2LG=(gTrnibn$tDvJ(Trj_|8v+-aBc7i3ccC%$6zcC`I!bqi|eSSmDA@ch~;;wUM
zHV~)bHUUnkiMJJ`5F!}QG9y!@7mCtBO&8tx3;unUkHxKG9JGHJ=e)i@2mZMv7m$Bf
zEZq~HP)LOFe+|$sj}F$*ug2zGK%86dPeoDnv_lxbK%a?2`c@dqSy0Vm+?<Zlc|8>X
z0a0G!#b(g%#pf-h=U3fY(n4}rHzajhv^MF?=>6XinY5xf&Ku@Ej?r%M6FT`$LTa3y
z6Nkz>u*nNb>n%xY$9y?E@15Eq)rc%AOPkQ=F^QZOmjaDs_NUVnJ9?toqOW`E+ubbR
zf(Ai9EI6(<HpY0S+s4mdT5!hM19a%gHn1Zyue!%Ki=;<;p!&@+p?&mz93F+zRcT;2
z@{F`vVh%RHZ+eoR+F!5L0$s!upf%d%H+##3zt&}<r-aW13H;Y^hoZX!P^YVW;C-9v
zyGu(jUV(iv#en~6${MGXvgVx<&bq#x{IR*+mlO<DHh_%{>((*upUlA#YAZSsN{2zF
z%G#?;y?Dz!N^RV`W7ORC?Vh9;Bh*}$Yq7iH4v&k%UD*5t(lh2~M2ck6Pi8K~5Z+*R
zA9Fs{(tXrd>uk)S=J&roNz5rt#3WbC(%No*`~E8ZE;spAHx*&ZjQRAcjRcd2<KYos
zCHy>kUqg;HcTjuKO=)1c7A`=BS~u%b`@F;AkF2x+h@c^qE<DCP`s~jgew_5={-0r(
zXMw46+&g$>e{^@WAL8F^eo}&o{?OSzuYV^!Jjpw6a-$r;_>u-4?X?PBxJ`G$J<NLT
zfU%<Yj@+VFi(c-{Y-;cD8C(fCV-&A>BNgZ&m*r@8WJw1ASNK;aKu$jS!G|CFZU;i@
zwy#5Wb~+ly*%{KiZYDs?tnW?NgZX=fhpP0M&%v8UANAopxb_4r66rH>Z$wgJ$qg`-
zbe8Us<sNOrht$|EoTl61<C?Qyhk(Y(dZ+hV>nvXgC1<-y+W<7Y=m@g`WAmY?Ol|z4
z9O|L2RE<C%sW1!UBDjG75Wx;`nn$@uO<9npMX__M=;fF+h>&IK8j&_#p6Jxr`3v0s
zPmwSxlry`P>_)Q>c|8O~2j4+3LK?&`o|t3;=Hb=zSt%PZ<;b;}us5kWFNb>(NIT<4
zj4Dny@$!?vevC=?+ehI(^yWn1{Iq^%gcrCQXYxf8;36Qb8o=T+|1EsyqM(TnLX&w8
zTUt+5F6Uv<O&qW-Z=9Oz2n^)3K<td?3=bdOVia}MN2}9UPEC5T7ncO=UYZ_1NR~&m
z-Myv8r*n5^XxGBIkltN4_hcugW&-ru^XB&QD#PaX>$13>ZCY);{cd@)arjQaz8+i$
zcv@15gPXjiPhFu<b)#^4kHsv!rW417oWFucQSmB4i8dss%_=;NsKn**n5}+@JfKT|
zrPmgTIxyf$)P9w4Vf22WP^BsrA6c<*{z8ij9`NrXtP^|y`AVJz@8|Ig!;v4M-LQL6
z6`+~NcT5Mv(iDwahr)2;gZvy9ta;(9h$LE37@)`dWa`qjX=5QHKOx*5_N#ruHz+91
zG_Od6`PE9AoK{o*dO6<fq$YF76CB}dU=_jj?0C&moC0Pn=pFI+V~G_YFPDVX1I$^E
zX?!8SE@UMC-qVAxwF<9G+mKTU;CkGFeK94`Gz$AUpF&A`p~bw}KDrI?pSf@FKAfnf
z72{g8crx6B*0}ocBqt7y`EPQU@+^|T!_k3%o<oUztjl9j9Mvm(rER>$QEqFujzwRN
z#9nZ+c6J2fB0kfbqXxMIXkG$gF2Nmz6(`*aK?i3?4gNM74jMbWM>UEaZ@hHNfk=#?
z<gsK>Rc?tp6rP0Qs^ccf;ZVY0{sZG0`os5KX5~jBl5zk(+%~Ov^gdH=8C|g(ycR}E
zzqhfux~Q$Wy^T`}GXd06xm6;-BRQ`yG(K*0r9^Pbu2i(0pgP<yVb)>Nz_;?sT@W`4
zo@E@ny(I+HY{~Je3N)J13DGnbT+u+wMc<?s+KB1$0<lpIdmc*P++~=!cW2##z``W@
zE|f}Jd*x<nT~z@oY>~bT-QRUgn$-12`@A(1;22&3GB$k&`FGGye8KnB>0A_yF^Jk(
zJ$k=?G+czzK6_ONEw7fA3Flg>G|a%M3YyuVj^f^v`x7*1q;gC`1X+8C1=I|ccwDQZ
z;n3YfYYpR2(1MO=Mu=*PYkRcnlAF!Gy1XmtMQo;;_kQ_Ax%>I|j<`?&PxFXIcuYbz
zH{aKVKpnsh1C$Iem_$#e>3cm4e>XgOe+vl;cxp>ig$vFhoa?_a_RE9V`<DY4T;u5d
zZ<rBqC394%wW3!H#xsRmv;P|Dn!^3RF}6a7ttV9`Xjb$`ld5)!w`H#SP<(_!>mKBj
z2921{2f5LqrvQ;7CF<xMUl5pTzC=8FU&2X&VF;Fv{Z|U_LTt3{-t0}ao0uiI&TP^E
zwtqmbWp2G056SrHl^;%BrFXkVJ_ygqN;-t1)Byl~`>0o8g>W^5FJr`R?5X3(&<8ZB
z6OMdY40I>fEf7cEC<uBHAt;n-MtOg)G1M0bQlp`H2hE<YmP1BZ)46<8XudB9&7YyA
zo;VwYQb9sHmNU1MKrPH)gUed*C_D+^^t}7{t^Xxo(@Fiy!qJ&(UhHku4baVYa;<rT
zbPovR5@Lz2xiPwvV7t?whbIAm^ev-FFa?s6UL5LLkytEHf<C3*LxB0B3CsX-ppq!S
zc!bJYZ<(8eTP9Byq1f*gWWPu6Y#H{fhJ>I^ZLzKJE8O%<-&yIFOtsEmXln#|W@yv|
z#xM@YgPUP9FenK7QYmy<y=rc+=Q`dE_W+!+58KA1fIZ-P5pbc_MIMm$fbt6>orMC&
zl|w9L*#kr|rWG?bTYPZ5F}Y{aH3cYlt-V9=LsGNn@9p!Bk>y6eSdpfB4C>r#9>Z{J
zz!creRRJ7NN~X#!>03JE8U)sSI1aAs653Sp<~t~B=lOp^^)T1@eqptAcQSV%bjp$5
zYVL_f4Q5UkaG|>mLL*jS5WkpXcl`@ya>$=E&ad(Slf<aEc#;*#hVXyG(qYGPSLzZ>
zhsYpi?LlhV2|Y^Q>t_ZAn%n(?M<7T@3X$(3n7u2R?X+0J^a4k?EL~x=Y_x_WqS|CD
zRTwcf_Y%RB-XUMNO{;+~tQ@^>A*le!8$n8Qd!B3oKTht}$bqsPOOoO9l6xtRI;_*u
zNP=ENY$~qFhN9_Jz94?pWp?^W5mjgym+J6M2okB-cH02$LGoJC0^8qweOhSJ3qP_(
zw#5<cPV?w6qUZZZr`7IaU|57l&@{y2aB|D+@QJhDpmVx?h|L^(ZdO=n4A-E!JrHhW
z5Wjt2gERrcEG}i6NM@OKk@41KiAAo?n?(L55i&huul7+x7`cFI>Axrbnb-~<4$ykk
zz~xF_`3o0RMgOZiQno-P3fB}Y*%O%$tr0<%=2eb{@qvgh4wg4GjFlG&cH1I60mhe(
z(E_9lk0!n7r8t%wOwONSye(OJbzmoE=PMa&^nMUW2N;9k*zYf1TKqog1$a87vjE#A
zc~8oyDejC5OM3AFG-^cBtGPcx+rsFD&QV8}yY%3+6KUc2`V>PHubZ5m^kSn-1+*h#
zA|**TJFJ=o+-8MY_h=hj5WmpTM-TNvZQJVk{%;%r{?gTk(`w8=cr?>5kTdi=)^VPv
z3k7SlW8f4)itNIiGNHSDenEbk5x)9{9}GWOOzpv1iBpoKy{|7a!hy|Efg7tHO90L_
z2Czg+-a$kNo5~3z`SpM^A4JUh7Ev8e{CH-kz+6+7Nw5G6;5yDGd?%yD6)rbJ5e}~z
z$p6vuG9cE&&<HIH!^yPGH*SZ&+X%=8Q^tpz+cyEoa^6<XgHf>}9QQhRH%<?d#$)Bx
zd2GNYhDje7M}7h>`2+-{U9Sl=-^B%jwFUv{wIGtY=jk#0n-NJL@_QMKacv-+i0T?$
z`ltBadqC^Dl5^c6aAVgt85E!S%iAH~0q=N7CtLL@Uzu6|SO`~kh)|n20tT8#Gvf^0
zk{TcE(*8>TD3Vv}o7*EO=1|ZoP9nD7(?UY1s|d=r5*gmu$}#~)6M%TR^?Wz+!cPj1
z8J5gSYZ>RAeE`iuGzC+Kw`cZ3KPNPX1L8^FZ-}<J4SDdV7xS`YnCW6qseh(fBXgGz
zr`(jAEwIq^;dmOeAX~|4`F&MyZVU{HG5GKuF~(&d`1LF&(IyOf;qPx2+m_~27S~@>
z8^1{bFZd1d*q`zbV36hZ_U#tuV%XkdRlq}*=zV;lOE<s<*YDX*ScU3`N#p6~lAEJ)
z8_5vEJl3V!88YJ5{WYLuV)M5m^@Y2sctd*Cg=oN_`az!3AUQg5KRiPPFdyAbziV#S
zF{jnBUOD?soURZ~A~Dm~#k=pMZoUx@z0+R!6&5@ripz;7zu1Bm2tBa)Wq`r6@Ekhc
z5FMX(>9~B;A}I099wp$_U21!i4y6)MPW)o=jZ#S><KVXzjg0*uwIYADNj72?&B<TE
zrT?$+q(tF@l*+WfP+lQ=JbIr-S=|EdkaYj<(YK8A`e<BLwnl?wH7UfH#g;llI66%|
zI97W!R@<f(J)Y@jM1Qc~X}Z9ZiPC}MUaugceMFKIi_h^qzAD=Su-~&xKIFpv6|Mpw
z#73Vq5;{|2f`tGAgjnl$Y`6J(KaW*1FFhWbuP!<w-|Pm>G1*7R&N?h}Fat^<HUp;m
zgGWrNgWDgYOQxyp<8TcO1H+52P?c&=Z6akX#u2mFu~hroefU9^h0qsxjW|NnDjp42
zPZV{^s7w#DQ)fl{)2{jnL5HdQ#()Q9>(;TcIJ0^Fl4apuVit_hSdj0hq;AIRC6d7S
zF@H!y5l6J&`T!FLuwA5DSi6p~VdBUJ*fKh6-`>G|ooi17uAA{IyiZwCFkboeR;36Z
zpNU>yJeC%F12S1)uI}~ON%NH-Slk%gIqFrq0PNDf4MEy2w}okqdPlhBa+4*2kZQDK
zxI?R=9?@KH<PRX&s5Anp`6-D3(j@K!kg`r-Txoy!%93<q(Qv4b&3SLk)sy)wW+lBi
zk!dm|q7#o@2t)9dZADDHUIi<YS^p5g2o=;#L{t@!5XvE1+LrHV#bk)S&Qu9OV#JW=
zTrtnO7z!yDdA4V1EEw0MYwKCSz&qPV9eKy)S~ntzHwTp=+=eX(LfQi3NQsBIbjHDI
zrQJkOJ|A*JFkThhKbzZ~Bu=u243n{`@FcUE^0UG}p=Z+aS0EsG#R2?RzCP0l#CC|d
zU^7)Ux#f6eKVf1fOxkh1Q9`F|YUzg?;eHB?>S3dy)J)_<Sjqp@-n{6l=x2pY--gl@
zv(i|{Z7<B#C3aAmevx)Hz8YL(H>kR@gIPowf3a5ZZiAP9h3+TXEk8E-S9rH}3_uM+
zugWt<c&hvN&Bw@V%lnylwF-`Z=vQe!kL?|~q&7S$3c2lClf9w<kOn%%FNnu}^ny*W
z>SYcDJsNl?7%lG#3AqwUlQUXiE&(>x0L9TIpaWk=g(oGEO;dR5LyMu)#8n`6eD3_n
zk$#7}V!l6GpqC-}ngCGm%b>FQkV<V35f}pm`QmOIm^W<m(0vOS?w*=c+|W~bWV@7Y
zfl!5Wl&MdPvjFoK-eoPcr<4~}?b7MLhaXQr(A>;}%EV42bgk_cyYhMF)i+i2KLwf@
zae;tEf?uId+BqFi*B@j0HSrj5#C7T!QHTE3{>E@<N>!0NgI8QVxB)CF8Fg`O?aAw~
z6Rj%7eHd{?i7a~WGgwnCTlspT%|&Ma>nw3(9Gq#%BT~q?W`+oV$0>RbaSZX(o&?pC
zuI-A07<&IqJH}S@HDP%jXNqFxRs>0`Oag{aN`*M&bz_L!`ug;So?1h#dSaU{EFg}!
zbS<qK)=l@&g&nmvx2K`K=)<Bt6QM-UyZ>rW!<(1u!E`4;7y)W46OY9wy*MY|$nzO2
zJsUDYdjMv0H0g&PWn1A<H2Zl4<JkiRLkNH&PKOpZQe5VJ_%kj>G!kyUZ;M>Zk+p8;
zMOz4J*5Y;fu}*MxU4Kf_xdxYi`ni5h#=&z+!9=6Z(T5dn+yzs%9bUEfsbh6S64EnQ
zw!cdyT^P{B0eyGW0w6tGF?6Pd4o3+_n+R7^R~UkefFTj*-i+R-%hJ$yXU&Lnak!0)
zgP=E(GgVQ#xJ<A7F~m4{as(ljP$yHBFN}3yzI#!88r<7_U%BoKC%*`jK!^W2RbVN8
zsHiM}4?K9Z(D*E<ko|$>avQyn=w+Vk2RUrl$={77*|%#8?@m#gGt#UBAZAEGF`mI}
zfIL})<>le^@-?`ljDujxBxf3G`e;?83g3LJEBbY~tmLU%!H9h2JjWbpJAQpL!Y!!j
zym-oLN8UO#E_w44;TF81dOQT7N4N5ao|7Q{4OGIbUv;-;JOgKDT=osq{uVz|cF11(
z2P0f!4&&EKp<UBwg3fr`24Npas&!B5NAD#jalQi}<c?I<I|z=-Q}`8-&q8#h$}jc_
z{no)^7pnUZ|M1<!9D;@uS5t<^o_u3TswyQ}U<(xMyA^AP7VZzF9ZDO7kS<txOE1+N
zSh}CTt9=KX8m0Y=^BW?g^PsM@Vk{WC=>f%M&|Vr0TbK<QY2bd>$T%YX7M+)BmEFWh
zQMkrmZG$Qhy*fTr4aT?r`*jt~3VOb#>Co3UT3i(8j6(5n0zZy$ywHQ<Is-zjPb0Ow
za4A6_y@S3J(*bKNfP-Nw$2l0_-j51l<jT+wR~W!7SNRrnLHmvJ9LglzQ$<}C#1XKy
zmTO8K(B1q$AsjNfhlqsMzFKrb=N&N3{+01DC;#;|lFc01bcpRowsWhFR+kJ=HEQ#M
zTAjcU`6c3%p7gtEE0T0qtnrPLoswp`)|qiHBpdE{!cq;e<pF(eXYV0-G2_~O>05h1
z2pD_&Gcf8TR3H@zbfBVY3gB$IAC^&5h`UPU<&!*bI)t^qC(daoj^eU?!hL)TpD&Ax
zEG)Y`ymp>tM>UBqs_XLyJ*`Gme<xm!El`EXy?(Id+sKoFLQlDK3;U;cqg&LYAV&EM
z<AnOd^`sN;lZh7+i-;rm=n^}0HxF>0TxKSb!x+B;5y9jdE7I7#{I<q}mx^WqK6BCX
zp&hApF`0NBDHG=`dscE!yg3tV0T2}fuT5B6rSU+4vLMQ`$6&gs4b<Y5`LT9L`e6Ae
zv>B7uBZRmPttj#Tx&HiDx(@t5cb#I-6+M;RXS_vSWH|Q4lu(5!ybr%;At%mMVI0H`
za{$?h97Np$kX9Ve-x&Uj`a@_OCYuTMGRPiI!X8Mbj(k6vMkL+tZjx4pL_}R#3q$Qf
z9af?9e$8V`S74!bx{z(?z(2V2&zqYgOBY0*@(rWc5<QRNkhp}}cf{sCI%G04V4lYN
zTzN`w9^HrF-1{Bzd2(Gf4oX=`>U&3)N9VhjP-CGgYF3Y8f$WU82@18Gf=9fOSOX?D
z3Rj)X8Ix($R8-^kpE%aKj4wU_v*wFWw}N^;<w;Qv;O&8+w2mnxao?1ik4i{AnzQVX
z)*(+Y_M*@#O$@JGZ(ZiQ9@VS5ll2VVomME}JAQ<i_3tzW!!FVu*#>cBAMrY1elm|N
zU1KZ-bJBiePza{8hIeu<OOFue0uf!R78x?=W=h6Agwc97JI`ewVd^)C?#T}j)GIjV
zfPHUP7$jRUZAZfIjNJs4BNl&XoRzTUsLWOFvHc6r5EsZtt7DS;r)AppbYUWcVVnIm
zF)HsYREUj9LSA$s6`s@oV!Vy&!RlFdOh!nbTc$zlaJ^`kC6pEut^!gqY=X4nC^z{J
zr5H{I*(-(n)44mWt+JgxSf@Tzy!YT1KcClho%#M^D*g<#0gweJBbeCg2i?zQN{gmm
z`Hf6f<YaKAkmx!|9I>vYoBB>~p6vrGWzR$-<Am+fHqLx?UtsXa36Ggqu$cKt#tEz1
zl6K3P$xZTe5c?5q0r{!p#}rk)cN1M9&ZQtCvlRl9jk};+gLk%dXz*#QMmhVmR8Nk>
zR{ROm8wUAo@&+9}T;!-&r-}Dd#u)oV<SCQ{n`stthh^!&!va;h7~#bh{B020@R0rr
zM)bJEU8;c|pGt3h_KnAs9<q~P7;l#cuw5-@9&Dnff#3r2%Sa<*lGEtChLjdw$S022
zA|8O&k1bWrP;odc%#!Q6o!<meM;zYNiF<^+?hIt_p%jZ}Om&zy!Vyk{=9)5<PtQc4
z>}9@-wn+J+v6%xW6O<ZG2#FK|D#$YJp{Y!<pGyoI88*^Rd?QOO=b$ZdgxCcU5RS@T
zVu+ANDKD~keSpx(;Q3A~6X(XLZf^9dC`Yy(z%47t0~)1!T;{LuRdFm~6pJmrD|6`4
zA7)(<1o{jHX8>M8ZamJ9BdzLRIZ<R#)tVJ7Nuqi`EO<qBv1wgaZ&?U<-Ya_7k){^y
zvM(}hxH?xD?bHn^29)757l|YPQojtZ4GXucB}x{Y*N7dbgnY(9Kw|!l@sREUGis)#
z=$dGvyF!+}iMoTD>GPACXR4UqacSF(U+JA&$2x)_6hQcx)De18kG#2@8;NGu(=?hm
z8=BZZnH}*QVvWlv6DKu}LXsb@JeY6`{HY(kn+VvDwE{chF{|2B$1HD*S=UAoZxYBK
zpgN$aC<-(oaW02!lcL9-!4kS*u7N-sYD)>aF}k?6B~0K|24FZtT6J&8Yr27);FW(h
zZes9x?CNrsF;%Cw;52iu&!C~YXk$%D)*S;}q#Fr3da<4!38pFiM$)(%`g7(k4%{<i
zA`9P%-dn&F?=MjM7|)*LHJ<|>Y%0V6(*Uwp2{G-Nnt+2VC1-x8)#xrcM|5>0xr18{
zMqYK%(@r$tM1qa`FW7U@>QRIDB;7HgC)K-UqsP(KRelmUD<_T~Wh2<m=l<{xfMDl$
zgRmVNrgCST_KCEi;EAGF(%q3Iw=4_qI!T&=K@Z{U84vB#&N1HV4)t$FFS;+?Z<$kv
zS50Fw!gmt``NMHg)RuGdZ16~a(Sh%X5sl9hrMk(wIOuX7_#{&o?cWXrM;4=?fyzWL
zfrgvT^AkRW@VagV`(l-q<>m2cyjdXE3KzqX-YXg>d$=8sz1+IeU7}M;$9zK^VegRY
zpuL|c*F+MHN}^f-(z2~JSgY-(w36}cUIF8oWe)@`IVs-}Q~QhMe_)PA$SN5p4nZBs
z&Njvgmu$>gy5Rc5q9B-EfpD<w!}F5tyR3EqhA)Y5J~018w2WZr#Gy-<W9goXVAF$Z
zc$2_>J3$0TdamDOqTIErHEHhlRzKu`{Cie>SS|K=n9mOxc|qy~?0pflYnN92ei%#8
z+?lax1BP)C!WwD>B`5AWTv1AYJmc9dB$yFZXwh%#GkwBd+Qc|<98dv~uMdGCudB^F
z#4C~RyRw7|9bT)t4*wk0Ji4?&$inEMyMxsEq5-^tdI=^#FSIP8Rd;;)gy(A?t&5EF
z9J)*mH|-{FU_6_G+WqM?;@mNUNk~cD?>d2vjOu9{;xWDK9SCjq5U(@dreo=y#amu(
z0XoJ&u59nfWyV`og27FnX%h>M264_D*^o@-+OILqtO79J*cTG&c4Le9!sAqpY-R8K
zOAz|(4mU#af+%j~JOY}1z%*E5)6|z=B)G(2gb;gAdaq(X+XIhJ)w|1Jq;L+%^D%1G
zlr&=2$jpLT4;1KeQuY#WHa=@0Z+6supR5-hO$5n#1jz!%+ZE=8opizRMgUemae}xW
z@nO*mzuCXNw=z>>N|@Qi`PaR~)jIvg-&0o)@dgAIRuDnOuz!Te7h40m4XB6M>!7Bw
zN*~?rOT2FAUEz;&I3d?uBom|T5+HWT3X*n`emKN~ig3bRkY@RTNT{PDxi>PLgfwYe
z*RI#qugE~A-5iHtBH-v1$Z>$6!tc=oW!#HYjupN8ufh8!TD#oxA#FIW;9inW0H;lM
zcu_xq&#IboG($7nbXa;6H}i5FWEQdZOs%BbaC~4ZXx0|Gl5Ri9w+$Xi4F>%0dd9)u
z8PUacoNc)8gN3Dx&0`xGjAPW5DKHX*Sxp=PEL8h)&If=?9B=0AASV!`tbPsLJ3^xn
zmP}4Vk?9=u1QFo8&mc;$=-r4xUhF2XiVBfslY2%PDF#ck6>p+C4nZR&DbcLdf)$1b
zpnHy669;<!(A`nQEPY#vF0SZ=ycd6iF=Wv8ZI-5a!4A$ZU4{+Bk%9ym4OwKtY6c0v
zyoGqEh2h=5RoWm}n^5h)s8W7~;T{5omUUMcFxqKdP5y9+d`q<~9ESZ^APF?|c(c74
zOFxBUE6avte?sRQ{K~-oKna(sW?uZB`8D*2;0P;V)T9t6i1C5){+q4AK0B)!*K`_0
zyGTDo7V?8ft^#s8QX5Ca8|0MR-5K^O4g%z8m){sIEMvt*wGrxXh;s+A<=)(IoN4AV
zkVL1Dk#Esipc!&qq^G;KEcfg&Lp3wJ0i6(0$|TxR?k`pS$K=*SEUq9n?K!w06&Bn;
zu_{$9fVTvZ{0tW(zVM1%gJAOR7b{CQiQz<Xvn45<I0E72O$3$nqU;Xy-tyCoXRk=3
zjf`gETm+TSV(|V6O7=G+{D9$aj3kPQ7pz4xA&!(VPPpoDQ$=n#J+DIGwrLoW##wfS
z5uK%3&Pt6f!vs%>|7M(sBR)W4_m*kjhG<pVO`IAQ-|f<gn4@v2`n6?7qU4(V>qr)7
zU<+O)Q9^@BdYR+;qe7h~D1oU$6OZYb7p8+6W9JB~7;hUP|B!Ww;YHJv(lAEvg*t?G
zMs@?k=9VR~T^9h&;~{{|L3oTfH$`=h&UY$?IxLjv55|eZFhd5ho~Xq4Ys&lTNc9-Q
znEum^&j2|Zz;}v@s9$g6{&KIx-dX*Ka|!L&B%qxaz&Hrh)x|!MWjCd}pmbIh&X^Y@
zb9MlO4K^7pOmN`m7ggZ^$9p)b`Mv#;l3&TanMjzl5#<0_uZLK(e~bc#9xII0@iw)m
zi4lDM662um)dS60`l<bZQ-FlA%OuUzBq$YH)UC}cAcfq^cbCjEo~=V~z03%fj5N3R
z_N5BXGQZRM)k(C#c!t!ZK%C#$An$ukM;7GNPg&s@-h+G`epLl$1aDEto(rWRSK19c
zI*?Z(#ta%j4rir389<$2rxfCxZ1g@`S}l(WwN9vZk^r4{<GzDgPDl!YFP)<PR<(Yn
z?<#R5=b0XH?%wGAVybJlCIq*T8|LjwWGEbwVC2ND=MG)NruJ7i9&9gK9YVC1J{!Fs
zBMg!45JYI53KR~*XpN6MH8sdPXz$3yJdV}TVHYjk=0*!N)d7^OJXN?dve*EMQ#i4Z
zW_U0Ao`6mievgFWtNYeX6plbTA?zZfLyUqLT<Mr-3TKmWe~sLmnnRr9^f4GHB$;R=
zS|Ary*?BJN!3340xpR#Br=TY1y-T*HH@yHMZy2$e-z$!R#C*Nz4Svf+-7%{BQaj_u
zSC(MIH}^rxFQ>4MYftWa;yw;jBlZ)c6piF*)w^;3b`#zV&A${{l!b%oT>Tn&eeZla
z+5AT7c&kAW6w+bNh$(VP%_)^TkiAJ=ISvxe)CjU91z%x!$Zo>9v1Ww@NaxQHxfNh<
zpCGLTmkF86=+?8Ww;-N-^zB9%8s+#G;QhPxK=w|Zs+w&G;Iu_mO2lI-OUrYh#%X1u
zgikTKCLSLZsZebJJU7CZ^Pa)bmO~DDQuI_#tg%bz-cMCo`txJG6}tPuZ<u|a$sD8B
zRZ%s$m)`C$(rjJ!j+8^d*oyZ|oJ?YV!x4s^(xa>!f*2tL;JR$#j{y_V4vkA9j<i!D
zTz-tI9S!m3^z)nyX(w^+IPMQ{?LI)op(f0a;-QKkJl)W9jp6lu-`<gxJss`y8C1*Y
z{KQy9hK#=>jtQNlMo{P~^QkFllYYg1v<JLlej?=ZiooD>El|wCq=^${L80ps=;mI9
zIb3zP&%qQ1<+vNC6)d`2^$n_meFHO+!y~WN;ZVAuGf=Y&V-Gz-xApGSZLX@wqHL(m
zM@AaKt+^jy%F~(*&{-Fui~tfhSJ^jZn)t7$zr86-mGhxRi1Xn$hFy>PER5HHn{q0)
zML=xno0UWnUE>f}3KG&#<|Nz*0Z)!U(&JA$PaIjP|DR5%I^x93@B|Y-Q>>(GMNGeu
z3{du?e5MZ*kEv!~Z=WBhZjLUsjfWt4qtvbE5+em^OF+Aj_G-}|;Zb@sFMU8u04O9&
zpiUDx6ZFS~)m`Q{aRs#?1T4%vcdK+OOp6pbLv6*oHjPeEKr+PKFEM5~&!I@-RHEb&
zwMh`>38Q^VAsgIP1k<ahB#ST`T57pSFkhE8>Mo^Gp;FFx1JM<{CKqIs-f};Q54Iu?
zvI_m#RkSx?Z^Eq)gFGqgmma_i&2t9u#<pTAmWFE^Kh%XiD>8-oZ=mEYN%!}T;FnB4
zJb*gXVeTs#<|t<dMkr{02qPLPu3lsJb%nmDo3i7C<rRI=PoAW{qF{9T*p&5-tSPCh
z1K;Mg&tP^vb(MKBU#x}AJr3s6LIbV6OS=)b+VbrlP;zEeNC&R%(f2M>;m&t0pY8Kt
zJPU?~I7YB2RSNZ`K{6~somTYDrFcO!+xUzi`>=P!x~0!x1~P1`d4rD6cU^4&V4(4J
zg|~{IJWH+S+y-|_uJ83I=a12CvRG`H71>$`8mgDSt4~@8qkFU}-z2-F^l5h~xdX5-
z8rKLZ^&X|v@0(v#w8``!F~Mmet3ISd1qq~R@}3;Pj7)Zz><nc8w$w2qJYlkJuCtjW
zs3~e$>hNFmz7T!2p|11;FPqe`z7I!TT}xBB;~I+eRD&8j7)eiJZsSb<m!*U^_b&Al
z#o=|4PE{MJcIL8K?xm^?^jmM}9=<v9fx5+kS5oTx7paZUetrvytL2Hpdw5gzlG%A8
zu;>+rz3(&$(qjRvBT_6D+9Mvx1A9QU5ypa2(+<=;%PX{0RiLMdd+f3K$(wTRsy?@5
zj!AOgwkGyVhKbPvwDgh|yO-vZh;!~FA++oD=}Gk$*XrnvC+T?=REVsI$F75*7KL3N
zdtTgKS`z0BxcVY0c8GK135GyNdaCQCyE3)w`1?bPcL_@T(Jl>nn?g(3WaaGT-lZzc
zRq$q39dQOJoNsp)7v=6Io`y4k^6@n_<rZu(zs%VCJz*g+3>9fBdhi?LMAtGS;aCLB
znRQrPYfgJpIQ$5v;)W4pkn+&2ml(mMOThoTVH~wr&oCl%tO}tP!BD-p`w$?0nh&uH
z!0SV9lDGY!*~|vnTcx1{9a}N0Dv4Yc7dTz4LUuMUwI^>%=_~6}8TZ-Qi=HmnO13mF
zjwf5{=%PK6KtZU%lo^#q#$~eC5K?NoLuO4dZxAj&s(q$Rj)hpgcn3_I=4f4E+$0+>
zT|?$pOPF|rhFGV(sQ?&v%CT*HmVlfAq;<hI>nBq4QbC<8ZxHI&l$>_vle^T6#L7_P
z{z;L&z67_2p?G^ufdyM8P&uMip^8^l7h6ZtZ;~N4y&)Ogh^IKftuwFS#Y?|);C+LZ
zeO(%_I>WI+BjNT<4|CJyNEvobX%I!ZoWB+4mm>gNQ1p#bC(%m?v*5rjHq2aE_Y#uI
zI_0b@cw-bS6!JlEk}lhyX&l3C|Co0C=s+Lq(wUXQU+yO8qxi*mCBE4C=<9}`yOcwO
zx{)P2U`!su5g1H8={vK+yVCCohA3_%`+!z_XsL>96&7$1ty*}lT?VG_f6;*w_NwdB
zSZqN(1slLYSIv5ycml|UFq9$I^|BA=Hr!2k)YKabSPfeoPg$<R7a^%ar@Kj}DQtH@
zh2yo$)mj=EcIYey@CNkQ-dX|y2P0KN*4F|2hUMzNB%NsHz39>ik(fjlCqZl99CA4*
z?2q$(W3pqDP<?{(lWfP9vnhBTZZ2G7=a`0wuya7z$3zSmR)a8%+QZ*4)@Flz7S*!0
z+>hi<={$~Criu49^^H-K9J#Kcxqx-+|JrA|Yj-JFdVM(g>Y73;CdyF01sog~8?t>0
z8&vuv7?<QVEl0r&Il^?(;p~~FbD{c3ppx-x-tnrbk76ju-xZqI9$Nl$Xl^yd4|c5e
zBSglA#cekNlMVsSdd}xazvW>1**8_s9it%bYCYP06F(Za9<XXhg#ixiL&SC@5(Zz8
z4PD=*fA$)*ob7htDj`VJkkwq40q7J^tdQxa?m3y{$zz&B7i%N5fG|zch4UY~FDwg@
zx6Tm9QMHCRY-UB5ZM{H`&QzagQMwGr0MxGBqjeXj{9N99%2(w)9CbxG3msYtRVP2g
z7Mgf~CTzAB%J}TTKU4JYZkte8?qIuz5_dsIn?e*xYNaJxZbNpj)K)^FIvZZJn%Sjp
z2H1Ld!{><dI4e3lkw1swFF#><BSalA^=k22ev;*cl_=gf5U7I|<+)a1m`yex-}Zk$
zIe!>~+nMK!S8kB_LG01U<JY``(4zN<g!_p%N0z}Hzlp;A7--5q4!{|Ze_ZY-a>f?2
z0qHrd!LEsOD-@t&{`p0^Us{swTKJx#KLi6Jv4$n;2Vt&j92J_uT!H<Brd=8lOoMUf
z;#$m6Xv<vtIMxZ9A1`yp=GC`aJdQ^o2fBA5ZAjnlM5N@)uLCaY-tJQOoTlHE)yr37
zbKg8Ein<6<T+TPsWm{#=1YLk=L$askWuza<NE$jE7T}ypVzH<4D60(Pmz#m9d$fx4
z?L=Wa^uGM_>u$o{*VVP%4*fskwfQ9vF6QYxj`f}{R+pedb0f%W9NBYSXs|Ysu5D;X
zcuaCaGO?jpI$QdcLqB1VjYZ@1I>Z4Ed_@837n`mMuKzXW5U06IHzUsbD0gO~(GkG5
z5UwBq>Z;pBX%fXMI94^7)cC}xKJ;W(D>TS^V^3{`Bq0l+KOqcz0L<L<*yb;ui2PcW
z22WkjKOR~<F7v^b<8V=i!WGz4l;r+fT`Lj0N3Ao?vm;Jf53GHprT_u{buRR5Ma_eH
z(4~oDu_rxog}Bm-PzjS))}@_JQW%8)V+;`f?%j8;c8G$L`)rbVdK4@q{EfH3-dAOa
zzsAxZbs0=@%0hGZhZeRAEED>%)5Te>M)SNqK$f@|2QDJBRe6q3q+WE7v@(g}F-n5e
z`aiyqSExJ0UKx23{HHR!Ih}j-Y1hpak0r4VTzp5YK?=9IOKmL9IE8&MnTufczUB-e
zsew}H7q0>?J;g;h@+)j90OL>R{#liWgFN@WWZg!JN^tD|&tjxi$(#@-x>MvpFi}Uc
zh>?R_^UxAntZM*7Z~He)oPs`PVrVg-!c%q@1M~paq0c<D$P;QCVsZ1FJq}z;m}Vd_
zeMbsJ->K+`Q@v6A2zp`u`E@sCFLa$pmPY`Nh?prrz2fXNMTjA}%?8J{xl7w!Vlz<!
zH+{Px|4`N8v*wp4F41aPP+63I^ueV(sG*NtZdFBxy4ve-R$Q;plK0RGM@pS8^Ti-_
z+;?D>+Cgk1MKc&O(*OLr433DkXA@WT3CYYnPvQ&*tHYbvuVWY+gDt5CXqi^Sbdqr}
z$rDNV$9cNN(ph)dYaf$z9wQJuO7Lw+T0P%Ka^UGY@GKqrA>lv*)`koSq|w}(cq@|?
z=Jprwi&)<0&1d?63m*xJXrw^gcxjx|bZ%a&_PBE{=x2k_0uQqKC}~qLNqaP2uY-g=
z{UmN>(36X_kMC`ES7v5*bmCH;`L!p%NF1TU>eyM}8K^s|%G-otXCj;EQ=ZP{hL&;_
zO4TqPHOP$w6kRI})HC>UzIt{MxL4&S6T#g0@@ueYH}1D!$<0u@0d)gJhi)6R-2w?1
zTiC26QDFZoZV%dAC>@S_y`bb4hVNDyZ)yYW3_IgidM;dre$bf>r=X(IR~=w6*Fu3a
z2Kq2zQ`kY+7bkO&O+bF~34{Dh*rP*V<{-BU^6;L(NstQo2d9I$qU#|%$lWhENm=Th
z7dnjU_J4i*ReHdM@GC!`>KMnQQdz=|2QTLTqBp##oq787>5RWkiA|5SvE82NR~rUy
zuHCb7_e*`dJvJpj(R}LvUY%}(Do*%sG)oZMH;vK4to?1>%9RH%&R=`C$<`$57^d+3
zp1lvQEqw6O%QUn2v5~vHy4AE>ira}}Z7^h>JYK^Oi|pG}!*_V>OxxrTi{25++i>~e
zgH=|g&K%@Ne?lp^eoWPBrs_BxCDUx2sT~2|famMnzrsoj*Gf96q=tz-dBs4*-|g4q
zH5|La9hKJppT9!}w~w}I*x*Y&$mpxWZh2FrcHzSZ`g*0zeAU4?C3<MT<(bxe+!-8?
zli||0s@l14S+z6ACb=Je?O&nz9}}>vjkjvyILlP*)hhpfu#0TsB(XlT=6`GWSK237
zo3b|4@{N0nH07F^%Hw|@bO&A4Zx|^#rneKv)eqW<W0Ia-Hx9)~ujLx3XgR~SFT#!w
zKix%H=_JP6eBLiSbilx+vW!%6y32yzb<!L3g!<O7io(i$?~R2U%Z1DTKYyBlMoF}y
zIfNU<o&tFB_S92%@r8G*wtw+Rpn}_ZyE9U(BT2_ddMI;mrFGIIHb96s{69*;TO71D
z9l`iXRU$dq8wC~dG;9CS%XR^xwE=PKzIfTl-B$OWM6-vTX-2ZBOpR{b57q<sH_+m#
z21fsQT8g#EVTSAP5UY11|3am8ScIbxKNP$Bi*5ZW-ll7VuV`p3ZIj1m>h;>e?&C^a
zs2aA+wO=ksu^M>(SZd!>7(!8-<k_}{Ra%FPZU_)L2ax_>kE?Vyk*t|0(8L#bvyECc
zRQxL=jc?-f&XQMt$rJ+y?v*|5V`QhHFs7;nKMnb-_!>5@h6{xG-@>rF%Fd3`HY$b=
zkK=T<hE!Ugog|ctd~44B-(UHU=KuKjg<F!<HGOe|VpOY9#2Wv@Z)&(V@wxl|_bC6$
zeY-IJz<0FPeAOD3J6W$I?koSwPWQQMxg+O<`11HK{?t0mWn1OK3~_NexIi}n@X*@-
z<>+H)`s$82%|Z-ymWRBL^35-HI&dCW*^?gMQ<y=~;mfAvCLKE}|GuRoIgs4Hs|)Rc
zlRn%<UI{$Q`}mpPe?0Uf@&aK&u+FT5IY%S1&oYIZU25&$uWuw<b%VA`9wFCBi+yt4
zRH7fvOZvo11KT=ckSFZhW$YiEh;|ZY;48fQEkr?;)^QrclGPK3xGU;-e5QuV>@D4B
zHoB%S^y7kVzXvL~vB}PA;Msb~ssx$I8JVs8U)BTL+_*SG5lyyIjf$P@A8UP(;m%8<
zs!n|ru6_00zMmKLs@jj`4pY?lvUGsn-%*+DGbMA*E{cgu<|+{iQ)AUTPNY7jXz_7p
zKAw&C^N#V9@l%sOe}2;)68)KejT%;rICz@-UFE*|P~KIFZFa6pbh=K3Wc4)L*7^02
z4ZbXd68ve`*Jfiu1VA9qZ}=%PoF<K5+%b`Nx6;~l;AWTUg6LoF9{Dt>^5g5>h}LoV
zR`IEUZ3`8O4UE?O`1fDu*+KZ+yP^H=Oba;0(Y7$cNehwxU`CsSiizRe5{NEb;O@Ye
ztA0HFd#x$mFFJ<B7K%qTZL%7;)Oqr()T)NRJ5wd5U&p_4E&-%NEnU2O@I=y0e143$
zlW7rgz1=RF4eWR7<BKP6?|hIpzU+gho8qa+V`x*$v-3~m<G5#;s$1bHB&A^ypSrB!
zdK;aph7zew<mbAZN;c|9Tpd1&$-uU`Kv{$0g_8c-{!$d)7Zl1PB*=)<KU;@64T&`-
z%2Yz<hYV$a@Vj1ay$wUH*BBD*ui<@?AGe>zQ@Rfo<&@-*vNqWx`xyQ4$G_RGTw_A{
zT|E7W+$7}(>p$<`65|&2E5uFd?ks;o{#9W*<+^)B9|g<x{X~%O5Q0qhd$TRVaxNp=
z*=J_#?^to1Ks#Q;vj?4FV&z}ict?L&Nb54Sy`CPAWjV?8Z<IX1P#+lgl-v#d#0<w~
zff>3Db4ore&neHHJD@n>CM&CfN5_^MQIy-{K>(>7o1bevFcMpOy2~hC(z=kUF)WIn
zW~~>Hxcasfts@_g_x!Q(L!IxV7NZ89z2K#ak8}<2$p81Wbi)dgIbTNWGH{P=gNF$n
z%=@n6zn{|)MrWGT^&9RaqxlrwSD)l5X{1vcv;Aduje<v?|9ku4H)Rw!kL5$LE-l;y
zP=+a`F%osTYCzcaS5#~a$j4a8D}0G0wEq*Gf6wl*{7Bu4fBz?}pH4OB<DC3|A1$L`
z(j_T9MORRdmuDB-I;V2Ouq@oC!}T9M8-mE!z-C};xLZ}~c(%+PmHV2jh1N6dD182Y
zi-`@j-1qo=jUma}@_2`jhY{u-ec{}>upbaEL-x8ql6F-bAveo3_gLdUdaZ$?ZqD;P
z%iB;c#9=uN&J`~BisFwPx$iw5lpXNExgY<2d7o}7(_S>oG#iUE1rBW@0w3229kEBA
z?qn7vN|&|pm9T8==Syx*5{7*8_n}hjv;0-=!sl|&MaLVbvf%!DpzkEHmD}mOA=hx;
zV}vWBSw4y*^8fwD;vVF;CKurRRMUA0O1dChpQ#mL?cbtygsPh^UdHpn(y2PH@D-rC
z6mK^-h5NjYMaz5n<{O1@@k-HJYv3b0s5%Q`bj@o~7;kqC57YMfBl}A~YKP4(m6`Y!
zmY?*U{79ymJE<BD{_iyt<rWg>Gnv%ORotdeWXL)}O-M-i$Stt9OYItCqTofZCBqw~
z727K#cU|r(@*{hg^FIl)wFM{e<2h}tj5JXxmF~_oo8(%EjtDIM54WFVAL+6PjNkHU
zH>hXtkl*&1nfN=FU6(uDD4P}T=t3*RWA);)bkSOc{J@`Nu4<qtR8$ykTO}&N-m83)
zn=U;Bcw2C*HtKbuCiy|1^mgUnd2e%I%L*wP*u1ea)A^lLdr>7*eQZZ%Wb@@Jz7xg0
zmiI}0`8yUED~K4Ny{6H<4-f}osGETvBA^>|geiogyHy``r2oq;W*jrcb}yLt2d9Eg
z)3+i((d^wWrD`}Nn+BQl4C@u<)0KVLZZXxx#RVP&j1W*}Z82y^C`y#!GL0wujAWE)
zwqr7ArJF+{rHOJrQ^9G#+?Sl`ABe~rP4QL(>h2YwqZ_F@?&2fz^%JG0Om!74V8}|l
zT2_o?3cp&x1n{Aky~BfpH9sK-_FS<2@Y7NXHc@JA&Tf-$PGQ}W?@C5)j%Iurjbc&$
z@iYF1uMA3h6$ZiciS36El;LQbYPd;Mb4V@AS9;N^TVpE!{`S0BE4$D_xaqTPdics>
zAiUF6#kF`W#rh5T0>|IpynnsiY*FV%Q3c61E!Nuq@TLp=dU;3}>NC$puDdGkJ&o+n
zv=6jJO<z5}JVs<Qamq>fN{(@ZL($ReDOH!QD*qqt-iN?CQ^-dK)SN3Ly@G1E*l3PK
zzUD@W6W|)6yUE(yDy=Qf)OT4dh(GCFf5%I+w+06n>l9~{hw*pp^>q*{N3(BISH$$C
z0&FNDr5}WM$04N(i8^(~r|a7K&%M#?97lvMZa@6^_kY6s<FGtEs(z=qQLg4iGZPdy
z!%F`JJ9${9`B8Bp2ld(lXx^jHGVrl|FRJ*j@bs;q@A?uc_Fi-_9UEPF_Q;L9T<tRl
z0Z-gLckbM*;x)AstiwDmSFv~3^tDk}xJ#acQd-%YdtKn*|1#SFE~{KWoZ=EfR(t6r
zn^aI;`+MuK3?3%lyn&)jlR0}8IEjNZb;jb?`oBzhEVIroq<uC7Dt9~zSZn|?1|hHZ
zyHXh#&&D;Zy8?Q()O8WMdfp52%s?n#&Yl;mF0S(CD|89`spHS;QWVI~V}%&2xmHGc
zo}sL4qpAjqUUg~205AdtxNzyvEBTt4zMv|_HQ-<Q_a6DCrNi(kh2FT=x2>{~uOA=D
z@x}5_cPaIjS;>`CIN8%28~@*#>&12x1%4DbL1b%{J47*(4xr0NrO7I@4!OE%P=qfR
zjma@7yt6XjiIWe&M{uiML!jl9d3^D?98S(ActeGx<0_j_eiZ$!nOZUISy2K)6!ng{
z)7D`hF5^q;BsA(L1E~`A%yOv>mdjDd&&v;{aJ6Uz2v_%<GL@=kYIF+Q1aLL<(y1#^
z;x#)FBEa{XuVz@@=g*znq>$8?YE}bp+fLTwb7LgCCrYo1I>~xor>+Z%bFIU2YPm1u
zn?B3g@8MIj7)eg;xpT&fQ|}qr{=3&MW|1!#?mZ_nWX2OE5%A;Wi^_djp*;Ty7{svb
zvswM{DsBn2cpA1Eq9D}6(e1x4X*<&rWe(;nJw&!sB{s=0Rti-2fs!EViUrXs-Y1&&
zSi~<*%2N{)5^5Fyay$ff>^`?GQKlat+A;x`Aic}Dj`wwCru;Id>*yKsGH=dx{AYg4
zIA-zz`ym-l^A}|0feg3G<ef(3Wm^e(e3?O}ac^E=9BLk9-3zN?e+I`|W!1O<i1ion
zrB@U?t+bxqhn{5j_I>bx<8eYr`0_@XwdwfsL>azZ5<*=T!<iy$dX-%e<ST)9`WFT)
zcGe0DR(9hN-36g7zUcFFQXd&FYEAOZ5Ott93a=l2w9b*>1B3?%MG?|&z^2c8-=#Lr
z46AH<s86S=R*1tg^(XtYXNTdxmV5VERef@M{#MozZX%TPrG0~ggA~Q7?l@>YFj*Cf
z<DqN#afH%giDs8-r#RgIC5upDA*SJrC;6$zKb#?BP(pMK$ER|~i#ka|OG>Z8ny@IZ
z`?jU@NL47sFp;9;Cwm5u1y>N>|0c=#LO|3m!w<65?T!FgZtgDX1mwO`NlbMQ=l<_1
zd)n**gkxQ%A51DjWoPAldDiSOdU4qY7$?>f>DsY~;(uZ~<Y|Z7O%c(iEN`G-dixV8
zdN+!Og`20jZvHP5f*eHqC(6cU`0TPZ$^97m!@46>tT(6r^D8UP;_$gL>*H6!g?18Y
zOh7ANI;f|L$vzwZm)GouL~AB0atgXB<~M_r`<KzHNW$xzO5aH_L!a(E1@HW+ysfe)
zB&Za}^RHp=z~|o;lxKlFMlYDmuso@lK=DuR)ofpf*y{9!4cUctVuQ~@qo78ll9hjO
z61oAG%Kf^sXT~9#dtI(H!*2|gCIk(NunAz?r_L(RaAPEAs}z@n;#2VA1*O(uWve^H
zoiZc2TM8$^-|crh8+;xO+@JCo$-g??xw?)d!*1u-qeBvniDEzUXRAWNvIZL~_qomk
zxW_vPZKzc<{VU6ojjxJ#Pn3_#l+W~Z?;ng;3Q9dxYSm>_AyizQpVqCkPqrR-H;2wN
z$|?2k-z5Nd&%MG{s<#OCx^L<AZaYI9eN*Z6_A%*K*`*DwpX^M<hyPv)XBDkY@mz9S
z+PY}&wQgWrXMTuu;|ym(YHjndPBpU6cW2K%tU0SfwqoehWv3u<m<o`%TFFfkFV|Vh
z%G9&?ai3Ln?5RYGM|Q5QlmMT#Go&cBVKVA9YGFtbD)Ez;DVA*lgX!U|749OGEJU6)
z4P-7mXv~*w$UZeI3BgzRHn!!{tGI&aJbalS8C4z&fr!uVYCT|rtNi<d7TIM<Imfg&
zFKNxaCpwapiHaDZ@nG2XPm4YPS?iWMd~!=Zez<8hEIJgBsgqOO+rPeR8?0G+1dL*l
zA9XoD(nJ$qL9YsDmNv*dCn`RAA)nS9t@_bA^^wV<8?0D397j_`Zz$d~{qL#f4N;pl
zyNXn`n(^i86!+-9FE;95>6&0Y(3|9OqolVFtcT>E_tl>ls!rrtNX)TpOB=^ByECmP
zcL@$~uaez${t>VlFxgo7cdAw^D(7U*$y9NI)|z`om+>@PY5YW4gN%XV>+9`oEwz&4
zW>~)eBMkhK^xy53Iq@DTeeO~Vk%wUYz_w#(nsj4!z6W`Qo<;5IGZd{rA#S2f@5^nD
zw*F}Sf#)aflv)VKk<Yl&Y$@t9?09@hF=}|()<Kb-gLql=m$dwyS7vP->yZ|3IwZl`
zVB$18VqLZg90pGOQ8Xsqn8G)s8csROMCZdPhQ0k;uzdf2Y;t0I<?11czeAiiOpi>9
zx0sK0Pa~n=VI8q>FQga-inqYPJDKH~NU!)B)+T$y&#?x@IV#o`T4(2~GYvdiHQ$lV
zTDa!Ztad>~lz<k6%-KA33lj(1$zQEj+2pDTWRt~D6!6KcNAA4O1~>Ag0U{g^CdeVK
z1i080%S}TD19H<M^O9QC-?f@%v>J_(oaRaHX(E$k_IH)-q*GwKbxN|a+?xO6M*qs5
zL@WQxz~;EexV~juwVWZi*{V^^)b3`&Q!Fx=M(<jUx|y2r4JAzwUPZ?Afo!A3H!Z?c
zxBx=F-j|#5uUyz~J>YSUR8pKizoA1he6=IaBP~|Fg=G#V_%s`QW%KENcw@(8){3oK
z)_>~r@VV+zt3~Bu(LXlU^q=jOC{ip}pB~ByOLgm80r6aqR*Nwpc%0LGy!U(@(A+~Y
z+114@9tc(n7hBH-4M*_`bJhac=pQFuiP~p9ppKh+xRaT`e^9IyAaw44F+;JY9dV{<
zao+P{lWA_dpdg8f%4k*hU~aAK#c}(dBfdiMJE?WRmzrZh-L3NP!{<pQ8fS1*#~?<_
zS!R{Y*O~5%o@S>^^S!27@JqXZZYC&SFF1wnh}GPN**@BvYoJLrMu}-%C>qZ8OMW`b
z*$#(OVrLWV5U117B!GFVg=T`nL&#71bwM6nV%<zVI0z4>rbnx>RdWCB5+$`@Eil^b
zhJ+zq>fXTWg`cl)#gij9SoyaY0^N?MZiGWk=DH$}L3J}N#=wdIUX8O&gITzO(p&Hi
z%;pxi_Dw7=7!JShk~>#9K)ic#xi|anKW??k9VrNR!#*LzGbCCL?}boMWHQYOnC7G)
z<SX+O(6R)1S%Rl!mtlXi4|LDq0Eg|Rh>A`Z=@3f(c}-TLxZ5F8Rf>Cj{mwF#QiSOs
z%3%7AX_`S^-@=Wa=DP|?E&ys%;RDR}hxc_I#n^I*wVP;Lrn1V}(dAdg{u31*GE6}H
zmqBN1i}OEPn?fMnAsi0J56J)+Kq_FoRR!qAmqsnxrTIs@bM<%NX=kOnI>HdDDvS)K
z1;z{iI>$#Z>U;MG;fpqXc|31!mst;#93RZc*g8=ff#ZGMj{%KI$Cq!#pUk701d5cG
zmgRuRc5Muh948d@@;veMe;$URmH*3!k$Hh4moCGt_nsKa*6D~<droe}mjvPIr|}i&
z`B<ky$1=SxQ*Um(+;!;7i2T5QS1|2nOfvOyP?LQr_rAZ}b&`(H)5DkN;ZLeim27b|
z+~w$n-I*)jWs#>S%NNA&sLS}RUkbSO*$3Of0=m^@oMV)8YB=_*=l4MUI`fpHxp6)D
zQ!+xiWO;zd!SO_rhg4(YWK?jfaf5Vi_Ni{!#(!=F@(tFhsn8QQF87=$%56%#S;ajb
z$qDNznW8MC$*|=lrTCq=x%n2>oS<TTaH8Q=VcbM<9fVQ7RM&@nfu7^zVClt(ZVKWg
z=fZKVOSeQsEJq2;yGhmHlXa%ZN;e;Nn{}Cw#dR;F>I91UU1q}~;^(-O;%P{1-a7S#
zNv3fQ;8&WM-t9Bp<;+^OHRP&>W32fUS=o=WLR|_jETv|SmCQaSsCe<P+ZW4K1TG~1
z$a)}QaqCo=z|vO-wQjtT)PvmrKEE6dL3g{$RiqM}A&z!DnFX_ibK6r(G%jP}(R`_L
zx%fDi(}*vCBYcH<C;WffyZWD|t}sjsh<8FqOKAZs&WbptmX<In(wH~|M^qL<)G|JD
z>Gfku)!r~C9q0-=L3^dKX3(WovMfTJ5vW8{v1n;aiGpQD1yQN}Ah0-PbSgS!y7%Im
zls{m<*`#TIIO%=Q^FH@^&w1Xq2M*&cQmt@~q%`<aC(HwQ&;T~$xcO&Z24ZF!?uDKT
zyXl)3ARa=y#2ynxKzj@Jmc+6Kfm+e;=JHWW{zGM9d&J_h2QlRUuik=-)jNE^)Fu5`
z4brSNrjqcgHadq>O6-ds{;<%6^p^%Mi4w{nYo=TLs^~}doA<^Z3ws!F$1=u*Dp-<G
zp?#+4$5`bOGnMZVj|tSkWn>E0F}ha~We>RZ-nk{_H5_|VMRbdt-eMTF3T>YmSs7hd
z8s%XV-I)~>cECzmv-M_Nj%Fyr7d@SR_2>b9(=wO~(x*jZG3c8K8w|t}!azX(EPkHE
z%pH@{*#cE)zm)Y%Yvql#D;51xS|5aF-~6zqtyEck5vze}rvhtzl1uXh(L9^<)(d@D
zQftpanQt&rbd-&=4=UH;Gp?PV;e)0V38hN-qpY{g?+JC~UNUdl`E5GsE>Z+a<DW?^
z;_cwIKoD?Q&UPWJlB^^e={#vXC}hlfi6sR9f~SQ{#gnJIdzQk_sj=U0K<+{8EJCsR
zPz4f(hqSrF9d4?f-&Smle<OIFolp2uCahoL3rozQfr@c?Igx<qe2QuM+wi966U|zb
z5RzB0Ytfo*yi&?~iH!?u%W<F;q@n|&BAc2sxb%n{V5dsVbOO(7VGehWosG^<YIY7s
zR?3sE9{%Uv=naXD<8U+U-3sxcOi|5ZW1TQji+cWwL(`^8GmbdFribCldwNGi^?{j6
zxV#I3x>o(CXQ4+|k_N#@>|7S)08l8`TC<AGVv>S9lvQr5186Aa5*q`?Fd&H#Gm*u^
zV*B`QlvXQya;FUc`=&Rf#0EZcvMZ+E%XE0etm1-Tnf1l12wBf>#}J1rZyKy+1t)NS
zp*aW4JT6mGro7m_qm6P}i%^~3kHPhOfDUzl0Bsy66UG@MyRKNgO552f>y3CNYW2D2
zd$|rT)!~YUY>4WDE0B)C)0A&r*;OA^3e3FI-6xH~`#rOCujpd7Mz%Fr)*Ui{B2k>)
z0+`%0;34#JNm>Fu4{zfY!W)3^@#B39R#$iNyGXPf<cwN8vKEi2om}qlP#xH<`>AF)
zOtHzflJJGRjeF_MG0mzuTP{M)8D{F_&>$KzDu)EMNTOCskm^BZ5MI9<x%0Yx0er>T
z@aW8bdWWbsUsV5#s15`>*`3-T=njc08w#oflhT&Qv3)#wKwMiu1g3BF*OeOBpGfIT
z<qV96E`N8a7>;f0e!)KlZqFJM!Jed+*b%)Yy~td1t}pV6AvoE+Y?}Jg6FN&8u6GKc
zp;c(nm`-*Xk+jmryFa0{4w1S;bc79BX#oX}-B3I-M`A9oKwf(D-aDLrZtvR$rox^n
zPj-=dqw|_V-@S-qR*4Qb;^8}R`nXVa_S_@pIy|GfBD5ti_N^me_nJ<wAS-#XQ@5nZ
z9IChEnd->O<C@Dy5p09NusU4Ooujui*UwhwPAEBwjLhl8tIGN9Jr8tfY>SUk?-I~l
zp8)N0y;Rouz1RkWUkql{_K*8tXhxsPfT+<`%*-|&8qb!qcF5yup-AD8VK^gyes5s^
zHfJSqBH?;rtTb%(Asv1yZPoEcJaWLDZmQcNpToxK^ZaJwdo3S4J2Tq7s%p-Vo15!l
zf@apcB5AHHy<I%3(rF^30NCbBp0A!*sRxfQoeZbBKFxKfI;183vOq#h8ihH|8$nTe
z^KH^i*~zh#N&GF*_X96fM>OA_wWxp@-;D{h4B(Rr&ip(Jh#bwPxDP`<;PM~YK9GUD
fJN~zu<n_CtH|@Jonfk}^Ab8|t<*sf09Ig2mQ%B4;

literal 0
HcmV?d00001


From a35e24bc0e146bc4792efc8a807ec0de9b2dc2a2 Mon Sep 17 00:00:00 2001
From: Milo Schwartz <mschwartz10612@gmail.com>
Date: Thu, 13 Feb 2025 13:37:02 -0500
Subject: [PATCH 35/35] fix table filters and update readme

---
 README.md                                     |  25 +++++++++++-------
 public/logo/word_mark.png                     | Bin 64948 -> 63034 bytes
 .../settings/access/roles/RolesDataTable.tsx  |  20 +++++++-------
 .../settings/access/users/UsersDataTable.tsx  |  20 +++++++-------
 .../settings/resources/ResourcesDataTable.tsx |  20 +++++++-------
 .../share-links/ShareLinksDataTable.tsx       |   6 +++--
 .../[orgId]/settings/sites/SitesDataTable.tsx |  22 ++++++++-------
 7 files changed, 65 insertions(+), 48 deletions(-)

diff --git a/README.md b/README.md
index 81dcfb9f..61e1a689 100644
--- a/README.md
+++ b/README.md
@@ -22,8 +22,13 @@
 </div>
 
 <h3 align="center">Tunneled Mesh Reverse Proxy Server with Access Control</h3>
+<div align="center">
 
-Pangolin is a self-hosted tunneled reverse proxy management server with identity and access control, designed to securely expose private resources on distributed networks. With Pangolin, you retain full control over your infrastructure while providing a user-friendly and feature-rich solution for managing proxies, authentication, and access, while simplifying complex network setups.
+_Your own self-hosted zero trust tunnel._
+
+</div>
+
+Pangolin is a self-hosted tunneled reverse proxy server with identity and access control, designed to securely expose private resources on distributed networks. Acting as a central hub, it connects isolated networks — even those behind restrictive firewalls — through encrypted tunnels, enabling easy access to remote services without opening ports.
 
 <img src="public/screenshots/sites.png" alt="Preview"/>
 
@@ -38,12 +43,13 @@ _Sites page of Pangolin dashboard (dark mode) showing multiple tunnels connected
 -   Built-in support for any WireGuard client.
 -   Automated **SSL certificates** (https) via [LetsEncrypt](https://letsencrypt.org/).
 -   Support for HTTP/HTTPS and **raw TCP/UDP services**.
+-   Load balancing.
 
 ### Identity & Access Management
 
 -   Centralized authentication system using platform SSO. **Users will only have to manage one login.**
--   **Rules based access control for resources.**
--   Totp with backup codes for two-factor authentication.
+-   **Define access control rules for IPs, IP ranges, and URL paths per resource.**
+-   TOTP with backup codes for two-factor authentication.
 -   Create organizations, each with multiple sites, users, and roles.
 -   **Role-based access control** to manage resource access permissions.
 -   Additional authentication options include:
@@ -61,9 +67,9 @@ _Sites page of Pangolin dashboard (dark mode) showing multiple tunnels connected
 
 ### Easy Deployment
 
+-   Run on any cloud provider or on-premises.
 -   Docker Compose based setup for simplified deployment.
 -   Future-proof installation script for streamlined setup and feature additions.
--   Run on any VPS.
 -   Use your preferred WireGuard client to connect, or use Newt, our custom user space client for the best experience.
 
 ### Modular Design
@@ -126,17 +132,18 @@ _Sites page of Pangolin dashboard (dark mode) showing multiple tunnels connected
 
 ## Similar Projects and Inspirations
 
-Pangolin was inspired by several existing projects and concepts:
-
--   **Cloudflare Tunnels**:  
+**Cloudflare Tunnels**:  
     A similar approach to proxying private resources securely, but Pangolin is a self-hosted alternative, giving you full control over your infrastructure.
 
--   **Authentik and Authelia**:  
+**Authentik and Authelia**:  
     These projects inspired Pangolin’s centralized authentication system for proxies, enabling robust user and role management.
 
 ## Project Development / Roadmap
 
-Pangolin is under active development, and we are continuously adding new features and improvements. View the [project board](https://github.com/orgs/fosrl/projects/1) for more detailed info.
+> [!NOTE]
+> Pangolin is under heavy development. The roadmap is subject to change as we fix bugs, add new features, and make improvements.
+
+View the [project board](https://github.com/orgs/fosrl/projects/1) for more detailed info.
 
 ## Licensing
 
diff --git a/public/logo/word_mark.png b/public/logo/word_mark.png
index 14da644ba8acb0ee4e52926e2ecf32953f3d8a36..d75a047c1649680eae1802f1fea640d658177955 100644
GIT binary patch
literal 63034
zcmeFYdpy*6|2G~&a%vJr2JM(w84Tkv&fAr=6t<IyFvcM{%^-~kIgXsRNm0mN+hy%8
zWrkw5l*5dfM7gRfrX}W}Y@2GP<5be`HPWuG!~Oj}?%#die|>ki$7bg9dA(o9=j-%V
z@{Ru{&E>0?FIlog)8}iiZA+FcM=x2TShh?BK1m?jN#TEL<gbHMmn^Y1mH$zoHhQKn
zS)y(iw<9Pm$Zv}aDLK)a7?m6uZB0!i!_!NaxOq~^L{fZo+M3Ad*tjHj^wUe-=rwUs
z?&w_(emFn!hUmR<Umr|~-hR-32kBru$vFz`>9NL*>H-83qtl3MsEG+lsV-D^^gLY`
z_`CdL8}yp_N7CZm(d*?0t_kw{X3d7=l;|~%);KE?4(GVW$=N!J7)c~WMq=04;p}W}
zaP~H~_EtEY3*Onq-hR!(KWI2EB`U^co0s>(VepeXdT&}9*~P}@z<~qS2k_R(DX})T
z&d$y@I6E6VJ1cm?Dm5c1jYzdhN;UmN!7DnIloCfyi%U*gBd17=Ox~a7js{jg%8*F@
zgKSdjf}TKQHdG?n#?~4qmuddNDAFI#k@u%0%pV>_vWZTJPK-`UOND1`|9F<XH#sdi
zb#L;2ApOVJpB(_Y_4E7VjDO2ZV&Wf1q^5052Qd~D@^7C`-H}0#w%Hb)n!G=S6umJW
z*fjklO={Y<=s)%O-*_D!|KsJfxS0R&uKb(Ngo>ud{f9^8-~90?*=0jYG%+nXWk+&y
z!YAkX=93oJ*x6azuldrCNQz66>(xRo#lkDmUc|I$cQm+?gB8xs%GPd&ot+EL&cy+5
zg>!Jh;XXd<mmC!rlkrcF;&<5EyWpK%>~Nnw3XU8_Oe6l64@Z$)Vv<u5iC~4eL}F~T
z4LK<mz2*<wx@<^JNKS!+fjj)-&wVy*_$DPeCN2TKNZq#SFKc`@Zg8}9c679|v$maQ
z*U!(zCn+_Jm_&;9@p4Cltk!XHQ7%L~2LdjJXlE7e=s>ixw{vu`B04!bS=l<pM8)7q
zQO<VG(VyP;N+#`>`=$K-k1-mROadBzvge3%j&dT}M_SoB;~lLW9PLR~&Nz~-m2+fN
zG|s^eA59{WK2Zxui36A*CM>2Z=PC*)MiYs4_R-D`R?*Rpcq@B+w6hh#!NJ)onq*7F
zJ4Z)3*pYxMxnsBh8DNPh4@Gx0h&umaklaBN_J8~kkDLF;##a8ng$IKFs|Wu4erHk~
zSi=szM($i64X_=64ipWi&42by95p&2$SV$XlRD3aorAOe;_reNedp+4Cr6P#b+#j#
znzn_Q5uK8{08f7*#xDFVA#RcB=b!N>Cc?qr5R+n)6XKE<d%*nHa$1YNwgEaea(wzo
z(&j%LIu8;qU&p0FtYj=4y*--pClm9y;6fyQ)F(+ERnbxCH6K5Y`!`<o-?QJx_Ydri
z2Fv{~V(sH&smU>E2Z$-r>tn&(|BYyt%Ptokboe>@sl@dEHS+`~QWOF2K(Hd(g6rBl
zMA};s?eGMvXgd<YK9b~Y>)`D4N%()qydB=f!Rb@<|L-xsz%pqs7&;m<s15pmUmROo
zoD<HO<ZKlag^Ph$B1Kve@sR|pD2EsvDaw)LOt6dj590hQnEhWDhm@R@9-Xqty~xBA
z@cA?d4|jA-N^;^FBAJ{JN16|KoAjiph3xu=Yp+R5Uh^k({ztV%MW@6q@`J^v{K3MS
z|AXiKmtObZ1LBYR|0l2eziXy>0Qm?9HvfziAAk1xs7r6Tb>?dTmw$%||6M<XqQC|6
z%72k*oSp0lj<$F^E0VJV2~w85tyLsG3ep(S$sro=?BEy~GasaKYRUh9GtD13x~T5^
z1g%g^%K!RD84ExBQ3yvTLF}eLnfrCwb>xyIzn}B*TEBy;Fe6lDOcxXR2eRiryq=sm
zzzjOyuUI;f`P7TJ{jWY--ww1zH5{tQ!jJS@97tcuyYH4d{mWpS*)gBGsi~C>ytfTe
z&HNpWaa(8n5+cldRlYwEarp7m`YNN^r6q3}_aA3Y4#(O%Ihp&=F^m3-^5A~<GsfpZ
z9Cp$7@NCrS|9J#-^gnu$JIen!!+iAok2Cx~b_TO&rmx;toBPsD?4CuY>Qx)G^p+6x
zt3~UE1lwgRJSv;kI-kRScxrt7PjDMJYJU`y;ZVy|yu?&j#TpMX4Gfu@u4H5Do<@H8
z(@0(K&ydf=4xV-%WGYohti5u?MwBZa(+G@kPZzk=mDCfALYQhHlJ7RW66XGSf)9PF
zcniiSn~#hq8z-@k^NZih?7VAIXOTpeW~Npx+0LK+hM*lQ&`6L(n$Gklp}t-G^6a-I
zm;vpOQcJ0rWoRzABwNO<@U)~X_vgJKn7A@DLl_G2%v+VG`q$6!S{A=Jf9hQReS-Qf
zk=}SoyHT5Zvn@$j8)51wSXx(-$}pOaF!%3SK17XHWooP9EEfa%n=f>H=xTvN#V+Lo
z0#u!-{{-=5VRV7PP(<EKf^MvEOI>L@*={6KDKPV~R-~s^MBrjIJ=<VLkBSQ^xlMLV
z>aV5Po_Ke~xr~9bv_cIsRB9QBTBcGg$@~V_fM39TbFzOus;BOsIUl%{ZZ=U6LUHaO
z{bF(f70*~b$QWi`P&5~5gwmcfj9eMI@eDmnTf3Z8ex*{)B8&Ra<tht4=*=&BPBu*9
z-RDo;w_@*ZVW-Tbrdjd4TX<^xipK<{X)!jT-=%mI^p?F?^nuMaU(*{&1-kshhGg?|
z+_<1e$FE0NIYua_JEwRfNh&%mJgvG?JXx!Qq&`A29U;z0Txo~+Hj9a5sOk8$r6u(I
z!cyoI#w7G!wKOE=IRsVSN0LT_PTbWAJt_%o1A=O-c*{(WSs5<n>eZvRrH2S>{)LEr
zLXRfZ@*FRY|N8|)lI{pm*;}jIAfZ2)wIr5k?$3*9VY{^Ke=#IlqvgBU24Q_(bZpWi
zvWIp5J(fXJ#MH}^y}J{7e9I_*H*8llWFSK1KIBZ$ZW4R7?4KC|BmV3A9;RCut4BqT
zSqjs{{5K~ftVT%6+^_}&x26~Qh@s?4alFCvPw3Ta;VtJ)fFjo~W`ACh{jtj6sVwya
zqJ%9&lSoU3%AoDDw=I3%37nX^!>JUr8-4x>eMnLnRzsCxlDb#|dNuASrgU&!=wVli
zl69{m_BnS8L(h<*Xxe&xUtMlJ!6cTX>d)3|VIOSiz&+-94E>7$UACrWw%qkYE{=f$
zOz4qIWLN7RyJ8+Po@qRYdv$9B%nGqkR!>l!7HQNK=;~c@cB`Bwf3=v6XDh*(v$;Vf
z`-95!sjG*HH*Vtdj}vq{#eOW5Iq@VrwqR#adGwWJ71N;z_Zyt_y3$ngYX9Dtmfn3^
zP$n@<)pxl3eB{aQqi5o$elvJ;#d#=F?=wO5eksA6Y*0%VY^$U3Bynz!emmLg!&)&a
z)C#S5SwoSX?b)}5-1CJw$-P5_tt;Km(20%IF$0|)74xuxLazj_M@!mO_!(t4eW%>E
z@9HCb@3PdeOSa&xTB%`omyyaYJEkI?qf~T;A_@*s6)Oc9iw#ve?nNIO-WOVUK&X+W
z5FqwIrKQysjY(ocOCAS_ugd+V-y-O6JjMD3H<*BEW~ek9O?ng5Mu|GFB9+Z*B2@5N
zC!hb$t%=~izMc`6iX@grBS}-=I@=^qeXC|x(~Eu3)n*%m%Rf3Aqea3(EOLyqR2zCy
zsbPy0J%DyPifNtP7g}<OqUso7^`w7Vii<HaFiqh8!cuuH@J>jXDyN{6`T|?n#|f%q
z%wH={v9C(w${w?Hc14)PFf{Nr5e0|`T^DW5kN`NX2`c!S-m71vhD|Ip-Ga+E7$V--
zT$_3oDgQJcUu=7Vs2L~@;THyf2DoiYw_pYywX0N%coa)VLX^5Sdzxt&;N0bn6i1Ec
zWs=p>BafY#UNv4`%TTOkXbpCqKPnzwR?A$iiktox!38xJIJYL1$r(XB!1XO7wGJaq
zKbi*j>TMY={i?!vWq@Eab#Z1HSP8z~dQT%=<VV%<e|hK;MJ<W@T2jT1cSsi;?9v?-
zE^Q&F4G{|*f(nDdrTHTJK07SCPT$b^qPJd$a~9$$yGe?SS-Z%tSOp!QXTLt?gh&GG
zD&_v^N>RO1kSxq7=IMnNj*-=^xn`RtmzkDX8JQNBP2C?7J(7*e{Ib+D7lSbt0aSkH
z@{62=Jc`AMcU$Ah9_M(wC^oN7cE2Pjj|!5;bL)|=Z@uXz`&Uf%W=dUUZHwPu8-w-<
zyNe7VD?Q;h28r*V?bns9KFxVg5WEa2FD0wOr+gYSN=RL0()Ui{w}^kt=D&N<yV_o|
zRwwf`gDQ_!ccSz~F<Cm=;@r_Bl_r7RcwPtvG2)|l;+_mUXXH^H`<e9Xf$wJ{Lf=`!
zM8Wnh$6AW!6SkAY4<-41M1&nLx<p3!_b(slYcp(MKNY^GE@@xni#{j5E5T&M#Z%U1
zqYgwAk51c%R<;T<+ywWncowWBPJ*P+!@BgsSnVrCle~B2?#~2H0D*tCU@0f}{e;Xo
zbb@4_)YmClrbUfw5@?Mdwqz*j4D`J~dK7AlYd<@ZRf2i5)s?J0QSqEHKAXV4AVXiN
z*wn?3sVfhmI9d1WVUJ<A1PI^DI%OKKzFzcdu*i%))!!l1nso-Y9wh7D;5f(>PjkbH
z>&j}$u1URjgRFvCuf(_E%@wB?R~IWmM~7<3Iul1MnTn}^QFmC&oCH2u+J+R%iK0i0
zJ#CD~y}P9EWXR86qkp*PMMt%1I0>34_z~Brsq)~WcCyZCb|=|l;z%jOzm0KS<SH}j
z($`)L$pbl1Yqj)jq^c*eOOUQ^-u&D_T<;lzc6CH!6fsj_vZtH(R5(cZa<LP9xamc2
zOtP}(1PGGqrmhmy;+fipjL<fTdx2+PcW*2sV38(#!lKXv+d35WMTu0`8<eS`i2NxT
zWksc+S*G`jSm3;v@S9359UE;f_8vciw>2GTILTH(ahBKRCI)@6_%R#1qftNong>A?
zdRUV_%g`Ykb%=u9%2cJ;(`-Cd&qnawXV%{f4B-2GSPGtp<C$COCJ?7}Mdd6#RSC+t
z-;@d=@>;UYxWAoWoL|$A{XAeJb$m{o(wz5q{+9!r4M;{K8B8VWa&2)Ybw#CUy&H`u
z#ikSW(}_+owu^i8sG}#pZmYtwe_<Ipi7`H5t!j=WO@D6EOm8Z6d8O!!EbU3|dnz&@
z(&@osX0d1;pNb2J2dE5EXh8#~mZ^iM5AietNf-3TD)l88<KBGgvPzMHTUo5c{xr9p
zYOK0A#86FUbnMbW#?Tk<C`(ec8t(HCcZ$s^3S2rWX^^2{NM3E-mo(F_LtUaR&d$=;
z7TCHKOjDM$*YvOdEL8^!%;>22R06`)=-CS6o+L=nO@j3C@>JZ3sjowdqJtiNdz);1
zx`z!)02;Zfl2xbK)^4TK4Asx`=#M2B-me<gePayNYf+_S|4`%&!*&BF@gCOl!L`n(
zyssoX1d5i{6}t0__fR#o1qyDoWU+!<36H7%IiVULbZZ$@pHKSC>I$1Ad%6VWcWEI~
z9hPzYTIUgNP~pz71g!w!R<}G=3GOrp)HEz`b}NpRqO=xArgITUW@(zx7tPXeW#~0a
zbjM4RBRfZv3y!lCo^t$x%m@DB*as!tPplP}n5x49gxs;*v$VBE#ID?Y0xkHTYlR91
zuy!qFrsq0KF&@>XFe->A<R%Ng8;#Yy!K-H(m=m!B(ulkZLHW+bLqzS<JtQhpTTFB-
zD3&Ze-T$0l7%RzJ>;k3<=mBOM1We2f=js>W2Av`Uw<7b)={j}Aono!JA|{4cdUS(#
zSb|j`(eeg24C*5Z(pYYb*WzrqyiLqqi{ftpVRv*YD5y{!3bvl*HXX*JA|JOS+Ct^l
zB!e5gF^QP91W!jjg|s;DWUjPW3BkC31K1U4mBm6x$(`&oB%S~y-ZZu>R+to;uNn5M
z-Z+#<7?1q?unA<7*uP6xKk_)H6zc2R-k5}*hx}4^erb~wXWa8%rgf!MRk}1?xFp85
zIQTP%%P0r4BwCUcl6p=C2^-6qMoxl9GHYXYU3G`@E}>&+?oK+^0gog(kGM=>W;kN%
zDs9mhZh6Jh6~?@Feqj@sc`>kMXaYUIL9$s=&mDf=$3*2vUDnXUu6Z6gMt0BEaEfTh
zY`(M1bkZsReo(#+#WAc$ooXB)fRI*|CXQE{OHk?JHNfa+5ak(x9=K`OXTj2SA~lc3
zC?)k+&+tsd8Izq_qoO9VYljcr#G!9r3pd8*m4-3f6aq~|aVyv)wLi^nr>b1~3>ya;
zPJNwnzJ=Y-(wWXU<j+n7EaL34EjFkty+l^^KMu8*N=yGwEMz7_wNktud{CUpGMQwP
zs9NncY}5nXXS_uX)O?*{U&b)nC5mi$`L@0+UaIR>*2GjgAPP)4hI#Ike;g|2ntmUG
zQh<Qsc4U)ejU4_^@-WGtW`r+tnqWK7o~F52WxU`qGV^_)&~7}xNxFahNT*m4YB586
z%GG70E%IW^2w1x$bu(rkkh;4Sypygm=G~?$sNxnwA$B)l+Id@R?j9DZ`TArD3t>85
z98Wd~{F-hWTedUk{wDXs#gZ?L``A>JwqUDUzCJ^Bn53Uh^85@M#S>n1(>Rq{iorRK
zWAgY<RGo8d@0Jr7-VK$OzBqpIWvW7e$kr{7CtY@>@SSAM>E6XHY|41;*D07p&Q6v}
zle1f3q~QY`H;9gM)!D*Wo(jrLkMMjY4jwPo7FoCzEjD@7R#5BTTA*)K-9<dkj`gNv
zv8H8NlS?g)+7yN(l^>9oEJmt<?{P<`zD9~yg;tI+_Rz6b?Nlvom=T~o@{5@vi*;-d
zI!-ce=~ZT}j*UEt2_Am{JtxYT9V=DHTKQUNF~jv(l=Y%+0voLBMAxLAok2D}dfi7i
z7;~MZ!C4v&Jg3jWa^QRX(JAt3qUkyIV*=!lD9TvnJ(;yfMWqNY(>mR&@EKWfK|*3r
zG)qlC;ulPC*8|C_Cp;&qxeWQF|I8wG2k0Od`J`Y+Xr(%HH}tW?;z1cHOCy{^;+rla
zh&9mh(W<_~TG1)`OG_1|^!6E+$!ifwW`E^y(_)lc8;c$g;_~ZR#?{1pOmOG}hM~4d
zM~3k@{7!;-wRzFWn{Rp1o%R(RBP*R_>-n@%p)WS(j7sCO6km&KKN~ZgIA4NE{>Rd4
zfmUc<G>BcpwjM986ug(Yo#wQE{$v+C$ywSYb_p$cNuQEA6(5o<_b3YxHp`Zuu3E(B
zGbJ<n(C9LAvDr9n``Q5!Q#-srQ$loGJerwWTekLOs{?CUa$kRtg^ymP?MQ^uNQA-S
zZo((~su%suuX&p(Ydd`D{iK4OEL0}Lz=S(0{S5p~a7Uv&90mKv3ygxyeDtbq{d*G$
zh*+^HC@?>Nkyd=>{^8Xo8;Z~ziS#_(>rp%mNfwf7JZ1p;5H)ZqQC8g%PwoN9=jm_r
zukcn&Z!}ABSR`g?zw4rq5_<2mRyP4t$-4e9xZuQOt#0U7`fToj4b~YDr79+IT^Z_@
zOw~zlol}gdHAj~qcW^_pZii4Yf!ob{|GAF;RuV-CuC%1!t$8S|Nau;-R>5~~PWA><
z)z9%_U={<t(@WNhCTRDMREjoJ7ia0<6f=7NeYf$VQrljnQ>4R4L|H4bbu<}&jsuec
z`5>pPi|;*NWW-wWv|m-S<P~x8v@00q1O246H~OOqYNX;8Za>6#j3j#I<*(%wGi#m}
zwi;tVat(|yaul4Ashs94#)-Dy{4k|#-<cj=g6iO*$z_IQ<-kbg6Jks1NONuPNtW(t
zBpwW#6Jy}d-CcL2UHVi?aVrZRS`-49(h;vVLPCEzOC{v;c?XsvKBzdSvQlKxnqYLU
z&xoLnr(-<#mT9sS%>_{jJRZfw_}C(s(>q%-CF@j)73<X%8`vbPOp}ZpiFzh|NvIcR
z0!66M;!=h;ed>7Kk(UIWSkWPwy)n#LK0E%JSIX?zk<DZaf64EGB8@VpJ}FB}n>bQh
zUlc;N@~6XemDIv63@Y~{7&Y|ll6)rrk6SRjP6vX?E~0A;^vh;YK}K4Qh$n@V$xaP@
zfpsWNmyT)eM_Q8g97UlsJx@j3`HM?X>}s6>X`*XVp9B9l7;qT`9llTlJ?M`c{CWFX
zsM`5bxPxfvNK*3eo0j^`99<-OMJBu(S73XCx1V4*I5b?sQfkH(zm6=3Cp$R$(z_6(
zy7HF<RTGYhC~Stict$wIayW`=2ozyLA#h^mVi?BNV%wHJ<fsS**3LM?<sZ4gFT2h!
z%A}ZlR^f|pfwBz5UZIuE6uMJVSt3g*mIz>D$E9P6*%~7vbV9$@Y-ZMqaQ0^~Pl-i4
z&tZ9YAuB|jWs?eSlh;8p>rbB|pAxJ};FJ*5O?qM_OVSr38Lu2H+paJzUI#@SJASGk
z9BES@j92Oj>SL1iSw@#WYay^y&_=Y1E40PjGR%N9!N9*~CsOQ{g>2xG7D2&4p3_lO
zxIfR2wfxaqAH95pKc}2u($3H{>1BUznjj!ZT5H{FMbI9^_~;$mA5?suf8;TsZsjK1
z#gK+2z>`Fk5Hie{RD9_D`*f0epl*01MY!cHMxlW`yQ3(R5#jRC{M&GJyX}Yw)xvh1
z>DeT4a9iB8VUa*km?m$w*VCgcf=ciVU01S-2Q5I5Nm%1tl>I6;C%x<?UB9;0ziD^@
z3Z8Wv77?w?Dv~psZa+-Q*i%GA60fJZ+*|8YVVatn`s}SAMt#ydH184lXUxDh7!XAo
z`Lp9>ORiK*<1C#W{dt`j&nTpdr$Bjzjpvs)$vY+}zM=aXuY9_t>Gr4TL@6(mTq_>S
zsqFs3#!iF1Iy66?;+P((+7YRH;@x&OPPW}9!p69_Q<4bjL>%w~FyliP1ClcQ$a?2`
z9tN%TY1>g>be5oGF4UG}xB+mVyAxDi9(IO^JPohy&(aO&=}Q_Prd`~$U^kR08yA{)
zK%B@z;lpa-VL!rTsS&bB*bWnc>krcowqgdr#e(_%oI5N%^9T%_V8ylzEx6CmtCxLw
zB~J<R8#L>bU-WB@iiGhplt)Q`NY2{xg%hTh859wX=9bT`zL6^PBRibqPMQ=!e$$=J
zfu{h1c!ecV!rh0}$(Gh!UmrR{W16IXgPq=`AKs7WTl(lVK^VS~859p`u_eJ-D_|A`
zRuF%puDQC1XgOy#w{FDs;0^W%^_&C9qMRc+gnECIDopU-&FF=3D(1qJ&>}xN=FJt`
z4kF%BfPrGAe^g$qL`e<BzM&-_R;99WS$a7%&z@pn>Qg{JTdm1vpmL0IR1HzC@zTw*
zW;SltQ>rcZ0w20^96GqhQ5YIZ(^>2D?3NipdyJuE9-$S^HTG$HQASoi*E7k%!yDFf
zniKeX{{x?}vD#LH{ZckbK37OuJExVMjV$W6ulM&{<I^VCf>9q{)+F!_tpIj2;!LsZ
zz|i~){Gv($Ugj9HcHq_p1<%rk{?kNcwtja-4p0sMG_=Xthb%If?UW_kcHrtuUTd=@
zIlRew|0d|m^~zw17F?`O#@~R^Kc+QF=Nu<M+$u0)tv1A+zyy~Z5bcsma2g+|$fA&9
zB65MzwkQxE(OueI$}CJQ_@L75q`~$Exk=dIATGaRkgPT0OP{(RU*=e5FZV1RqpUtb
z#P~dm9TD1yE2Vdc$hqf4q~ikewEazk%`h_QcdxKHAZD|1b!I+oYs%KD^Ol8>)vUQH
zLtoRUVD2|4@z-D}HxW<5YRgsiL$Vt|gY9WhBwV?`l-^|`@&<Pk<%;-rA@u`JqsfPk
zN+rRt4yNudEypkevt^9cO=9a=#W}kteU3i#>Ndp>s#&1q*Wf=fpQtnfm7aH$pT%Rr
zaw^a!ptb`QT%TU(k$4I^2E^dj=ekPtrRpqoSEd$}mencx**VCfO3-Wt5&5a8!Y*gy
z5_(NUJ4)HXvU(zN<ZC(#50n^s`oa`>LSx4pbckcR)SvcUASlSmq*`U`G#D2NAAbtL
z(IR4vV3bnPf8TfZ2xh<*e*%?hT2}!L2Cy%mYaI~jOYqRZlL|2dmcO8$f;vEf<LHmV
z3`l?fP~?jBXE(gv=tCz(Vx3=^5mY+`Sy1*49JS4V$wIysOiS@BJ;Sv=Vb{xLJvfbS
z4-K~ef-WiyfmU93H09lWA~M~Vj@nNeU^;LuSWESZ?HHemipMO&9K=(u6+ze17QAw;
zXQ2(~-~+OVcwr%Ds{e}9u#{LLgU18KCZI|=1w7X!^spsG5ftU@!VSuQPS&4un?qT1
zR{PL*wWD&>!$Ak;3j~6%&Z*qEU_Xx6U{}KXJLlim8ZQ`RZiCb`y3CTIH&NEW4iKf(
zt?_xbyRKpqUJln}lNWS|QNM=MFqDP|@1E<$X@Hi`#9*D%9U&i7-p2T(%wTzDp`{0e
zHo|+XRhE$Y;qRponV$*{^??rthFGg=F%RTD#hl^?m84QM=Yxeefz%i7ky*;(LJJdN
z{nvHsx=bHl1&N`Cm_Oe6hazIo;qIikw}!y%^`Ml51dc9iDQLTm(ZW-vs%I}hK)i$*
zh<}+h?yAB5!|t0si_V_-!3m_eh#A;wdjfT6kb+3+e*?8Uy)e2A2Ch$g!Z{7F(ol%U
znfg5Q_3wXIM3jxOab=%Q*2^Bb^$M`)3|Rf3cTg#;HP3O>Ab_KYyG!sC)j7LtHP8Hb
z^2!rF^e(#XoI*Ch<MmID=fK9bu*a+tpPs-tujA6s#Fmw_R#gj^0{J${5D}XD{-yfD
zCaFGI^+q3<ZB%3><KQ&(7X}<D=eyJ_trAB;fIQ3q!s!IcorLA>hH3{4fOS)aj$E?J
zn61MvJWkLYW5TuoC}6V^kVPg7b>`GwR`A?VIcRO%E9J!y(bJfxZ`=2fpwP_JfXv|R
z7DHK~O8)y7rZDSjC*&&eix0sVhpLdtG`z&reupboqOMfM^=fEELcw#Vg`Et3x%u|P
z7dZ<OPJMlGBhZ&Q!3qD6pCB@TEtYUQzoMRh_!tG<5dkse6r(pR7^5yx#c{E(B23c7
z$}=z?<r>fQhRyVc&G3?jh<Uaj8@CL1uFRyENKnd2b*aCx5I-qFnrvLY<^ADMQ=b%$
zA7;}qDqUDB(>eij*4{$avRH9eUBUgJifH6!K)93aRGG#cGJsg-+?9KeUw)5YtORRn
z0xiF0|5en3tVtBe++K4GlW}>@h7VOhj$OU~r&&34$UM6@cvmPqSS3@xorHFRX_CoM
z4-gTvbj@J{Sp1lv<O*#urgc~&kZ5w{@H>VH3DuK56saX2E<8Zlnfs*t?R|6$<mzci
zW1l*Et?K$`CJ81*MEPNWV758{0i~CzODZFsJqovzt*yDo3Hq?fg5Z&_d}w&G%awc{
zq?S_++@B#E?Q^Mr^2w-VzQu=L4S${!uvr6{hhGWnI*;<#qHuA8V3(v;hI_(;gS##s
zXQ7_<)Dwc~QD3~J%r+B|0J|R}3gviBd$)~GidXqs^-&#};zWK<-UsFGBd>*nR8%H;
zMY}vZHi?qDbVi9vfH3OUE5!}kY)EGF1g6S&TYB!z2d8v6icNU;QAYxWEX1_Xt*%&}
zuAg-Xyxl4`Nwz|${WdK2nO*Q0=*D-ySr1ZH{K%Y=Nfob@Xp2TA0a6=jF-u>YR0+2=
z{(&?X`ga*jM>b*x{_<k9m?*on@NySI=gs<NkXrt(UGW~6brii8G>98Sof31Z1~4t(
z;y6tdr82h2WzGZ~QC{$(2l17&-%T%^>rkvJRha!Cv5^>OX;ntF0%9eoOpB~odbObP
zpL4)1tQO83;u*hL4{N#kGaZV9XZrJHSWs8l2i@-cWD#s2v<!&Q`QBq`0U+spA1x~f
zl>b!N9(1?z{4K+WZn_T}>~@-0Epe5_!oQkXsLF^2j1Ls~<7Ew;J3&@HZ7b??Cjs(5
zU8iW}={(Da>oU&Yn?VE>9Nq8$H_boQpGwsl77(*^Mg=K#<qqKS*l5$bBV*E~r+aoW
zLg-O{{bl8cWjPBn(?@@=eP%M#zd;_JL3TN$mcD~6ynR?UzfXeoD4yhYb27;`r~9EE
zV;DJ!%<77c%2lopDlh${^1#We4}y@}57PhvXsb6rNVYuJA0Uhc#Ns&)5ngFUniz9<
zl1ET(s$9uEM8|BtXBS%5DfCW&y649^9+Uyq3qG^cujzI%WAogQ6KIoF5|!;JT-~L-
zD>5%xuo<SEeM(g0Os0M&<?l?U`fE|9Oyvn%%vxp0{0kknK)H{kFx+`3tpf(zRk~d?
z*cX7OPusuN2WMCz9_!}ep>=YpzQA}qACKc&5L5%?8<<J~(Jfb1`sJ(0kuOp!&NYFv
zC{FgBW$8^vXmWw&n=tfgVyc_4jiJBBVyeYYMac_Q)w6vb1()uhnMcrPZxj3Xvvgx4
zPHyn;QzOt0QS~atV=}ud1@9zFVCRS8w48}|x&kxKC8vATSxE4Q6F)<rSt<Bpy!gF5
zh$dGT3EcrdNuRV!*S@BZ6$+ZI{W`4SEX(MC&<*?i5Wa?TbzcI<f}j~IT<%uzRN#?i
z_*%Rkl?D)Q@=Ca!sxaC6n1yH}VSU>EF(l9!ui!~CWiBv9)uS8CLZ;pYO%EJ6?*?6U
z+CsGiX4>Usm-;JfKC0-ROKAB4!RnS5znk%oTqo#fN>^Pew-IaxS@N5hs+lNv8$qgk
ziq9kK+~_m&p*O~;=)=)Orz`SNbm0_w)@oL1!OOyKL96De!S3#}*?lp4Cw=P2ny<rZ
zqghLm`|ikZ&Jgp|0*R&_Li^B)rvgja$}6SsBxM_5^Yu=O^eCE^xOd5~GXThJ9)P+W
zR_W=&xFH|C&P@`=5D)o?sSs~_^o+0@x}3L7SFArCIxzTV=j`{5aVFV-`Sa&(r|7`_
zgyivkb%(c8)Xs6HC2O-#;eFewy*Hm@J@R={6qjXeh=DENOO~RxVEwGxD__0N4;e1?
zbM6^zC@}JmF?G$wTi`MoYlZ6+Iq2{Q<K$0>dp~PQI9K_^>F|$DD@s>qz|xT9aIW8-
zwY1sDc#xsd%!FG#3f2(e4p|1_y!MJN=Nay(e4L-jGH_)A9Q{<&o8F}s04mJ8N1xgW
z7Mhl7X0bOz%v)J=9avhUV(iJvPAH;D;34h{)|;h0Oml(0Ag4Gd;o+NTdEtf5h&H6y
zKH=;PdUW;fk+ZNihT8*6Jqm2Zl$kz{O%n%T2g5nW($tUClq<DY<3?{SQ(sl842u}2
z2*@LSJc;eB_S`>k8e<gmC)_c{*05%IvG^Ji)~A_q*fmdHPI)`lsM`}-CrG^i*n+W1
zHn`EVhou#QG8!bK1EGuT)0b?_Qkd*hujo3&(#KOZUJLdmKwG%(gfMG{%Z3dm)aMB<
z^%IpjMLCWd?4_N8SV>aCiCrmLbL-|lO@urnUFwaYCGPHP4PG51%>mH+nM<$kG}tBf
zBN&o44Qn_GP+e+Db8gv+qoN%xl&QykvC<Gg(Uk#k`z`9HpyELaTo-eJ;R!;XU_rN@
zr~I38G|h!ZGWQ{H7FVdm7LJ=*3pf<c%e2z`uopP9^hw#_hp|a?IM-LtS`v>k9Au&l
z$>?-ZWR_xh&t>XAj$Tj?=Xs!dj<Jkg!F}=&j)HVpfJ)V1qP2++u3tIHg}R8LlVkKj
zZRD!9i&}R<&cYrYPTrWM^#~jGTHFma;O|^m8bP6MevZ9covjiI&_67!XBoLNRdhCu
z9FVBW_IH`Q7U#l{gJSoD15+6&E6)Iz*-#G6P4f?TSH|8~eIE<LEV#$KFv-H!;I0_y
zb8wqrcs>c6!L;?~9ESx+B-|Wyu<ogsInQE~`YdWFQSP)#VW-5y?Mt7wssx@9RsF`d
z7+z1B%OSAAoO@kiIM?G1-dv==FzL$(2BP7j90uY2<A-T)c`!}j1U-waCA&`)sN;IC
z_SyCAp5Z)}IcreyH`pngZYa1FycUNG56L<}2&SSw+*~n)K{zSOrQXA%-v5JoXqo4?
zp3lRz*l_D+K9;AB&&JC3ln!?HcvfMYW4QFEwY?csm@De3kJ-t~d;FYYwsEHzQ)Xn)
zPF-!%*D7|B>;zxNDnBASPgI03HqucWfXzqn$4X}4mK5iz3l;ZA;?ZF2e5%vjRgvV9
z%<^Lzt1;NDWgy-$o?FW_GUZinC+lQu<*2<DgtqiuJu21kC=2iJ?suYmC7)lFHcQh(
z%Qfj!NC^GzB6Vr2Rbme0(|PK<V5|_{Qz@)OP0p=&dfLC~9b~qjm{Z^GXRYoO*_RpR
z#E_Ri=@}N?gMmHD`I1DpOSQW=8FCCDjmkL9sOBh!2QG97LS$~$TmU~l?qWK!DE^c3
zH-bdUUCP~0WG~`nQqVuN0k%#jV1ffH*-D3sa6CcHNqA3YFrIhJmLj_zsqayk19c$O
zOY*Si%+ENnK6<(EswdpGNRE?tu=Bi!-2u-nZs?t4*NJ(aJ-B-R*TB{?Qt<EcTQj`t
zgqtFUR<*!fS}m~-t+-H8HZAp;HJiwXeK%$xvU6p%sGg<X1mmiC;&Gv+l_3YS4<d{9
zFQ}&LXE|<x!96DOHenMg#fcz`d=>}k0|p$M@4+>VPLW3GaC(=KXXODwN<vQ=`>Ar)
z%I*r!9{GMDc*aq9uuFL~LWfI_QmFB7(iUsYhHM_(J$wG6@-eM<(_G$f2rc-~TKI63
zB7`5@fp#o*^W9}lLI^Ggy{0<^?PT^PvXUdg?likv;*qsX8>Cbor072B-56x;qX+1E
z(eNp!`~3Modezp!g=kPr>fu>wycSsj=S={OkhIlr1)XSvE19F>Rb^Oz(}bRWna`}o
zlfIKkR|r6)2W^sDECB^=BilXc86zX$`r=_=T~(qkt3FXN2A$2u1^tXBLR7;o9wXUz
zB=H$&e&xXd9=E>s>b48YP5^v5gV=1?YX?TC`}aN-KO+1lIms5waDgsUT6GY;HRWWz
zC*0>$t?*+QbxxX#JIrxxBGyjCNeziTHlM1Oi{SpwvyR!B$f9QHs6;D)GUZk>+4sQ(
zK;7CWWxVF<w)3cIkz;6)?uiqLEM-ITl1%A}SA;HO9?!N{W&Fq;I;QmQ(paIfTka<5
zc}(yc7~l26;K^;GxE7oJ^v{!uz_tOx4{|O<>9b3ddUR`Qx(~^)9(k_???Hp06_|5w
zzK$FtuZ6wtP|)rehQcmFl;+&BhTiPr;p{BccMO9uvYMIvM3>N_OVTwSuu2?Iv<2UU
ztf-Zx7`uBs3C59+z(89T^ymbkW6XIc@sN+_?ywYNg^<C^`MJk~3a1(Rmn6t5g~?(=
z**JJRApJOKH&yW*?<~PkXY=i4kH~PV*7SiSV`jf>hJ8R1me6ZgR~!ut+|d{j2fCHQ
z)^!+s3b4@w20E_Ntu5!N<x-NYY2kEKx;#R&kS0*<-r}}Z4G9#x40e$&w{X_V)Mo9^
z^{SK^g@yM&6}*;Mp&&2L`1jXS)vf!M`?TePzJ^8B*zDv_75{vfuz3J3J3XST<35Xx
zAzM!zZs^nH|0emh*hZiYGx>EsZL8|?YALQa`j(pdw0#9M!h4fL#-E^yh>+_SV!NWI
z1gqOjS)0`NFz5@<y?J;^43=$|wItKXV_393sQ4_)a1dIRc39qCl3$1t!!+YfJj);i
z>t9RJ_4sp~zljrcBJV!I@PP1O%kgTv-e0J$6D5X>5#dXFkKD=rSZS9W3-m?>i7d5{
zwF8Qfdri1GM9QU4010qd!^EbWCa_<!6q<+_o7l43(ijbvUb9hHfZ#n<`$_>6I;Hnq
z#tS@);~8PFa{qubX{X*>7`=f&n}&k)E;+DP>>?F+>A}=46RuR|-`8q=C)p(X60XJt
zFYge>jF;X1c>J`aVRu&&Xyeb{kpdy~F5RZ6CiMhnoQ+{9y%xargh7-?rZhThX#*F=
zAf@+^O+r7aI?U#jAx~v1b|+GPEl~fYPN>dnu0}fatqv_8BRiTsJ6J|hFsl))dD8Du
z%-b$o1skq&?B%dLNl>=#T|d*8EZhp&sZjV-Y;NVhOZcgif-xDtJes+?bdYR%qc`Pb
zWi&xQxgRLTpp4sDCQo^=-h>-W*z{(K!9-atQyC1rMD8Sl*Fa_=py^QI*q-R$n|F-t
zey(SCS=5ynvci*IEB=wAY?9{{SPiJdCa7&y3s;w=UJdiZU_$m?QQDs_hC=8Bmj#Od
zGG3w1M46s!MFa{~cIgg_^JUf#x@=SVrIli@gr1jh5l@aV>ymh>R6U4K81cP#%`%z}
z3bp=JwSl`vVoR?tjTL)`7F|FN2pI~a!aXoWC1e@*ng}Z;R`ML3t~0}_l?K+8AH_Ix
z0XtB0C;MaX!C3iEfrw5g`X6A%b00A_YIW*RG?RG!K_yJK7?HKIfukc&We}8?D0ulW
zsp9en%~ZVx^@R)x<6DN|V5D8|8<w&@={PEhl)%<xDd|TvvPn)J#jk~7Gu7ZBC&cLS
z!|@DVC}TAM5LG2xONTT52$y-Y)ClZDOExo<O`TW5aQC$!z3w*&fmSR*WGMzj_(LVY
zr`1aRLk~lH!+)n)I{az43q!OSZX2?UVc;Y%t1EMMrpph@uO-vjB)!RgbE&gi38cKn
z2-hcl?yO~lYX_JwjZ24vKRewvsNyzR{T$b<3@+W3HcPZZOO9(*UY04&EemId!P}x8
z;}x0YB8+npsBo7ww?F#NI~J&PQm{s#Fe~(MVv2oYuOCa-73DG6zX|qJ;6XdE><pH=
zQ$#byxnm-ha(AJBg1{=i7gTW|p1d}R?LTz&ragCns`G^Vutv&#+*>VG%hH5e=ERZX
zEX8DABHzrXqFy^BbVQ5I_;dfR)yzaay}_-e;2p0rQxxQt*j*u%Pvw;Y7$`JGDJ5}S
z0brr{6K~gR*uKbQs|TeCYj3c35_Bx5f`ao)DVqMg<;mj;uyqp+^3CO?Df<FTEf%Kj
z;;@+uEV$LQ0Bv;kJ}j?UmtZ(5LbuRKaRrGiJ*P-l?nI5VTd|F(or+YIvke#e&r(&b
z*{gk0R)N9a%TD!2H~&Ec6{zDJmdJk0QZ~Q#7bvF0XQ`-4QE>A32API+zg+@5NM89>
zY__FbO%@qa*V9q%;k|41DnHG2A(Dgqrl{xjriFT;xlHUTLyE(d!!|;7!f)kw^IJu1
zep$JERrq%!4%};P*}z3+>`&D)AQ{}?yo3wb-1jhj+{D{uWevlo1wWW#oVqHFDL6(^
zxY4&e_-pT=%2KkfF^^5yJEsMs5PNGVSAgQT*M%8wN17Pw_@F}Oh6i0;&c$U+J<<@-
zwL^rMISy1`W33<EXW4781M7-zGc*mE2>7KRL#A4@ZJ)|y=grDr3zf7o6fQB;heg3N
zeI)AAO1Pm|^c0i?voY9p!k&St)FfP0cf^XI5W>_mWUd}$8k1}uJEJ&wLhiH#?g`$e
zuB?O$ShP)&dr&?F(7OtV$UtFKUBPxTOnmW<B%KkGLtsSy2FHl0#>agMUAdR3Dwm|I
zPWK(7uGAJI+zRANz}s@sM<dX@T0hpxPC;5()L(-SZzj7M!#%_shR?BA3T#BH6X=-W
ztKR&|r@~a3<13Oo7k=B}8BAHZzF2mWTS;))+JT$Tp?O#x{4KQbMX3~HYwlfs#chU>
zB`VBt=r&FxKsY9Iyi)!S8r5h><B%7yNZ2T`*Ro*mkWg2C8|7g*#Kvi83td^-;p|<|
zzr#%6$?>SIu#?7HbAEx}brERP9X_kot@(h6EP|^HS%#BbxJGp4$U;4ff%|=6J=LUs
zO+Hrr4r~;Y#U5FjsSlF1D#hwDw14kznE31ce4k&QDJ9PItuDKK5e$dpYQ&J2RKhQ;
zIUh7`W3^P1l8{9(f*ciY3#GN=C|UdhKUSYMETb&46kdx0Bow&>##K=RFbYu)%*bem
z;v?8cs}y#Cf`g&?kI0%G!7P970Bd4?!#oJZS9zuA_WYcT2dgtP){1IzN@&Gqa-JBL
z-+7y7f4m24S%U`1<jz?!pdDD#4Gn?|Fs=>O!fJEaSMR$Ll#O=~ERPNRj~70f`rw%<
zQ6L{!Z+zsP^Ypv64J+3i#uO}#8VFm5{+_U}dB6VeA*%a~?u_htWE?c+axVX(O#Gwz
zecctxM}JzTxbC}zDDCLhZ&$Q+OGj%nTP?rhR%cDm-gxK6*QpkVjmN&%5UYgdX7G(j
z$G7=D+;I$decb_Jc4O78`UmkRq}RN45s5P;<^m~S+jZ|bKgt@d7pj}lB6MAGJ2@%F
z<HxF74(RW-+i}_<B=sSV#!!#_7PkGCUgVYz6?ETIZ2z_)Ue*wA4@;?2;5be*#HTX1
zUHhPiI40SFDljJ{pWok|JyUT{YS)Y{rG<;O%r2XbeXzW-szL{WCog%$%cf$@_Whv7
zSA8eT|0|8P+>@<LaKg6+`dT!;sG<GF#tyMZ_=<R2B|J{^HcoRpPUYCy!!(KOX6CBr
zwkFRh`cHbSSei~E?oen;Rrz<}5B0V)++T46eVu9w>d8xz`jwIApQw;ct@|eUY9BR_
zIK(|;Yxvr-vFgeBuiCflaAeVHN@4{DRF#<D5_P0rZiuIx2(Q_dp1l?X8@%fAZQgsl
zw)BVbbzO;@W(v;UOlF_VRpSqt(rB&}-E%$1S<9-UAEY$C$ffa(hk1CZSJ@pyuDFDX
z_Q>r=P*nVTd`@PxZoBp)jb=ezr`5NfuVi((xqJ`PGE95`EwZjFY$qR#nfS44n{OPA
zR&(Ss!!o_Eg0B{GX0iycpu;%1X$9hdXq|j5iLf3Vy6<bS{=Ki$UXnU0mq*;(X!wGp
zb(+>JiN~IQQp7}!iua*%2S9siZ4deCnPThl=BjNMx5Rj?K=@{05KJ2_E}q%+jQo~i
z@(P-`9Iv`O6G7Eb=#N!xy&E}HH<f^%Y`*H)Z&`R-odBt-5`topU6d-lJ=C?`LKA_w
zgqCE@{4hI#aWfg_edASEm@K?>@|SNcqVtc??nyeSW?El$KO=W=N+sxS9mJ>z3hQ>e
z)L*s%L+W1t1^GvR4S%R|jG?2&v99?pt<;BV{|c^mDq5ax$Rz8Y>ou$S8C2ACD%VIt
z9nXDd3kth9ylu-j*BVM_?via?%TkZ;zhDtorcc`FRabUKnm-i!v;AMZW(wmjj-EZ4
zaoJiAafphYTOPpH!Fl6fkiut5o!-{dWDYla9un~QYKz8FFAk~;Y13<bjU6ZciMp<W
zMtdqMJ(+RB8k|+S_uiwoLtQ)L>S%j~OzIb5G^47QOw)8I#J&P0J{46BWq}^fl+Z5Y
z{0>}lz_*Tmg<$Ic@Gz`1=E2L0L0&I}Oqr#dW<U?}`rj)LF>NM(1M80xl$yjtL!m!Z
zUHE%z+C{w>lFdxfL*LGm1$!9UPkN2Oc~1ybLJLmvmnJq=ZFAXbSWApeD7KWWDS~J|
z5PVqe6tS!=3>}%;rP0bUzV@|Y>9qI_6^E|iRpXzd8pn((%pZk)DDV8u4q>a6lRquK
zTXXKfOx_;oUMgT8=H@>%ROtKgE5yypSn(aI*{|1rU0s^f<LSlONkC0r9g4olo)k1+
z91WqcZXpp&^{^xQq|<F*Z0Q99LqMAdLI`W|yS{8p*jp?fxHy(0wmS8Y>=yj`ZF1Mf
z>Jl17W(bbLO}k9epUHC~QM~F7iz$&Y);q45{<h2I-m00RL$(_p2961BSz6DToQsBi
zi7bswQfAq9aG33WeIqsb13`bQ+IDU4slT-xqfy-^3cA@r(WIKP4V1lJp@pWB>qDX6
zRXzI_{e5A+WF;!k;@Z4t9-$G`Hi<byp?|H~s)q;>G)N8(ZS%f%gRs)1f)*f7J^ALl
zZP(aGXmM17u#(Hi%j4X%dcR<KqF06w424^Oq8+~jE3fHVS{!l2PHmX?oQX#J_uVAe
zf~?UFZ;$(TYHD#vxQ!13@sglW_{}-a+h4S+#rtL|tmZ*BG2yTg!^*fP5=i;#(`b%b
zz1<?_wY|R@H1zV&qIg+U%mlFg!HW|^T^m+vbiCM3&xWH;3HL%3n&O|YYfOkjFfHda
zKjbp66}2gQ<aKW1<Or^UM^`;FM~lAd(kqUrv-{Pt|B>`9jkPSick9VFxe#R01^<!a
z?9uGT?H3qoulh&~-QB*Ozw<iyhWcXvmh(>n1%b1xJ0o4*0<#Zy=rG-1!EjSk1thUB
zT8Dls-PWZ)W?3Jl7*;vz&7sJsF=2nJGS)++N?WPAW)|_J)GmW$a3-m9-M1$<_}<M$
zi=<Si)6EH6YQ?vysa{=H`0l1EV||2JqD{rW+U9b{gRg2*PHPpVp3JD1b8WPd6FO@d
zR_Jr>S3WA4TWc!XlBH!H_2AoE&q3D?#;(MGgz^)&9-BqD&Kxl$*S>7m=<a<<UG>9X
z<@z<>N7760-^o%ho#)sL%@ylXwL1b`f=$8-^fz*}r4vJ4J1pEW=ooQ6RrhVx%a=Rc
zbVoOG%q8XW$V03`RPu<j_-OmYe6guWV|IJY1PG{us1=n{m14fU7pc>wmRv?VCS?w}
zZ36FTD?&#)deC<LH6S=Vpnp4Mk5`tWJXU;%f8XVD=K<BtxcH>6P8r*guU{>6d=#sk
zUE0jBbX?yJvey4t?#$Pn7H^Ytu3AEK46D#4SvHQ%TAkKKY!c@KP;Fa{MVrBI@Zq_Z
zrirSk677u~9@#6#de^msG@85AgxYb-XKs1*CXTDLa0nIX%ihSrc4@ZqFpVJ>B%QJ`
zn#{l>&m`snL#|o}bmYp3N+(j6-L3SVqq1+jvNSeDLAIJcf875cm5<45(z!v6YQORo
z-$m+gY0FlTgoNf9;^fJwX&+IsqyG%f4<x>6*D_l|qncUweu%J?9}_w2g7(lwY_GcY
z6@s$t9M{!0?C!TQqT4KMbeIm}y>IYl1aqfXmae||uCMv2f??r5X#BreXzC(Dyg5P^
zA{m&qIGt-E_?|{R4Q$>Y_TqfOTK$wmjoxsoBtU$TM)mW0Vd>s@Htm$-gNWprJip^+
z2BjH%-PD`O_cX-{p~ba~9l)5sljayPq--ZhYLDG9*Gc2!(b)yZn3ry?BEfIC=_880
zy*68Du0Y_?A}T81`5O1U!xb9TH_6A_RM3%s@yc2@D%9O;QUAn%g+-tKYn4g~&CgVH
zhNY0qr8fTbs_(U_NFN~`m6s!3v>F70Cq@o!b^PJ1bYtjBL{9UIvW{DEj=f1#jhOEm
z?XP1JN{yHnyGMo<$B$&%0&w}78|MGQH)y{JLf#{m$uZQ&D{Fao-|ea&epL+TIU}Td
z8`GGe+U#=uFVDp7s#}HdETcWHdbR>B`bFm8k*ntGba!QwH)oS+WZ5=IBW2~ZPJv37
z&atX6rip(!&156zw4A%Y{VNS_yk&ii<7t`_<EL9*B&OA?-VS8!dpBAL#q<eJ?j7~}
zP#yiJYl=Of8Z<InSH1#a)6*&qd|`1}umr?|GVYM?Lp0*1KH@{kG21;4R}J?aM@aul
zLpD`?FhzG9q3KW*JGNfjss5C67h${EV$YZ8uv|-NT*A*Uer^(qXtI4?LvT!^xtCYC
z*Q~ieH?48IoBA$q4iRDNAJ@`x%VKv;ZoM=pA>Y<_`}KYgzJg9m!+n-+H@6<SL!JR%
zlFVN9yh2u<0APwhFiT<#M)J{-%`^gnN2<6L&lQSgab7duRavh<w3E#y&ZK=$ku9;V
zpuInSS`TrSMm0Lums<4$-vm%#&iCO;1apH|-4QYK^0vJ~U6vVoLJvU#8^yKIY6|gE
z<3^owwkn0<HPdRpE#%=U9flHU%=flme>xwk&W7VG^-+O;%QwK-v2qA*<J&h|AtjI5
zUvK-SvV^vQY;gL_i;Lz05smuOHkTkTH#L2+k8jhM!L&DrhmNefm5PqEzQIB8z2Z)t
zB)Fo(nya+*5P&$76y>?y7CCV`Su3l(IqQMGz5l<y{bgd~_Mx6Dd{ul^7|tk!c=08^
z;0;UdK!m)ys!v*NT$oV<9_KQacD>E35{gZPR1=kdy{hdRCJT?g0yC<rTST<zxD3&;
z<Kjlcr#;FD2os14_+36#3qMDdP2QZNh?`ASS~>_-(aJ6p((z}KbZ!7zREn^bgMc@U
zwo9~$zwM!3VwaM>7w3sD2|(oUeONcGOOf<j>Shs^38itrZ5X^5Trep}$I5H?+vPmB
znIfydHvwa#Tdue5(5BJMMRr|VESg`h3tfR2vusq7J4Y7k1NeZ`uX4K0$GuBwerU8*
zbIZ<y{qdA-URwfvRcW*VgfzIWyuPX}JuKhSRP+YOr=6w!R!XZB=is~_dS?pqXw(b0
zmL*1?zra|V&OXgwY1OFzf)qb<IPveX_s(+ev6NpEgXU2~zY>sbJrFqe%c<z2Dy6hQ
zuUX6NybRwA>LuYUjoP-&d#l$Lj#TE<I9AT9MvH0@w(Ftv<E!cmH~QMVHLNp2;E&rK
zK}Y6<<~e=WShXK-I9W<--N;!5z<$y9U*3JV57_eSN#a8v)pE;{8)-RHk%1(=$Mz<&
zbT{MXp<+z&5-}5GwWyCj7xPQNhK(Eysx;ucaEtgDd>sPOy5riHG}=!Dqv4&WrWy%O
z=m!?%@M-@r^YX31SG_i9(M{jGSJB^lqP5u0e18j5@qIa_$w}|}r}y?WpDpXS&eVU!
zU3I=H>?U_dLitH#>4}}YM<!N05IYX>zLon_i*`tawIh^b_3^RS?ZTBdavWs_bN&|b
z$r^L!=s8pLZr{6Kqa#&ra20%Y9_NR9a}<1cmC~39=|)ru)0b#`ql9+vc-v7ZtLqB2
zzYnl5jW^C-i74La)d1v;EYUH71k`u-H$7z0Ua0TV8awPx{YqVBT)c@yhu9`+b@axJ
z46k|8=f_f4k{kQtPkclr7ZiN!Wcn@a>$n;k6?KDW>>KR)v|k_nePfj-7X3gF%ikW?
z_E1Kdt+;g@9jRVdIQr%N06*SIgp|;j5P^_x3C&ZgY7?H9uCFr&8v?Qr5VoqG?9;x-
z{CJh(16Aj42YPQdi6I`CDf9Vl`@x&`L;Zos*yF_bWaI&%_juuYu&~QL>P+q-+%Dj%
zhK4LQau~e48iPJv+|DT6=FNRX-r@DaB3h}0<_y1^V0k$LRZ&6fwAiy2oz8v354UJ`
zGK%%$Wc%J-g8p6?VZt5Yhgul&wo`n(+=9V9D-eiOvR=oogS`Zl5h8i}Mc)tutL;qJ
zS3PNs)h|gZ9o(3`!3WeSu20zVqObm(NjnqY;k_A{IdS=BYjDz?6$q&>s#49@AlQcc
z8vT8^g(((_A8bO?i&FvKoSb!gzCfQYY9JXlx^-C)+|kBO@*-$ES#hGNsyun~?3d^{
zIUif~5$zPcj_n7po12O}kDt34=sk#?sl3cQd28@3Q`xxC07<&1L0tA)WQ_$r8gE~)
zRURW5n|;|>b>mskb-Ub44qth7AwJ}HY;!D|7Ce%J3t}Z=J7qP{ypxF*(P(?+ZZK!u
z6!G)6k)c(yICOg8wPiHgW2rh+T4$O}8Y*cvuxkK~dvEmG!j9wnKiv7Wgk}oXPV4Hh
zTg@eAx*3l_L=EodD~^%$xWS&<Fo(!jklSdFVLL<VK|~#x7!@#rJrMKYTWfv9)4o_R
z|7B!DDec6zk?me(Y;9)ktw&+SHeOzv!55@1sB&B1VAtCeZ?A;2RWDZ{R0Y%gV2gU;
zPJ$Ks2hdB~){PuOUBSJou-7hGUqBRWinlZjF-&FZr*n2R;xwP*)Wv5TqFIKWq!Q4}
zy@-|nA7yVI4)y;2k0(VU48_QxMk!e`#!j3v=uA>k_AE0QWSv8nNQ-UkrxTj7l^j}Z
zGZK>}%WNl&gp-uryi*QYQX#7EJ)QUG_xpXX>-+uVH<zofG_U9D`MRI?en0N})xgrF
zW`hw^@<a4;oeZ8GZ}P;oY*Rbc#a%L6zv(z&jjLZUMBUCk<CWU8Uu7?PG+F(Hb63;r
ztybxjX}p^_f~=R2G>xCu7N2;BU{u4R$~OPoCDqlz_B!_5xk2UrUdOHS^vxunmd_96
zB*`)g2S8r7fiy*Nw1s|B84Lifa0`9GK~G*-`P0$pNwf{SGPiDSG!-K0i`KY!*Xb>Y
zMcsIu=1iC!N)18Gt5ZNvW|=4m^7?41S>Cvx?nbcGyfuhb>uxlRYN=|d!)zlOsiwB-
zozlEa*CY|KGyWSS!_5^4Keg?vRMSDp2#l9zdFGRMK_xR6?o&*Vw_Lj3o1)Ruj$Q8Q
z6n}v=-mP`nhV7AeY6oJz!!B3<H)*zi9(dZ5qAQt>W@8Fq=q*kG@waK9OR{7%{XUN>
zBErs?IeNUNYCv?EVH%+IR)$N22)gKk@s-WYZOg=y@byr-X;jA-Y85ch*jOOkyOa{6
z|0KD=(Y6N}Z;Wnm>e`u3sa`Ow&;9tqQVAihRfa~7ru{hG^;cX7uH~?%3}`t7v`Ze<
z93gIX$f5Ydn);Jyf>!)CopOtMkfshiFHlSQ88SHM(&GM4nr}~h_BCtZP7RFgQf*gZ
zs{Pbli3xmmnV#gO0J!>;EF#XwzdNEFvI^#tamdQt-bSS-$_PQ;$1RX)v-6DrsZ@BP
zgjmy3K7(sfRXfv_5)p$#-OGJRp(s4L(zw5T&AuJ{(#IfjnZg{|DNr9WwaH<&;N;i|
z_c9eD^@S@{zFwYS&(RLfZn%I=vH>8dPq~mA335}ucEKs&^XZ#?KeZ$^zVqxJv=K*!
z4o(ZNWF^;8^>uUj?;wsb@dwdU`+?C~klrV|QeLKp*|00{tLlheKq#4&N7iCYbkQY{
zUg|m;s|e><pp-Lj!$y^ZSCHkWp_+IW<EDA}zM2z8vha@Ih)%~LS4y5xjb~s6rQ;xs
z$kpG9CZN0?#MV6L=QZJgpSR84%YDA|m15$mDYF|L#q$L*^q5=&)BE~1dNOdOz|klh
zJn!=L`zHh!@Y4yza8H~CsJ-0Ja)@SuUU^lq&f+%;B#)9B>PjE!DVY<agVXY#V<>N9
zWHac<XPA4z!QTeAKV+DGt!@_K^DemxQ%a2izFM<sDtf@5!SM%KQw8tjM&7o@G=RtA
zf+o~Bez(Wfhwu5CSNG)$$3GAF?+beoS(cmiZk!TR?U=9+ZAmfKDmUehGbu5D0EK7v
zpxsU6AO?zCn|z433(!(_loZg_zjQjk$9{DlPgoaoncTR(-GA~f6kx}VU9aru;=btI
z&hMN;CgxvgL@qIo3K_Sz6BnHEfvyBmd6%smLZ{^n_U!FrIJWnMHGVqSDLl#XdtVT}
z&2eC)5<R)2i;_X1t%y|Y_Y<t01HJXBo)V)j?Sx;lZ<j$6)Ic2$aQ;8vz6To1QPK%g
zjVyytN|%<%5)SMi<3~|x>O$LHJC5_rUdziWSL<h(a^di#h)9{q!%}c&ea9;ZTES@;
z2)G2Xs!_f6ivMgxFm`0ydT18UyCKN;9KYvKsM$FO{JveX1Z{3>kIUpOGafnG^3KIO
zOuHc#mqDHjg0@2F@-vp^q6ub}6}g|6S1E&TN@qg+tp8zoTBxr1=)2qY9Dz0^vi6fK
z;)3=17OM^=6A9krkcrqB?;zu7>>d`9y+PPs>T3!=&ORFwksoh1uu=9lLru!;jl+o?
zq|gQRu<wu_+|i#0RFp-8tluQLryaY%g!GOwh|P$gAAxbwtZY#!gdHDeH=+qu`i@UB
zzvb#Tl_(<)p1$aSLtP2mU%pBj&!xZx<++BRqwJl!z7|qI99;eW{-mXhmn<YG&SueU
zUx}`mI&>yOE}SrE-K^X=p~&3Y(?MiNxL@qoOVLX@EJfG=u*PQ$xkO~=F0pTi)!w|f
zw)(24AkdSLr^^X2O5c$5P_e}ga~(%A?S$!q5g&^N7Llwo#|BIPn(mcSY}mh<_W1O>
zIIWTgxpQ?&mgz4059y#u6IpmA(>MVu<}PFdCy&RZIhwKj(S-EWFSznkXo6kQ6*7K$
zn>h&6;wQdm4e*q8I>jxf%+dDw=!)Lx{mk?PKWo~R5W4vk@({~4Nh@66p}qRMkCcY*
z#y3dzZ`$0gFrG+HEhLjON3D3AQms$f;d(U>*$z{i<g`2Fv^j~cnLAw5M5KH+SR;=p
zUwUt?_7x*W)D!8aZ_b}EMjm<Aq|7B~w-cnm9Rc=!!Ihf577M6R@D{f1L03!)3TCub
zbV2GbLrMt~+8IWc6jpZ?L2xB8nTNHHs2MT3OzhdG?Kuk6?AO%P$AddV-d;!TMBM7(
zOXhifaj*xieK8Ife-L}QRG2N?Xjz*3oU!A{gHK72SC?lzcD(pZe$l2yc#5e@|J&Dt
zBfmkS&GbvB>fqn+-L82Hq}I1buOyNO6`Fmt?AeJhk_+G(^sX@Sfv<WZafD3L&dwvk
zvWK{&p4t*)i;NE<U&x7@;go&BC1N3MC3Wh1k0^)K_vS28GZp4KTOpU5!q_B9M<#Zq
z7zF3#KQe|t9Pz7($Ms}}2s>3FuvC7Y%1E9vvl9m|dPRY&Df9Ngy4=liInP2`<C}KS
zmQkH$44E$+fu7AOQD;3Ghx(ny!aKEEqP-?cL+<2Wf5m-;CiK7oSLIO#H}W85@G~UH
z3iI7p{;9%Reew_fdOi3<XKQmPE-?Xx`~Cj&Xz>wbO|Un?+O*Y`^0`DhR%7R(Mgea{
zq^9%s84^KlHph;rW#5^|RB;jbGm+864X=E(r+myBdcTP=wj6`=2{)c&7c=FTeMIJ1
z-&`~OT(2G$65;#b^wfcmcijU@WkM>YeEtFsh#$TRsr%rgIx{t(lfFAD7ZT%wv&`v^
zV9V$f6WOpAp3lhH&%Zd#)~qvv$XlPYAJa_7_W#9y%apn~frO$$$n4d`1#Jr@V%|4|
ziF@D!23XLnuzf8u^DYCfLZ^uDY?LB0d^L_CD@m7yX+GZnur#QY`_%M6YS!`GKB*s9
z+s@#_)^Iq_5}FmrSZkm*_kf>ZNMfD^I`4t^YuO5)eY5FG0m>?(Off4?p6gXG-&bQ)
zRTBfLnHbl!V!C2f`;-Z|ce2Lg`>3f()IZ~-h+7hoZ1iw;A$eaYD}<@M?7KVPM<So7
z<cw5eIfu3XrNnjA=Kdz76%>SIIV*AXK!lQZOZg%bk?kAAgc_j^FL~*`oib5R>{39P
z3^2}-X9slZa~&_fG_ly)JZa2Su?DRR8Qyc?dvsrjBI)*)f@HV2thQ!^YiB>>&s@02
zM|JLHZc4RdpR<rW$i-ru=f8&IP&a6aaOJsHb#!(YKL|9KvxSq=ugAhoYq$WaG@ghW
z&ZDtxe}SMC6`cG*Sk%xRl-4Pa1cN3$TAlglTfhU1M}hp4)fC1PwA=M7Eg;himd^+@
z7&YZSHKm)rxq%xToUFnybniMEpsr4+g<1*7nWIrfG>(0W7MoSq`w8-yQVpy*YGOhe
z5xGQG3GKXcrh;f?At~;A?DBaOmk?p!u|a{LG}oc;nf;8uui@ot3S(o&;x2{BgyHlV
zvS=tPEZjJsxWU?4X`oeuhz-8hP*(xO)1q$_bxnf_EqSgf(6sc{6^1Nbg@1}jttDD!
z9#-S}ZiF8VUo_Vj?jptYwctX`-WT*0BNI1yU^v4M$n&3giJZRRyYEkee{&sqH+m$e
zR-i?TP1en&$xI?qkPe>M5p$^FRa^sW_tEmmTOQ%tLfOz=&`1!O<89P_#uu-GfZ^J4
zx<rMqB)`)>I3t9iGPQq(p#9{^UCo^R=r5gixt}lWecpL690M-TVP#j6ZpS00g4LoO
znjk-$c4=Xgg~Y?$zQd3vdQwxBGZZe8keor@k#K`%J#d($`%!%9&@~G6iV6e!h4W-k
z(JA)=!&Dz#@&`=|qS(Mc{{L-A`FNZDAMVs^hv>#e*0-|4kjKKcLOak>x3fYP_E@N5
ztGu2aDD-ui%~_*wc@}OQ+7TaIX+E3`^C|%8$5aurHv!{(K3ic5lJkk=t^#D|5$*O%
zOqmS&2GE8IzA%qaDW9N}Pc#+7T-km3L9%5%Mp}STmDf{p!blVn%_@kJ!D%{r&YI<~
zKKU9&aV(&M>u7rv*CJB7ns7U!6(v4>+<4My#hs)(AWJh<yOmC1Eqb;n=Ja|%HIoPB
z0Y|fb*_!svOxd<hLn!Hd{+*UV{|oA}_XoGd5v(j!%?|`k-bXBU@-4h#k3#)x3=DS2
zNSfMYs);%F-HaaX@s@X!p7Gpy9Q%vOmdhD;iIDgC6_?o&O}}4fl#qd4Bo^h-8h6^z
z9&f)n>G<bZ8U-p1hfTJe;70l#SGkfi{z2%_mhJY0TK?{Y<RJZ}!!x_FioVyOX6wXI
z{=!a(v4}c7z;;rfOs2)Q)SUtmxSv(MfSgT93wXVfval<(<Adw@yv0G0HDBE~s$NzN
z+yo}#6;N(G6r$KqGZr$0-E%x4fMF6pOj&iUdi-WkDvqGW$F+UrIfH`nQOchb8P13c
zx0>s?<eId`kcB=BZ5|%%Fes$khW$sZzP`v|P_O(th{EcLdJrUolidcl-(W~+_*OaM
z`?EL=gCd2#5-H#kKz*UD^RD684q9xY^matyIPqeS&WhfX0-ET~1K8AsOYv5a;LRb}
zwfg$6A9B<z7VIoa!IGUxx(0ath~3Xwu`AbrMoKYeCE5Oj{EsIs5eO?j|81AGsZ_IO
z&_9hPJ9!f>G}EeQ=cYb0RlTz*j2Jm-?ikUjJlOL`Hcu;P^5%-A!(V)@NG2b}-ND=l
zLAucwR>XqE>>Z0gE@x5tu}hJlRGK;rp^ay<itibadv5ATQR>pdW-txdg-8pP9=7(|
z(s(pFfl7Opx2?uo=~pL)d=y6^KuLw=nzG7N)2h-(U@^+y2KeWK6JJx4;`EYiTq%Ck
z;7{9#(6g&p!#l&=YCPe<=e4?4y>_Rjj4%#19Bvym0?SU=tT65{oC5uDbI_(DBjck9
zEbi<hbU;(8+kC6ocwlr7JrQ{fLLRfj!$*tHF`{Nv(>0;WQk~m}D<tfjy<)=z52&h)
zGPsRb>b;~=8PO{4@m}TFA|~Dfd-I>&wAEJ1ipXdROYiVf>$dy3y%!MKtY!VB^D5fd
z`Ho%_GxVE58F6(zk5%H(<na~nE^i9u+k*7l>lT!<#S81&*i=Itsir+=p$tNRl5CgB
zRftx$?MF+q&2v*D4n0W=BTXG|awSPmyjw9Hl}9v>m&Zs<9guljiD1}~AO!?fi>58S
zi8xy9Bk6qF@^}Dbp+aU;6A{$vbw<dd#`;0O#2FXcE+n6$OU=sfHKc$aNIwI9EKx7G
zTPWo(-pPnDHfmv#8hWuX0B%=8h87qb_8F!m3(2KV32P!U%|7z2A*KpM2?e2P8Cp;t
zPH85qO%avAFwV-rAHl4hT<|V8R@T4hbPY~>9J9Tl<IAALLyWW&B$E0J<n<JrC!Mv~
zkgF7yn+`c}wzp0+o1Mf3CpNxU@t;t`E@>P(fE8a@q?kyLwTl#dfXw6ye?8gJsHQo5
zJ8-qjKSyY$Nw);=5R205JG`>qm7Q2^jkaUo)Q`9-EY2e1l|tT@dR|ozKTWc{J)s}5
z*P%lb!Px9|^_8!O&|jfm3%gUj{#Ybl@zyhbgyCt@_nnZPT87FoqUZ3fk35nfW5pc!
z)r@o2WUF^KU+Y3CSm>U`B}$C=_pP<urQW;iqs{7*$7qj#d42n9-gW(L%|6k5y|3=z
z0q9gp`EFnZxJ6haJLzqI>wldR=zAu6PaGIdTy?#&yVVaugM^svZ!W$f48x2U$<WSj
z@Rk=g07>(GkNP7Uy69GhS3JV4Lb=<6vp+Djgr+y6!4ZGs6VWKDV=q%e3uNA%LJ5H+
zU!St>bJ$)*j!(;!$JNU$e{6*7b(*m)`^KV3i<(aNXN~nEkfW?!2t*aqv<z@0>B-YY
zJD~<F)}ngjbHnk)sFo9}#QFBnu78R$asW|+8c5V%3XQiwTPC-$%;`B0Xx!C<uShPM
zqOQ{#rx8GTESZGkbF2gxs1Me?4`xzso||d}?o&DrT8JD>s(ArwpW;M@DiTL|;iCP(
zkP&BS(b6yRA7DPzZ0aFKTJOuw7<<mSPab{}bDUP{)dsr;xkiD5_7`z^x&*f@MBtIM
z77m!j<Q2o3j`-Hf<ky3uaXtm3b*N>5>TuQ&*|4Tlhq+^kA;)U!-=N@g^~@Wllp^4K
z(njcp4ee5&w8{-Sq-L`}kT*|3^lP{s(L8AoTpk^7EuKzkMHI}FP(`#h$L~UVBqGR&
z?9OxDk>SFU_xx!{+Zb8?PP2L$PFwY8QAdB54C@%8r;UEjr<hn^=g;8S(lKox-#zEX
zVV5l4UVg?Gi5Ca$+1Ak}VBp<k5Q~v5_|>*4!9)1A;(K4=B3fw6^v3b5LHpHKsF+UE
zVspTMRUUf1@(bzvX_ntq*kU$i<zUO^FqX!}S03oe1%8XmYaigN7dap3iVa+3S!MFC
z)MOn!)eQRfHcl;LbHgvstd+UYarbImq%xB;MZHQkD%mYXfUY|~<`$RnC_WG08X`ZN
zd5FH(y&we1Lbl5dU-1USTZTE=c#cP?`rE>qnj^lT?3o!mxH)c;F{mJTA<RX49B*$J
zRBCJgCXB*!cA>xU(g1oQH6Bnromen$(V~Z)cUE;ImB=Daa096|vD|UL6>q#!?7PWt
z0J%}UL6Z!3#l?%LaVuZkUAFHmTo8G?Y?(ps`f)*Xw3v2xzl<jK1Q>*cjqCeVt8*W1
zN8DK4`*t~hqJJd-gmvAD_IN`o)c6-2*0s1ZA%y@W#eqMX_13e+3ft31)Q=F6&Y&C|
zX8|JMQ^~I}@|L%Q^+NnEJ!0%_;0ZG|Z>W@NJ!Sb9owA|a9<q``T#U@*f%UD%K1%M?
z^w*Hi&GNUbVY!)zjIlJC8<%~42@4`>&8CN7Y?pL+tt*BJnKu?M6<txAAPip<*Sk$~
z5AfZvED$S7R2$z^l;jNsvQzkJ5+rRc_^eIf=6A6u6zC12)-(c)B6?a6!7whl`}#@h
zUDDJ@mwFdJV*xi@L6bhy_19M&G**VsfB1>cZ!yRIkXV~M(mH({fw9TSpuC%?%^Pc0
ztL0hJV$(lT^dn5LIlQ?TWz~~iZ&ss&%i@)Dp7WQ_O^J4$_nW%Ik5`LoH_lB|pELzW
zCODwY=G@d(A@%cV(f(6bzTTeqj9WF)75kO#J>1kn>{+9O${u%4_`m0A&r(dGDB=-r
z=FnbCAN=PKB_n+6^NtWC7eGB{^+vc1xmV-cQCE8=Hmz@6ChSeot7^<*WyfeY@Q~e6
z2X#9c0Hn-dzh<gtFgA*Uf+OwZ($A#mT`6ZG-i-&XXlHktGJ%T<vv^-1c`U4-S0WJK
z5Q}6~GWlW;!mMB1aHui-D5>V;fGf!>(SOpb`=JMJ7IJ~cSAMjYVVBIie%zqlBwTLU
z_Uv>1{g^C3tjLEmKgM~prD>}_{HA`dbJma8g|*63AwzQP7u;-`@pQ;5K_G1vV&tqk
zTm7X0e!OW(X65IG9$Pj}7|JAxtc$A_)5cDHzr}Caz9tB9t!cF91m$k4@OD$XG$@zD
zDxoGpzEQQAaGB3DbWN$mT=5;w3enp^gfK=p$R>xZB37-hc!K+cN?=`-g&vTioF($^
zxl`XgA&IolV&@Hmemo%E$p9=o7`|6Q^Kvk9dBSq|igLJND2J#gURVll#PP3mDCWOq
zia<d4HV4XUd!%0!)^KQM_PE)r?*ePW1aE1k_o^Q8TP)Be$qzAyAGS!{-0wGXHr?gi
z)L!Aq@3K@u`0rv=jxKVA%1Hckg)vdN^@Bo-1@`itsz!c`<iQLITM^?Sq`FSL>ZObQ
zyDYOW_wfC?%%1XZ*|NQ26h~7NTK!c=GnS#kp#O(1M@xT6&hL?agzPN<1N}aDW<G|9
zLzU1HyC^|gGep#sk3awLv3InLyFQosIAzv~jssV5aW5*l48Xq<KN6v1P^_1mKPZ{Q
zE7RltrOe%+Fz#4%<)FaaL~U8K5-Sox-&PTr4?dVgC_85n#zO6z_)XhU^*P=%2fJ_q
zl^hW+DW+GI+ouCAo1L$&21vV=9HO>;hsiJVUn5D<GZtYlJ;ypqg`|1NZ;?$sUy_(t
z7n-u@9TQCQx?^#N-?A}>bLt|`!s3Js)Lmk3j(*uOn@_VkWebK~ws~@YdDZAM@|Dp@
z`I21P{8OOC#i#tYwAJ0SIYFN*0HWmpLX?^0yRN8ONV~Z|XFs;Kok-3d#mMwH8Br4a
zE(K?+Ft%y@V_)c_W<g0_(VXM_Hhir)T%v+#p&&@m?$|1IJ6UIOlZ8sN&mY%~Gi{jL
zT)-g)#|bUvb96OA$DWr>P5rgNPd0k;yk~aA!m;7R!&3W$AYkTh98QaaQFu9azIPk}
z9qQ&60VUlSS*Sihc5rGUBBo(9O6^Gv3&+lnVUWyJQb|*{>qhmLn3R?MqvfVkaH6!>
zG{=GAL-1z55=bBMJ=1U6uxl57tv4KN8;@yy_l^3%Sf?{+DH=*JSjBNa#3C_XRX*>d
zIRYc`qultC{Et6q8M%l&T3aUNQn-m%bz>%nw`c)!Gr;@5Eb7O8ly|{U!rb>~n*MLD
zJ&KaJXuyBewJU$p%QNd(xXK(y4ro%nczRv*`__jq^gqtASC7U^jInCN)tr5fx)o!n
zS%>t*1qQs|JhS8%{ZPrbCKa?<cu2DlkcqC4GZ1@{UAA~k`!s%9!->8vs=WegFaVaJ
z$|BU-U&b_id<~$wr5079VNagP9)S0$PhT=|d1&FH88mlfHjj2!YepL@!`tmzv05UB
z$mz3&;M}X$`0TY-AVd}#+m^zcI8a{oF^pQ?SjD#TpDLw2KKgo>egv8HMC=FU?Zsyi
z>XW;KM0lAzsD(Y@GT=s1&9<i7FCE&8RxQtDHq_OSCNYD`h5rQW@VWhftWqht_5ma5
zgpvM+OuauSXFeGiBl2DKM2Ge#Wm6VYO>unFp6resvW|jQ&bf^cee;jpnroCZ7Vu0I
z#<;&Sw=8R_Pec`^63GS*oX@VMQ2o;&n9pWBe(!>x)<pEGA!@l7R%E$al8a-YFfv(I
zK_zPov;6p9lum)WWzBGn5I()e;(z!pXWhbRu@)s)#SJ_pYX>|=6EPQi7$&>0VJD3q
z@LS|^cu(;sGAOTCj9cG2SeRmSP8y~2*AGaubuK>Jr+%jzjM^JK{65TOz=Nck<3BFa
zJ<wU1hj`^YU?YiTm`AbCjrfX{P^`g=+}Ohw8B~k|tXEE3$1~wC#C-~`V>9!ZDpp*V
z1-~L8EUoJPQ)<QshLU^JE4`F(QHS=M*O^-~@~#_YDwE~Di;uA$K_DUoT|sgfDvl09
z=n;F65~EYYy-Cmecv+={CK*|x=#xTH>a;pH)!iiqKJG+u0db5%y`P)9?Av03y?H=g
z1KZQ_kbe4Mt2X-0#b1Oj>OY6n*cti}Y5E8BmqaWSZ=JsQT3qkcJac2tGyW~eoRYjK
z-@?;I88Y9Yij@0k@&B+;7v&$90cS}8!*I%{Zmzepf|?Y<P!DB~K<tUkfP)?)24%94
z^;tzWOjSjJ{kl{%gz#N&z}Xm-y3{m8@XUBf-kOkX<9a`Me<D*<lJWNeErvR%xyZWX
z4ABPeCJO-TyCN{kwH-5hPOA};Wajfv2fCMT(PC5TN>#495WKs?WgP)|Gr+g-1Rh;#
zp~M(DaFE>w;^LFR-OH+(z2?r75H{`i`x{Kes4AkZ<8oQ~r%cMA!jF5=MQMtpsUv=;
z&rPWy7Wbf1{oij>qfi9;5x>AA+kN~$F6zgw&wC`SWTl?PNPcTNCMnR{VGh`MjglPe
zg^iH-Blz2QnAB%w?jBB269lc8B_tIxP>Edy=ZR3Jl;+NaE(<K;<;OZ#sX2LFDMl2V
zmA%;=jFr8REuTI|#E1_OHQwMgv*Zv0^kg!EY>|-2(sObv&LK^0RM9|BO$HXceYX<r
zm-vjoyTvU6^=EFIK@u3ji7v4`n*XGl;m|PyPh4=Ci!lBk=3C&W_tRG0T98_KULOx<
z_9|y{u-J%F{RjFHh?2yxnQi8Ra?tS>MY~(T1#>aF$G4FGaqqR)oy>a;bw+Onx3Bqx
z+4JagFH^heI~rKogQ^j9r8l<Ecg?X6E?$Zk<xN-&S65|N^4ZygTSG<yw+Peh(%BGJ
zU8!T}aBNmApJYUkWdPf4_VV296+7Yqc(}7VXbn5Ir21qKQ*w+W`J&b$*8@biU+YC5
z>e%8(K1wKc7Bc(JrzGZnyy;a)^L7#bVyoJKC&W~i-Ct}o`;}GOo%EMZm#e>>ANQ#`
zz4IWtfp_e4N|-=RKO(sgp&zkXn$!3>W!VNNtUAfOeMDQm;8*q+zih#``*SDdy^}3C
zfXbH!w>SIP+1ng*laCgl;^n<LG^Vn3SJOW%DLyCi)3l{EQ__FD&_pyEpp09LCnDp;
z-%W@}0f*i(nj$C$CqvP>298R7G7Yi#gt8(r$BJJ3&Hl^)yBQmC|9Rv+(y9;1>uzvx
zYG6t+no!~Ref$=7Nvn(dWp~kini22n&I5pq{d|!n8e>Z;sg11XTOh=V<$aN1cDJV1
zjHJ8yhs(>(P3?kbF&vA6Dsp-5%hh-M_4GQ%r7iyFE4s<I^$7rR7rL)Wrd<WDlw*t5
zMU?*V&8qFU>ny+OsYGBzLq`0N@NN(jRV$8)>;23IKPCb?L71{j!b3sLriAF(YL*ji
z*a`^pN!<D|-1=q2qLy~2>586oC!`mPQo{gF4;iC=)J;Kum+eiOqQIbg!KA$EH&>Es
zX>cUySVe(u_ot2BpY?+)Ruv|cXt7WFcIYqRP?;j-*U<zGubR~-8P?c{lha3q3VHET
z_p$?6knh93wAiG&UJy;M%w~gr$y`K#ZPk5+26h=kMPt8=|Axj1xuP`habxB&B~1ZF
z(u26wy@{t+!+C15S<$Do?^owZg`$)^YR*35F@VluH|KDlGq)VetqZLHXjfN30fpfl
zNZeXM(68`SAo(aXbTm+_GXFfhehi!^`_zDZW75<WeRs>mwt;V7xM}#>HL>q!l?-XI
zE`ajk1(duS?=G0WP!P5u_1x4d-sLG@UL7zdb$vL%(sqAQ2i+>3mz_^bL@dgf>^L#t
z8E3=B>i^8=CCn>>kp6vc>MUZ>7F8Bol4z`@e#hI*2{4#Zy!<X}B`(@C$9vqfC~GM1
z`rn=B_*{j68C7d|5!ATJx|~+7!)N89YvR2*cL@c6Tz)NQPSBm>Y%Q;9H5PQ^r&Vut
z^N(GqY3oOgJ>x&j>y11R+S$-F^aNjPu3Y<+@9THkZ;F8+qofD4hioA{h%E*f@IIdt
z-OF$I7RRUYv{k64Da@bQsgBl|yk#)NiAjLCqv;4qR~T?v%szNLngRu8yy^dCwYt$a
zK;3J0zT)<ds$Gf9O}q&Y@cz!&x~my=MB4WqO2Mf4PvAVSij?<{q)L+EJrlnP4@mVP
zL*B>*uh|`q9jyd7;M|}WR%&vj>s}Xscf8Z`kju1RG`JeceVU`!_7=RO6}<agFmI*5
zREcklvvLgl<ED>O_l12Wg|v*knm=fgi=O;fo|jb+=1_7SjS@$Lw^KZ+<9a8y<bEav
z3MnK)^z0Rhu3H{yLE-w@9TLnfjl^XAJ`KV#e*2~oUt}9+dPP;2Es6yA8-6%lO_0jm
zBy*rV@{hDZ)tn9#6jb7CpY!*cz0yaeHD72e(_h+IE|02S>&~X=<a!xU{^FbGWkc>~
zLcQSKeSphVjL#bkJzcrd_gOyzS<B7CJGC5+(BVnyFFBWM`Aub+Y)UMc@rH!Z{7&4t
zsbW0uFaFR1qI>DIAFe*nus0_JP;b9L7Bqt_k<D@mM<-<YA)Sqqj_b+yzo<1I&Ukp;
zL{a9z$T@hwO=MA$79HxoPEcw1(%AqBQOAOrzxeA6NN~RLo0`#+JkfbspfKW({81X2
z#BbRNEUsGp=?+VO=`McX*FAH8YoAD`G)$Qw<qckCfr~7yl?By?#UmE?A|Fv=&|hA7
zg8SQcvdNuPk`^6Q0~qH$K#xLca1Ra?zrVqBdT61Ee$#a^NGs=0wTE<dQknN^TfV@y
zC`%A-@w`)~E9LJ_4eHfj17@I8HeC|bQtD=WW0Q#gxE)gjs(0#sNY=mzE;tMDL69uK
zFL|b3ez{jaVn4R$DZkN2RW&td!fa$>4f+TAes$>k7IpGs_v#9z@49}3re%ej5l6K^
zaI*W+MsfeCZ+Os=j{qtA!K?al_H%yi{^N@hMK!dFaaq`M+;g5?ZgwsW($U>@nqN*1
zczDF_xj~nV>L7KgHH++<+=5CBqC38R0r`>X!A+OUhPHZMnHN}C+>U(c2U(A#TNA2M
z5GmC{5#l!~4`ZF+^bhoHTtH_!77#Za?B;WtPLibkr;=%_HT+>j+_;`+X~ZSRX@k2n
z3Fexu=ajszL$z|Bxm<K$z9`@a`J5YuuR!rJ`i|08RpRZY@d$>5^nktb<gHxpUwmIw
zdb44_umBe3mI8+TcHh%%_Su5BzxcI2%CoDJh~nu|p<nHgi8v&*O~j3fj5^FGU;PTA
z+}FsO9iZB|Zp>|>cw=QyFquvZ5yQ2)bx)kfNk!mnY0kCF1=S=2cQ^Z(fgvt8g~XF$
z00qKotW_?pnJC_(toR;vlQb2Jzq@Mc{7<O)f!6<6L)yHrS4j3+w=extsR1>&CItBY
zZ<2E-n|gOs|BOvp_=E5HrvaWcn*1uDVxJ8=3YLzJhiK8+3~F7RcZSargp49{R|ZSR
zHgq6cLzF_<_gA)Nb8G1*UsK;ule#fVI>mvq#^5DxGS)i&al><#1QV4Z47Gk+-^rVN
zwzAWq6WaG>2%E+9{!{vyXg-@5f`Lk#0qfV5KU2E+GuWjv+GDk;37Au6ZQG-mmwkhF
zESxddP~4|g({VR9l)T3|Ae$GMVr|g>8~8fndA85^YYP|4m0LZrmoxxiVF0N+%6veD
zwUG2ov0IK!oa?TormA<V8XG=_YxoB7S*Kfrwk%H&;?;QYvbroz7k3~vjhZfD_Uao9
zt{32|P8Uq+7A4-A)Bq2ms&e;mviIa^RO<Y=NxYiBKz}$hj=mi#=NeJGFT&Qprm?UE
zaCQbn^_LoHt2Dla?8AkNMJXc6JsTXSPb*G`dT6#zX3-uWnchl^HO_vCGRLtE&I)m_
z<bvrk(CK~h`b(RNsv@%})GSfMo^3I;;5e}3yO+?w_R6DFnpSQNWZnd>-Owgr?=*1C
zBi5vlsB2{1Hu?y8bG+F^tgUmSU;QT{id*Xau4#wjgueFaf`3BSq1inY5a2JlCYc=@
z=GZnXyPu@1FX|LQ<F#>0)hLqBMFj)mrfEpd!V1cchiS3Vr0<t$tHy(J2YJ7`l2~Rs
z*mqjR{}4t(`YFg-gAp11C8_eEc<YC=<;|@dbh;zdEgyU;F!p`ir{k5BKec+3?|H|-
zoiv&l9asW>(m~jNu+?9DY;Ne%w(h!{bzX0}0Lx?Ns~DV;Kl%`Pb8=6-xK+CiQ#7$F
zV48=s|E29YHnWhdk&r%w`P1Mf!821$Ag6r>@1}SOnUfYkggm7&bCVS}ZACZRW-`u1
z#zml7wIJ?6@U{?Q<{K~b`Ny`?Os%kO*J(W+QtP5m5;?Y`(YX#$kLHZ+0_%KRPE6Zc
zb$%!y%8Yz)E11@yJ+`0Lq{WI_mPTeM29~Iun+n9&u58tPX;BJlAqY9|)YO|3-aIvE
z?RF3<F7~`KhGfM*I@Yd9-jf0G2rKplp(kdU$up_HP-0`ExDUAJWC5hc;5`j#m5d{r
zej$(a!~_`bt({!CVagI&|4DYw_>#%iy8^l4l()!?;sv2PZnex6Chv}rEUA^7NaK%J
zH0Bz=JCEbaZ=9`M>popD`<~xoKWzq;38EoSwdpj@zTL^N=P_+nwA|&=#-+S$XnLdH
zBDtkqK6B9)>SsCy@8&@lN2nCjZfc(0hfNKy`u7q1E_`K}swO|C-ixk+L0+33I-i;-
zHWFQ@H(f#|CKUT`4u#<wsAG9vWaa0q9`ZqO_y?SozXAU5Wt?pE_<^E~8{~~oQsu)B
z=yFt$?e?(uVi@WPC;}{K8(@!<!D($B*O|Pg)l<+-Y358CO?%rk6kL8kg-q@1eo|{1
z)!SNfZL#3pS$t0yfAb2nZ@Q#9_Q~(GSDJ_RVtYE%3jEe6G4%i&DDg#AL_VAk%08R>
zxv#eB`8j_305uJBkq5()`~~RYbdmBKfMH6gkIeRk`6lGOQ(CR(_9kR4(Z!8;CJ^iP
z9#MM};5*1t<{pt6_wvjRq^6EwWQ48O%c~f#Vj8Q<{V5-2>E5+rTM0IxG8KJ-f~KU(
zm4~xKF4W$~JE`1)O^wW=_&ie6m_ySmtU=FHT5L(*jAde@PetGTk}@|10TEwoCe`y&
zyQkwNC`-5O9{x;jXq5C65jzsL&#$#U@8xSb52Av`?ef(r0Sc8BCNS{K*o(hA%|d2E
z($V#r7Fn#O<4RwU!noY}#x~CHkeLvc*n<3F=HDac1}k>&imC&+S|e{af{?oGpV^B|
z)n6*&$782_t>UF##l=`TH+2*@4V^B(Z&?%hh>v0`75F{`NMN+t(WUj9eM>@(Ul|FR
zrKG#(^LzZJRPZMtX-~dJiiMI}U`dYFSsko6IfXQ+jW&WTkcV4w?4VfT`37HYp2~{E
zlk~8Ojl;E(4=g{Go$!AwsR+|#sy{s#BEuU=<Du~M@`xJub_leKoH3ES3vtaH^b8qc
z)lNfd5{&8QpT<-qZrqyLd8<j>W&eoJ)j6Xxfp;RXOB>52p8t&+nt=vjmAHWXTYg}z
z+}>`{b~fvE(({VY?$`%7_W6RhX$TAeb_{rrX|Y%PHu;~={*ZTJz}eYfx1n=S_m^EY
zTqP6mM#QR4nw>rN4$0jR%00uB7sc1QXFdb7`Dbojg}V^U_@eH+!lX1XtV&J06L!f<
z7<xa$F46hJD&{b<P1fo;-?v;@`|pto&Et_tecRziAs22XzUb3dbLskVowh7EhTnIw
ziL?s(t@2Ynzh#SmV78GoM5W#2|9<`7eW^Bd;<_JgQJf4|mwDd)0ZIscPgC?LyNi8g
zjVCvHChx@`^hg^bV`{i^U|%f$PyjgMr2x0fEMYyWcz&yeA$I<hQ4_yK7i(2O%VCw`
z8(nLfL+%)KUs|c@+d_*yG}kA!6nRV3;91zBC}56zw2I#c77&rQPIVnf4a&a@^*|C+
zX6($)-Pl^**#h5^y611Y{^4`9?O#|tBOiL+j#*KC&M8I$T0vG!?;f_Q{q2fU4exf}
zj99p6Lh=mVUi0ns`WHEv_jVqTlT3NG_&2}BPU!;eF|=4|MK&gs2R<nQ41>mMIf;6A
z&BE(pyeT#{_oJQu(#4|cNXW{_H3w$jz=D@u^-*;Ao@q%1DAS1<+GEeaKfKSUJnk|J
z(yGLY7Wx)V0W{4sbAD3UWQQ@~<g|tmbC!}-vwJwTlDthp(=RWXxm|J63jn?re;9p*
z>bm1aP)k0f(X!mShWz)TH}Wc03;GP+1*KF+UWa~{O9s4MPwwQtT>GQ%SLr@&fQQ4$
zS+D#tHE4=%0374Ud=S3Bs8$K!PgT`b&o!t?3Eg^`tIQ4iCShiP2j*U6;cg*N)b^F!
zFr@CFfa<e36b#fhs7R|iNQQhWgWO@k{2q%#SVdv~!iSot{AYO;k56NR?>EmTGYSMi
zs<V*EIty-R`o4hdA##D^_rG6Z{xp>q-u^=Yzr{1K;FuvR|6d{~5PJut8U?|qWI?!u
z0zsCAZ&d2sT4m6b5^h}6S?yYtYlVa=sI)P3Y;>sy3gLG@75i0~Rv}lO>-EyH;6DN7
zX*DmTJpR$m>D3-P)nyGGzb2=qx32|dhk@Ve`28qp^lHBW?>i`{W|eA#-W>(L$NY*v
zYgP8!dMtZTf)=pr+pSn<@r}yuj@rE6dmo~V$B(RwY2|*rn?K>~nRZrB3Azzg@yg!<
z%7oss|CS&5v|9kyyx^3lVQL$Ar;xE-KC+S4^vtV(sN`_Ei)Ai$@Qm#lfbCfp2!f!2
zB5a&iFp>82{$&Qe-LB~pO+)s6#gFnd+|!yDBjQDWBx1=o`!;DYHXWn)y^jU>qT_Ii
z2s8?;g=^}vHUccR?}*yhUJ#J(hZ}nM{1c#Q`u0HBe+Dl&Hziy1@*CHVZ8AbU(M|qM
z*u~E>SCQFY783R;Fa@eVz=xy1x>hKC$)^0AFA~b<SLSk`@^^byu4Uy=$X#ZEz>i6X
zM}B&)MHID(o!X8C1i)w_pJkQUFgLex<Y0+Jrr0Z=Cjd|mEX_)&7gqkd$(m465ei(N
zffbl(QaAlRw0vF~JR7n83)GgeHwCBt>OWMPX8$}EadHz0nR6BnF#2n0-#O!;l;e39
z`aqRwI{Uar$I7;`qamN1G{e|vjdzkFVCGl^sUc<xL&_NDN2czEE&R5w(8jF>Md4Pg
z0O%=8Av0j(H?R3meFo|p^ghMk7^zaKn3f*$ZJ9DTqZu@10QWC5&2|BjI7G|>_crza
z_e+{He|ozWC%Y#7ioCm|!wMtsea?1cZcW6?Z}UaW0phN-hl{-u7rre4x|S^JcWd*)
z$m(CXr$1?yuRjLxBIt(5Ht~h8{B^J+n#UiZ{56k%QSR2WiH@nCVj2j61_h>PltR`5
zQk1bvcxWEEfyvCDYdrWw=yN{%t*G4Kb(jHbyI(O_$;aYL49|Bvxw82a?nRlk6KhQA
zM7-0siNnJg9ArJYnjOMKEFbXe)^0z}R5}JZCr=Q@QW+hfd}~7bA^oKx;q$)+2)cb>
zow)%EH{xs8O@`*Jlcdq?XL+X(2qHa$WO7`1DDy0v0$&-p@{+EwIsV2-sglNlnLj}v
zsKBhe3lM#6_7}tyWqOZGYr7N#%VvbjDEPkMKH3;PE;jt_$HP>$EBUXIi|Id#B6^BP
z_gl}8WbZ&^Zps@pUwKq|uW+Sex`2J*+uiEG!iLw~8p_=j0otp!S=+SsqxbLX!)^W(
zE6V!hH9s8J<2@#EFkgf;HTpQ>`Fwnd9lORYwK-hTD4kNQbVS@bAdT|g%45Ny=xk7{
z9S&zO;&*4-`FzUjudFfy-Yc8gk}%4pw|k@lQ!;F33o;B?L>%tZt!KFY>c6EPa#RB|
ziXU%_CYFuXOB;`4W7I5@D(NU9LAHw3>Y8!NDM(U55E?AY2pWJ%n;T~IbkPZ(lGfCe
z-Sx1_&0~uz?laym-FY}1dl%E*V8pRo@AzetQ`ksyIb~#N8>6<UN{JhuMmZb7Aeqo}
z>)I%k@4wLkn#v1&3kKBz32IEdY@x*aXWQ9ez+NI;1RhKU56<n^ndPq8I@F-^kqm`p
z-_1?vsO~LuoDZ&9n0gy_j&i473fw(s2fQ5l-oTq32t?wY3@w}f>H(>x&#6QM)^bpF
z5InaQ`w6u1g<q<^Pz)Q`VcXmLLp9?WT$!p{v;BCZJC?5)_oq(OROoQ}n%?;_WvIbH
z7D8=7GhR`hAe%+d$tNV<$6m{GP47lW_3YH<o)1<;SXF23uJ4sY^bT<s8ciM#d_DMR
zpoT(0?r9uwH>Ok!?XSRT`XN(;QnYZh749=5Oz&CAeV|@!X79MqD0tQ?Il#46q1BH<
zWsf(WlB#bQq`hQrdo^K{Ib_VG1Lyz?W1ADT7+YpAx?-mkmC085WkKhwpx5VW2<*a0
zn<E#jfUv4bHZl_)e26z&5LDgf9&}b6jTY<ud}r}|^$h2<DJrBpyqI!mNriC`byulo
zJ0q^9Pl^W@sJ%+#Rz9jx6s=Z|BEcZj-%!_LO@{xTCa5b+h`|VXf<!*y^d=9+rseVN
zv;OlQY0dPlW$36AiZk>r#~5lUICf6`3$E-NH2PwH<AV94feafQ`*yQ~RC*Rw{Yyic
zAukL4g`X8uLOl=RH#~L;%=Y;@Mn<E*@;(zz2D4F^-_0gVgFCXQIih4EY5H;`V@D-j
zDte-sx$_l~M!98>vX`ln!?BQh9R~zi_R-<uW}k$(CdGwspGu>M12F$5%c~fVw@qM$
z#FscwUXM|e)Ekpt>aAmWN~NVnv`{Y1h++0~*{4lTV<Q*OBI2gZ3HUrm(uB{qu#oD{
zp@`;p7rVo&fE~$+$n8Xe&jmKiEh~s&r7&*KH^7`VuV4Sukf}J<@p46Xj(Z>&vG~xI
zAr(!~bYTD9>c2gRY&AeQ&7K=dUn5%?`IJy%+GT&9$F{LfwTTGfuIx_YU(4_W;iwdK
zGE$ng+x5z3suud|hz$ES65%v)vOC<R`a&5T(OJyP>|QD3^ubGwzRDFdVZ3xWB`euP
z0#2$bJI3U!Hs>w%YDkQfG|wQe!Y?(%HRBOeEqYQnUd@;w(QrqL@D9K#jgwxPubXWd
zV#nyG*d?#i*BILiK~#duvW(o(=r38imZ@zI9wi)SJLEcMx5HaFRFmN~XA0?*!}R+D
zO-H5Dy9ozSca%cq8Sg?Bojz>oUO0<rzCU2*j(@!Q#EUV7e8-BH?x0;hH5`95U<2o<
zAX=%e`ZQ`dS&{**V1Xux2+-Op?g@^sq|as&w-3>!Gsyeq0MaKvLzfG}S=8w^5D}rg
z^ZZ|iMi~;%7#oLhv$Rv%tZ#$6K&2?N-rv?i6V6xj#21Yp4S3kBr#g1+j@emqZJ*$&
zi7QU3&clX%&K!pw)+NZibO)4O{<t3IjPy^sVT~sxzK-p7-Gjc<IC20jcEoNr{ggJ>
zOq*3~vV#X`4Yon#i#nExEhZfi+-X+Tc?sGZ;B5d`b%0aFhSP>Hic23<X6PH0dv`GW
zn_N@hx~7tail)A|<99$~M;Lxr{hVr)cGU%My2W3hU6g#o2Dkp_&mH}O9o|hK%&~n5
z4^S0Kp>TaD<jj1pQz)ZRl@#O_6^6Odgobvfp^3De?{4XK?Z{cZYdWqukKolLuGu>V
zuT&4FBM@<+o1T%iq**8_nx|m!$~L5p3%g{RupP$ql~Fa&34dlO2v4zQZNYc_SoLQO
z%nQ6`NKy99iPe})3MDlfTGoQs0#nR!_Iwo+C;L2>0jn6Et+-%94}oZ%S4CiC%?Qz%
zzS{<TltOtOgKA3{c@^_uo^vq!Vingtm}3-aW1k%Y^*I<4wDF;RiEe|h;Q+zB3H`+r
z1Yc}O?>KJ#sIrPw>0UJ9w~?I7Jl;aL`wSBaoz1iuU9S{H-%<+YY~xX!eZw~cmK;L<
zA<n)$@l)FeCOpVvCoBriW?4rLAzG^b<?k)d1j7pA&Nl%=r5TuD-WFS%SrsBv?bU=t
z%tjK;LNJ(QIC$k0LcS5+NP~FTtAJ3kw-(nyAmo=1c~W{N9{l&l3eVZACNfJn;3FF}
zq3*+7rF;sNy2d&E#`{Ne^MIKyp=bEM(ieF|@0vmy<?0KBykWM^Aeu1tI-LVE3&LgJ
zXxPEqRa6UmcVNgK4Cxv2h6)&HlY&Xgr%*;3QQjPvaB}qp1~R5Rm$+zKlmmmg?1u>m
z%<HMZl(%RN5{-&qo4&kE8MJ;h;8&iDu<sxHqA0vuhVX8P<1aX3>l?;cr6yafHA1Bd
z=?aA};7&sfkr_;SAo@<0Z{!O(#Nt8|bBD`hA+u%Rt0>|}Y3^?dqgQX<20DM#mPgzO
z$^YKiGGKOqK**=uuW$R_=*ebl^AKN$zJmfDgP2&>41Gt_cHt}(XU8{4(U_Rv_MO2B
z7*kuiY7pj{8{8)Fz0Xk`JF#J$6t8GJY3At>G_q@wm+MFxH;fTiJ%}dEyK15}j%)g5
zlU#KOlLK&{Ti+XTZ1!-D`lrTkAoEXP5W%iU9PWlTt8sBZDu?w#9|NcKXfTP4kT<^e
z*)<h`ScKjfUt|aZbF|4d+eWCZ_l0t*T|I+T6c=Ujnpk*|+d&g>6Gk7_3^c(&x{AO8
z-&RVR$H9s|&u?MLlr*=}AKg2^tPX&9|CfLdk*@^3)WlT{63T;)@DNh348~|8cOYZ}
z%5(^0D<Yu?`Ij6snKu+f6^~TK*;&Q;O`DbOK0~F9oW|2qek6@?cZ1+Oc?%5E-7hs`
zV?TTmvlp*v{r>%BEs&PqzJ;ZLs5W@wq%yN90r0YSC71D&7ScL#H5nm;nFtVz;r$H+
zNv;iB^bPXJG4|h;R-e|;cMj${dZk%$7SZU6=NAzO^F}ZBrkC!o@*LT@)JmlR;KK`F
z$2>vyLRu+Eqza<fK%FUibJ7Hr82e?|#FnlEl{g-<fuJQ^IOT;<%}|Q>ms=?OQ1(xw
zP%kQjwhIbO*#_Sd<L`(Y((a~vvDsCxevpJVAO5%fJ%ys-o;W{IXd-c<Gct~Z8iG-_
z@O2Ygy=xda4V`*SW&^CM=7gsuk8#3os{`k|?n7$~#UmC4T+V4~g_05M^Yhm+1K~c4
z|J~>5%0(U6qzR&b_K7Y$ctZviMI6jVWTsKnAfAy1HH7|dt@)O=vae_ttoUXRn(z)h
zQR+pYEnf_QU^Iq+n3t)e3uc`?ud&Gczcj9KG1o$niWt)-SSS)6*bLeEyNdh!bPDCF
z@RY1N!-V`krVLj{l)*Dx1jlU1zMFoW%?|GWK>~Xi0=xGSa$pE&o5?0|0gW26oJrg?
zgtIRpXA;c+hl(mqXyDX5M+Y3|2Jmh6XV~qR8Zu@_MFypUstfj^TJhh_g&Nkd<F(sw
zV1i#=z@(o-+_;;8$t=}EtG=)mS3w{!biC$4o;bz@hYM3uL?95o<_+mostzn4ru=h>
z0x-oj6qP2|bS<*BbSEZY=mHTb531Zl(i#+778w=+zSmjbJqn(g@T2<F8T8_D9DM8x
zvI7cqp|4PjklM}M?A;k}p=?(wxDH#vAa2y|6*}2E_25_mG=<-3x1bL@_<uf^D%1<^
zWx0V*;Ck?y4!og|u=6?hy6WqwU>=q7w7*j}1=I=%NY-xHf*xK|axvE8jPS1i^HKYU
zqOr46#6(P;DOriRR)ah@186KCY0~(H`a|`nGQp+zSg)7qTMxe84DbzDRL!?r0I!$^
z{PaJc_f9IkxDY;%$dGM>DXBY#*tb2BD>0%E7o_;he>I^sPJp=}9>rPQPBwZ2o+`yw
ztGwt+?ZlR!&#|a({V!4O9K3*YI?iLnh&ix&SN4P|B!+H^CSogymL(KgRH)F^qgq%a
zxq9yCNs$n#(nKS!4GyOcN8Da+;wgNhAIhNZrhu1(pC^AKj=$tYq7pZo{3U&hqcW&1
z_8KAw8*1W*81&Stn>EtbgZ-aC;?9aPou6mTdhY{k7&yQKdM2@8X`BHo_`jsayfC|y
z)-;%sHF(W>!PTA@A1^(|+nJehI7-|yqZ`TU*HhM!IZxbTEqvI1jHoqiQ72L_)95E_
zbN83e=46n;#iVQ*0O@&!V9bz+)s#cV9>Q%4S>TQ?NJcf1r{~bVgi#Tn+^W4JF&Gs+
zL5Rd8_3N<`fkAW#A0zcdv6wxu+at=*nS2a(XshWbW|`q6TxRygODRd5Jxp%g^3Z0s
z$rmAy)fQ4#<G7u{8A$<>W%A}HnpBz<9ItW=gBE+~Je;Bv;JYP<v(daBBg%rki$~}w
zvV?n=D$N4Z7XVGSl0TBL!sQKmEI`Abu+KXVR>nwp{_hcR?x0+f8g3aRm0@He$h&Gf
zyIr-!ULxl@-sz?I3#3q)G-@ght<e*y-JSsM3&<4o5yNUX))iZ9;cxZ{_q$3{X;kJa
z;X&{#sfVCBg1?0|3lC7W7Y<Mu)ULU$O=zQ%SPQZ7%3z@r|Iv+CsKg|_Bkr8?$)-HT
zsx0ZL{oFKcMd;$*na^`9Nd&+wn4*Wa2CR74w>Nu^wvRx7r~y8|_A9{3$~uuBh9iqI
zA1-dSP)<!d+$c5H`EKFDaE9&|R(w6!cfBbe)fCWC?#NDIkRx1Hnq>!02(0ULzPiwW
zbp#<FO{X3xG-P=KwOxJ;2?>73uAXzdFqt>*7lZY>BEX!Ldho$D>EML*3VM#tLJ3#4
z*KW6v0!A=S+6|(O^VTY_UpVNxA1<CO4H@_`b<>dqDkhPA`gMhnIMmp$V@5(wJak9r
z+O&yW4<|Nevjgip;bhi?muJ$6i9)6t5u}4@I;a-$LKqT4U<&KD#hI6Yo<dJfRD&l9
zE3!Db_a4>s3)zIf@mpB&|B(6Bk!LlutNR4MpfY+U3&ECSC<EiRk$NdQpsO(<d{(@@
z{J(+bPp<n^?$||MAqsbt6TD6O<qzo&@G*xw2nRwqQr|x8LdZw_{=HEsLAadv6pizx
zu$>Q0(ES#y-5xv(Wl`tM^uyR|h5@lB!6yvzHG|=~?<tg916<jk@{;h`lD{1mU;Jy}
zd<v1AOgR)?PsJ<iSzk6k&1Rz>{0NbS|Ls*byK^5b@z7jh3c$%zCxTY=;jJ*3fTs89
zR8)v|`(bKMK4m4)S{P5DzdCBZ^|Sybj)R;@nNqeq2D1;`8!^exjfp^w!(YdC3ZLiD
z9rc0-$qMcPuMeHA58w5i9na^uES#<Ch=Pf+wTX%0dSG^c=30adA@rPj*yr5#MUgbX
zVWd>JmMS^O{=2gK57?|KU`oP)7ViJ0#fqDbOhGodXQ-5e<9KabMV&|++$_vclS=hz
zfW7`yYeE(tTi=<DknzWaa&(xY#~5<U#LY&KRY*%cjbFVL1M(4&?pH9e2@!WM_ctUd
z?S8%O4|8{Ri8&ryC43B^4O-Pp@?p3($wyk6XS{G0G#O*2Vqyy_?J=6*4}ONM@HSz&
zj#J}p6tzYvm+=GfqQ-x_8)pDhs71GtV(KY}miJ>`I?r6T`)|lM`$S;CI{*KY$;e&9
zPBL}k9eHCm_Z?Zq2*%k_?2N>D<4586%=>?u&)%?v9paENR*G*JxL5{j$Lx7#z`Ewx
zbqaz<bkvwU`?SZMACJPNAYfX{?w10k2IiUq8c_j!16g;Co`gY}CHjWc$vEZ?h|0h(
zur}EM0Tft)yB9D?zTgVr#`c%n^US4cniphNe5yY~uO@<FKG%=BOSn!MiGDym59#wo
z<{9>!xffO&l0-jwCk^B}GICbMZhX~b`^`HU^8_GkapBcOx-1sQeqImb4}_Y^%2Z8U
z*+OwLY#|S#4S0Y-`Q?D@ed7=R-F&k*w&>bHh}iE2q^t>9{@=Z)U=$-}RaCUuP(%C{
zjtpfJ;Giw;WhI;J6!&q(&Du+<M7}r-5Bn*@8{_(2rOhL#_19TREUa*2I29u`efe(M
z;PLWY)0j-^`Q@M#UdA9c=hY7`<ENp^3CPgc$%_i++-nU|bpUOE^-6*<f)t8)H=ALy
zc}-~1@Zv0xDaw<R_*k<NA3e{k{`1wf4<3!~`I0vcCyzN_O=P-YEy{BH<QQ=!*}E|>
z6#`RuKX3Zj#P&yX?SPrazuL@3KFfDUD2EXF;cP#7dxGjg-eVILNnvb+j9embbl`3T
z_rMw~sZdFJx412Zz`JcOR(}?93g-3PfYjPVFXXFe|Es-!kB2&c|HtuCNCr7H27^LM
zIZecriESe}#KxA%c}Afer=k%NavX<EwuIPa)wYh4hAGD}Gv=j8whfh-L#18HOe#~v
z_j+pg_1gFE@86#v&8?fm%=7VhT-Wuu4)^PNTn};(F^}?PW~iokBVaC+Qi1uhDE(qq
z8m@64j-Yq@dV{S`^AR!d>hj<(pzbE%<#-`2+0-pykJ7=18Jcx9c|@rQoj2C=i#V53
zALsub;u?dh<I#_?g8*zj(C~(kLYMZT>ncRU&u29TVy^%Vvh{vfJz!n1gDE$Q)4U-H
zPV`Y!Y+7-OvciM)n5kFm#QEv?&lzmW+Jf%WssqDL_bVc*mq$|xJpZY5s!`nFJN4`9
zO|!t8M`KkxAF$>fr$K;C%S}H1*haa%cxG3$27St71a$`4JFhqD4t*a&%xDb3R8!ID
zQf+w=ocHwT@%PV&8wCf-NnSD5pnwY_*<=ok9?d#Zl0#~XUb7rf8=QT9f5#*I_~D2z
zT~(R`;B6i_Rr`wSVRDQKkrKzyPUjJ~^Q3%5&C<1kIofF4jR*+z5t;j;ApGu2sqys?
z<p&(BcZi(FH}Y&eBoEPbnyTr+as^N~`Hkaj6z}9%?#oe?!k&XA(IclVzgo*Ms0O88
ze5J+v#27Bj4rF`-wtirsG{pQtca4GGlUYvZ=}V#b0FL?A8f<R$4mMQQA|tkh-!;F?
z_exT=CDU%kt*(IUt<62ysTeiY1Fibd`A)Dxb-*^ahAE@Z$`Z%bHATQd&~%%-z^yC0
zb?1*)07&X!aQ4X_gne&&j0Yq#s%@__$U%3VtjfQ4-RaM1*y(p_Y%3yyS+}_xFsy6P
z9k_dr-uK6!{1xSynt~71ogQ4Q>d^OQ*leD_v0rT{NkmNdi(PNtyICSTmP&y}Qs}4Q
zz>~l^|AE;o#&8OHcWv?ZRr81odXrHgYAdZ?_|A>P-cnPZ8G<bH6&?`voz7OKzcHc_
z12nXE7x{;=RGOtyHI)#0b=O|Jo+8BnD)c0~>sV{<f+O@wgfGv_2+s-cJQ&%%HL?fa
z&~04D+lfav54D^^8ebq={8m`RWtzCHYD5<z(9*x;2mw}DxU~Dn?5y~T(UG^T(Ei_-
zDrhNa$$u(pwW1NfWhmq+`G-i}0jZjK?;DIQBa`k>aeh+7pyE7Orm904X4w4A!tj0#
z90ZQC!@*;KSnRgX_Y^)OhE3iL4_UM9V|i``t>|sd+uD8;pz)5kvGCmQCx%R&ID5C$
z+@>^)-Z)V&Vji?A_jc7%lR$Xj+5K~=00K8KgV)XE28@$5HAT=ahk5gHk7;?DCftD|
z>%mPns8V<(qEOeOs|?AOkv%8t=6*7V3kH&~mAyNNF_U1C!K;0LYcuKYE9#m056MF+
zfOD%Jh|3R6h%z}=ntg3P0c&!W6;~=)LD<V-C*FL;^gx8T@Xzc$w^c_%c4bnO3%-5!
zM`=L@ew||MmIl@irjibLGrP1sdFr?zPB4bM)|4yf5MdSFV^hakOIYRnlV}g(h=R-d
z`p}Kz1v=uws-SXk#(>z7T+~3*Itw<>aiK0qtwSg`0GB{$N*+FVj2&6tued1OuQozg
z=vXSU2jtzCsu7slDu|<MEB9D~0q6=Rt<)>r9K12p36+`8RN2<V-P@*K$#oFSGS~YJ
zIe{m>Pd*ArTkG){J9Co}@6?4q2wTXjK2Brg#N{A03ACM*7aXhd@vq$(c+mBD&L|{i
z`>1uH#KNzex1<Ggw2Y$Lc|L~JaqdRO7jZa2(}Jfc!MJOxejyv{(Qfd=Rnw2@UM4B^
z?!FDQmP=ZxDQp|fM1zBR9dI~<vyX3<3KFG7uQz*w*dB=gF?45J@yVj>%J+v+v_OiX
zO++R;_Ima;JI_=8ha%n}5z=c|_J8gYQyWE(q-dKbXP%Z6T!Qx4T9d**iP?V|fUKrA
zi`}uN<k-{TeFSgnCA6C#7Pu~KvrpA&l7;g<?nvrGbvGo%dQD0NF%k6vLz)m_Qhov7
z<W@|0#e{}LAGEb3qAKhUUuO#A74sVoBw=rhjR(M^LzMC#Xx10$+O3^AA3oL}$IFEA
ze}qc{xsND602Aj$CQuy`T$;_o75vDQ--bIeQpY+2UIg|E8MhCo2!Z(!t)S=hmzdRu
z-e1}bE4to>5|zGO@VfW2K|J&eQ|)-=IzR~oC@Z`2G`ips)@OOud!khBOxc<emn4<4
zhm06TtU+KwD->g=?nN+?*Xx_bc(@?cGJwN>P1dMw(wM?U&yD3MN>u$XwBd3Q=(TF3
z{8z0`$g*tv+=m24)sKCBL}v%K>&9rVY6N1$<OaT18o=pH=15&M!wV?>CWs1?XE+hU
zH+AL=itI4-8HT0KW&n?AK0*`l`p<GncwJ9kYB&vJTGph7#Np4Ib!oA(o#)+RH@6@P
z>~vnJwEeX$07BV&VsF0s^w{eji~R6fp}LdBXSrT$USp0F(v#`p69bf}`ndGJ$t(E@
zH<sxsv|>8Ngp+JMdUk@JP&mmq>R+ci|2qr1ul82MN`tl7uBI&C({HXuG3Boa-I%Jd
ze;qA$eQT8z@IK$`9*Pj)=!i<ASr0}ov>-6=acbjh7sl`hrthh8U)P;(9ObUO<E5f)
zuug-s-}`YqpJw_&tftpW{yqlNyOL@Um^UKaA>E11IBr1x&8%CCy0YTJRRg&}V^h|b
z(MWPHU7JQn0k}}5se64Xs(a4KA;B16n(RH|xX58b7gz%i)Net(7ptxWR2>;Nkpr&E
zB_C-{T81(TPtd@t9xE6WxG^<D&N^#m@vl;MKj6U$qgNqo%m9UAP}C}DkD9u&Syly*
zFNwgNI2kwOgec~s^bcJ+h~#<(8X?$5eVk6`ZwZ-_Nix6KOPMp18+e8unsCtM<q-K{
zhl1h`-r=O>P<wgIfJpWLbB(4*ucJDH)X&A?bsBri#7S5h3C=q+U=yo&@_sgud$eVk
zA6VBDf2olM$-&o~<o`-(%}$<$y@T7|`O{U<2niJ!>y*qdj*V?HQ`XLkUEAain;g>~
zuRdaalM%h_tyVuZ(0l6ZpYO@{G95|Wg@-iDW9AAAo;Q6RoZ`F1pqK`phtkOYb-0q2
z5G6Ee6SNrRY#{!$^xW+8K9iSycnGyoMT1qfR~N4rZ{Lf$;C1g$<~Q%#eW&96e>w61
zYGnd}z&#gBUw*r+{p-viWaPBQZZzj@&HHnAGX?YDTh^4siy({mW$u}z^7E&}1_b41
zM^po(V!4owh2^XX{WImhqeDUm<UqGDhBryChwjqrve0e>o4d5(b6-YjO@@QUsvE`I
zb!LVLm4J|`4zXcnftpjXo9y#rf@{WiC>8Q*#Ww9wp0%dGX|J2(^i4wvwq3)syD6Jx
zlXi%h%RsQgJ(hJ#_2_dy7jM4+GAB25!+InJV*ZV#Z&f7WL!O=IDFg3>UiX^0KPA{I
z51B$(GqX%b7%hHaEu8l0jT`;xOkC^+J!pOCkK7M)A$!!@nLkNU_TUm!>AJN|YR`~l
zW=Z{0l-d_z2Ef&hsH(#1+N)2c!Jt#ZfAP9ED7aSD_=m5LfIKkk;AWzWV0=8j?T*1N
z1Y~$kiBfF~#m@1!Nl|cfS4Whw2j`SzU%P?@>(X)%8Gy@UOBC^%VZvb5A?^uN?k+?k
zGCy?HR|PG=8ZrAB!(8dzSG!iGY}39`d~$<*-sRWM`Xhuwu0_rs$z;jT3HIiQYT+>e
z?V*gNHuAsqFU&vdrz6kDNoCvR8rg1Q4J>Fi>Xt{8?I0i`E&K}D53+OQoh^tW+3v>C
z0M{q)6q2%^Zwj^RDt<?+f_{j5rCSO#zWn8lc}z%wqad!<z9uh^QGa}Or(yVP*0OFH
zLDLg^DHi7Jky!bbKUHSMN88s<ifZud=R+X4=_lb8Ex6t|XUB#A;D^at!(=3CNx5qA
znPrDib$)friI$}R*M!{g+zIX}r-|Pf4ZYmbF!ON>ZD`=SBIU-_#bt0*Kb$st?pdsr
zeW8UQK5yz=R6pk;b$dl2RK>Ng*bKRhh5wimR!$21%L~8<%huQ8xk7ipJVZjaUtbzP
z@2)RCsbLOa!K(V<yULXhBOi&cdfmHN)%c@+&rGhd^nB>qK$Dj;L*FkcW`$Q!lJ>(i
z9g#t;{3xr;Iaes#_I)V4iq{(C`H9i(SWh;q#DpBHn|(tRM>PWg2F8@n3)%FRb#i&k
zTL+iyzIlIl4gx&K)hUgil-ZN6CbNz~TWiX5RC2FNQN!WayUc6Kw`kWata~ux9#qE|
zw?J5^a@%S84%Dk?3bzq2;J#Gn%fgsF+azb(Wo`)8L2hU$$qXg1EYFw~s}YnRIdMF7
zKw?<h5L0qCXgyvkPy@&Iq}n(<OPF<{{))(WV2+y9UcCLlduSHvB1K)#+4n0Wn(e&f
z5q81P<k;PC&;Sx?;=qTM$bLUpWkx332$8GG^MAxVN_oYnP<NVt!#aZ3wt9#jie%$g
z5BA)l>J@;}T)0h%<ejMN4$VUpG_qok_qQCJAs@_1UwjaZm#^GXbJ{To<m$XzQ&)It
z${+rooS@uJAJ?nUi^YH7woK*nR^0s50CfBT=!?{Ij99;P8>g5h{GI?ug3YKV6`8A?
ztRE%gbsKqQvFL&xYgM{cKxEJMx*mwXG1k?eCqkUSxh3dWz~m*D?9a!^v1t;P*S#NJ
zAFnB{rkE&e=6gqU==p><KzpM0L+{&Cy5Z=>QauAgWZ0VOQL2|hc64SIiXw=)2frN0
zI147>nC|*URx?HIBhUS|<NHQ*s9?(iVeJFn5j+?X$#*TlW*)Ldvxomm*$l8rHr)1b
zHD?Z}AT?nO=S#cfco7nT*FEc@ORgrH`4M=3>n9T+=H9NKb`D)}HJRz1vL3;F<#*w2
zC-;i=OpWzdNW1TT9<eOwwi3(0j^)lu;OHC_)Vwc5Ul)8w&}!_NidFXLwN{nvw}D<b
zA+@l6$J+N@HV@Wyyqb$`ht*u0kI2))%2sZz=~n}9>>VD`f4SG^S6_~3ASK-@K3Vk|
zip_k4g*%>QAczZmeclhi_n%~0XrC0a{_f`qcWi!`D4(hxSnw#;DD>w|RSu_P@gBTw
z6#ELAAp$qMK;n0GgeAmcazm~Iu`RE)YKpDIe()$gFqt^}$foucLFP5no6kaa0Oenh
z?j(W=0dd!kXDg-9)?p3e7!LM!Rn<IM^g?!6<#Aexe{(EenQJ<L%iD>U^W@D+c9j=u
ziu#Bfs?IQCw^U?|@EKHly{tPJv}zj}H5F@dIOKao2X87BY^nnKqxse0Kzk~6NjD(<
zrMv$j*PREay=#g`L~8w-=`WUoFNNBzg-MxeAWA^nKA$uYf2{t4&N2bqfdC~?jA0X)
z-b~rxTN<W}I7f!#xg-3@^1M|z#k~d}>(SRkHdf?K3X;mfXQDz8z}wM+$4vQJD0~7s
z7!1V1(j;V{`)zR{-WBBE@K?roTA>zUv*0(cdq>Fke)RH%z70KDmIqM9zEdX_(qAQ7
zo0}jrx(PEf@4*htg)L9#J3kKRwx#-JffH3XF#8ft*KEK#?-O46hA0E^WGwhOcnvmG
zZa{YiXTc}<6}y?T{S|4y<1|>`oHjaQ-GAejiVl#25>)~r#w3q)Xa=N*rTF{1e#-Z9
zb#sS^V^JzIZYcL;sXKmPj_41Krna1g1z7uENPyNqNr#s;-w9et$rHSm#W$=|6q!(M
zY;!EOB7cORPhDS;BciX+RrL<T$ctR4CgbOQ1Sl-z7RXS6i7i8v`rW;!{J(R(YWNYx
zqKV~UVexyRJ|XEp!GG~B#C=}(WavI%qaijU;2xf+r-?n~pdD<2$;<si>L4C0AIrgD
zY79U+f6rv}l(WbQ9M<$lu`8}?5!fYJArklY)svzq=8CTKmn@$>U;vUXLr}HgmBF=$
zTrE8I)X+X3@E8s;H6xap^tk@@iA-5)Z3!GfydeUF9KgGCT{PA7sbkE};**z4paC1C
zd(On}EYP5{^+VcNvD+I!S#SM#)9c=pM7AG?iSC7hHt-a0wq!ql1X1t>O}I&ChX?nx
z#Lx<elWr@#B0;yK204<FLM_a#y*`|`Q^9f{+10V=zzpb`3qF&a)t6r`18P{!RB>wp
zmlaj#J7qIgzjGYYv4+>7a{8bY8>;O-3lekz92M3QZnS{4sit`8pzGC*#!e<LHT-kt
zs-SKCAHJG`8B_r~_K3+#EZwu%Ydl?rG|H!X{!O&X6SUFYvl63r84LEM*z==Tl>wa~
ztg>)qMTiLm<t#Fh15o*13AKG)BVdMl71?Z@H>BU80A&Xx(pA&n+LeZEO!h;hMS+Qt
z$M_@0zE3PqjA~+tD=8r+FYk~Gp>nF&D_O;sZ(<Pt*0ZUPUqXWvc=BF%u&mQwu3UXB
zQ>a{9mTRIPr{TCLxIEQIw1c_}P2Nu^Mn6Sb4$gujBs(eCNi|SrMWU)V3BwqcO5kNy
z<TX?D#?x&1fS93wf(%rNX+T|12Ql>^DBjo64^3xGYY6+M55XaQkry_)Nf%TwgulkW
z4Byr6GE08p=nwGth}S(58OnkxvStKxxB$-HUm51yN^R4<Qks{mSxrAW@sP>O)&3bi
zI)s@z2-gwz(p$2#Mtb}S%8i^daBTHX4XL$NWjw*J*$lyi*7*5W;Rm2so+0i4Cq0xO
zPEfMw{zTn24o)`;o4*REIISciW^jqAZ(#F1Jm=Sp5(T-Mu*r>($d?V`392%n;0{Qc
zA_<V3PxEs#nSqI{R{^7a!sO+BsX>7zJz`PK4OQVID)qXj&PAdE-3D%mQibP;uf=lK
zc@hx)r<TgSIe48xZZ*!&{SOp2t6Jh{3N2dULhwZ5g{aZYH<-OX*3Z}NdL68d=3ADh
z@q|aqv(qir_kynMh(gsus}T~SM(@^I4_*>aQnO0FuPL4ssh4chi?!+eN=hj7`n2BP
zSkF?YE4}qcuSLvEBO_XMsnYA7i8QJmZKm4x^YGm}#qWY7d(tO0K=FQxS~vzG=uR{_
zwsKLK8?4Q0L-vgIH-4PK6Hf%+l&9K4E)4tXCo|){I=cNl3SJ5Ex(i2ypQzglx=n{p
z>rNM5l9<B1Z@f>`O%?e!1mXRA08_!O?`>M^)}$-~qW*-0+311Uk6!n5IKMzav9>wK
zR3bvOov~B>hm#A<(&LH}A7)$eySHBV2&)>3-+_<Lqo@aFU53iKjY*G!OEVqVBW@;z
zYU*CD30j?5<k&Cp$>qeF(nClU-i<FwSBEZ8s)>6Q&D`0LJ_?aI)^R$RvJ<>(fI&2A
zg}ly9h9uSXkd?|jRlF?VGT4HhC8=7F+5DIh1w~vKU=^Lc3GXz!0J~+;cglyOx2>kX
zdtSVcZUyKE;pXsJ$hwuFx-v9H-$))Q_f+z`E_>OZ@2X{tlfNnU%9N~KaG+k!cKI&i
z&1J7-*%9)8f_JIgLizIQ6t9Tq#__QC*DNRno@g@b(MRHp@a%%@tQLhi0U8os;k1t9
z(2P`1nMJ|t6+$=b-ZwCBx>{}1f%i1!P{9gQ&LVz|vv3Rcf+1x!x(ce^7!bc5gJKW^
z;hrFtMMMQDsipWG)TeGD1MfZdac>F*3%CmSyK&v{UAVJNIf+OpPLReeoHco=wxDkB
z9r66vROpJvnxd>!M&tTU)K36&%#xq;OEV|fpK6NF2qqxHmi*vq(kwAwFb>T*^LLWz
z>&#`Ykk`NEor*<ea=*U{M;eTvB8Dbe1sxP)buI_5Y6;P(2AQ5lT2QmrWm@Ll!LN`P
zVam@}Q&uaplAxPA8`OGWlY(0l77zpjz4trvs;U!0g{Q#j8TRekf)Gqo;sXNS2Wrav
zSH@y9(7(xd%GuRqQdlFrSf1ZZzghfFD+#3u<wmbVYKpzZ+cgM#IOB76)SU&^qXp3W
zXTa-T%wyk14F?E0m14T}`QJ$lD;pTeVD=py(@#4RZogrw=+L$N#8`s1F78m~!`{>V
zy-C<y?<Sc!f%#ZER1Vh=v+Bt~C7GY_D-@d?(85@3<|=6HOxf^?1O;#a<DKQ=hXu)X
zY)Cai_1Ey-mg18p71dWmh0Qg^LG_HzAVQtjJsj2H0o)L9uBO<DG294|PM_F@pgvCv
zfMzM&2s)$q-Fp9Qw-fcPQxwP^;nlm&YeJgP``6*SoyG6mq-oNNR<U4HBEZys@Pb_e
z%jr#w{e{}SYvC4%Q+DQ`;8Q)LtND;t4Tq@fr6-VoyFG1r;VNE65egKD`SY>*(QI8}
z?j~Y-)M&w*(Sn9iZv=YX2pJmaO8v!BC5yiX3SGgw>+yHzS)(8ze18j9$9hi80p)0r
z{Ck)fJMfq_?`m>G=rH2jnp+88LuL>=5$87Da9m0@dHIG4s|7UaBe6d2xXDW&aU=Q6
zKsQ{|=<vNO+)XHS^{37J;oCY295llgZWfwQ(G_VMRp-B}|3IrLRuO#=u5>7@w5Ul^
zPs#Tj_H|Z*BXWDBPVGurw91bUe5bx3#!36SA$cUS2MX6V;pGRrH-^*BkznhXqlMHu
zmWZxVOV^kq%N~Y{ib-a}A*)5gi??w~&6b+YP$6mwFMUP&x>HU1%CMo<L1xI|DZrG9
z+YldFxcQvSl48`rN1O6M*953AHkK@Ht!ZDKlB&*iM2VL8aW%zrLZNR2B%`M<e%^~H
z;3S-C7Q~d-bbDP*Y(?@+tyZD(7;QeH{@DS@G_mj~XMs_9n!03lzxq(wcxp4HL`s2c
zhsS(e6ZGwg5dn2SBlSht@id>1($T9H!b-%dS$_xF3?23XrpkS~(jaF~$;OWiWwh`c
zf_6Y8YwcLpCL;9ZQgNfNoodp0hKtUERKr6jAFJCB-~H603k4?`XlMcdXG!W+;`vpv
z8<e}h#pVGbKOd6P&sqmZ4#7OX_Aw-;C(^Y8Kw=%P58s8WM-CBuW_Pa~x#BfWb7*7~
zV7{v<ZWhl|FPFH7@$VDCAC+n79Ux}LVXW@h{DGVnuzu9YM`10D@2}IN@t%U~vAvGt
zTgUayBdfP0ey1}#-LwK4)64VMp=ht6#v5$EqWBoyDodmy9{0L8BDRp8hN^x!Ftpl@
z?5Wt>RQxu{t7YOkI<AUyoUSk*7Hqvu*9#L4VbnT)${^XfvrVzt)v;>8++nzIfxO-(
z*ld_=WfN@Ja-zU|R|%Z^EYK>+fyCUAlKdwnv;;`uTB@9~gyI;LSxb4VhkN`St^4BZ
zSgw#%hkUet&nczM<I=t5L9Pj5^&e*CpgUv6DRGd*ly0k=6Vzkzq^%-b2jNG399V@N
zQn~9nH)Ab9TmE#SUK1>=T-R1TSH&<<WZq>jbM6hvCpawd8O{!9d+^-EYULZ^AE*4r
zFkcRvzte>>1llnsVAC>X;w}A}9ibRSOU*2};X6d5jE>$0_i;C&pn$oy39SQcg$lsa
zxB|-QAty~y{OhWSx!Z(aGoU#8brsYR#{-XBbV2vzZ#<3MNesn0={rj@jw~-Zp`<VY
z`G)pqNda;X0F+TcCEu?!v<(T`1ebxTxHgYp)ck0L_vitb<BDkRM19aBVE0a{*?567
z#AdJ68N)GGycVq%4?A-HplUwo3E>+4$=^v;1{Ct-=FUtv3PfbeyQ=^Yydk`b*9jwE
z9}NI+BYC-8A|04_XNS~gn6#-PYqMa(ZKp=9o^{vfU7SN!>(G@W=vom_sS72vP3S55
z`e#kDhEP)&$=k9Imr2R1p1Q~w+V@O(?{YHi;U0Ni&`~5*b^38kuXTU7JLE6=yHUvh
za1k`ey}!p4`kX_*qioF4fVy6<Iv$egzXq6zS<Qmtc(j<Hex=x}Grx-iIWxo0(0(Js
zDt6@qHWmcn+^@r*Q(R5L_zX~4w|u8Ad)>Rklxya`#Vhj!X320JvD}F8?AQf;{$<}O
z?L-$i6T%Z{lxOpxoLx2wr#iv1L#&9kzcbW0vghckh8Va&tLe3-2-8F8=aOENvDFxs
zO(a*Yj=isrCl}d^j%1-D*=rEn`1<V8C@3V*LH>h;e=z0|PKjNTsRg^XB<E^LDr{d^
zF*t-jrQ0m?8%kS#jsTYk<LC!|0o-iq$YIY%ENDNKd*pqPURC^VW703+qu4|5+8!&h
zYrBjy*qHFlAWk*qx9seWy5X~KCNHC;Ka@bDW-NhM2>lMY;AeCYGj_mfgwYdOA26+K
z0uWo4c>dF<eioRy)V-EQ#?SVZL$&d8I#;j@DyFd_rhE|Bc&xCJr%<JTd-p9UfXjR{
znrSwg2~32w+4WlH;_{yDK#U987w+Le?&1I;Oy79=A<HromI*4z1`2h+atbfzhbX;e
zyCNtY6~h>|b2F*z*{0NzLESul#PyDDC08>RT-0VgZ`Yj)gFP1fC&Uc^yOE%X3yM40
zkMa9Coz0jS=aC23@`KdRH4c9UAV-T@RuTzy0)^-=!ZhEhD8y>WedEk|fq`yHG^f#Q
zP2raQbzd4X;OYbI(8P!MyRWNg=65lzdq*0MKl%CP9y7b!55K*yY<Bw%RAJ&i-6iHb
z5eq0FF@@8GVpqv|b+Jdg`ZG6^5y5sSy%ARUMvQ2f)L_%$26O6G4_@l>c=aDDyzXri
z??BN;ZIQZww5;!3k8CJ?@dhr8TZdyVGKW7az#~;xK{oasr0OPm*4PN$%X2?LiO30B
zc6bGPI2d<07@}$fp9l<c{e%kKn*7w#gMD0TW*2EvGnQ6H*@kqthl^)Od+X!+Asyb&
zf=;e`@EV9I&k|7xuV6D^f?+pb_8PwcCk)Q&*E5p$pz?gD_M5ys#FWdTVF;DH8F*JV
zW`nNkrI^(tWHU5rn+H1y%G|PFpM%8wF=9Fe=GpeDORy<C$9cQDCr5pEo>#8^(==6w
zh)&k~17p#X9^G27>iDYR&qH4KRHfdk-jjg~xfncSxTdD~ig0_s8V=u?H8SkWLkt}1
z2Ppp=;l__;9vDr_ha0=$`9t$9!LpY_5d9SJeMAR1J*w@2?$@uDm?R(F6!?8aK*VNO
zlb9Z47yz$647!>)^G6(~&x!C|!*>s(e({}Ryv!0GzwKl_@r6pNkAq}JcJ|6gX!=|p
z3D<d{PzZel2H?YIeKc$7t80gxz>0Gk5>;BVN9~etz$4&CPP?wY8h!4|p85|FNZ?|@
zv2(PZFm7*x<25jC&I$<B=MM{}q+9GWr|8Ov_3Q{!yi78I>gnuJI90=?HfHzD1uO)q
z#DE@!^FtAD;GU(n?2bvbh16{Q-x!NA3pcZ0JuSF0;@gNshq#}f8eH$)<)7*)a${<h
z!65G|@`(iu4E&8AwkRKs#@$J-AKvv!5QT={C_?cM)y!N2_vtMwfia9zRr%Z~O;jDQ
zD)5Tv0Pq^77(px1hVv(7u^a7k8~Mq|6szI1k>)lWES{_aDP1u@z$Mt3T1N77LqBlW
z$lyOai?{l3A-{|4b&II4bzCU%jnM4MgFYOWk!lYl5lZf6IJwuGN%ibA3WfKXt02qb
zIGtEc%uj4mL;UxT;KXfRsDaY}c}wIGQ^=ChbwJ}%W$m|;g}suyzEfu$ryc9#P%+&Z
z2Bm^45%o*UMXms-cHqWn_r<s*xmL0ULelvMTZV;!b-jo?tv>sV>A~SFI6&Gmet--o
zWuRp}WB6cs;T%9-XJB$>LK3njn0{5)my`7$W`GKgoTXYgTW};}o7g2u>kJ9d*X(m)
zs3|&X>LFNT+)Bo<sz#(5J<R^Qh%fCRZn`|g#f|r_kE<L0Y}4+;srXduJGG>S5ZsWu
z-hN}%Ql7}+vG3Ay!NWqzQ-hD!4%V?5ze+cB7J&HxjIW-U=>+GX;I898d}G*UPSc%s
zlBxKK{J&{4C$`DU9gWlH#4ImBRbwGNdy%f&*uYp^&iYCfqEzR{5BsMV@(r1*?>9jj
zh4Y7R)_jvpH9W!CrT#;Rw9+8{`IbNk+=A!MK{}JO`VZfULe1c7+0OAB$GxCD01-jl
zg2Cdqjx*2lH2?5*fFK(@_kDhjF|UQuNlNQ0c~PTjkj(_p#7Q$CF&cZHjzu`>-Z{bH
zLW*q$Vx^Waa}YJ$9yk_A*%hrWd1%h51+hao%<zl&V%DxMf^&mj3;y*VmNUoX8&3_+
z-uLoP^W@h`S0V{2YPesMb_9KW$m^%OLl8gn>l%&#_a}vDRh5}3sdpk6-&JE!s76jZ
zQEw|c&isxu_*wfwEg=0Rs~N*xJ+)0vjxnF~JZc$%%fsk-!78-aTm4fDMIxr0A8>hk
zY&YD<Bl3v+cI2%V@5ETvk4W`C9Tq+!NML$$9+){nwb0cPFkT2(Muaueb9uB;!MDhU
zKEyGC!*pxINH?>`#ZKi%BH#)-_|iKJ!}w;!h}5O{2F`ZGFpd69%V)~z^LP}vU1{vC
z78^!7v<w(rL14dGdLYMBn+@Bs#`taJvV19=sDJJ|mBM~PG?06qK|NF-2Pn=@!)JF?
zT!_gTZCzY#(ZFax(x|G1znWE@$>)0@O~$XpHUejKTSUtK>Gvrn4c)sTNDF9%oF-<Q
zB|<3+n6Tz#a7VU$NA2+0I{-Cw=u{%S$^j3Kr!L-!`_=xu59|iVX^1iBC8i6PvTwF3
zOb+`_ct_|ikJt8#SygL3$bwcS$A?k~YX5WqoCt#3y?9<@*>+9q&Dx>?ZE~=InUu(Y
z;SgZ!G@%=OqkDq`RHz^@!M2Eci{6wTIo$rmbukT$f?VW%QH<eMzDy(<w<DSZCDxTl
zov&(Jjak)PK3SnNHHGC&F++~B>|v}Nf!0uZ;3GVvta{sP(-yrA3|KF4)BU3FRBNpA
zaL%5O=lnr&mO3(qr^GmTP9o@IeK9rZfc0}5_{*1T5G8OlK!2_9WFLUTA#<YJzEfrh
z_sFdbr}u@AnJE1pUaZpL5U`%8qJv{;je@OpAAb4(*P8H?^AeAORjWau6LRij->!@>
zat_APO#-fhTp}-qgw(ns%(AV>w+&&0S2^LEhd-}ej#B5TTgNw(-_>(~1~Ii?bNs4s
z{<vysET0B<XQ)TOuG|2jF7yU^-~6_B2UFc|_pN$j&f{f$4$8NS7RE>8_797IK~5iw
ze5VZBp`L*g2)lRKcL`bvva4L|vu^z1+o(FU3cMUplTgf90|#m*#Z2F+&4~5nT)6G@
zzS4}TP}$ohm}08<!7m?0^*&~<ncy9Eh}hY{%_mM>tcSzj1yMkgk3iSmcwJ4}o+ep~
zdPZQxOrpL$Pzw>KhF=+-kh0%3G-x9N7HW?8`appZW7tASm%>Hwt#ZKNPAFjn=n)u1
z^m9yknwdyZwa@kx?1LlBst5kyYL8_%3eHBhoT_H(Ot7LxU;P|MUwbA*7EuJFkkgEi
zBrRAB9rY6fHdS-|n|cP#Rv3yf^+^4PwS@ICT(zMXbM8&X@Eq+m3Bp9i@Q5gbXiA<-
zLKT8?1keX0(K<@?OO&j6PnU33s@H;KrLFsH#xiM?9m7;=nRu0dI`{R{I{;SfCT1Lj
zhtC570h(O7U9QaWQ61+9W7y68XWyx_1pPT=TKA!T4yp<{3eqLgwbyaA5D_#m#*M2y
zfkEea{6<S-q2PHAP$MWHA^>rH4U7-@IW9fREE8{9uxsdn<6=WbQ{n*sf@iqD1h9Sm
z^PgGfHdO8?_`p<&Kvckx;a@6(KIR^4?i+l^@L9$=5Ga*oJ!EubyO=SC9eO2F??|<d
zP*e)-QbfJ}uYhR3zv?@c={sdd*=nvXX>Q@45tsN*O(L}C1P-BxmhKX1Iueub{WIs`
zSL%_yN=%KBkZaC10Aa|DgqZmz58IgX)FQ$74uzbkcj$g3nZ#&*nchZ)qTYA}X0a*H
zc!qEiL;{Xrwoy=v8dHuIQd2$eh%b+Qr?#q|YZ(5#yBv~u(W<8<s)XN$KSTLtJwgF;
z<8fMeK|NC`sM}e*b1W0cJk)qsy0SCxKK*w<E67Rmwj|xV$-n!Wa<vh)`5G(;$kZ9Z
z5oW;qYKNZL6ZN(4&-+fj!RrQrF2ZFjtCE@CgH+AS+2;iJfli-)_nlI4wB8SfCS}cL
zkuCi&>Nhtr<lv?v>gNza$nIz`t4ctNwn=T1lv{(%TB^Y|eCA><i`M!VBu;m}fp+D5
z^GGOcJWSR?^v!Du=rBG-YM7Uu+=Q|K6fwR&&Ryju18!xPY(|tgG7orsN<j$4zH`&Z
z7IXW;M-ladV0JcDvB3I+E#goRPNfU|sDbq#o`6<b=1B3M+2PmYn0kJ6Y?u&-$Fd<X
z(XV4aX3Cs-a;jCd7E24URDvUxFNrzz$UsA)6ZL+QXEnuz{1hQ}s1|C+!K<xthSm#W
z2o<h~Rgm&Sj>d0{0{&j<cP1}Qr0dIRPsq0-d*#I=jA8w3j3r}u2lb4}OAB$C^iV(g
zz<aZW<oXY8%j~Iq4b#EZad!|?8JONhNWZFfM59{yZp^i{Z|*2DRSUV7=-tXXO{?$I
zbrCn~T-ESdtK^@H-+jBVQ*YB*?)HUA->I&@AojlxurRMpVvd~Uz;RF1kMIG@Y7`OL
zwFcKE{$;$d3f!guLvlAD`@-in#a-QvA|EIjNTW%@0NPyU)4AUatDeAV@weS4BcU)y
zb?AO?tcp4BCGkQ-&XLp^ej8rx5gae4qY&@rGf3uaO|gY2X~DigW8PIWC2J1M^`C$m
z)l0v4-J1{vP`8DGLtR2<3@b^U5r`h6(T*-uFFd;2J~gF|0ojD)ef4phl3R=4g+YF&
zAjGljNkO5=BBFi-wp@00#Y5F0|3^4L&#jSjW`VY_Wz?<+qVr0b2gjiA)ewFqLKz&G
z*(y(Phb5i}AQ?y1^icKwGeQanrQ<&P*T*T0A9Ve+w_P`ei+ENaQvvUh&PZo!iq)Y6
z6Lq87EEy(5D-?jPvr&~~pQzW7K!s6CzNTn|((*daO=7=r4k~Mb`l>_Ty9`RFzA4YW
zA#%YhKq(KDk!b~S8KXx}=8<vH-2r$xKRQ|m$%j@AA`bc>%t&~QYFn}O<MkQQbH?!C
zanKH~3y=t%lVHmWufUlqaC1S?=q$>l9CY2eZjiMTFQ27jYAZDGzW_S#nIlIJDWA5I
zBFRf64VF>mb6Rq2!O-3>LKm5o>h7C{u)p~G36SZziC<@B2~N@3$6Ma^ZepVD!<q7Z
zplkCpn7a3yWJN#$?W*Bj1)jo7HN{~<O^W$-THi^l#TEL1AD#fD9@Cj;amDMp;50#g
zkae>JNQM|(pQ@_QKSQFDYMiV**zHmpvU)_|2h4cvJEN(32`ZJWlB<y<6}equaIf>U
zqC<C<gylO$My5A33q-5VXG^{>FSx;181;mB>8|-(_9mvrnP<>A+%KGjdpo%_q1VnO
zCSx+sEk1bCeCBPwTkiHv_lka1bn?9&dH-_KLDS6?-H~`N&A44#9$J5s+Aim0VX^1D
zfzxM=4SUoz{@h#klk8t9YQNyrMvF{;FLper;gnPCa#5o%!2HUUO?Uj?o(l^Nd)0rl
z=)ku_RgNcbw?6rFuJVvek$-h2iK#jFU|`_OfrT9lN=fd+f7wafq?2sRx~IXJBx27M
zAoiO(ckUdJu6fJRWopfE2dJ7YfC26=dZDJBDOjP*uas868+J>L>~riW^3l9dpH@RE
zwoqV4U7fNE#ZGWBFC$?ti!CG;ldoPi@PfE089}W5<~5U&LGe7>l3?UgWHfcp@gyV_
zzetZQ981!+4WSwJoozbLi&aq${_A&Q&m$s73wxz*Xl7|~#({S6Ot`hSOVRx(Or}UG
zFO@%a>QrSfWME@y?LV3<u2>4kWLos4Sfkh)o_vKEQgn3mW}CLV<&=akHpauPv$uxE
za_AqT0&U7k7!N`8*qezm_~NgUuCdQn5p+;3qFDzpZKpj1>#^+nRJ}pr5dtkNi-b4n
zJ9G>gktgNBh_-@8{u#+6-N`(2v$zrd)srxxC(S-bx!1)^29zc1s82mh7-^X3<$R70
zv?;a2wR8^LFU<>WzS=(Y`;yrFh|fpSq~w%z{epFL53%UzZep)UswvgPUpRK9cg-`p
zu6KV(-;T)p6LwpDt_+16xirYZsD?>vyRs(OX79e}@n%Go%4~6(k;};enE$iFFQbLe
zM^kr?<_rYd_ViCZAj{szXI;Y6PT})?vPi@t{o~QmZyQCG#EHc=5@s>gfA-a@SMdT1
zzO6(@>XOj*ielS&eo%=m&I69r_D9-WIumVhq$^%%yr7n>?ojC0bO5HAu=0$6hR-{8
z<pFB8<cd+BoGprt3gV4OCI$xvo~JIY?n-sYdSg?;lPn1;RoLQRja+X1jADzm11}lH
zkT986(p3woGgr&X=C>p(RdT~(n-}C2rP`fvY*B}8X$rE?w<FBpNQ#X>ZY(vZr;>e*
z=>o%E6=3yx0;sDeH@OsTBV#goV$9;=*w~oO!gl*~Pm%ZN)YDTMX9VVBJ5cP|B3Qr+
zU64)}LQcwbA}lkSdjmS`XjgWlb=Z%jaJ@wg|JgsI#TXoM*jK`TE=^d_PF}Cyi*_mc
z5W3P+w33htPwG1alXe=*Z#y>#!>!Q=(A;G~<88OnaA7kQ0~b6eDavP(N?_hDMKqAS
zbbR*G$Xx%xzyUFC!TK$SN6|@EGn{%9L6!03KclWLM6qLi;mtO`<Q)AnN>dS7Nlla2
zwgwxx+|t`k8x(EBr(Fe>9@5SvWzGoOq&F5jV0V3i>ybrlrtA#cjB49!-l$Gh7!;Tg
z@@Is{3BUk%WOV;f*tPtFgumut^eDEocw@W%3~wGZ`08lRe}1H_wGbs>dz-0fdC3b)
z6b}e#G!bTS=W`S{5sK8&m8|+vW0zZj9l7(8orHp8K=tQZnSvcjvO$tC<cYllOojO-
z733AG+tL<n*K#*F?~tZDrB~JspYM&&c!bZXrfNBZ+9-zU7)^03Q8ZXERUHIZeJuM-
zh{H#c{zsDh$6%cnlFB|rN_DQW)E)%u&Eiwl;YF3TP+~W2fzKw$8yD41*e}Q=YgTge
z;aQJSG^zI(ZFB75BBML6Q0%5WHXaccmv;s5k+dsfgaR+N+Ftg5zHc;DhoTOXI|Op$
z%Yu6z<tZ{&$b0{O9erN9zaiSHoWm~Rn<QcMyAzub5!;y>Be2JEzW?7FjgE{U)1VNt
zZ^T-`Z3O%fs>Mf=W{Yc)|A2=`hpAY|Z~yO8LC)VEFq&c;peZN|(ebe~6^QzkT7y;g
zVSqOWLaAyg*^NR_y8r#ei&D#rbr#-Ot_uM!6);&KMDwDg3Xxo5(TfulnTeh+RHy&F
z+2~HFyV2C3h9a@sq&+j8sc?pWLqZzM{ZeG)^E+y@<XDoPXUM_--}g`8u%}qI6uV@!
z0~q<|Ol3REi$-_KAMi;F5o3i3|7SAWFZ%lha@qJ?I5j&~P$)D6cyE)7dDfx!>=?M8
zVC%o$?0?F*DB?cqM$`F8@tQ@A%5J#FxHVWao^0T9@+OwGN~&FP>A%Ya)#akz$2hLw
zhNq2)4LWlQg(B%X`!qlLfua{=yFzEE;8zd(*V~ICes?_i#t*r6wwj7L!&jHeCSmMA
z=3I*wn1^H61#w3t|5_;Mzta6Smz}U269Uayd@yOv8EEP0QFOHaI#pp#nB1PL8v3ud
z_w6`t@Prsj>{e~hy&*m@mRZRg6n>#<ek3;=_1V!cI8$u(djHMVlLyN7+gvxfPUI-G
z=dz{f@xnrZauUXtZ0hpvFj@jWLyTZq;QuBNsN?<bVy<yq2&o;+^$uA<9A1-tV$&)=
zBbUWGtqPW=_)xpSzla&RM%|@zVr@Z)o`rytw7OMzL+nkp*ay2aMl~h3O@e=gY}J2W
zN+g56xiV7jDSTEn6*a>e<R>I)v<5pguwnDk&EN^LDxzQh`*x5@lDpBTgXpI7)l}ID
z?f_Hij4*_%5+8EO=n3_*#ClQbEz9Mfhr`E??!CJIUA!(!HIHJItlX9TOiUWf)*a0R
zUOlyCt0t`v>h}KMY>fIctuDT}=F6>>8VB|yiVrSmMDwzm+=~3?9|&OIXj=YT4s6PE
zj3Ov{fPHq-vOq5?>+|ZF3W*fmeem#Ejki5MlH7mKeB%M5BehzWn=U+}$_~Q)W*gpi
z>q<9_r@w)>H>HJ0wcoN<y8j>I95?9WTK33P^mtR(6bdIn@ByQRgr$MY@C~g35u9Eh
zB>!8GBZ=xR=9yP*cV+M>SQTM%l8in(O1c8(^LrWTh44u4%A}P+Y?J>(pR)ZYZ<cdc
z=1Gk7Se_z}1=I1u-J|I_Mt7|DnG;!CdrOFIniT!FEK>i!)>5PtWzbjClIu-f?JUtv
zTBXm<qS)D=pK4Mt%rola;<%Ld3kuOa$q}bea{|xUHUCFnv0=!ay4+f-jEXQmNzEZk
zh3pVdwzF|7V!$P|76K9><BaIh=*+dNBn1`0EOia-UmSAj3^V9^dHb(4lM0>|wzpNR
z3i1MoorOy>L0%%8w2~)wlQPdlYh_842p2+#KmKdh?{=%ZG!&ZzvLo=>&avC<3npXj
z8hCos-K#@f-c=7Ed`y(Yh<{KV&vKd>+a}$<xH_xp-}HSk0aM>W<bZ-_OO@>}_yOj$
z&NkSh#idB!n!P;`N}fQ8wh?=c-RUo`?aX%;%M$XO{zY!YMD;y>fklgD^tfiwr7p)#
ztlF+vX4E$oiqF>+uUOpimaA3A3|8Mq>_HjE43fqQV?_Vnjztb3@Pwn8CfD(qkEkmL
zg{xaa^le;<MmjQ~!lW~U7dxin+r6`#XA|?rDM>4+$L*^zH*zu0H(RFT)Uabw?GrVR
z;2~K<mv?u)saiqoNy&=9-UNs6Oxf~YLQC*;mL088pdz_J{NXG4{CCYS3+8Zrj*(9-
zu0<Fo_LHKbS)ndAx3msZAbGZ13e*cpW@=rgD9?^&&~4Ai6$<qT7n=X(o!iv8|Be3G
zJ_(hg)s>+F#RD$4F4psp5%QoLV+HG0YfG9_Ij_I0Oqh_Qq#|H`9sb4dZ2`!q5mR?^
z$6bZ4OozfCZvCiH-@evtXUS%%S_S7+$=L`iQ<9!y$=Oqlf;~y9&}-`J*e4YRz}~Yq
z|8E7CaM7Hg?v&IZPTQs@uP;l~D!O+|4GEctX8IG#xjXAV?@^?#3F7R<8-C^8o%i-M
z-TzIWwWf?>Wlvi|RrVYxiac6N<a#p|gLu{WY<K_)>_UQj$I#Xa&U2>z*FlSnuJD4c
zAZtNPu)mTqbA4CZ1j~X1dNK0*ZTMVGSOc~*-HLe22E1JOcyz8h6&mL!)b0Pe26H;N
zO)7#$SLDaK2$193s&ErJxVvGL4kMlCBybDFafBS%2wS$=1G1iXqg|@JWIZ9{*w+>G
zZL+bowe49dIPi5DPaTW4{kba%)0IELdNXR$w{HjcIDuv%DwM1Xq)^IvTIKA1*=<yr
zlne69{vCYkWWs{(!d+w$eRpjyzHoh#Q^|@E*osNhKOC(t6|T|i_7Sg87G9uD5*`Q$
zz2^8_d5Q(F6!`==Gis$}Wjdl6e$1Vga^x3AI)A_%NOtzA6Fp#}BY!+v?aQ@dsswS)
zQDxnTag_e1yxGwUQ~qMzG1@BP@<+h)_!hh`eVzlS@$ScEh14gv<Kl~x+9dsCtuC4;
zw1C|7BpbGpv&0G9EAcJ2kjz7MWZ6Lxjj1yEbtXnvy217R0F`(<7L4~b99Z_RkEVlU
z-HGHSiWQ|6k|WcXk5=!>3X`l}#GDZwsk?i+m&n>i)tKn*pdMPDN#7je^SenwXFbcW
z?9QUp=6|)CPksUho7)No1rEHhCcmQm6DtcLDuZ3T=5W9+!#w(V9{s{9>Q~pMPvx`q
z;&r1L&az6rwda7*9qhi*g6E@|R`~ow?oG0OO<L-amtXkazAz$Q{kG>hb?puMU%!{$
z;cIlJ@5Sea{6iI##WInVPJnK-?A0P<9-HPFM{=X5*?QA(WGfw>XjZcS*7$%3N61c;
zY^Y%0x*wK%3I8T-(?1sH4kqyOKWw>Ax)37WrN=ou-EBV2R$}TUHp!2KIK-3m<4JZl
zA&NF3X#*v}>b)43lZ>5(kEp01j*mF1Jnqv0+~4~41vxPRllec=?sUhow})a#R)K7&
zQm~2aJsipNnC9qBv!kb3f&PUZqqOIv8P`TL=|(=ZL*R2U6;=3a(0_C6&SmVfBGMUk
zEV@t1ylGoXRyEAC>|F!&R49XLohF?`@Z;&4iFB1jx=vdYyp;T)s<26`jILE?bmtEb
zQ5#}kZ6#YTFRKA?yN3zO-`O;QN_&d3s{1??$U!4><Jv^>l&8BrrdjsWJ@(UFy=j*D
zG)r%~2kmazyT6D=%Jq>bE#Nu}ZcvcW2YE$2u3X-kN|B(PqhF*UR^B`L;Tm;#*mQUD
zSoXQmtd3ELX|r~Z=D!)uGaJntfLBSd6}Z#y*mXi|1#hp^FiF;8`7yBB>gQXKM?dKX
zae5OvUZHiFo|aI~sm13(w?nA)0C*u_6v&p-!PIMu-TjfI@{zx5`iB<|C8QT|HzZ19
z>GKkd$KTrHWPO>i44LQARbasCuaaO>1hc00VMuwZ#-jzgqp2OES<goc&yA+TH&b*?
zyCz+~CRueTmvOfQ=VzZezED%Lq4WGa1*7=)k|S47Ku{Nm{1h3i?qXA<6-ta_ZAZtB
zfz(1((W+-nO7MRoFa@R;Y}>#NoaV-jX6TOQDcF#v(^U7FV_b%zm#feYHhpiaWbHq0
zZKOuf@)$Z}jz#U!;Ae~Sk(t(y=Imzb%{S@HQ&xQpw)hyV*}#q)El{utv4WTJXx;&g
zTQb30GtaW;KU`aO0+!8|swZiA2LBUA<i9$#OoQ~Y{Y9-dY*a0gW#Az?gwzCa4@a^+
z{IjNFb>l-U8h9X+_Q=*@$Bl=-O1t<1y!W-p0Ot9V;`L+sS(MfPxFnI*n`0}N8O1j)
zdU36coa+>0-2;5@2?ZIS?oFQV)$=a|iq6y3{V2NQ`DJt+!@e@V-ks&W2eEA9v9vjG
z%zU}`sVEh`UXsq{e>}{ihM#>Pq<2GRtQ2kFVqO9CJ;_QN(S?d87VI9INVc+jlY*^i
zL_9URDd9QF%2Z?>*sX{^Kf~XYv?4`TzxzMj=IlwyrUjfHZ=>noqHyb?(lT*jw(pK`
zs`R7tp2f;v$GDUTL2F|Rgh#O58wsgA3c4$=D|-NQ2k*h(pvTb{+L!k%hvhJx{ONUX
zmsJJsqLEMGHL8Ps_7v`NezbyxXk7)%ii&oQ#omZTg;~O$;f``8Ti<f8h@+A;|FMM%
zOOuwU+J9#8SCe{WPfBi3cl49+Pz2t|@u6sB#jcPSqY6kXz5CnWKBqc-oR?f<%}TZH
zvtsz`zY@jBMeUU&WqDN#cIqxCUq<ytN!_G0>4tqL&B{pYYhgu!y`=W@0AW;9*YhZA
zC)@AnQuW8v1BRnzc@oRT)pJ6H@_&4*#`&&H65bfu&F^O1jrxAv(K9dBS}=%a?Qb}?
ztpqWMChd9Y`15S4wsWkWcfaK<`wb_5w9srg6e1lzD9Y;julL?Jg_d+J@8kt%nA)*`
ztRS#)9@9;det%1d1-tL#FRa4nX-Z@QS;xzJkJM4;<N5o>&c7MIBTLA%5SkP6uh9Pq
zs>WZZ=wu4MYOSSk1DA$!2v55TJV`h5kH5%2OwYyj4mTbu=OVI<Wi{i^-;e+wi}eR>
z#?F5kef!3*N0qP)f~5Tut-nhT?44Lv)Cq{Azr96REmc~OiT7O!H7`kc-ai!@Xv;=f
z^;>e)&`sH9qqJ+7JD&%da<#4#d$v*KoMYEziMJPs@E!ux_2eYTBRBBSF;R%Sa7I*%
zKcD_zr#t3t3cyykk^Rx9gAf(mrt~1Tr*Bti2`Sg)uqAivbs~4|^%8O}=(lVqQ$F^A
zkPu2$iRRh3`#--<>?S<m;|qivDtbV!HJh@*mS-N)<avx`cZ|Mp_G8hg=pfdlWDDBz
zA3s0lZDA%!nt}}JlHBcB<e%IoR)EqLQrU-)%wymR+$VAf4@i2G^z*W&WYt+>cS1RD
zXE{p-O+imK<(>lsbM^SkzgjL-16Imkr!3mko+rX*sT1Rm=h4+iM7v_%$d2XDiw_Xe
zm$eBD^dc)!DP=Dr&o2%fFzS1`qt{bpD>0cq^$94baUX&xSg6MR60+<zVz0(Fe4(r<
zY_<>uMSNCs2``~PM2`jwMaSyVN_aAdo6?TC2gKSXD;wtd?><aH-=HXO7OPdTH^Rnj
z&wE6qBt&vQfY^<XZ7mS&Op>kSvA>EfOkn(J%5D_<t8R)p0ZOA#wT0gSo=!sh$TO?i
zyH{;X5k;ZdZ^_<{re_~BCF=nIBLm;cng;99@L95^AqYv-(DVzN-06A8>VnsAgZYE)
zF}YsyS<oWfOwsumGJUUvl&N)?p67!|f{d~tp*`~wKEJu-ZhO37-!yv^TGMlBO#L9h
zeB{FZwzqwL^LA{@B#&h}WtHwPx*uX?pBBW8;cxC>XdT9JH9#M)1##GV7#u%huNs)p
zW_<cGlYlM|@gsAb1@58gX`4(*xmqAYuhO(YWbXvOO1r8UntU7gk*~a<@iFAmHiWwQ
zBC4#s#HfNhOVyhMQ9Dfk>zy{q_9MxzcRXAnOT1$&BaxzUADIxsyZSGu76zApaQGeM
zMsKF4QP3##4zvXUB?7J|f`KnMnFg<%j78Iky#S2CY`S-v1}lIpZ88nXU2hr!9A<5Y
zU9$FYlklB3Gy~Vr??zvlFbL$HqAJTvP=Tz2Se{8at7u!q1vs`m({ng4pegqf6%)ki
zz-Rk>orzK3vr{UIkY)I45SM4;Yna!hZ!6l>e*O_Y6(*sIh|DWw++aOLJOmD$?XXpk
zmGcZ>l2<<*vl~yJBj0d~0bnJ)8J}|n7!|ulUM%w};2Z#oe&Xb5)|y$W8seI!v;U#M
zn|Zn9GXM`S)1%e;qS2M%HGWOGo9TInuw0XJ9s!o@M(o{w8MjQ5?XbwS_3rfCL;ZC@
zw)}IWQ^GQY700k_61E56u4by%jaYP8(~G~Xd*a(Q9de>dga;Qk>UD=ukNiDm`#F#R
z6?W{hvV0MBb$^i?T-5;nyEven8$s;edKkyn08IqZ$g<diZfa0^CJ9VhGaryNX<7IP
zUr>!t+lvP~C*u*U1)<n)wIgd1C4v4~hWHDEqEl4u*^<9~s-o7(iQs5V=2x7sH464e
zz1C&%)&f%QY)RkTvkZVE#$F4L^c=+Y(5P~Qe5dwY5r{QD=A2fDZ9HF=P|zrfpvwJM
zV&2TpOZBrzU!UJ@2%7#+vydan#ekEwlCLn1aAjUm<Zg)9R<IyamygA4#x-~5$Le{C
zWC`c9DF2w#_H&cs2}pemE^~kQD1eSTMrnSrhBgV4Xo}jPa76{XnX1~z*LWa6y}~sw
z4#ciLL(04o`|W>eI45WX8h(TPe00DVAk?Smb{*T0E3IK#VH7lvvU*UkL0OnUC~O7=
zR7;GD!jRVUVr8sML%v2cE=BDOE9o<-Gu!fOIFM|r4vC55d6nJH61_+XyPhn&Su9h*
zBY_gaaw+BAM@;Xu9Kf+}{VlNxiPxoFlGaQT_3K`$D%oG;@A3=)H0$wv`ba%lHH@-$
zGestgvLcJJCMy<YrNjH*`n?wv7c3xkW{!OL<iP^~u@>Xv`RPn0TWYmBRW(a&UD11r
zs<4@&JQ=I^Uo6RCYW1SYqQDZBwLA;+oE)$)+gVD|4bj~@v1|$!+4#%kQ!xE6O!hAH
zve;P~CQT<{(94?1{3i0TTkA(c^dE@Ys2ZNa6$O0odNjWN8D=!ze@VLCKC2CqX3KcM
z$tUi}3{?+HwpMhzQ8AwUBkh_0ld=WBFv<!~k!q681SV4e2_rCm>#Z*8H@%$E{n6+O
z>v)pxS1bUc*?>+kzaAlvWpBi;y+K)R0bKM)xcK5XtI~mg{NcZ8>@o}xE%L|zzK-Vi
z{_lt7-wucWzqi01_<wXkq~!kz1F}2*|0N8IDUSo3?>LGdRjq(87bg$LhHrz@{y%xf
By}JMa

literal 64948
zcmeFZd0f-i);FpmpfZUd1POzTTE@r}Aiz<vhzdA?fCz>#hzv<UAt(ZZ5FjD3p$ZDZ
z(|VLsWL6+m=1hlza4bg#LCBy`3rM0BV?n$twpDtc^E~gl@4fH+>p7pEPeZbQd#}Cr
zT5EsTcdcLZ5BhqkY}m44)v8r0-g`X{uUfUiXw|AU)O8B*O&oTI1pc+2us0}a)hcUa
z+5cCQZh0ibD9xCofoB4J4!Gd(@z&S~e0ZcaDV_kMSFOT$kO){@Y~&fk@W|+x1UIAk
z2OUO+F%fP?#~gfYeF(cFPsQv#ml%2EobOTGxmcWYgpr54A%^4v6U0ZJ!5Wg{;}Viw
zNNz?S=XHV4vafB73_lJz6YFNQQ?{UCpwB_W-T1^vLq}^{E1a#ZqoI?tbp$pXiwh68
zG~8jk17%}tZ-cV8vbA-wb9S+}H~js7MzCCBM3l>6&o6&p4E}O6I(6m@!NtZVB_+i=
z#m*X^7;S@cc6PS0-C?t1hZT&lN=i*QgC$udBpLrPgJ)zCE-{91CI+8iD4P)*jz4?G
z%?L#OZ4dE;PtztO{jMj_m<<U_ut8bd%J%eeU<B^dIKtV)xQ~lR;A|q}BI6?y&LqKD
z)Tgn8Q}{FZq*M6+V(L#n|7iixt&h*AHU6b6@$sLQNIJ788Mg7eLjL9Gq@$^XNSniv
zN%*sgxX3-pAg1vjyGc58IP$YT|Bc6C_{WC{F1r&Wv1jm!NAdW$KaTm}ANw`jvBTQl
zaGMVn7n2~<z;@YszdsV`i9HkPW(0@sU}d|*3bo_tjvX$xJ6s&>tZW@zY;AuV>VuDn
ziAw!fLwDG_piqAr3MLnUJ%jyU4vxUNMBx+Tv7oP*cx-f}4Iv@g$neuCxa`Kq;S*tD
zkj`%9_ujjAA56qY#l*o6Nr%058G7&8?TB)AbhO%Gjru6AkB^IYLed#*0xr_q)6EF>
zY8?|3;bMz+#NwPHovotm9HXr4ZJkh7;SRP@R*|;hIBYl$?c`*)<B#V(@wl@x3z9wm
zn>R(^aWKbc@oZ6c*eJA}gB8jii?*^w+ecW1+eO)1VbS(G93pL_?46xH&E}UF0}hRi
zTRE#tstA}d5{unoAL;C16&dMhXJu~(@}V6ZoUI~pD6E}xWQ4;GT%^ovKCgT<l62+(
zHZ?La>34VBg^m9GQ(Vjn1%4dki;V|85wHo-__&yam3sX6vuv&vKij}OHZp(wZAzQ}
zV$qLI;j%X-2`n!4_oa_S5<d&^(GOg(IGKOD8R2BM85v<@_}kYp|Ke=^EiL^1e9Eav
znDoD~*x!~(!bhD+!6ruTjD~akH+(|2ciGlKhkq7737h=i3y*ffMSvxst*|H@%F5m$
z9IRl69oi~#2M%o?j&nviI6M8Z`F|z+4m%eIr$2n?e^2<|MaG?igN}q7!^Y@;e>-5;
z_Ks*rXDdf12YV}fl*~^euufJE;SS;9=%@%Z${GFNZf9jk_&>fK96ljAGI51@5wMA1
z^Jl<4+>D|U@$rUO0wFF2hn3l)O>#oS@3+Y((>6SVH~buc{!6t*L?*_pu!EJWd=kO%
z|HJkEmsa=hg|pxE|1YiX|I{&k3?RRS1DpSQr1<S`&);<UrR;P*-gz$nDkl89b_kcC
z3q<En@%sN!Wc_`8{Quhs{V8&;KsJ8_Q-DjdkDq`V{P79uMJ9l^CIXN%8C-W`)vDKD
zdVB6XN?JWDP+Xc$-8u5kBV%$B|3iOYf8WByd7FC6-tL!;O6#)r+5de^f8hFggu|CO
zUmH}pw{?%s&F@1nhpCkl@80nOcOJZc$H;2$6|?$(&gINSCP$@bw7r{F`)Q49$BkDO
zb<;@+MB*WaiT8?sdJgyf>2Gg_<)Z^DeuuF=n;!npkpI!kZ&vd^#_&-O|KlXGknsPb
zF<1p+lb6Jg7|-fTUgv1lSic^j-XuC&a|dndDSRK2&C4qhdxAa;rtJM3yCQBKzieVL
zCK$=|5*sE5yA6p5aXb`SewvR7p?Zn8BeR@;v+3V0duP3&cfjp8XnAd{u{-rGuJTH}
zzHa^IN<OkIcaXS)){RB4X&J#OChz;ahKaXomb`akV_&__G(R|mrbj{=u#s9d$fOdU
z8M1&yK>D)3M=MqekH)>unG$c)@ACc6YhJZtBExc~MSIgW;JJN2+*Rj^BFZR9#0|7A
z^^shwk)P_u3Qv%b4@_4+s@Rof5~MREQVyX_^A*Zs=!y;NUtjHzkK;Ka^9Ko9zTH7+
zJ+E-NsS7a=>g8M;j;|Ctaiis4#`E~qWIm>K;{YcJJ)s>;K6|y;xeuqWG*X~JQ1E4q
zqUCs4rDklAIbK_z=R13K<t2bztHg+S_ask)Xja>GjK8b;tuv*BbuR8+S~V*QnLCF@
zR`L&&(d>v{sIvNgoaI{2vcFyV{4>MA%O<_UF--ko{^7DqZ<g=B8KL?FlJ!(;RnS{1
zg=uBkMT8Bs?x?t~FZ+V-@4?V+j99JQzVkXQlb%;Q$T)&(E$1v#ll)FNgjG`IoSP+_
ztl=fcalS&YHy0c&qu3ENRh#g0-6B%RpEPh;rU9&~E@4A$w+hL{m#r1{1k-#{*O9+-
zaR3=r!dufU)GRAJLIh2!j}*+IHSHEBtY<q#D`#P3N9<%+s*MpGYrC6Bj<n7)n|M{F
z5o%2!T_<_$ZPW-gek2!1_@cl28d{~2Z`+6M*H2oYKOMPv<3CM<OdBI?4!smD^h7@I
zDHUu)7O0fmoqs6WR(A0<oCmK5jU)>X#u524ZT{(Lq=^#a8Q)oRS{RNo7~o1u?xsvN
z$dA>l+s(fEXI!Ua9PbcX-&|w~IwjgSqe;mk;=h=n^Ezvdqd<p*s_k|jiHgyxmp|UH
z+U|U`s$Cy0cQ<i^FYg*!yHd0cd9h}M&mYU-HSAw0MWRfha<Ov0-0w;H37yvh>(AK5
zbw*Y5%G#3FHRD`WdEcRRD+S7BG?pz(Iq53-1_?=7Il)I=BGF|2j`7Sp1a(@Mi{HaF
zvI9BUUvzi9m+%anB}l<mM{6E$=y~-EI{9SFpG_+0a)d)EOWAI=J3*1BfTU0)m=N;o
z`u=tlODm4!(uZkyIFc2Q-oz7}Da*M_{DQ_&=$$mu@0J_c{wLGgt7Q^Y7&Vf&yJ7tU
zf{lLXw{p??y2LHDtT#+eUigg*(W>N=8bj~OQv0y_$BA2fyGPMV=0XyZ_Hg8qyag)(
zQ=nJEvj($uRvapmi|(Jc40lS#{Rw!LH_Cel+>|fNq7dz0vR#QCumn$-7Lq?LJRHYq
zy?~c<#IAOoBO;rHaQ=6R7++otT3M+Co9k@BOF(AbB*OM@x<!?MK~dUUb*5~i=PggF
zQp#l?Sw>nHVv<U*Q$0cKGPkLQOb}G@C3lXrA~>3O|0aSDX-m6mrEq{?<DPp$m8wCs
zYF|?<GKp*c(1%l^bxTGvqxo@V`E~?*)vl<x#>R(&z>s{F7~yzwwNeSM)lKU{s-5M@
ziD}Do;Sd0nXKYzz@EtK}A+U4JRD&+1{hrPgitg;!Zxj_swi?Ovl6bf3sqwe2RCwwS
zpzwG{K_XZ$$1$#JQ5-s+`*eZsjHKNq%7<n~3v3rBmAyo#kvY4G&i&oqBhTuNv&*i;
z<Q5U+tXZmkI6c^;b079mu@h@elza4}Vn=#vA5NwkCVaj6bqUW%%dKJ0`953tJ~dGb
z#d3+`nx!Gt;9yop^B(sG!=BTPI@+Q;1eNAd(YlbVw?g%_p>_wd4vm#0UK4U@kXRx&
zO~M!)!^x?#z6qSpe;D-r6ah#kbFDcPS!Ze%McxxOp_~->%kzg=^`sJ3-^4YnD(FM@
zchr0zHi~{jYCl0!<GZia!KgXtz-o%<Qp<aT?wXF{>>)Y2XAeASaTI7`G;F%Bpf~9v
z5uoBIWY$wKgKLjtRA=f{DeeC#lZ)+t)tvWMq(U-($xissllt<MBt~VFv+mLQm7?#Z
ztK4biSzRxF3{z{MD+k?o(TVKbSFM+{P*P+Q<>a0f#={Fmq@yccbKx3T>wO(s*Bj{<
zAyf#~57F8KY_i0Cw*Jg<BBr+UHF2{q4`wodH<K(VBI%`T8+^UeH!mdYWL$~MH70B>
zr&Ah6wOizi1p`Di_re<s6J{Zq)53R5#2Bi`(m-~X%O$K_oAEwe_N+xYO<VLu9H-1C
z!L6Tnm#C4z^7Wg*(0HaK)!Ht3^wGvvOje5M4d|eF<;owQ{`p`Ct*-kGdZH)^UE9eM
z9~!@OqrKG%EjKJoWv((mnH`aux^})RmSCK~{j&mX;8gOP`H5+p%PB`@Z)ivkq^(mE
zM1_r?L(*T%cGFwGvvCPi;K7?0s7UXvTzU4G5~JFaCvs-$o1g5T2%--X9o%VS4TBo4
z`U9LKqK<D@Rz&K3jrq<BzS*BnZ5|el@$FI)hnHo)xjKcw$j$S-2oG$|p!?YlBzJ4B
zdZ2kwxjRKyvaeN%{wMoQZ!zrIm#AD$>A2Wi-}R$j)*wNCS^2FHbskB+L)0tJwrlWi
zOmm~92(OSdUjFGymy_vPXd6<fEl7;(G@7z}3MX@ipyr-E$5aT*w;(biQqOA|aOVXz
z%s+t%)e^9dth3AwVf1L+9k(fr!wf;8mMbSkTXQLd)v8x4@ed^4OV**}<16*^EHn6W
z#P?&FO5$B1l$)r#_&%(zb=R7gozBd4x~9EjEa|q1ykUO!$e&@)KeJ4FN43i6b==p)
z>i43+xGvQ=*14WnDHhACI<ix+<dth62}%shW4Z+Q_Dwe2poNOmxT0$01A?nNm5x)K
zs^7L!?TY_Az<B;M8lyDKx9{8ks#vQ*<3asuFCilC^2#aYz?7f=v<{<a(;Yct))RKt
zq?Ub%Y0x6j8mB7~3|{hBe-?O=0|NITX&is)X^h;M>ASR~K(a=I-aw}>CexMRn$Tq~
z(HW<?5<HSmYA55IlJ_&ru?Y#jzxzPMhb_3cuB<C_4KdgCziQjTEn!W;r>{*c{w@@L
zI}70|u~Eg3M<H%*-v7!o3av^0b(gCoXgqg-uQh)0I6>)U_j}StHQ`Q7*3-bxKAHW(
zpE>lyLXvdnyEQoKL*|-+&TDABO8z!v)|=&S1S^b$pbL`IkQLx9j!Q4>edv1`mad>o
z?HRy2th>Z&lk>5w$v8V2%b298#=pyyYZ2N>*SZ&u5!Cd%R$x89QH027$)^=j96kZ}
zcqswV|0XAyhMFimCUmNdIaguQ(^zlVQ@n$`2ZFpdKUTaMt@oN?$-y{ci)?;D>vP?h
zdM*5b@r$KI-IuI3ruJLW))nyOS??AcvS7aRtq{35v8J3>DKh6F47eHWjFQ_gAjD=z
z?PS<Q>kW+p=wW|*A==Hiiz0DAtJ!%kG@TvEjYq3%^VKoA4~TXNtV+rDajGlPLciO0
zmYV=D;<J5FQM7Kl@In3Ki%F`>PD^Zr$U{`&H+Y6((z6<TuDCJpCh@*o0_P!#4RAxk
zR2|?2m3TLH)WA*Cz{^MLridKJv&M+#3EYQLOa0Dlrhyv&kmYCR9r_Ox_gtF6vU;;K
zshK~|f51h2*z_Uo`fV@BF~GyxzfKLwtYe>RRm;evpLEi4b0CXGr7jqi8B^!WQ)&HX
zaqO?qa`bRTefABej+00$ZH<#ie>_LA;j@(o8FLW>Y#Sl6m-pq8aau1zg!dWz#fxF0
z$j&ke>qFAIZ;|v>Svpcn_Z+gD!x&Meeaiq_%UiWsN40Bf`#+4_DKd-Y#xoUVCqh;f
zuX@Q_iJpS?a1pPiWGT5MsN9!Th@)oYR+QY1DK_azZ!+xBxW>XV*B0|N<GQv=H%^dC
z#d&Q`<U$A>lsm+~fm<V0dEcN{Pm9zs1&go_%Sx*3o_(C4s}G2`I{}Vlg}wqVqqxaS
z8R9j)lgM=B00Nix-rnc!KE|w*5(D!UWN`!B$dNdDJabJ3?S^z)@~A7BA2Oa9Eeh;2
z30e>6wzT0CeGjJK0UQY{o~hCz3>Yt5lx);zUmyj3x_}yYQBl6#vBcUd&)-RlP~2k&
z27l4<{&**uH-e<2XxYUnSkt=ht-yC&)N{PknS?5*XrPKBZk62SmD${rC-b+J<@3ZF
z^*iBQAWWofso>5r<>;Sn>uLjvdyT1X9(b*v2RfU%9rG*Iq{ki1D(vjKex5&CO*ieE
z8j`}xE<KWl{=)Mb*7wqVX`B05ttJ*vjizkrJ|oYR=DII1l~UkTvL1+I#&Z{m9xplX
zN$XZ5jf&ujN5}Its^g;hTom_iWz2maMnpyM<!7%S3X}oSoGdj@UR$2yN>rQ3InmD4
z@#U(J)cbi`8Py6&?e|iVw0N`*U2q7Kd!DG9z^#;cr)_BACt&h!j1=yH!}+wKp4GNo
z^qM-(`T(+>_yLX@dpqXbURWszR*LUTWp1d%W}7>*yqOyex+)3gfXs}=_92wlgglej
zhnT29y43<&t5Rewi(eKAym;p36hS&B@4RGH@~1Vt7jB}sYtmJsgHBlUGP*CDj7Dpj
zyqg~q*oWjmlF|q1peQYbeq53~p1UXPCj?-qE`M|gqv^D25&)r@1|2Wa0SuKa+4z!c
z#guR1Ye?;1a^*;CAJpqoRs_mf-49CTv1iY{Lx|L18#!<;5Oc$>gNrK+a1WK2#WOdk
z35iQv^<O!Yg*wtwrYdhQqa#7Jw0=E#ahJ?0Xr)Am!Zl2}x5Cxq^hMwzKI8DKr>GL-
zlH8rK0V*og$!E}qVd6KMWs>pYU`U=Wf!3B}RLikqt~cNsO%WZ-$<xBM-i>dYu}Z$3
zIV4TG(0V*;fbW>5P{EBRnCo{YSca=p0#{_(&nO67TxSNm>~XwCx_;PJ?^j=2?cG5x
zA~;*Kwa(9@F>(go@l5SXzCuVg&ZOtZhd5(L;lWvM1A23cO#fpbdFLEc>8)V3%-flt
zF2ZM&#hqpG@uV(<$aK)YZ6D*=b~s&hNX{MNrl^I9t<1GHoo&)}wOtgVJ|yZ#?4s$;
zef60tXk~LSpaL)P#+U3$vCepbpGa#w=e)!=Is9{e^h%qH7?XGe9Zx?^l{^@<x7x?B
z9L<V|FBR;<s1=77-E!SB(2aD@wIHl_+{<_$ox7Wm*YPr8yucOAg>{0dlfrk$P`zZn
zY`ikbY#d7SXbw7V&Dk&B=glxZe!2R@Yc#T$pNJHF=el}Wv@ecl=A9^xV{JvNyNVIA
zn@6Js)Ig()a7_8P*v}FUQBholw2Gz|ijqHO8k5+ET-2D;)g>xJdU1e(#3%)JZVhA`
zX%RQ*^F&Mo1D1j4E>q)k&f7TDy4EYGwAKJuhVdD!H1WO~VHQ;C$d7AX<;U8(a3j_7
zq?z|s0Oz)J`8f7BXr#Gd8vwJFni{%}uWxQUz=-IHVl+kPiX;a@C`BecPa1XK3gk$7
zq2v^SBgW{H)5QLO5FKnCd9ttrwqNQ!bk#YIn+n_q%f-9#zSXZ~d&cuygdeyA{7JzZ
zsj`02r{iv#0&1uEgfka?m=WQvWfI$K<lF5}+S0s_@fhE)-y$$;)x~qp6E*Z#7+<yj
zz}1dlESG2|J)xj$y`&ME1yRozqE^sTeV(yYb0W8ee?n^VlI8nJ!l0RQtBe;xQax`*
zTeD%1YqMZeNa5@HP)2nq1#YFnQgJ28VuI}YNivfREEPqs><PQS>o>_*YkWKHi0+Qw
zjK_0Z(>7-0wFuucHCCWx_i2;rqK-57O?nu8Cb2BDGI}h*-4QnOLUn2TvPHU1M~;)g
z43o+Gj5{lm?k}a77oxOGyceEiMZ78Hy&#!ccR7OAEQRXhSuLUt!JHKFvTFr7WS$Jq
zyhiIdc{66O$oKs0NX8L2*Rs_a5pPBcc|;}mtQ6rK$sl0`$ml6<KH)wY@Y~j(Y7x}S
zDU^C&Mzt!1w9$Z7N;ICJoClcrnRbC3=GD7qSfB|OXv!=inp*P$yc=Ixg)6#W^5}9E
zW7F2X{Tyr-`nBGr>HfBdv)5TfCb-dhnLHQOME+8ZahuP_a9#dgTB&U0fku~jt~^s;
zJN%|eklRN>i+Z-?vt`V-c|CvaX6W5GtYva%P@Rb=7H#uxJl7}K7*gOxL@%#3=wf}k
zO&M*k|CZM7W%`>IM{_Ghr^~X=G9u1i6ObSWAev23Q-nn;@N;V7%PRwKFMl*3WFT<9
zRwU$GEcrsTzBWIVw8e2h1JYnG;S011M8>79?)i%KM?S6g>ef@Mih0$K>U6Gm6m1I0
zU6eScDZ66M+95CQmz*gBzPDpH!AO<!B@!~Cr%WB!&u1Ps?(=HWE%*3GVV`xnY#QM1
zml!$<52dZ4lwY4i8x#v7yc?V2Sc3%RewKh_>|Xfv)6xv{<f5e%gNoZRhZqrcR(n;;
zYM96Y?yW$!bu~{{ymhwG{xw?8hHXb=ngqFOp~y981D<GaS!N4gj_LntnpXff&deZ0
zJLA3r1GenRde-TzI4s;{c``Q|tKo>t_2A(aCIn2R6W<cpw<cV__7hqxaYH|EM(hQ<
zssEg(y>iBLm7ZBKO!hY#I@>x5<3h4<sJlF~ki0#X;ra$_956?|tXpXL8B^~l^m<*w
zwq}8qblb}nP(Fh0(e=j^qaPfFnjyJ&>nEmVX&dXyxXyE6Ym2X@fG6v+BcP{DyqAA;
zL6WV|tD}X5B;5qo3h>qw{Fc|KfiE%%V#xO_r)ZYvSP;H8Z`LWs>XTuxlKaelS4}@w
z5>a)^)Z2Yhd5oY#V-wNq@hlzz;^go8sXmMEev0mX@+KD&qN_01wTKT-sCE)$S$1mJ
zIHsR7%%35cHlLi(7|Xj$FtzTC@@CjPUpt<OXF-Hm<9PCq9LvOe=&vvZFQcjXeHDZS
ztGx?#Hwo(2+^^bO3(=eHFu6Jt*~c5kv|ZE(U~knXJ;ipcZ_oyi%lLA~BwI0te~4rf
z`?yYczS_rC44U8HY&e?XC<?)-m}4i3oyfrUX#=4ye8cRWu4bi@^!s@V-VAeGt_oUi
zjOggwbw{F#`3%-$9~lU;(F0Fjhux03@Aompzn?Y<DYU46I&qEn9ZA1kKkVYo3;jLJ
zO~pc6u=1u%oLD(crG2$c*SnDw^Za1%Ly=Ba`*;|`^>4X%q0PCEU|q|;78o5v<0cW;
zX-QoA1RF4VW2WBa1v>rgfU+D9Zmh%|ll3_SM$||nm(cz7$x9RVKJyHd)O}heixXcW
zDN2M5LqYdb<2bjN8e}j_zGZc>NorLTdc$!7T9t<)8Mx<u_KU`!eFpC(Q6(ONjzHaH
z(fob}Cep5_-GTLpWL8eYxq)M5PYW|TTSN*-`ZbfDc3Zj?b5$6nBS%}b1Np^gHFw+l
zbmR^P>87V&zx~!5W>I2Xh;{2{D-m>>N1UbzM!ub813_P#j23GVFwLS<WfwiV9}w*H
zzxrf7k6)e_>myIU`PDuh?$3%6?}eIpw6-5Bzhty!D(xF64ZX)|So3-%bEK{PT(iDU
zYxh(+_zdzSZ2@&prB`FF1Kl)g9>su=RLNh1B&T`<S*1r~4~jRX0o`K!DWF97m)?Hy
zq3c7!*<ULvV}9N3&A1S?vvIzRdPia(cf}+~Wr|>5o-;^Ppmjl_3km)o3qJmNUZ|XQ
z>#^vVcmRUYch@2&NAf6Qu=2AElRG`%pq0Wd;<>#NOC;smr-!Ot2JPp%d&P<Y<YOY&
z+cCkQipnTPWrDt!jLwaR2p&|Z%JL^Uhvv#sqEB~9PnDg|Ad9qqx$}pG;MTb7xAhn%
zi{l4g{Zp@?mmu#8ZuT&0B<rpilV;JrdZ1JNQ><$I8B!zL(7X@fk-yqVt3JBqs0}Rn
zG6JJrj4d_k39eVK6rO|U)SdW8Azb|~Y){n=pFvgSC7fljbNU9{Z!12`diLEYjY2T>
zy=)Q`>nI9G7HANSme(0{$*rgZ-2pS8NPAG+<Kq2j?yIxf?Pssw9^T8CO|k3w(TcAe
zl3PT~gN4r;m6P#Z!=e}HU4N|V9dIM&dMHIn+<Ub$jP(vM?3avZnSqxrpFSeFlwUMP
znR_<|K=K}v`3AkFQe-9F_?al~sY3Y-K9vrkxE-tk;XcL5MX~Xq{rh&H0vw7gA1aiQ
zV+mUUQCvEU*0$lc2xf?zX<Tsi-!~lO4~c|DZTEf&PnFifpCJOh(qZGB*a>k57)|h`
zwPbI`v!p1r0vV@E;~bYHq^(t3fsX@nVy<gR#-wv7?x3WNw4GM}VLW@XyQAXvi+IT8
zA7@3(>*d}hy3?+j^k_gvidLxP@3j<WuOM}0yPvo?kHn>^)v}I>z6i;c-`^rP&n=aF
zF^={bwDx91Vs|#COc5~UIs1tvP%Rii4hgn}T(m+f;JFXP>sOQm{iCnnK0%V3;M-79
zj)EO!7Y7MjnsK_0!i@l;#D*`~Jjwbr&G~D$U!Y*x7?@U-lS*>z@60msZf|7~oP7a=
zx=mbC6Rlo3YwY#gWQn;{!<*qBz4O(xhlEYmT|pxNX3g=&zHICWt%zVek#oFZ1)_$E
zbU~wGYT^`Ot#x<KNG>?zY?}{rtvMfP!cwB$io}ayV(~-PvmRHyVZlCGV7YY-kRa6u
zjhq%*Nso+!0zUf^LWyC6SM}nDW8}Q{Ga@F@n+7<kXeF}1im9>kTo@)nLs}+b6Ivme
z`+*>Xh;kOaet-*9af+~wsq`87gPe^`hVOoyBJ3zH+)n`YF3@pAx&H2;k%AUM0%j#0
zY`Gs+k6#@va7JtEntC^8^x-V5Asg6KDbynwyu9*BOvoQ@$oFVFL1wy6n@{j&AQ9$*
zb!D`{dcAq}Q<CzZm#;TW4YxyrPdn4tWxy~|bsR;=YA6)S<GB^0oh!B<5fpeC(*SJs
zW2Pnuka+ST*0{eDGDI)IS?R`?pY;T@+?Vgsa8)iATth>yq&RS{nrBDY=G$2z^b=$M
zv@4{&5+upS{oKuHIVFaPvos2Lc&G$t9)na%*Y#7>gxvw*`f50y7s*@)7gS?w94B>Q
z<dO%cR6<-K<g?7<m(#v^!(27Y4~hF)RvBgid(9$lrF9ibHTAo0t^k!_6e&s!x2bxa
zN<nZ4P3G#1=P|~<EN`^Fwm^^M;hyEXBGonVZVUs@EWx^3b4}5klHionwdR04k`Kuo
zBv^-1o|4u9@AUZ`7Qq4OIzu=m)h^|aqm#qUAp;yK)JevI<$8lW?9UmGHzT4W=<;ks
z9*?L!L3b{r8aJ$;u>~l80k~kSdGaVu^+AK~g9Z)P202+$%3+a|>3sFsPF2fr^Os$|
zmM8Te{E5h()rQR_i`<uV+$kx1lQP;70+I$L13=M7?m}Lu0l*OTu}Dc;t0q#%WO+eb
z0tW}P3W%7jJ%BC$oMb@!mu+YdCa+ZNUCoPv!Uu76KXf%{%{1uG*h0EF5yX}wX)kZA
z;3!joHwHR2OK&8fC*#kR9?Ui5?Wwq%_jDv@CI1W-Un<|D4`f9GhUO(PeAyK*wWV=&
z(2BC6Jq>7(QP<b#wXWhrY07k5F4T%2z&tW~V_^k3116sXCf}k<7etL;d_z*C@kW^&
zi$!rrn$HM;G8;T}B5XDn6)`{EZ(uV)L@g7)eh~?&CU8vKWWaquH0$sF4z0vH*#-gW
zULjNSE!J%!@Ayh1+#I>H(LP0#p0@Eg@e6D2W2UnCNu?pIs+~7u>8v^b-AEo;tjIL@
zlaCeD8wTCyNznS7Y^JW0=sj9-nvX<67lX~qbr_`-L2~OJ267dS>WqY52TfWR3cY5m
zL1nB#r<AzP@ub~QYB*h>j=4kzu7rDnshh(8NFCO|#eOxS0!Z&1xDjbx$#Fc0g>z`-
zQd@God-Q{jmpf<g@mMm>KOHI(z;5zRFjZ27c7yhirZK8d;i!dZc_>$xWf~JqXx&;s
zdQ|fQpg68ruk;oREYf?R*oFGz7hQ=;3B1bNF;BL7mv<sW8<CK~V!)E14?$!b$1#J>
zg7a~#GV=w)WFZ!lyC`1gP8om)v&VqD<$#<|EkN6`Ls=1%B!m-e*T7sD9s==Bvl(|2
zH2n`{o={=D;DKa2<_qugZ&6(3N>Q4uFt6py^$wipKS6P&+uRH2`~h)j+DRb7O;dN_
zsAti-)BIg!`9*;7x)m0O9QWIEff=~y2Miu!g0AK>cm@*J#yBACyY?_QYV!}2<!j8j
zj#&a#6#&Q0su1m#CZ!Rs-{zSFJ?0|Fux4Qr@e5zhcjzD5TOMwrqV&6cpptQsF4!%#
zb$9j|lvOjTgOex}N&rL8Bkf-GIy+hQ4`AUQw5}JBGz^=28hBnEQ~)>Xw-nTTc;Olm
zSyEbB^c+t`vEGr)YCBDt8%t|24<tKVRX(WTyB0yKRzWx}!i%rN+@uX6T$Hz%jFv=`
z43;(VEHeCT+H>8GJCeCOjrahF+Azk2aB73f0DCiY(=k56V!$_T<2=_@qScxN8!-(c
zauG_9k_r!p6i^6%y)v&Z`}u)HzZGs#MU#qXD$%&Msqy`|y^qH>?}fX-ULl2)F*l#V
z_YmByt$)y8xjQIYyC5$Pijm`)N>JI}3s^*p=(Mcak$X&#d}rj>iuT<Bx!-^99Fz`h
zzbyH52`RJ+s9O}9jpq#uFUSbHfUn><i}^vYcXrUwRkFl)X?+5_6oAh`#%3HaHX_0X
z-|k0fEid4-pk0R-P|ecvn=mG=ean|w5YYm-9w_o&zx`sX_i~u5M5R9r(HiRBFAlZJ
z;n_2i=9ufrdmCqEg_+094abBV;u@1@xr&mgRy{mCw!86mAu5606wq7&z+2I@r^udL
z!Xtv|3r-;^H)TfX+KjUp!cxrVAz+;+sJ-l(V{WeCK4h*3BKDWdvsXBrJ)<~inSHdc
zQADO+-5g`*%gRA(YYPsSWyzpLgKmoO%Oww~@p$Z&VCX&j`wzBGPUgKVgox0((WXm@
zSkg2Tu%sWFGYQCSYtIIIE?Uc`Q%SrAX<C8Tp1A1I87npicV;~M4_#aw>lSm>G=TH$
zqWY7mOceumh2TBOe8Sad5XW#hNhO+v7HA7b1M%_a*444_B7g8N)1I9u?nuE5QLmQ8
zDJdFAaZO+slIHAvoO-VB;4;;RgGbXrg;0yn;2?0i)*N}XVzdZZc1gaM6)!bhR-Wg%
zN+tlR7n$E<GPj-Y15*h0mi5^+hCi&=@!}hWWJe2>k-2XeCRp_r{#(f%lAV6@hR+tB
z9ZhZ69F~1i`{d5$Dlf^R^z71<y^q>HSxIA1>?AP?F*+~0OHv8V9|kI;!esF&0%u%K
zix%t)p&h9?;0hM1gYPzwIc>xh1TG}=VzF@7yF1CEFPA2zZy>uWis;ya3(3<K?O|?F
zYIIsg)<KzG1og<CD#w*OjPL;!vIixWA^E+;sw*+(6WLB8AL-4Q>j_04hGnHvR11@N
z%5+r1^6D*eBs-tC41e^Bi0Eez66LKq*G8z2JTcdI(84%mah`wFd%wx87A&VUmQzT<
zTtMvrBsYgF`Vb;#sc)+?`R_$<wx#QKWKDuaS4QZ7;8aM#h>f#KuHw^6UxY%?FmC*U
zin8V;TMS1-J?C$mAt2E$#A#50!rpj1BO_-iPQHV`{4GLW2UnJdXFCbPQyY`{!;*P$
z_eUG-z*eS%zjt@>8H|p2tb>CLJ<Y0JE4rsW(IYfFj3=w991OUD;ue0a<3jrJAO2BP
z;`Zj_qwbKwdDTFu+~4r@hd0+^uDhR>*TwaTHed{#_(6fuZ+=}BN*)##!i8|UFgPUS
zYd5Wkrt4Vap)n|tc3RISi=Wcp@}tt$R&=QV$<g4;h^TR0KhRw%Hgqr8)6*rn3roI%
z(y>J+9A>+YN1jr|c1PiJl5>I{ZfQ+A_WJEo6U7mPXkD68yPkG$d$Ya`XTOAx5IKnr
zAoaxsy-3#@4*ot})#Fr-4%8=<B!__s4|eV6y_2rS*mI$OM6Lriae)zeirSD_%y*R-
z^+n)ocuss>F2aC4AS{O6|MLg&uBB*;;YrTG4^=2G+F+83XK!!xh~xB15-~1ZlIb$O
zHA<FF&f+~Nu{CiXWP^Jy?=5Sa65k`!{{b2v$<!9!BCV(0OD?0omdKHy7UQy{kPhk0
zVuVld<;Op7D<j*X=%o_x@f_Fs-mWI42T)Jv%}LSag}sE;L;D%kku!v??VHpfW?A)A
z*>gv-=2>cjZKKC%EV_utMRbrWI8e?D{(9C6M~xOPO3nt_D0XW>4t$m>*|~&CPrZKo
zyy?4dxrijD>g1(j?43AZ84u4QaIG6U3MQ}Jjv+rY)WsnS=es7k#KyWZ@-coT6o$8a
zNQSs>`i>zhlvqiVL(CL^{IXTqh84|2Xe<xf`(!{$^ZpbSMV=A+kaU`Vh-%fe;m}ar
zJK{T1Nd1!ke!ao)&Lb>yjSc&GV5gU4b=npK-b2zlx&VcNJ}{c1#63;HfWsqbTXU14
z0V3#5v)~%wT>h6BLr8zQBYE?@NuGLRN1tF1N!=aIl?E*d?R{KL7XOaG<rWL(1sj}8
z`dJ-a9SGc#(eh(^AA_Q2AMjKnx?OLw@a}U;5WS8wEPRRL*6}wF+Fv-Bm|2Lj?xgc|
z>q8fcZ%R6ZWFF$f+B&G=t9!Qt`f!#ev?}X9JL#&Np__4@3ipZm5)fN&As;i)!69jQ
zUWzF0UHFhFR?@_T-z`WSSo3Rt{LX+<`7*LLUml1&B>gTyErAma_=NS4DWAee%{KGC
zm7BQ>8DAk?v;`v<jkSvc%<>3J(t63sCRylnzBREJLf}-x=oz#l&;R10R@doAMWt`~
z09LMO3fLpC(@Df5-nKL+^YNkwAoS)BiPvwZ>>H{_aeJiarK)jP+lXt^S9#cSNyf`o
z>F2NCekwZ}$$=$5>1pT7w9XE$8q9d=`t8ZDtBE+Oid11~mGzb9KPQIJGTgb+0ci^;
z$P@TPxIc6<)Fv-JY;>Y^s__-M2t2!kgZCS}cRb*hd{8{C`wCN`GW>=cjq}w=jvmt>
zMW7)ybkCHbV+s$jxLzQgf0Mb{NtA%0Dm9z{zjjd=;J~eCz!EX4_u_y&-4J4<I4F_o
zEJ+cf3c)lqXn4LdDMUF6@d6%!VHy1z7$Xqs#F7+vz^|&e;;15thE%n$_sChdTAmjd
z;ZYa{x9_1IckpAgWmNkv)!RoTx;W~v;5@`ZW<(*JR&Gc3JnK;7Vd&f7P3quUw|oe{
ze%k}s3b>=u`W_eOJ6kdS!=iI(5md>b^cGxDSNtP)1{B>S=#`U`>iehra1;8a^?E#!
zXW7MGf`xlN9d>G;&}FUIZ<KseapEFb;vGVc7DT|yEkoB+%L--)=Aqg2lZQTn4{*`S
z`a@SK#^O4$G4v=<KiK;W`u1p}xFv!y@e%aSfa}^K3m&4Q0GbzG++_I2Q5$qVZ1l)1
zY^=MHbBqrSCLh*#c*rj1O1PNUFRu?Z>g{<gX-9GC!bxB_w*@`tB6tF_xTPT|pvt)w
zVWW?0)%jqNo^t*69$+gkqPS5@yO&lu{?MMR6?(A(iCa=yTKagY*%mz(9>nO`a5j(p
z)O)=15OdW4XIL;Mxq*Pbg2E#Wdb)anY9cqO)zYSP-FbGjsrS&gvc?by)#^!%>UB7(
zhUDB5eq>wkqXwymBpOF8-YY}zdq_^{tIhwu&w-3*gW-5U^!p+xhl{Xbk;OMhwk-}e
zNQb3=M~I;9M2XP`$AG0uDkRpeo>y-^l(tCQP~1lh|I<_=T!GO<jdVn5WD`j%G(Uxg
zYX6cUgBPMm>Be+T-N+0Vtq)tkCDVoxxSav5@<A#?0!#?KQnbx)0;yG>xf_m+?-^3y
zC)^FKh&gnD`+3VJAM|-Qz}Y&Z32wD)tc;x8-z+*jPH~0I5InGV2qBu0WC(48*7tY8
z!QeaJ`VIcFI_NbQQOpk$C<OTo3Fd{Ru&u1Ha;Uj9b{7IFv=BQz`-|)P5BlJG(nm4Z
z(~rH1q@q;2JRr<$3|b$W`4)ti5r+E$@=;u@^iZ0CWAEwY?dh>piQ^LcBPk~Xk^gF@
zfNI#7Z|7s?7O&Kw9U*1Sq!64Zveo$Uuqg^z5B*kjf~lkigm}1&`MkTi7<@3xgM))E
zDgd)m4{?0srl*-HbX2;62k^<e8>c`tj-PN5Wpn58BWZ{DDULc{1~8Vf8H(UWOPgq4
zXTMm}3ZGA>fw>wK$&BcjXqr$}ZO`Ms{n#ud%V|t4{)xc3Eqg5)Bh6xauE-8fSNs;P
zOS*|Hp&+TJulM?)>&)s<2QJB>J>&XqdQX8}5%gwSkrYBRDfOf64bZxvH!Vt)x}>SK
zD~3@jv3KNf>X3y=wk#<w9ZN&d;odWSjb1-2%0U~D_cm5jQT^=WlK4hO4T~<!#!<Cp
z=u@gIUA1gI6=}uXGOv$Yf@>kPF^h_t0^iZB<9^i`l4d&L!IhD>3OyeN5TZ*c?mWMR
zSXF&ANqT5WfDoZ&fLW?b@>q6IEo%B%p%sp$f`{NiF18*=eTU+DaPAQQYN;KT{}!~E
zNNv~|@b$Ioh%usbLg!$;yxk)25K}X(aGsrl<$sUXCF9!UL`MJ=XrwF7cV`2O5M(h$
z)M{T7mVei_C?W_Nh#V#^Dn&M-*Vlo(LVz!_^w1navtq|ZjmVnO%#3`GEx0n%pw%+x
zE|j8zXpVdX!3iAojtqVF6{6a;4cNzeP7^mzICGi%WW7WETX0MI>2lHgN?4QKaHV;`
zg#pa+X|O7mt_0VJjPHcP1Q&6vrvO!S<+PqJ=QY8UMmSl`dIT*L-7SJr38ch6s#M_m
z(iJ~!#&a&f_0;21Mwu3EKyK~X>A)>9z%6MkIX3s4{v}=tnH?p<e+#Zvd7g6&%50W0
ztvzH!#!-nX6FIRF-@B^eK_m)jJtzrwCn}VtBEPuvutCZ~aZ~ooU^}!1eaP})9oxHn
zf48JgT#n+(>J0q|(Uw-F;lC%Q=ug10Xv00#IQuZ-mJ8C4_Xe$Dr`V5a7FdSRFXGw9
zL^|lzrE?i-!lw|X6qa>g%6fyEga<<kbj4?o1<u~8Ocd8_X-j%YzyqA*XIRgjJF@Lg
zHv$K>&SG&Gff+%6D1DCNW*~7$qo61*Vv;s2LIiD(k}i@Kp`9?u4!(lUY?q*iLjp)A
zkAYp8_R7#X$!U4((Ej#&uf>WG*gd!-*4{E4-mX{2Lp2`m6Tg)#ptyS)s~<*~KDksW
z0IL3>D(%fk?p=aayZU5KM}D;M)Z%2ebX{m+7;8on19FF}juG_Q6^gOhCW`+=h)%Vt
zXY3wg%(E(JsQxRP<EfIkR_#fn)bPoREp$}>*Oqc0jkAMobMi*Dr?zMg{P=7Ccq;KH
z1g_f#TUxz&vhY|Ts(J5KaNw)3cbW&=84BYkNFNZQTR=+#+DNBLY$Qs7<`$1Qvi-V7
zj$ZHCXGc#W$knp7dRdMkd39Y*f>>y#;6+)EbhzhF0{QS|+7{qVhYCalxzN13fZFB4
zsYL6E0*gp17lU~)@1klnj`}@{JIONOYxWc;Z=HY)Dj;zq-0lJ=v2o*%@$3vhYp;On
z2|5drRdj>&ef1t2wgC-AyMputGZ!bM8BCe%Pr{@_4UdAO*2q|N1WqGe&cn#!>6c4n
z6xW81QvE72+RUN{8uk;RBc{IpRpa_;fkK)_`|4vNQr}odLf3K0ap>~?3ZlGkcamgR
z*%v+OPF&_DJU6ECYCN}&idv?lxGq8JTtulPRvKfux4eucxsT$u>{rb~aUEN=!mRG}
zKzfIx9*KAiJ9C=IvWv8OfW+(J$}F5a;R=)8>K<Gj#s$%scml<B071dLbVDh1S06ts
zmE1;gw>MVzMVLA(53t{$)s#x^w)R0+74NLnOgT-yzw6xMfbV#Lt|UyNkOqw<H6zfb
z?9bHl@@|}@qH1|F#F7a52lYCD=G%LpKwDj_PMG=V`5CcnVd&8<LK@<zH^pRTaKO!8
z3E=L>jo%ichUlnex6q4kHu-iL&{5V5*&q#~ar&Cqj0-cGOF&S;*HH1kT7%*qlI{+%
zy7TBciH8uK4swhF;}s!W5ywR9ddFOV1D9?{vul?h76kUq8ayD{Ok4_M;rT46jWuc^
z3-(LGF^XP$8wUzO);slkUggwsT)7DCo<;y=3KO{$Q@@9F(PSZN%489m0zF%GivNB(
z*<`|YIZK8DZxW5$_rJ=av2}Tffy=XiA+!ZgnZb=8`otQfIfN(>$~eF%8BI|4M>x1{
z!Xq+vUd_2yz1FTQ^Nu*K?2@wuPr}?Xc?qhv{5W{aZjpCEssUMXekpWkL|BbvRf;$y
zmuBzA0huoE5b~bo-^g+*M3tNOLW2@?;nS|p>P}L^AnV<~08N+qO!ep=g6mgzxNxOg
zgAQ>K(}H;BzE^A-dj=xszJ+WQcN`(A6rV<Jb+)bL0SF(4ZVAAgpxpkin@-B5L$<X$
z@gLyyXiYz!16tkAVgN(qB}r6BI_0?!7b+AbTU$5ObwRyb=0BUubB@^B^c(^AP^jzP
z3gs7zP&cmBF-S`mi6%R@!g1+JN^w;A9(P9otWHAZpxEWd0GNL$u;nsW<Ga55_>3!;
zlpA3H{o5S8DB~)U#N)rgQ9m5|NcSM=y2RXShYxU}`#t}U>ph7rs?&U+3LTGsKSi{x
z<@SmbF^W8FS9^=Dnov)AwpFzPm}@0jdj-5Zpb!NeaR^aj>n1Yz##t!`y!uKu%#|Wm
zf=V{MuKNRA48^m6ZsVmF%C^QnrWc~p)2S%)-=Nf%xFU@6amfQ5^|i?&pu+>Lo5M_<
zNm}9z@V!9<uFd2lvy?l@(`gKN52^e#50R93urI>-IK0N7S6+CtMwKiyN>f?ZYF8}|
zr@R+!U2<A73(cX2L$B}Y7IkgN!!Ss?Gj#eOL}ywRj+>sJj|P0UT@jF?0e^DuLI>n7
zdbqxi#IM4Vwe{CcFV9QnArY2QdhOaB1!oy;NhYCAT(tKqO|TR0aYA`Ss?<Qdh@;Ly
zaS33KT)MXQ55aHSq$xn6JM*I&%k(Jl-i~k6uVt6CMaRWJhQ^n)%)3!P<c6{4MT0W$
zc%qjZEzDuAA!E&Yis0~oPkO|-wde(YYb^`!WO2tn)v|exM-fIIW?eF>y*evtlRC*z
z&hqMXeJCuKWe(F(w6A4^GG6!weYmkTgxmsc!bK*|h9JLmPl(m1=)45~EVHyH(SfY-
zK4UanZPmd1ec$ncujd>h@AjCDMjUZ$GrzQI>o;F)+q3rl-^>%sC-Muje$`eo8u?3q
z);ZxfiAIMfHmu3IXK1={-NwCZUbGeaj83FPPuaAPO>WP<?CbBJUp()oHqH0!d*pMM
zs9a7rU^@q%90(-ek?4e6I`8S}=}|(n6Ni*#zAy@}yf<`PBo}BMz7#qZeEx2UW=&H?
zmjR_Dtz#&75pR?{Ir9%s%=kddQ2Mb0>uZ|ASf!rS$;7n!CdU(O>r*vt8|HZj)Q>=p
zurGE_Q(YaU6G}D{3eww~79NBjRw?-I=YwV0=D76=X9ibk@jYADc~GNqIto73hsNnP
z!Z3pROD%Qv_k2T)+yHMqLQCCM<R?*9*O+dqX>y{tRW&UfUb>anHeDASJ53qcQ`0oh
z)7^u)Kio7FYP?W2^aRiMF*57_UaF+-`d!n)xux&(zMEf__D$1*y}Eh>@7_?m0bWz`
zQ|NH;`N9(W?C>w1sQIz%8k7gmOxjzrk|bebBTL@pe1}{`vFVaUd)^}GW>|&47o#}9
zQa2J3VVR2+n^6*(YT8DOK?s2xLbKuR0hUM05KXh8C^%M8bOW(bGP2ABQ5%lk8w#aN
zYNI5}=VRxl;nmckCx3~Z^OJn3-iC7rZMlVcdLCd7J?SEuD|lj>JrZi#jvgr3iF$m1
zmsmzVV!Jydh?)d+ljGI!+xc%-wL>a&I1aRW!ij1u3Bhbu+QYtix<-%Ol0T9(F%rC(
ziuxuvwpX(CfOf;%IZ8%C%|lJe+ThsTB&P)piBv(XR@0Qk{_E+QwoQ1ghUwO(rsUc@
zuSdbUonzwD>TS_l?&HDdzsbuhv8`#^+N!&lPfC-Ml82r+htqX6kMtO7iO!VKI3>3`
zl(DOQS-s-jXq~|W)zA@N!Kx(cHB<8PYD>vSpx>nMf+w4GZzzi2R$>}H@GE8Li5g}7
zqu?<`1CG1VZQ2pBxl#E@oghu!HQLPmpTVx42MUIs(1r0v3)Nd&E1R0>dE`?yDv%-R
zsJF##asS6}Qf=$VeZ6P4?3(mo?A*o%FEFNv42+H+?+}8Uxonr2O4_s~eN|<6Zhq6|
z7Qvu&Z7s)9UHwty?h;5T6$xfj`FZ4DFO+=|p18C-b}j^EUDLF>RjGH+0k^t1&^sG<
zs^-Qer@RpdibOE<#InJwX{bCWrJw}frLEh88LtpVd;ZcMBZUKeXJix}5*%wTP%%n=
z7@o##a@;?Q$_}qWbQ7ieW%=*I&3wC+B)ic{O17uMPmqCeV9FaC8GSpW%DpRYL$9{;
zyfpMAN!)8>HekQBKXwj*((lNh*G8RfyV=xyl%4UT>_kwO;lnpBc5FO<030c8<Dln(
z^5W*9<p+5g!@-O3OW)?bEXh^7H&kwIWR$!=HhvYJSD$wxMPYf@M^OSV4T>X>)SZ&}
z-GT5r+%2?<l23IF6p;A6Og~T0U$RX}Tl#rlf#&ku9|xBfcBrG?Ep+jY$1WC}7z#eG
zI<YPMbSb@KlVq<)VUp);`v>?kr-V?`Bqur4r;U0C_MQB<pJHp8j)4;HgXKI4c0J+g
zIZLbHIzy1ih^=YcHLDIDR#G@9IcmvKmK<cEk(1fQ0_8s2h9TjMbe%OP0FLJ@ys=uI
zeYasF&gj=+084poqIFBS*!aD(_hf!yps?q_g#mm`TL}BZVDOj$UJI3;F&gaZd!S_K
z$$>NkxnRU~N|=$~{y2DXE4cg1>vX^7A=*ZDb=R7vW{(NW@TKL(rsT2`LUuU5ly*}b
zhtWym+|=PFrWu50CD{(Mg9~l=A|_H-=IReQK_vI`f;~pRf{B?dHRiR=j7lqHF;PKm
zJ!}4L%2G`1++WmPmo_Y@qtfq6%7>nuK^<Dwil&S_2ptJNpZ^oAS}8nXbRVzo4)zY3
zo~;h+ayR1Q9VZ5ZORdfRSwB*$P>=BAI-@-?<vT4oZ%?kumTqvoj#d-C9#NA+ueaOd
z=~?`cb);eS7(sog;HRsi<FR$(k<fgs`uWM&;MlO5stirPXAY#>c@vE`6VzjQ?L)z?
z>*_Y4h`y|OVUx@<J2DM4P!3C}vGMJ^1^Y+aYnq-*wfi<cGPo*Y)igyPdkjHVQUbwB
z;1A(4MtY((;6Mqs!RcX_1g$~Nzk$lUMY0|e><r1SG3)n{A{Tg@kd{V9_Y+X%@cNT$
zt>z=EfvzOaUvfL*Yfc3FJLP#j4t8CiVVKNOkiEI27{E`*WS$+#bU?7y4Pn>4p0$;`
z+ptQBuu3*j?k%)twlKf7wP~T)|7`wG(RG|Sb&Z*0!LbHaRdsn!e+)jqVR<k6pG4bb
z-(PZuo~%h*yO{rzjUOvaWbWz77NuH6QAz?kehgkb=zn3)fjp4giepDm)ylu&aET=j
ziR<nV?ufHPHS@Qm>GaxaE5XSYt3Zp9hDC$A69lO?thGBF)?xqnO=@r`w6`a7NtVz7
z%0w26eyzGcs6P~3dJ#vk^yTT0Hce5;TRJNs6a@R@zP%GV3U0u2^kcJi*{;W9D~~?b
zYS<5Y<i9U5GYV%k4Jk<Uk;dP8w6!)Rr~1GDE-!ES%@0FQEHKTfMrIR+6JWWws+#kN
zx?1O1tEQmfOulJrnanYSH{EklSr+w=*?~EAxG>Ak(UPs8?>GhD?sY>V7E|q}(YH#D
zeCulN7uDRT>aG&6>+~0ac{zc3a`k%;<Z4KG(jZAio0fS#`M!QdXEgDUf6YB@kS<MW
zvfJZbN=?(wGU{s}2*@vlNc&d5Gmp<4057I>&4`bOSAy7LUrY5Otn14zxxnnlf!Pm7
zX1~g{Rg)cB{l@*aex6QC`t5$68H+cEo^1AigEunzb#TQD<GGv(TWxdEcJ!7(4#cJB
zBz;G$MlCB(qRY{fVy^NxT5{_1@_uR@Ma#nrA|ZK-wq{1>y5yLfhJ`L6<m1E?{~FZl
z;8?r*wThxs$ZQ+|x(6~#wn1RN&|0<ZzZ533U>`|*vGBe0FaA$Y6;xFn3ZeB%hK8Pm
zU<^D8rm^>z-#n;k%BZSRSC<*n@!0v=su_0wIhAsAvmd_<xfn~7lf56KYf*K&Z|$j?
zhup1bgcsKNs)&TlU#)&5Bz8_-dKUFnGymN9r3XaCm+b7oLjS<RhslA*{ckRxh>h3J
zwFP}==8R}7@()^ebp_IPqYTZu4Xc`xPy0XJZe(O+Hdxm@G;zXzIG?DaRTPg<6!xH1
zl2C@p!yDm^aH2s#xIC9S={Qc^PuQ`*+4WoS+Y)fn!J4a}j(SW53)~pS8@}_i*7-pH
z_%3+YNINxe=n1AQ*G{5YMt;vBEmaIX@%C@pRS^rf<6Ox%88zLLB0c}JxAc$t&q(~F
zl|xV3N%EojH-D)xmhAXCZz4&t7RnbIDI(vGmNQiqJag#Y&=gjG3cFRcb0>OZZ@sdY
zaASk(ZBabwDrr|u(-DaoD)gA(wRD3utI6LXT<uO(Ar#a_N&4S5IjU9i&tT;Jcsq@5
zUmkjLc&QCRe;{^9lPeZ%84vKknY`P-=Jg2+w~KInT0#L`E}F00r~LruaWr;L$G^$P
z)ALM^9#hpx<U3yI+OXwL{g%=@r)vO!l#)|R$T{d$ih{pbvUVWzce7uX&{_mR;UT%4
zh|)q4G$``UDCa$O$kc&0IhI12dJC>kO2sO*7s%DG^5ZJY?s+*hVj8D61ir7Kets+-
zE||{gJEz;W|FvpJpd?+h{MRPOObxMe>nbpok<Aowa%<qy+Wz5+1a1ZYhJVveucMFm
zEqTYz)sVKPYefHSQ-`m4f5gAApyc|OMAP=%{bH4nWBxORut%1Q-+weUuQC_HfAzy0
z_x*^@004-;R=ID}KN1_Su)KPZQ+r?A06NgI{x$ZTqmNxeE>XnOU_^7<%INc~yQpLA
z&>w?Kb2HfP;m5{l1MoU*n*Y-no2n`wsabpetNGwqIW)X72=4lx(|_&@NZG-v+fHd7
z6UH*vPIjL4Z<;{EwAHTx+$lkKOV=oA$5qM=N#D?u{Z&6_hqtIudhCH!&@9XPKKxsV
zCI}Y7y7RpmcSD-0A`W#GcMy(Z)Rxxy_N3d8Aefq;*OP1voV5RAr#F|Ywy>@+H)Y69
zWuDV3-qp9!RRl=e;7--spN`ZtrAl|dpH^M6UaqZbp7~qV77kekm(=(V18Y5yWP@G#
zB`&qBN^wwHd)3g${;Ja|?U!r>@iGrmFE5N1rK0y@u6mrVxlj#pkoQWVY+LdWyxiiR
zi9h<dME{7t6ZA>M$Hu#q(~5=UdU{^Z8&^`}h)x)fEU^JY-(FkAC79N-Kb)>n5yI<F
zHr*0o{!(J>TvpZnzW}bunh|eL)2gVea#&zg1!vm`_LE8hFde@XEgFRvRyWa~)8U@E
zQ)Lz2qD<*IW7yv{I^uWWo*Y3-zw;>*aU6AeDS*ETng70iFR19LJu-WmpD<2;JYsFM
zaPKThZNlGQdnT_cnEY1szNSf@v_14<Wxn~V=$a;_s-M%}zi=Y_Uu?YzRFl`%1`L9r
z5{58_Sy4d+frtzWNL9e9pjCJwGAF56WlFA0GAjsygm8Pk)hGxSThx~+DFP|TnCa^U
zMM?=#Kp?p)f=rdEAn@;azu{m1`dO^DbV1(pp0meiKYO37b<S33CGzjLOb3zpBWQI`
z#@4uYo8hI?d$6ekKLhCRj||-Fgx`LqIRknOZ=tJxntyyh&u%oc-~<Grh2eT<zjc3;
z*Cx7CdBq3BGT^iEdUgHcJ~!hHJv-q+Y$`-2A)nD?H)pB&tR|8`Hv{G4;tXWYK~W-E
z+o*``?{>Q_s``EiqFF$rJsCfrrU1S*%9n^Fc)ZD50((z&3M<InE&cKKn8B=vAQtS^
zMVv?)QbM~xDpx1rUv#(=3MbjU%Q2nKoGq%d5FZ_R)?sP|BqW_XvM`Vs_pzYQcF!tN
z@dq|+bkeA4b^Wcmx@Bs&eo>^y=R+BuWtXc>nSqn$WumhI{rgw^kr+`h?0tLltp9Lg
zK-AQ4$bugBR@CM<g>98+<@^H>B>@-GrpjcEjBR$pzb`k0g9iE{)%qJh);p<Z(vQv&
zYWU$}!$^IA2<dl9+f?>lwP{x1=q0ufUpcD!xyU2po6na9=X#dIk%aG=C|WsZTwOmf
zmiBC$UHjjYAMaj{`uqU0n|%SJ!^_QR(<x247h%wYquL7Ik3O0uVe;cv7sRhe{QIwP
zy1??_z)6@|5j{AMFtYF53@X{%8jaepL)msRf=Q782SH|Nqt;oT3TE_^WRHdA?}5N-
z89<HtE};{_%Xh`EYsdPRuYI&yuUnh}ZLxhB{wC*cQ=Ij>$7e63a4V8<HEPQ3nOWOS
z#o-0D<pSDobLyY>z6nQy6FiZ^(Ob*kM#b#SFstQ<ti_mr-WFzMHW5fIPd;cc=DQ5P
z@ZmU;VEzW8Af3<KGxQ$OSuUA3c>Lql9UGnDNPp-G{ED=0Ia>Z1`X1SvrLJIdRyk-&
z5sfA(ZoTdySgpKL$$X4r)3nQ?tM?0fWIwPf+orO^J0|(I#yDf+zS9ls|58lpR?r{2
z@STf+8h-oYPYc{FGtfX<n~zr-$=hH$aO_m%@BvqE<HpixvE)ig#YS&>x%21$D*F6i
z@2RD%@8HuaC;Frw;B=(#XDcOvZh!c?a8Rd7rRw@V%9H74J-cc&P98s|V&4@0+H~3Y
zc0hlN6x2K2?0tTI{Eo12B>bfnn7O$tpS9n82sfrABktRuikU(^)(*3YW1l0D^pkGK
zqNY;kTwPB4{50U-AH49r_;uaf<vCO9IfLXV5TGxA{%qT7L0oV?xpE>Sy}W+$TFIlv
zwF^i~5WoUQiayOZcvPZ+lMlqN<?H_1K)Qe|Y=+-!(5e;M5lh$W74ri7l@dE85|)Jc
z&Bx1q)GaT73#6(<I$KP4fcYEDyOu)zko=yplxQ&4Yto34qW4k?7H{S}b}{)Bk{;yd
zgH+d|9{lf<)tu-vF4}DsnV%b`SG8Z%zy^r?k&PRlX0u}N<(eCCE`{V=^6&pkzJj07
zfWUrZitf76&Xqos&o`EtZS9yj(-Hos%8AeD%0H6*k%f~bh35Qvi^StmF}Ca8X@il^
zwsxTt>PUUi=WwLH34N2rn_HFGED8o8e*U&;OV48z{#tG2YoxjcbspXG+0lFc(V^wd
zoGukXsgs&WdeBDy)@2Vjy|W^s<%_B11Fbh5A$<+^;o*Ud-(i8}R60omscA_1160T-
zqi8>}5M)Bv%%4dH)BS`AmM7QXLxbknT_m9_`52P07t)6KK1j8z27A$oA#~;0kpN@~
z>ECEK<a%bVK#-r7UQ@qlkyf<afF$oeQ;VLZS@|PmWZ`H@PIzY!w)tHWg_~^0tVTy3
zqxI5rNPiQWV#*XY^G^py*?}UazMlFHNr*+#!@#(&q7#|W(oycQb__Bg$?j~@*?ZZ2
zR5ND#-&sD{E?au|SJ}G9g>eow9Rn2i1~8Esc%4UMs}wVRI_>_#Ig@Z?qYiB-xF3Kt
zBK@alHw{@vN;4-~N5nBR9bM>^O37s;0r&-~@jdwvF?lgY5<i>4+A?)FeneaIug;#9
zl(*TmpPeLE*I!7kTyAI+_96>yl~?>f{sVm-hGZ7JO>U&!e;MSux$QyQFzpi3Uxf6>
zkRYA7k1Xi8Xbw!o$^Gws3yZ~^sbzPQU}R&@`f(&(=l$p%wpZqbtTO%PZ@>9?^2Au`
z>_Ho?)Gq4skrH~kFT)Y)m_k!Ht1_E*zgd#o)~jB8*@c_tPf&vZcmTXjn>6{E?`Loz
zmk&eadLZnl<~Q^*umT*A7@&O>$M+P`ab<DRDs-h9eZ9-<N7NggI7_vx`8_<WKgjs^
zwhV0EWL(ndU1Y%noj8iOMe57Z43m+fW-qr~@oR;3?c*zbTi)c{LMQ4--~|mR``%<t
zt@II>eE|*ZZOyMkCmPW!w~}*EqbI0`;4b%6<~8I?zJHYSsGE;>QR=ck{&D|Rip7i0
z^WF9tgH#<`p`&CUq#VD&3!N2wZz1J`WZjw=$=`YoF|M3=Kik3$&P=6GrxZ@FoOt#O
z_2$P`qNiv7HvH*4w)qk!GYcO1x49g2;#A4aq)GF<F)v8(V=_PATVK>DAs}TsIw*Q1
zS7$aBTQqGo>%aCv->n7Bc!)aDsZY@T$bxrC_T<8&aByb;;#hX#))nBu-b%M3{Xe*<
z&4@iTcy#_5W8KtFjLA)_G39RURKPZ6CzH2n2p-HCLSxX)E~=dz9m~Koc(ZQLaE~IG
zv}Gptnf^#Hl9azS5Gm_Cxtz0}a3*TX>u^PV1I`02wr%gKyyD3SM$#4H#QQ<Y9~DR(
zmt?7x6V8=aia`MDpTM@)c0696y}HsDN4&oNRKw#u;(;Jh0<&{SW#xouE}U~tj+zu_
zd%P@LR|M(0BglaiTNeMhdfmY^4$PD+!K1Yi%>ZG~2VpNp;g5_M6Pg}YiLW0>bo3zt
zr7Q9M?bSt6=wi9*%Sfdd+KSe2dSKv4htCK##{@3gbzb~!Zk6bp^9Y$#^aTB3`N%V~
zhbw*N0GcFpS>r>OLT=tc`UCLahvm`ZyVSfsK08ghf`o2Q3`Sb??0AvGOAPUA?8?{R
zsluLkgfjc!WKW($X85-#g*4N350jtTqIo?5{jeYRB|Fh8$C0&z8QQ_~cMKZDFAT8Q
z=1J|6AjE(+9Du|Ly4V+%+#l8_=1BHtlggh9@Gb@-;x|5eYQWs@IDj#1d(PDe@AQ>G
zx|Y(hr6FRcnC$LE(t&LC|Gr5(oyf{vv)`6vt>L$qXQrDz3h2K{I`7|4K-O$ai|SW;
z=9Y=3pr6;v`rS39;76-j-yn`R?vS&mlYgY$_j9R5r}bq4h&lf%C!kS%^wIpCk@kaY
z@7IzcQ`}{VAfY#{WU}(wdhzYijlS?{!8K$dQ2v0Cv5=u3+dfmHVjw{Oh<08>5*l%h
z=*sp|dVN!jg2(Q}e?4G*t>m&rH1>73p5Jc@?_|m)*Ol<!rg>AWYz5U40BI_k@X_t2
z+--M8&&y{lIM#F`z<D0q2R~5s<Ue4ONSHhlwt_x>)|?MdsAa_?3wuklgBQw1AgZ3o
zHE*{VK2QKQBUmm;jidEVGB}~@7G@(e(i4?eZn5l<1uwa&7%XZOt1LjacmDHF>z@Xf
z$I#b%77NfIx`DLF%Oll2a?(6ddJ;+Cu>6sPtuKUcS41C{cK{M^onhb+gcS30o}hNp
zza&2mW<0BR+Ee<H&H8$E6sGt6jMMUajw#9cM70x>?$2F-p)YzbI*$PCy3e@XX(&HV
z8W7D(!@MSTla1?m+apOvPQ=~b_&wztpSNcG3_dB$4+(4(zYw-bZPsKi&y>wyuC5nP
z|Fwp$JeBmVZ`;tjG@kqEoQ2tN6gp8&Dte6C)kAHdjDK)A9^CrPrWt2@-wjD_SrwW@
zZ>d4OXRWL22WKzgw9)~g#dti)Ow+e}f;y6FAET*3QD;S}vmt9^3)S_S{{4vnt$D)p
z<MdKJk#wj+tS#@V_)u}2Vr#2g6!neIPrTXqlI(PWfBlwAW4{q@D9RjiRUxJ6JPbiK
z?Md`uC*bdDZ`{z7W&<NHM-y5LwEpj3<<Q`u94>H|*p|0__D0tJh7{(*0;hR(vxnB+
zIxj#m;k?`F#t_B`HZ=qyK!XI)UlwMUbzz~61@2(y=w*MzcvQ%OqUdwm*2p?x1Y}0v
z?-a7OIYW2Q)8nrgpFZ<9MemV*BTgXFfB2cgOuspkmkFk#=+gh^Lo7>QK45K8V&wxt
zUqkqJ*1t45_qrIa8nxkva%v$8f{elMm5I$$-nOCqNs4++ha*>IVALoiI|_af)N@q=
z$AY<-z|pX1onDWO8uZPsihn|4HN!ixP~;aJ)$_+-*mcEW&Q_0e$e`dSIHIwgO;9o@
znjfj0n34aFBw13z0HANjo2C%fj~-P52Xx{V=@goocZXCw{!IM(+_K#YFLiDwQjhp-
zMe6nJM5zmTP%Fyy^5m2Mnn4zp<Vx2(*W5I@8!8?!r$yk&D$=1CY3R2^XfQkcI3~x1
zmt13oKXb9c@HhTWwB0WHr#<=8%dgOsV%9&<D>`8XMHA+2KQ*?5G=5G*hPPV|8preS
zfRlTr4S>;d<$s&H^GId!BJWr5w@#|Hf0&D<zak3={%55B#O(QKozNv~-0$g-X@j}<
z*(*0AvX-Wqub=sQdb-^!t45P(zb$&F1vpRTT@}cTbY+e-rCEQst#mItNKcZD&Im(5
zfc67}pHvUI&BUVUiHrIwofbNG4_&dAKPBLqZdsps=}3^Px8{}V``33Si1e2I@E_2L
z18Jw6-A?i~;vS=I+PCCl{*drvamH6kYc7lZ>65b%sG;Lqkp=8C-9ay_da(xo?09RY
z@XJb1epxB6X{O%7Lh6wUM)?P@BaS!B1>1(_m84Ylg1LKu<JmGrHoeyGMhPX%o%YX{
zhhc(-shB30bA6@|W{l=~@?R`hqbZf}oO->HB6|FYLPl6z%H7y&2ohtE+Eq50+vhoJ
z`<W?;La%HN`?)ymL34)pQj7@VmCADPX(whK$}2Ol4he&8V_=;;eJ;ya(Q&hB>JKQg
zz^NrYQ)}C~cn=M_9{8ccfF^R>BP1)FrtCYzUoRi%2E^Nx4hGaoY8g`Ciia?x0zLYX
zE~D&<B!2}EeUg9wOn&Kk#CVQ0^wX-`P6f~Wb#!>{N3`jikG^I6{V5}c<s+fAvKkaG
zSDDp0#o@ZD`oyQq%hm3iAC0$egdt_x?oZG+*GCNQ1L{+_@#CN^j}FO~{FM#uI+3QS
zI}n#Q{{MVNvQIY2?VX&u>Qx?Sn(shWj>MIn8@d@cX7=CeWm0h5-hd1dQJRK_b;^0f
zoi@X}GTflx@l)PY@tMwZO+@83+eH*|Ymf2tOSFtc%^)O3&reXvIk)6?cInyqrL{0*
z?f!T|+fD7zKgp64NyBsq6;*ou0J#aH{m?WC_U#0nHXgV1K<>nmXGX>eJ)ihwkVL8r
zWI!ytlzxknn|<uExm2yd(V!|QE%?3KuF>90$US5s?H$T7uR^QKA!15cKFXMAC=&-e
z$)>nxXHt`pP^*d?OCQqZ06Hz>;0;I#3idukr#m4Cbx44C;7G<djp-(}2JW?}aMq7|
zDqhetS+jrnI@;tn{}b9|Xvd>XuN;C{Bucp&o!0a7Muu-Xe<;0FAUe1wQ3TG>za&2!
z?>mnYZFrXnxtE2Ptf%??TpbAGNc)NlA5sqJlfU+K`$PZPQ#2sI6yh*J+++h(dzj*#
z=tM5MVrY`{NY+Eid*hHhqT_cA38hyqw359%QXm#T>f@EkNKNSK3y#WelKss3xj9yt
z`2@xH!l}Ysg_Pbta16ZPnkL_)6V~OAkp4?^lTDLt4dQnIgr5bKvjbqJh*}$aEd|`Y
z8+w%E8Y#t<+yGQLW!T0fUx$)4H^>;I>=cuHph}ED-eNWSO}8#qb72B)3W@*Ce00<B
zB00qeDGca0sGR6`!JO?hm#Vak@sNavtW)dAjBC(*ajn!BOd<e_$A^E>JR>%>8wd@a
z`yCD1efVdzMszkmY{{=_G96ja=+(>2QH$?Odj?P2_-h|n<DbyiIUaxPUmg8+?y-ts
zTB3PYc#HC2{Dz^6$)!<>tWmE~W;ApYTmv3~@=8h8alEf*n#d!te?$NNdF0_TzUpPD
zM@1e2aZ~7dq%8pHq8@mYW$hc9X;X1eZN8Q4>G6sY=-*Fc{p$@=ujy@w>C2$tf=}@S
z#$cLyPa+FN%O`rFr2c94{BXR(dfqq#pvf+3S?o$JBm-TM&&nax_g_q`db$67!3oDb
ziT(CWXg1a8^D@9l6-utl@S^2t(G;|u5doy|L6lfGFS=}knt7vpR$##y6jhydXqtR1
zetio7m(X)aTornYaxlX*+#w;Y4sG34agWaNjSIG2`3<s+Ah{{E{QPt5p<w4{K1u0@
zaoEtMtK1Xw<#&k8X+r@daEE*MBK4a*s*6kC1i7AvT}&n;q1F{oVH?~2*nf#GU!q{U
zM#p6rvsIeyT_%sR={89+ZOjWA$_i$mge4}ZQFq-YHqpSnG=;|pAnCZ7{!ov{+3182
zO}UEPFXYYAxmzACmbU5pok3#w7gGkmFAopN^T4)9rzEIr=}*RC6~zssdWfUN;cC>3
zZ|!BbvUPa=JwR>p4aI(b7@P7d6s0Jp>z?xkjpWMdWIzzINrBzGd>0+M{r09vjoZXS
ziyc{W7YbeH6uiH9J@wO6liLwrd2XykAT8nZ+2QTkO&@k2u0dk~&!|POQnkYJ&k~z|
zt25nQfu3Gy$o6VW2J5Zo{v!k?s|ljs>iU~0gs7OUr9TzF34wB9>o<UQ6wyn2gMx2d
zP3ZAm_U%om?L0O7i3bPEtAq?2Y$KpswXV$A>ixP!_ONl<Zt7<RN6P6HWWzI}1KsvV
zCgl?n_k9VPuBhA|(>2N6fnB?-6Si~Z7?{D4KYUMs1r%GM6RqgV2(r*ZV3f7Dk?Pzh
z{gC?eKFFO9F{?mPD5zQe4#1iDdr2Q|`z<t>w`WcNY8a=#_RfIqHD6#Z%$ok|R|soi
zH>X9lA4<tVkciR78;Sz@A9>YYyAyi|aqD~_F$CF?QS>!L2YZpz)Wb}njjV2SlJv?D
z{Xgm<`>KTT&|XK$Vx`C2zkjN{?6bOUpRZkS9(v^>(o%_rWqB=QKksy6C2#Dh_$6wg
z^|<Gq!m)&MgEix6v8mN$OwWLCZ4LUoyw<<pcX?;8bp~N6?J0U>_lm%E)_1rMu<8L^
zm{m$|+gR){^_S$Fqa26GvF}Ql7t1I0N53{<{wlm=958x#h+h50_Fd;ubr*p!u>Lpe
z^{?lD0QXQC-}h<$S2QTx^`H%q7c>bMKQ~BslJ+%+&A5IO{|X?L;PUtW{d?d{&WIld
zMb*vv3|~Emr2EfTdUT$`{|wPV$E&7`#u*pp3*{e|&;!u(c+C>h-{{%%1U>gGJgLOS
z43IO1my6OP^7rGatFnlXacSNh?Z#0vIb`NHe9YuJ&;EpG<~1@Bqo4i=ZOtkAP+Auh
zwMyTpM4cdBs+@RBV9W>xscplb;*ff8p9@HWUBh_HY0tpIG4=90>4YSc+9Y=+hlHNm
z{8j|1oYTkmr?*XC3x>#S1wc46^WOcy>tO0(d)>*&+2a?@#ik<q37qcPZ=v{f(nawq
zaG`Eyb1-W79L45Krm?(X$#!{8b=L)BB~`%Wk83)Q4wsj$-JUjVzsld~-`{`&vb~1U
zfQG{NT;7Y-r{kNGCS%k*1Jl`PtX9iMI^l^iv$wglGWAFp60W^A-9xQq{VVK2u+ylf
zS6fQ<^tJ0W+Vo!$u)vg82AuQGCOcu5+)5Q~g!wL;>G<s{9rhXmnCN~y5lV-7uCv>P
z5G?pN>RuY#(yiTV4*2Mx*9eMs&Gt0CPvy%{v=?0=A!`;IyjRP|hsNj9z2|SFE;MW|
zuY6;X5(L0<UlVae{5m70@2{r!nw}$-;2YHNyX(d8M(;Mg%|!a$%k7Z<i^~SXf386Z
z`u%>n@7i*t+ITUhddkWy64rLX1$#;MjgJ9f02;!RE|@+>k2mzaaj*~N!sQBuu|3^-
zz3GjkWuCK<!&h4Yt#AxL!Yfhueh5B*X6-(-#yvlOqd#SEQ?Hi+(m&v7kQR_+^0Vlv
zcv19Q)7vg&VK>k$^qjy)8nT|aI!TK>+g447{{&LVCM<Rs>f7nQ@g0{EMCYVL6@l!P
z<|FCBZc)~_K{g@lICXmkxm`mkad=OF)V7NM7~<l8<x&)GlftpXOIC>EzLhW}-PB;>
zHZLeDk3M`J0Vf1LXP1qrR;Ha+feJnC2oD?g>xRw;mRldGbiMt-{XO}s#%Esq4L_uE
z)|s>~r6Km(CBUIqf{@UHo=N7>5<81>*L8?cU`Yq&?6ajDjC70JRuPFg?(9I>q9JM(
zUQ)KEs0Bnc%cFGth(k<48g{sT+l=m9Xl7OF3j@Floc;TYD<@7S|2nQ0Jl}AwJj#sk
zK|k{tHRc?1HmO*0LmG#eMFq*+HeJ8ox_A+8Jp^L+{{21r*j{x_X_=Rme}5t2M`H~g
zO@}>Z&$To<Pr7JawcoYUd(1}A!6N42n`1H76o-HaxjRg7pdLIUI*%P*V4^{G(&i(%
z#SqNM0iu}l!07(LT(5!8=|~JV^v{H03hT|MZ-@VEgsqeAKqtII_EZ2OKq`6c3PL@Q
zFByBty^!Q~+7oC3|Mw@!tfO<^>5uLzVXS$17z-^-3excrOVu62$y$SQx8ls$?V^!K
z`pVOJt(uni7(Ms-e(behXzTUo;)<=C-rX;cYDJAT#K(aaKxvxBb+~%EHML>=e*3HG
zZH&cw85o(7ai&ZjJJQC}XLLh9A;T2*mxpR}9)cXGAj65FL{Zi!-Wzr(IOmq7N3fD>
z^3iS>U4p6ejPJRFP8^1GG6~mjDuS>~&J3AqLYt1oKX*>xky_sR`wW-@0sz2fQ>HKo
zkGOdy4Hcfvhy52lo=!$-v^R;NNa&8Hcg0Oaj{L!8&)d%>!|fmOy*(-v1!m__7BNjM
zwH+#&0=+<u`A1!hVDJ?!_Ad_$GcSl$&wgMkx}Ef#FIVi{J);vE|8p#%s<Grr@cKDE
z`7!!@8A??zdQE5KoCeKv$kM1^lgtF_z*Fhv^qN1^=>i_6AkT<@zNFwSVf&4nE*Mo}
z#oQ~#D#h6eAnh=F)f3X>k41{uVYc3ejg-@Jwy|WlMN03c-rXC!n#Kd7e_z%3Blt|e
zY4IFn_cLXDphXrJ_9cj1;f0evFdya9#$*2XH+4a#TFDAmsoH0F>o~0r8<Q+A*5$MY
zqWZMR2+Hqjk)sd-X4{8)I){9NL;;(zD57%O1pyq(*Ez7?vHU7}MR#B_-61&2VV>z1
zFA`N=DWr*#6vYKCQwK30a;+=nr!gJQx!_zP4l)LrE{?51qdetKr)FR^vOye4+pvc<
zU{25ODk*qn(HdoL(*bJb8X$`WMvPpoaw%KR2+nuw_Nv1RQ~mpmLLRuDfrKQrPvm)L
z7&Tt(RRXxc<z!NtKVRoDx_|j6$>58ZrW?DYc>n&CkO#(*(q!1+59IQ$*naiZ|2z*;
zSVI@(Y<QlfMyGZ+d$ob=INiCA0a<Jq+ngyn$FeS8DjeMjltzz9=39XL;k4ua;*S3k
zoWMKQ0!ZB-re(UEt4DS(Ho)$xdbzb~jx)h!&sP-DZJQBi8{G}!H)(?hO>R0+lyiYy
ztF<WlQPMMQ+z~XCjX>oYph|lUKGtQ+ahz6fbL)A;+RKdt!gI6)eA8m?{^e)mzYNCn
z(pts{!*kEkra=CSzu?Wz45-7-BY@k9@D;`{w6MLY4Wpmn)%w&w2{LiIBMs&+_?HR0
zq~GUq6jX^GnAh$P33;k)eJB%o*0QpBY?D>e*Pb&?U-7{RrBZHAyPSdJR0k{myu53=
zSG{f__idBxmPO)uWVq0p9|n+Ut}KD~$kXjQnxb`QBKMY;=X_}`(jVD-acMmFmDB@M
z5a+6ONvhnfH}^G<kd@8WRQcFi$Tg2*136^A;IfOhl`H}zd=u7nX45by<jdo<LYJ~)
zSr45}9=Y1;a-wXtQ@j2K0&|uwIb<-Ns{?;nYDcR{{mQu;3mchf+#X_*cZ-cvs$gQH
zJ5s86D$yM@Ry0qddYWyXJJmWx$XDe+v^`&-Xu|NL9E>a&_l=_F)9x?DHOX**PCBO@
zjUR4lA~wCDJdMTi1VHliBE=o@c4my$StP!Al)!^(d^)_^ZFp>RptFy`29dB~)Q+(M
z>;-pxu@!ni>IvD7guECQQ%-ClWW8e9E<RQ479Evn_ObQIi9IS+{KKF%)++YKU6fsm
z0!s#Me1G^8&~(=s5`*~FOfVd~<si;hKeX|@v&~CmjRAE)7p_1htP9q1&N(Cil<Z?k
zZG>y?LaWZ)W)NE<#(-WE{KQxv<o0o<dc=`4?fC@Sj?|G;A<UxDjnS!O*Eh^I7(=L$
zrW_dY1IvadF<&JfR{2<pXAs@RWJvtx|FPKxM~6Ia=2sX%`51NN205Dmx5;vF0jWO|
zKb(T!8x++?VaG22LJRdr8l`3&XPW_a1G?lSQor@ihupUytfK$^-QGjlD+5}$fdyrH
z6(2EkA^Y?!_L(^l=Eum(&S@HDfX=QZ+pWXM;sMSXx9{<c2-gOpwG&wlz8grc-u4sU
z>&vuk+8+!%-{|L>8v|#|B1Mp9QmDgjqrLfb5!*c7)kKVqiUD>E{;sXg{XnRFe0vC&
z-82S;pZCS2IG1D2AwZ)|^Kv%XVNsqGVtKe06&JiP6ql*6HJPHzE-&BI>l?_zsavNz
z?&Cg5rg@>u+iE)0DEjY+Uu7Ec_ITrOV53Em(L()b-WK@}BaS&oF+|*P7SoWGeL<3Y
zmqjN=H>P^C^_R%%kt70a;f=d4+Ly*shUinU6@gwKn`)&XGDL!W8@qlk53dr1a2}af
zxVG*lEdf2x+Hw%vG)97hwNC!wO;QfH73!05gGqc~ypX+qP%Tfk%Y-x|FC*m_$-*g*
zX71%4V%<E-h){Eiu%2!=CFCFV5uGGFZWeyDzfmnIh>^hMGK@kAtx%G)Ajzth<W9lR
zADm#13O;8CEWOWOy^gJ=8UaJ>_ki+2vEWK{`xbyiJ?(IO3zH%qWjC-+)f)i<h7B%m
zlG%q?ra&E43z&dvAK3~@iLAUGbIHJVPYShN5ztr|)epJ&kR9+cem+3KkG2u7Ldm)s
zwB}+H@vi)JejPX1S?-s+@MsNCH{p@R(n2mwHaDOY&D^_w(Zx)a>?D?jg=8CZ`ZXG5
zw{V>{B{wcNUDl0aYg<!10?4}qNTy<vsgqnbtiACCcm_$AjN>V&*wYj-B&}?m(5G9V
z5HPC9kff6(w0=nzmSa`;ir8KQ#epmuZRTDckBw2|1bD`AkMXB}HF}8qV^u>h6(~vO
zCi&SM<vh~X+oNCE@Q-!tU|XgS_u4fS{6_hEEca(rOqaL^0y&BsyL=ni)k+N!xo;Xk
zPiDAh=IPa6-f6dsj)>UM@;+8R1;G)=;aztzeLqStVH_e9HNzb_j4q0KgY2-6Xoti+
zZ!&!+A+J!9)z8&jl7<b@S2;$SBt016)Id^xh!e2#j6X?K+=k%Qa*n!2iyjX<=l;M|
zt+cmT{7JDn?ki9JPIZ!p{B9e~hJ4lvNDzdKLh)-~m!KKfuYK-`U+-{HIw5nh5#b5D
zELJ*l(WcOOdLik6$z$VKEzWAJ?yV`UVaiRp?hXb=4M=rcV$Mayq(H8Y#n;C?MhCsx
zBzq2DBy8L*B2zZ$6JNgJz}P!A?zUh&Ly2k|mgB(Dx{6mHq+rendL^0$(pbi*Wtv7F
z5&Lf3l#CN>@n&lz$pVJx%@l)aUN#{c<Z!=)QEe$?ooF298}eWjls+Rr)G-(D${=FM
zi6EEW_*~GjL`H<MxBZnoMG(<!R_<k7=XM}m9>qjJAP-ENwJR#j_N_3TitNw-Bk>2?
zaMEt3cvYY7US6NLy)?&xs`8?pgzfFAF~I6feKkyZNE`M?ii4t($oVWA)rs7=e2M!=
z=iZc&>)cRJ_=FbP_yyid*Fh7Q4z(qB%9KpVH>RjH3=%U-3W0cMvq*8UH(ezjX&|dR
z$ugpaddvD}Iu7`a;2KCuVzPR`*qI?(F~uO3moB+6g{$YW-Z&bplFU>DFN`{zq6GnP
zw^}q0zTs9f{b;xjNeBfir)Uvt#;EfkhNu!L|JH~kt3*Z|u7Lk083B)`%}_{m**q|+
z7_E=5AKp${8h&i7p{)aNs8E{!2{@2YS)vTkY55IhvD}mV<srsy(l0i>>H{F8&f~ee
z|KD#WM?b$U$xX+9`)46>=QQ7xkT-?nkHNr7hL_oJmg%BktBa~8D3$EU(Dfe(70y-d
zzFZY&DKIltIV#0$#ld)yf(CD|i-`mO1x{d8CCpCNnq(VAao{c?#bTH|#x@LQZ{8_k
zp3`*B+JPa#J6J{%ZS^BG7J2IubJYmEMteNAH!hbAGZn#vkS3Zh@TZ$kI@@SB|6K1x
zy9(?CO)DBLIju1t-l*t5Z<O;W|F>T}ori2lOG8!0w;`rmiPgcnM-et~{0<i#E0U9n
zPwTlVktx@>_@lkf30bs_;DN}Qah&QDD^v%w2YN+z&GmJk<fv3qRBJ>F+-=U}-A>~*
zfa&{D4r}n)$&ah$wh^w7qpN~-kzW^(K)C5hpfA9UUvf*?vBmpii6Vx)g~wuEU}dkd
zx6s)*)zJu(oOFAGPxh*PUY-NKq5~#{>GFiPqM{yIcmVQP7b^*u_bk}JeJ{c#^7k~_
z{iJ3Z>$}zQ+-5IE&oJqL>4T*h-hGS2p65+t3V?TvOj(p)QlB(e18r(o#IchYM27&9
zUc+mmlLlWKGkEAK)#Y}C#<XaUn5gbVu4#$GJe1_>L8)idXy`^NM_V%@JJz`USV;~{
zQO;dxJjWm^2Xl;;AmhkhmEX6KO`!Wqa-K^HKn3^X95TpoiHTXPLQ;f&B-tsFtf<l6
zK`7vHbXCdbK6ShYwDIzE3Wg~>T&0b79JV2)#r8rBECSX?d*AHeK5IdSByn$)%O9Lp
zFv#Cd%f8l>k!r{azZ};h7?FixTZ<Gid)*!|L$})z?Qb0An~HbE5JAqnUl{T+-R*y$
zG3o$y*rPJ#P9_vBa7|$%SIEsM_9igutm$It4=@&yOV=AV8?&*MROjjTP|*9aBW|=G
zBn&Vcf7QT0UeyWNhQ*xMU>w@xZG`6mIikW~JnioGO_+RI&E1<nyC^1+)V-m*XNiU@
zYmVpLfZi)8mgZfq-p@Nb`j!BE{m;`{Se=;GSngT=a+TJt%jPXJPT1xrXuwl(1F7i^
zv>`$Jm<G1DE_VUg$!1o>?_1&&vT>bRrrsQ|cI;1bXH;}BVkS60Zp<i6X<#&?ihqSM
zVdp^I^+Jfn{n6$$svnZ)N>PgyC=v4NC0QVM=lpmqQ=!{X;?Q-3tM`dx&g|R@VJ~s7
zikIgd40$V4^p?9h7}lLc$K|1~{|E}E|CKUwtV(+$Fls98nUNhITv~qJF;AbTuTn<R
zk@`?LiTz(rBHcpx{)kC=<CL`pX(D*XmxG{ec_G}(x-?_d?qky)f*B<4G;3EP<QzR4
z4bAo~lF{Z!qFE&A<-ddTRH>S+H&0U>Yj~&DqM$%_;EeFt+C??ckfA(qWHlY8T<D-s
zC#Uo!Rtc}TVx+-b-7f03GyET26zKLg7EKXYC^&Jot>t^3k84ZChtC9OAu9m<T4pHM
z3V(xKg`w)n&$(RvykFfKSX2A(cNcqCr}gnimPWN&V$9__q4Y&3T8Sq4e$+h`ubNft
zRaM6ny7`BrJEyots-p^+<Y+S2{EqB!RXs2MW1bg__$Py;TuI#wi>L0M7M_ak8+kY8
zQo<16UdDh#B}VgoxkiD&>!+`>w;8j2ml&koVyRO|E|21NrsD!3*ANF=I*!z_F`_YR
z!c9EZuge`eb~fLhOuxGD1T^}y<}-cO0-EHi*uUQii~qi2GPfRnp_=9MX})z8lzS~@
z#0?fdcn^IIeGOuEtTCTtax)wM?Tj%$+Jv#2byJZc4G3YR!<h1v=t-)2>vgc7N`$Q4
z5_2WXo>N14aE+m@2pTW2j1O_yE;y?Q!-@~B`w8@Bs!omYEmu2<Xe<}D;e!!*Q(&#Q
zrp{vlRqYpCj8;iZSi2I7&ZFRBA&mg~wV5tHLvtec!-@~^s56XedDmg*pRIcGJ&S9N
z#Ra&wdeZr);#~WxrC~c#+H~J)WC4x!dK&C(3?WIKwBrmE%NRTSc=j5de>1tU%7#la
zHbsl#OY#qyU3Rw>Sj~D3-Nf6p=R+Bz*kq96(3)Edm3(!uM$1e?0<(^yTk)YmmEvv-
zbLzG(kv9hr{WEc&LLt6M9Afly^}{=EQH;*;z+G2H!kvW$!4!9)r;q6*G?E$(+lQN9
zu3p=|u5|(y<rd`ypbzZz6IA?E%>Rk?$T%P$SLXQN+Z}}M?aNIV&;qiR%jT>05fdz^
znrQ?`;l{ptFgindJdQ#iM{g3w{uK3$sxTzPy)Sr%thk<_BCw+2f<TD-4K`jWEOy{s
z^smPEISmyBQ`KwuffPM)ex4BzTprx-5JGpQT55E(;&ibs-)`xm9Ik2i#p&S_s`T&~
zQSm&V^au5c7VDed(`l@<NiV*q@k{kdPanAYz-sa7t0rPKZSF$l(sO+Xu&NEdZ1MB<
z9RPeqwEt13+tYrks$&~N3ioFXkPS8XHqrbwuF}AmEh9pUPT5z=fTB6y7@DYL`_l9b
zWLK)%_sxA5Ii_X8yxDXSya9}#bqvX=WN%uE$WC^HVxd|4bFThb!3W4gA!=%gP*9^P
z-zI4U&{>DYG+bLk6R|=AsM5m8xi09g<s?->w@l1+TJqy_cta5D1PkG%>Nn2v5UIi2
zbN(rDxE^}ODBVtu&v_pRMUKmx%-Z#buIq74R>_u55qeG}>jts{eNNX6Og1y$IX8i;
z7C1J^#RU>g8_52jFDXgPyQsK#<F~Ox^eE6#TCFUD5z#Dx$))B2vM{$S)wyp?uD`M<
zH^4}U9wr4!9J4_$AN44(4p4Ec7rzi}bese6tx>lCwoVEbdn-=9p@8HqK2^6Uf22NH
z0Yj^;h<Ftr-)tAH_axmu3O-h}1=w6>v*Rk1Jud{Bqk9QCiaIl4A^G%KJ(wcOKI&F_
znQ-G4bxY(pb3a!xyxoAJ6w8AuSRqllm;(3OSPtEo>DWuy{w3XHKAhWb)((w{asK>e
zsGXmeYn6E$LlJPLkpO_sVw-9C9DOx@sncoaXe|Cn@O&#kKot$u|5=|B)$$DQNJWF9
zO-G%*>S@ZM>2{T9ek3DeivwOqjjd}ndN<i<(UBu$8#x1K>xP|7g+aTIhoRBBCOJD=
z;*6&|`<M3}$?oDD_4#KrRWl%B_jHFLp#Yk-(c;3LRF!Grm1rH#QVbS5g7<^6Kht|G
z9;}fl2#PAH;>RqEgQsU;x0YN0_2dG$gc<#+B<C%w(%Gi7j}5mcIC2e_NRCeA!}=ur
zZJDx3?s3jbh}9E^^5}Dy)0C2Aim)I@gVRtm5@fxB*nKGH?AWmom~?m2=P7=O;S0A_
zL1Tx$T;%-vF*brH%a%1fC)gfKtgP{ZbN3%u=pShxA(w(fy$Hk>5HHRJ{&KXooVfd#
zHh!7cbWy>9x<{iUq=l@o8X>Pi#tPG+4~@m#Okg~u?1_vpQt>TG;9~EL)h!>G?nq?N
zLOBYj*><_}4eD^`h*W1;MNBM~_<2(_#Synm8;FOX&i*9Y+@$b0UTxCLGoBZT-!1Rs
zOkGxoeSxnzPbXly0>>5zEL8PLree47fE>ZBYQ#i9TyA?i0`ARF&SvGmBG8WNMCmS#
zMlGAziW0bIKcYvwJBcpJ4hs#)veA)zJE=;Q-Yuf?<ZME8=e{(}GrTmYiTjFnxNK9E
z9%TR+%TlPWf0e8m2K>DL{UU9{iA}R5s*hv`KNjIJ<G#lw1OLW#tZ_~6jE>AARqc-@
zrpKW}i)yd3P;qXEZYPs1V`2?bVO({AI-yA2MQs%rDn4FUsRx;Y`-JRs@J=$Qpyw2g
z*~s7Tf4=<q>}g!*5f`&A&Q~9+Rw>xlEIL)mDZ>9_%?_K+^B;?Lv|Q4)p1qu=b%%6Q
zQtVAtvu!tu7C6{zW`l$o^3R(TMX}AGv}2Lz2aVThDqVmT{O^~~4qg)(r#gl+u}Bme
z4HcY*DTf7v952QIpqS@vIv>0_kQ+?FAEDVrn0oWyG#EOQcSe$I&j{9`RCHL`N@~nC
zl;e#bfjoR}*+k<%s~&OM^`CvJU=WAxvji~xm2?{n9M!;9bZJg+C|8eE-VJ!V?kD_%
zB*s{Z{QAKGwztpjL5k{;n=yp^Pi%sxkK-q*4U_jX^k!I)44~@Q`JM`0h=52q`||lL
zup#oVFHcZAA=_o6Uvv>ON!i(YgHG8ot*>)g;VMU2HR78YoS+(p{ASgXD_LkP&x&ov
zOSaT6pgoC%MykDL?O+1r(*_cu->gIaflWlF{2}l)UIL3ZKQa1UH@4`ayRFEIx+9jS
z1PwMsvqh0f3mIcQcMYI8QZsA9jK5o=sy62jYU=l!k4*=jtG)yu5DM-3m#e4fXUPDh
z(6#_`D$hut^XXkgJ#E<eg!~ZPYKX&>?JyvhwR^oThHH37Mqf6G6+)7o?_^BpY^j?E
zb!FO(9p@@fdf7>GUFQtD1tuj~zrxwFfC6J#BXqY|WL_ieC#6+<$X%!a2BA-yvIvBh
zCL#I&IE_C8+_-Km=Til^-plegl&ecRkB}>)D5waI$F%oz6%3?7Lpv6Ky5^##hOcsV
z%Tk+D49Qt2zY{I;<to(SbNlR%d-`lXPPpMW=M}<?v9KKZJ5ZpfD%f($xMnHPt}Mz^
z-_dbxf02HP*20Ezj>5a~%??&Is>`<9h_o^E8Oe=i%6?mZ+t{{foz&kI-T~$i@$wI+
z+~-_nbKV_x&^%f^d%3$k%_MsV7LNrqEMlo!_@m3FRpMp{FKUQbne%C%+yUu-wrxlr
zYVeo$Yu&n79Lw5CN_#h+E|){kk4JeagC-_LGEQys<6?^9k!)+KM?=1Qj8+}T;~nw8
z{%Ft(=jF}quF`9XcBm2hn9$NW9=TrpWJW}>X=DU|PVGlrwDZV%4J04_zwg?SKEKPC
z53Y#*+$xue6R%MKXmM?u0Ut}l${b(<g!~YXw#1m7>6|0%X`RYQ!<x6}L6B9TPC9@g
z+JdNH?lv_@BjNHkQK-Z=<rPjmb|7t&0r>|SuC|)1XE1gwO=l_M;eF?<S1#K`<V;Kf
zE94V+P`6?B8(l~sZY+_2PwdIh1R7gB&jM^R!RK~i6S0&wclXg!3=EXOa#YnPLyr@3
zWE7W*4{^m*=hmE_(Mqn8G5=d5zRAbDUvc)1g`)w`TF0v{KP{G?X60>mQTqf`$k#V2
z=k~&7V<tr~DS5FYUXI9_4FePB1J}%&bCUn>3)^7}KIFz!K*zqqo10#82{Ie>?iLT~
z1OEa@HQ44E1^k7E@!Y>4`e=RAC^s+iqfdI?@uLeyZNBzgRp$a1SH=@0fAdlOIID0o
z>*7QZq$-Lvold=u*0WwF%r&ZoiWh$xC)k!|+DO!A$|JfH5qN!)**mhOireqkUABgc
z3MIQpe|GEOGt?4zMt(hZQgG9-mJy?F@v27WbC_GuAt!|16W`My>>;J;Pozi5Pe(2h
z0~rJ;Ush$tw7*@38zZI&`xkE$yW26C;-+c-&&&E^T1}H?xUd6ySPN*wc$y(AcZzFZ
zOxbBG+~K0#MO9`BcHsW}x{s}#7vV8vP5RSD8=pas=LPtE9W}M(GjITCG^>Vfsvpu-
zrIFa?I1bCF81EP7`W1iK1YiSjlwXd>w~nIB6t&`BW;%^}hZOdV9UHn4Ly9vJMt66z
zpIpK;f_L0BEqpwVs&g@`(r-%gE?AHP)rppoWUWEYwn~a?4G$sY^1x;Ap%$@9RIC^z
z;$O6H3)u}zg4qhNq!hod4dE9LayGg?mXK>lm!#+A|MpY^++DUOqvvSK2$U|sbH8N2
zdFsIw%n=^6F-S`C!~h8?O0~CKY}nDw$6)TIh{r6_Oah6O<G<kDvT8|t^<~OF2H0kj
zLZ7`(pW6`5Ng4^64@YZNre$(n2KR;w*I7(5+bnbEe-;D4a(@L){JLuv%AR0kFZ~ef
zatt<Pw`Jcxo8JdDwD3n%$I~nS=Zt#n7kOAh!K)RKQ&qboSD~!aQDR$Bu)~K3TLVye
zAa%1-eg@T`HHXK+sS>~P{8(@lLpD;efA>9f0ZexQWcE!6olH?a)2S$7DtY<TD0wlU
zr%M0bL^>I%7wf(ZD$Z}D<^SUCcJBfU>N8E!jA6<@X>*58`BeOnGICVzAffGhJl$F@
z!g8_c39;$?(M79oz9@M1LI~|N)vAI1<XbHs%-wiG#w5wKLvH?1UKY*kU)DY&%z&Q%
zM1capo{EfXX=Fn7RI)-~#10L(Z35E=tJw|eksnKlnMl^tFerMj5mFRI)tMG3aaEVd
zP<GcU0<w9)hDYkGV#L-9BWkOME=4xfvD<(DDgWS6tsj)N)Q;}H;;%hv?C9;=>tDEc
zAo<~MjxBeJ%kxhjy#4v1Ft=rU!RB*{=Tg3Z(Ye^_>gw>muZR-!&*6(nkuMIly&uy9
zFZ#_8(cWY)NzMiC+=Ra$FqxT`FS(XygsJ@U#@-KCde&W(RY|R5>}_|(LejR4v|qs+
z7e-*n<1BZ$@g;3jAn_Qc*paJj5RvJo9E#<%G~teln6GGsgm<<h?ama;Z5k`=1T8tj
zEZV-xN$sgve=IY9CQ-E&#;P3(Igb>>&hnF*ha+6h@L!}pX2n*{w*f@}s>>mKrfX*e
zVK=BW$=RqsQ-e1~Ah8$hnaJ{{BRM@|meG23{ZPaqCH|^pAnW4#VJZh_4NV{i5A=*K
z((ty=tx=8CscD}gY$v7czf!%w8hs1pKCB9FTOH4iY(A&=%-sAjdK%u8zxFFHLQ+|u
z_#O0fkVNhwK8=I(Z5kS)ev8B*_=6a^T}ga+ZteXyZd=sU<q>K)&uR`XTP<Zx9gZwA
zvxI2`?FV3XMLqV8^c$1xbT9tmcm$LHj*65T^`pFe+IF%-_%E)pJ1CC~VH^cL&?sz#
zUp#voZGwur=SNzwI$UaVi)Nbi4_0g!CO2>N3f6UchYIh2Tv3{PAFp4<ndNL&8AwSp
zG#72=Zc8Ga>Q3}y@&EaXs68M%7INK}#ERj?aB+{M$=$~TJ%{dS$Z`01H;OyfLH2dp
zN&bsN|BB!acc)?(ozq@)jL2>wj`FQd6c(z8cyo&IxG_@GaIC!vy@)2Eii|LT3_{3I
z=)F(|1e|xqZoyOsTY+fqa!B6EUb_nW>nH1YF0D+v(IB4!qVx61S)_#akp0zvKlxm|
z*L<xEdV@fgx}HA^KM=BRTw95D34B;~78WYMRkQfC^`rutDY&y7nIK*+0Ow$h=QfHv
z@Be4FYu4*@Q^_?Q_<V2{8-*L~C#de0ULJS(%9bx3>MGdUfzo|d2Gl$C%SNpXz43h7
zY9ACIJm(vAJU_xb9upI?{m>Padhr<nPd!hKdJ1uGMr{ooF4oX!I2_`bAB@R8(I`G_
zk=XqNhwYoP%pOz5x<0ONP}LaNh^<CXe%bkRfg7)s)bLmA=h@o~q)N*QFL?V|x@(c!
zbXe{Gyj#E3c{HU;f6i3K)i4+fV9;r+zaKStI9@OwXGN17(iG4-D0O!i&S%HDhcWxm
z378Q9y_Ulf_BI_<crKam!!`6<8KG9!gEf4ooIR%U<)Ie>H|}O18iykob4WIRQ+S%K
ze``EH!{H`18eW`YRnxv-vPbHgLSRNwl$^f2_?D(|+IV<gy?9ZVBRga75_?dtL~|k8
zQ=gIvNDBw8;77yZcw+8Vsxw6e5_}Q14;uc*BG=-MFbz25Gfp@twZQ6%6Bf#Bn^s1G
zLTE{2rt*7SEqi+`p*VoQ_%2$IuzVnv&!x@OZ*CktFq9KxA#IJv7uX)QSQ*?4s-kIZ
z;(YheSwX4FK)8&7Hl6IYOohPn=+&P)sJCfTaMoEO+TFipcTn!pOt0SSpk&Ma<ZzXB
z#UOM6*-1TS<6I1qXh+%VaEI<-cZoVQck!xOT65U}FeyPd%9G#n0kjJCHxt_DsE>>=
zlfXK;`$<QoPdB3#4MPweQo}31|9(xY2C>jHy37F|*!|B*47445Wc6WkC%?Ft$k4S*
z+itD&?TT&x6<YZ7E7@U~f|Jo5-qDU%#j?nu9AAs+S1QnB#XjXZRIJg2^D;2Su1y`p
zx<06PGB2{n)i}ZiKTN*Y;cyf9Zf&$zSL~o_{auZ{%VPTni-w+C0-vU#2p3;|A`JAR
z@i4hv|NC4AVQ*i!)2Q{b-LtLG=Zh2l6Q_Gi0%$m`^g};Se<*8`t?dVo4;aenqN=4>
zNK51GZ=7R1*je6o|8>x0fh41-^Kl2I{_fR%w{dPB!AP7z-Kz|+k}uPAjMbU2Ge<lu
zBY*!vg$G1k)qKg3OGYMvUzGWI(@IZJm595}-W({?Nj6?rdp{QGQ*hMb<^qAaz&g-k
z$u<cb^Y)=}ll&wF#T54d@_EmpTUf@A*5w;hH&4(c8S>A9BR-J4{s3JM?GAzg5(Lm!
zl~aiC*rdvd)!R(ks=N_4kA64)*Dt4j^>zov58T=RNY`7!&FaWnvkLhdc*zcL@}lhb
zs`TqRMQnB={XYLXH<;=kK$9Gan)MyZ^0knzCcK0)<V$StMutCsG4&rER5)<u?6<Py
z`>ZJqAOmGjXlKi`N<b9d1G}FZbAF3R{s(R9)2{5Xzsa?!??L6p5Yv^@|Iv|IJZJb!
z)m*rlYZ@%rUd&Ii5vBOt3zKo7CVB=tcxiuYejF*A#<kiBl~0iAkz1b8FfPr^rGJ#$
zje#LEg5Oj`r=D@q6jDR#-@%OdhdU7N(NcSZCZ&f+-blZ$tt0NmmFhwo7bdgi$-c@S
zlLvZVmH_2&cE`u3`gcax;KH;5HHwv`z@9)4W~=B_3`7nwVER3O@j~7tK$WCZo@tHX
zzf^aEPG>%96zk`6GcS?;h+y&cB85Bg1Ea|a$gu57N3Yz2rwbykWkkg=X{n1lT|B#0
z3=A==qrDc>gRfLXUt;r$qk$X0ZVDv*{OVy|0(X<Sz;*6Sn(hF(1!q~z#w3yIKJ@V*
z(SJJ*k|N`79w6yidhwTxJ8<5fm|VP@FMrK-aFpAGHn0pI;o#2XaIZEOZ%{GxG+QuA
zC@?pm_JmnR(obWU?+dtbJ$M&eI20^i9b`?NYt%^U>;{w0-7*92E-cMdM#A|<sNW{G
zd~jgu5psRO3|<*xAQDT9)^LNJ<K;U^_HL*7>EBfsj)~NnwZ(_53{7gEprzvmC!n3~
zx<8_`jCTBa06X%izQH^rq+37S(WUfN&?JqkT3t_`wa+G+)<CD)f1bZDB%4lAujpo+
ztZEOO&3I-!BQl`sh>52#56zrL6NmCkKX5b}NrxK1AO>?Vjl^5D<ycd&XiQqi+&`g<
z9lJD5C6Fi~(eFyWwNFzr*IWBH7B>Cwp%Ls7nEe#QUs}1q$bSV>{0`tWI?0|xb?=Q#
z4Ezxo6z0i4I6mQVi@W)~%xx$(Wr1xLC?zL5tn1B)1~}MTBuPw13>O>aQ>3?S89+M5
zXMP~=kL^6*Q$TB$OMH`sis+bID8D7OwByf<4iD<Z0*(sL13p?lL+iYWT<2cB$CQp}
z&3VWzy){Yv7~LB39p#xPf9Y~{!YnCUrY3i!6(<8TUo%e6QPUKyr^4K$h5NZ%%z3VJ
zPR~>gr23%hUAtm=^<2GMiM6mxg@o*rSl3wV*v>+LSy~6Tc-!BQZ^n7-l6*u?kAq9f
z@-KI(d)`fC%J%f0HG`>ED#MrX7unAq*C#%pHGe*+p;h<XK%M!%0mODW?9%9#Y#IH(
z*Rc_FvsU_$yQSEj;y(ZRK|dF6FE5^3f?Hqn^ei%7Do?jB5OTLR4=9UA6RSFMXr_&u
z8)b=A2H24pF#0r{%~`OeHd0l09lAObx(e>!rT(*H_6ZuabLF>(KtcVg5=FR@h`aPa
z+K&UElg|9;`9s;{9i`UN)E53ItJ6Rp)%x73S?}i^C@ESR^INtQPCe5&EP?yO^<MB+
zXKkMuK&u&dtFirFsj4q=bB%C6>uIWQgkvmE1@aZR73%<ioFmnATky9ylh9`bzGg~(
z$KS5sy~^#F-O(EdtUN4l)Ghn{onWB36PGMZc1J$!A^twPtcTrzUQ_eZOO&*F;Guxu
zV_Al-#Td)y3(O>&w=!HghB_?%t_u5`dwq!7w^;2iPDIDp_M6Ll)^#>=GCMP2n10^#
z@qBKQdo<6Nt6yn<ap@J!m17bNLln2djqRK;up72Q`+^!;$DhB5U$bZ%y+NsaUK}JG
zA-^+;womh(FO-j;0&pg`L!@4MbJ-OC6l7;M1#b=AE+9K4FuU<MKQse-6~jC$M~qmI
z0gNce3WJ8OPg1otL~mF{hj3n^Pze9FGRV-%v^!Ry&c!-IiAJ9Tjx!~M?#_NROx}N+
ztdwGrct$gdY9%IZ3&qaGgfd8;{Lw?W9>Jj3(AytWdfs=JWY4!PaDC=)iAeIGOr@;D
z(#D<;27^f_(WWrW!*Ko%l9Q{!Bd`FS*GP|n(mrOOe)}xg0r|pIMBX9H;#obD>&H2|
zs}YLc!xv48IT}$EtLgUp;LapB_TvmVpM+Ga8sSkw4z^jW3u&R{OC8SD6jnQ2TdWL-
za@=HjHpusURB|&e1z3QyekxtnNJ919y0-PC%gBPK$F+N~v~5Uzef{EIx8VpwxJB#&
z=`rxy1(W>frLCXivSpX6>t!&K0N)+P_*q4ypBDB-`;8o3EMX`XRkcR2E-_9e9f1WJ
zH$*6jiF)D)wT5yl(txBOPI?-6zU1qnkMgRa4k*bjrQILk1yu<Hx&i(dLqPiyi%&L#
zX^7uLuQM*O?Z#g!U5}nur7yHud$nE5g|%6l3;WbdFExluLlAR4-oJa;p52Mz?Li+e
z+sDryK8XLP{D_UR-wvU#<$6dmN>Hz$R<-Lb!)4J{U>4xs%QSf^s|2fpGrNCs2yS21
z6ThmjfO0*@Ovl2EyFj?9&H}l2DuB~J!H-xuj{hSlDs>D_(W<+uWxmbWa|EWJZp#C)
zCjO~7kEv*jtA4I?{Kxu4qcDre7W8#)k+DrrO!fUex&2)fTF2kMK&qF;j*<$tVHC&6
znxkFG)-SdP*4gVD#Z*wYf5MLV67qb<^OHv#BKC`k$2`-54am5o@c6?pJn385?R<Cj
z(xQ78)aKh<;hbR5DQ+K<V0<Lb-d(xPN+k?tyuI1A^4lSm)2f-<bI(M@><A;zrokL2
zFwK*I>Qv_en`ETjl=U>qhqO~1u`>l;HHJ`>z|xX$J<huqi|2-ofN%K`MpYWu9!$2a
zL0z9$;n(7R7*~Us9fr{28E>K}Ymre?y`-0GicFogfAd%e2+%N=dIRTFD^yhJ+KnXq
zKWx1VJk)9X2OL6jn8tB1*bs>@2~!5!MzR%K8t3CEwuqSyOgSZo!8q({w-m9hr)=Yp
zS?jP-j5$4?L~ReID0A4-LCjQ`N_wx~RL{SC-`B_EV|&c+zJJ$!UDtgbzgHVDY|(*H
z1N7ZEYz%*jtZnnc<a8*2P+614F#OF;tga$?hvVZ|eJe|~F_g%cgn92Zzme)idc6L>
zAKXf^W$}2#bgxgpnCN^=c4qXxCGLmtqzZPU4^)``EYD}Xa&K<mjnjwj2Z_5@?FYo@
zz^PobBwd@xb&@oOme;DMtTbh+nc~)nb4_7Eu3|yNLoQ;?+cvjzN#8?nRo_jm%M0g^
z$G@F4yyKJ&6}4KIpeeHs*HzB(F3JTG7^QCYdtIMyOhB=3a$4m_23@ER74Es(QD4r{
zYsN+r)6l8h>i&e}zJ%941hSqWUmIwd{`^;alGN<vSV`PVcMOi2!V0<7qiT713m~OJ
z1-oV8y>YD$i05ZVYe5&niif#deR@wg*=W^zr!<?bQwvXe!IvfHP5sKa2Ia~=9IYoM
zMNj`Q4-sm1p*>MMQ4vfH3Bn~dt*X_yHI_4@i0!5}31|!fhALOv=SejOoUdO6n=M2T
z^g1sDv`5@RN-|Ecl$!KnA8u_l%~sJ`B-O}EMD^^}Y8t&CEw{~k+6!y>4F1qkR22Z;
z-IR#bw9vOR4qNT)NE)l+KoQtaMO|<`;w(whGU2V}_CHCn5Jl;WF^-&d^Vs<;N0ZwG
zIG+086`;2^Ge*S^)W)$rz3pj5Pm*3lNH^nFJWO`>{Ih*t7x&wep*n^TL~TUa#P}~@
zlS8gIa)%`wlG|ThZZ(Kdtk{p|;p{ALH0L?;ZX4jR<^1QIuQF85V0Ly2Guzl|?^7*s
z<JZ;VLBQpSd9z;ufOALa>r12e<E4hUwGS&s)b36~#za@;QkG`)K4*X-N<rK`+*aTc
zo2LG=(gTrnibn$tDvJ(Trj_|8v+-aBc7i3ccC%$6zcC`I!bqi|eSSmDA@ch~;;wUM
zHV~)bHUUnkiMJJ`5F!}QG9y!@7mCtBO&8tx3;unUkHxKG9JGHJ=e)i@2mZMv7m$Bf
zEZq~HP)LOFe+|$sj}F$*ug2zGK%86dPeoDnv_lxbK%a?2`c@dqSy0Vm+?<Zlc|8>X
z0a0G!#b(g%#pf-h=U3fY(n4}rHzajhv^MF?=>6XinY5xf&Ku@Ej?r%M6FT`$LTa3y
z6Nkz>u*nNb>n%xY$9y?E@15Eq)rc%AOPkQ=F^QZOmjaDs_NUVnJ9?toqOW`E+ubbR
zf(Ai9EI6(<HpY0S+s4mdT5!hM19a%gHn1Zyue!%Ki=;<;p!&@+p?&mz93F+zRcT;2
z@{F`vVh%RHZ+eoR+F!5L0$s!upf%d%H+##3zt&}<r-aW13H;Y^hoZX!P^YVW;C-9v
zyGu(jUV(iv#en~6${MGXvgVx<&bq#x{IR*+mlO<DHh_%{>((*upUlA#YAZSsN{2zF
z%G#?;y?Dz!N^RV`W7ORC?Vh9;Bh*}$Yq7iH4v&k%UD*5t(lh2~M2ck6Pi8K~5Z+*R
zA9Fs{(tXrd>uk)S=J&roNz5rt#3WbC(%No*`~E8ZE;spAHx*&ZjQRAcjRcd2<KYos
zCHy>kUqg;HcTjuKO=)1c7A`=BS~u%b`@F;AkF2x+h@c^qE<DCP`s~jgew_5={-0r(
zXMw46+&g$>e{^@WAL8F^eo}&o{?OSzuYV^!Jjpw6a-$r;_>u-4?X?PBxJ`G$J<NLT
zfU%<Yj@+VFi(c-{Y-;cD8C(fCV-&A>BNgZ&m*r@8WJw1ASNK;aKu$jS!G|CFZU;i@
zwy#5Wb~+ly*%{KiZYDs?tnW?NgZX=fhpP0M&%v8UANAopxb_4r66rH>Z$wgJ$qg`-
zbe8Us<sNOrht$|EoTl61<C?Qyhk(Y(dZ+hV>nvXgC1<-y+W<7Y=m@g`WAmY?Ol|z4
z9O|L2RE<C%sW1!UBDjG75Wx;`nn$@uO<9npMX__M=;fF+h>&IK8j&_#p6Jxr`3v0s
zPmwSxlry`P>_)Q>c|8O~2j4+3LK?&`o|t3;=Hb=zSt%PZ<;b;}us5kWFNb>(NIT<4
zj4Dny@$!?vevC=?+ehI(^yWn1{Iq^%gcrCQXYxf8;36Qb8o=T+|1EsyqM(TnLX&w8
zTUt+5F6Uv<O&qW-Z=9Oz2n^)3K<td?3=bdOVia}MN2}9UPEC5T7ncO=UYZ_1NR~&m
z-Myv8r*n5^XxGBIkltN4_hcugW&-ru^XB&QD#PaX>$13>ZCY);{cd@)arjQaz8+i$
zcv@15gPXjiPhFu<b)#^4kHsv!rW417oWFucQSmB4i8dss%_=;NsKn**n5}+@JfKT|
zrPmgTIxyf$)P9w4Vf22WP^BsrA6c<*{z8ij9`NrXtP^|y`AVJz@8|Ig!;v4M-LQL6
z6`+~NcT5Mv(iDwahr)2;gZvy9ta;(9h$LE37@)`dWa`qjX=5QHKOx*5_N#ruHz+91
zG_Od6`PE9AoK{o*dO6<fq$YF76CB}dU=_jj?0C&moC0Pn=pFI+V~G_YFPDVX1I$^E
zX?!8SE@UMC-qVAxwF<9G+mKTU;CkGFeK94`Gz$AUpF&A`p~bw}KDrI?pSf@FKAfnf
z72{g8crx6B*0}ocBqt7y`EPQU@+^|T!_k3%o<oUztjl9j9Mvm(rER>$QEqFujzwRN
z#9nZ+c6J2fB0kfbqXxMIXkG$gF2Nmz6(`*aK?i3?4gNM74jMbWM>UEaZ@hHNfk=#?
z<gsK>Rc?tp6rP0Qs^ccf;ZVY0{sZG0`os5KX5~jBl5zk(+%~Ov^gdH=8C|g(ycR}E
zzqhfux~Q$Wy^T`}GXd06xm6;-BRQ`yG(K*0r9^Pbu2i(0pgP<yVb)>Nz_;?sT@W`4
zo@E@ny(I+HY{~Je3N)J13DGnbT+u+wMc<?s+KB1$0<lpIdmc*P++~=!cW2##z``W@
zE|f}Jd*x<nT~z@oY>~bT-QRUgn$-12`@A(1;22&3GB$k&`FGGye8KnB>0A_yF^Jk(
zJ$k=?G+czzK6_ONEw7fA3Flg>G|a%M3YyuVj^f^v`x7*1q;gC`1X+8C1=I|ccwDQZ
z;n3YfYYpR2(1MO=Mu=*PYkRcnlAF!Gy1XmtMQo;;_kQ_Ax%>I|j<`?&PxFXIcuYbz
zH{aKVKpnsh1C$Iem_$#e>3cm4e>XgOe+vl;cxp>ig$vFhoa?_a_RE9V`<DY4T;u5d
zZ<rBqC394%wW3!H#xsRmv;P|Dn!^3RF}6a7ttV9`Xjb$`ld5)!w`H#SP<(_!>mKBj
z2921{2f5LqrvQ;7CF<xMUl5pTzC=8FU&2X&VF;Fv{Z|U_LTt3{-t0}ao0uiI&TP^E
zwtqmbWp2G056SrHl^;%BrFXkVJ_ygqN;-t1)Byl~`>0o8g>W^5FJr`R?5X3(&<8ZB
z6OMdY40I>fEf7cEC<uBHAt;n-MtOg)G1M0bQlp`H2hE<YmP1BZ)46<8XudB9&7YyA
zo;VwYQb9sHmNU1MKrPH)gUed*C_D+^^t}7{t^Xxo(@Fiy!qJ&(UhHku4baVYa;<rT
zbPovR5@Lz2xiPwvV7t?whbIAm^ev-FFa?s6UL5LLkytEHf<C3*LxB0B3CsX-ppq!S
zc!bJYZ<(8eTP9Byq1f*gWWPu6Y#H{fhJ>I^ZLzKJE8O%<-&yIFOtsEmXln#|W@yv|
z#xM@YgPUP9FenK7QYmy<y=rc+=Q`dE_W+!+58KA1fIZ-P5pbc_MIMm$fbt6>orMC&
zl|w9L*#kr|rWG?bTYPZ5F}Y{aH3cYlt-V9=LsGNn@9p!Bk>y6eSdpfB4C>r#9>Z{J
zz!creRRJ7NN~X#!>03JE8U)sSI1aAs653Sp<~t~B=lOp^^)T1@eqptAcQSV%bjp$5
zYVL_f4Q5UkaG|>mLL*jS5WkpXcl`@ya>$=E&ad(Slf<aEc#;*#hVXyG(qYGPSLzZ>
zhsYpi?LlhV2|Y^Q>t_ZAn%n(?M<7T@3X$(3n7u2R?X+0J^a4k?EL~x=Y_x_WqS|CD
zRTwcf_Y%RB-XUMNO{;+~tQ@^>A*le!8$n8Qd!B3oKTht}$bqsPOOoO9l6xtRI;_*u
zNP=ENY$~qFhN9_Jz94?pWp?^W5mjgym+J6M2okB-cH02$LGoJC0^8qweOhSJ3qP_(
zw#5<cPV?w6qUZZZr`7IaU|57l&@{y2aB|D+@QJhDpmVx?h|L^(ZdO=n4A-E!JrHhW
z5Wjt2gERrcEG}i6NM@OKk@41KiAAo?n?(L55i&huul7+x7`cFI>Axrbnb-~<4$ykk
zz~xF_`3o0RMgOZiQno-P3fB}Y*%O%$tr0<%=2eb{@qvgh4wg4GjFlG&cH1I60mhe(
z(E_9lk0!n7r8t%wOwONSye(OJbzmoE=PMa&^nMUW2N;9k*zYf1TKqog1$a87vjE#A
zc~8oyDejC5OM3AFG-^cBtGPcx+rsFD&QV8}yY%3+6KUc2`V>PHubZ5m^kSn-1+*h#
zA|**TJFJ=o+-8MY_h=hj5WmpTM-TNvZQJVk{%;%r{?gTk(`w8=cr?>5kTdi=)^VPv
z3k7SlW8f4)itNIiGNHSDenEbk5x)9{9}GWOOzpv1iBpoKy{|7a!hy|Efg7tHO90L_
z2Czg+-a$kNo5~3z`SpM^A4JUh7Ev8e{CH-kz+6+7Nw5G6;5yDGd?%yD6)rbJ5e}~z
z$p6vuG9cE&&<HIH!^yPGH*SZ&+X%=8Q^tpz+cyEoa^6<XgHf>}9QQhRH%<?d#$)Bx
zd2GNYhDje7M}7h>`2+-{U9Sl=-^B%jwFUv{wIGtY=jk#0n-NJL@_QMKacv-+i0T?$
z`ltBadqC^Dl5^c6aAVgt85E!S%iAH~0q=N7CtLL@Uzu6|SO`~kh)|n20tT8#Gvf^0
zk{TcE(*8>TD3Vv}o7*EO=1|ZoP9nD7(?UY1s|d=r5*gmu$}#~)6M%TR^?Wz+!cPj1
z8J5gSYZ>RAeE`iuGzC+Kw`cZ3KPNPX1L8^FZ-}<J4SDdV7xS`YnCW6qseh(fBXgGz
zr`(jAEwIq^;dmOeAX~|4`F&MyZVU{HG5GKuF~(&d`1LF&(IyOf;qPx2+m_~27S~@>
z8^1{bFZd1d*q`zbV36hZ_U#tuV%XkdRlq}*=zV;lOE<s<*YDX*ScU3`N#p6~lAEJ)
z8_5vEJl3V!88YJ5{WYLuV)M5m^@Y2sctd*Cg=oN_`az!3AUQg5KRiPPFdyAbziV#S
zF{jnBUOD?soURZ~A~Dm~#k=pMZoUx@z0+R!6&5@ripz;7zu1Bm2tBa)Wq`r6@Ekhc
z5FMX(>9~B;A}I099wp$_U21!i4y6)MPW)o=jZ#S><KVXzjg0*uwIYADNj72?&B<TE
zrT?$+q(tF@l*+WfP+lQ=JbIr-S=|EdkaYj<(YK8A`e<BLwnl?wH7UfH#g;llI66%|
zI97W!R@<f(J)Y@jM1Qc~X}Z9ZiPC}MUaugceMFKIi_h^qzAD=Su-~&xKIFpv6|Mpw
z#73Vq5;{|2f`tGAgjnl$Y`6J(KaW*1FFhWbuP!<w-|Pm>G1*7R&N?h}Fat^<HUp;m
zgGWrNgWDgYOQxyp<8TcO1H+52P?c&=Z6akX#u2mFu~hroefU9^h0qsxjW|NnDjp42
zPZV{^s7w#DQ)fl{)2{jnL5HdQ#()Q9>(;TcIJ0^Fl4apuVit_hSdj0hq;AIRC6d7S
zF@H!y5l6J&`T!FLuwA5DSi6p~VdBUJ*fKh6-`>G|ooi17uAA{IyiZwCFkboeR;36Z
zpNU>yJeC%F12S1)uI}~ON%NH-Slk%gIqFrq0PNDf4MEy2w}okqdPlhBa+4*2kZQDK
zxI?R=9?@KH<PRX&s5Anp`6-D3(j@K!kg`r-Txoy!%93<q(Qv4b&3SLk)sy)wW+lBi
zk!dm|q7#o@2t)9dZADDHUIi<YS^p5g2o=;#L{t@!5XvE1+LrHV#bk)S&Qu9OV#JW=
zTrtnO7z!yDdA4V1EEw0MYwKCSz&qPV9eKy)S~ntzHwTp=+=eX(LfQi3NQsBIbjHDI
zrQJkOJ|A*JFkThhKbzZ~Bu=u243n{`@FcUE^0UG}p=Z+aS0EsG#R2?RzCP0l#CC|d
zU^7)Ux#f6eKVf1fOxkh1Q9`F|YUzg?;eHB?>S3dy)J)_<Sjqp@-n{6l=x2pY--gl@
zv(i|{Z7<B#C3aAmevx)Hz8YL(H>kR@gIPowf3a5ZZiAP9h3+TXEk8E-S9rH}3_uM+
zugWt<c&hvN&Bw@V%lnylwF-`Z=vQe!kL?|~q&7S$3c2lClf9w<kOn%%FNnu}^ny*W
z>SYcDJsNl?7%lG#3AqwUlQUXiE&(>x0L9TIpaWk=g(oGEO;dR5LyMu)#8n`6eD3_n
zk$#7}V!l6GpqC-}ngCGm%b>FQkV<V35f}pm`QmOIm^W<m(0vOS?w*=c+|W~bWV@7Y
zfl!5Wl&MdPvjFoK-eoPcr<4~}?b7MLhaXQr(A>;}%EV42bgk_cyYhMF)i+i2KLwf@
zae;tEf?uId+BqFi*B@j0HSrj5#C7T!QHTE3{>E@<N>!0NgI8QVxB)CF8Fg`O?aAw~
z6Rj%7eHd{?i7a~WGgwnCTlspT%|&Ma>nw3(9Gq#%BT~q?W`+oV$0>RbaSZX(o&?pC
zuI-A07<&IqJH}S@HDP%jXNqFxRs>0`Oag{aN`*M&bz_L!`ug;So?1h#dSaU{EFg}!
zbS<qK)=l@&g&nmvx2K`K=)<Bt6QM-UyZ>rW!<(1u!E`4;7y)W46OY9wy*MY|$nzO2
zJsUDYdjMv0H0g&PWn1A<H2Zl4<JkiRLkNH&PKOpZQe5VJ_%kj>G!kyUZ;M>Zk+p8;
zMOz4J*5Y;fu}*MxU4Kf_xdxYi`ni5h#=&z+!9=6Z(T5dn+yzs%9bUEfsbh6S64EnQ
zw!cdyT^P{B0eyGW0w6tGF?6Pd4o3+_n+R7^R~UkefFTj*-i+R-%hJ$yXU&Lnak!0)
zgP=E(GgVQ#xJ<A7F~m4{as(ljP$yHBFN}3yzI#!88r<7_U%BoKC%*`jK!^W2RbVN8
zsHiM}4?K9Z(D*E<ko|$>avQyn=w+Vk2RUrl$={77*|%#8?@m#gGt#UBAZAEGF`mI}
zfIL})<>le^@-?`ljDujxBxf3G`e;?83g3LJEBbY~tmLU%!H9h2JjWbpJAQpL!Y!!j
zym-oLN8UO#E_w44;TF81dOQT7N4N5ao|7Q{4OGIbUv;-;JOgKDT=osq{uVz|cF11(
z2P0f!4&&EKp<UBwg3fr`24Npas&!B5NAD#jalQi}<c?I<I|z=-Q}`8-&q8#h$}jc_
z{no)^7pnUZ|M1<!9D;@uS5t<^o_u3TswyQ}U<(xMyA^AP7VZzF9ZDO7kS<txOE1+N
zSh}CTt9=KX8m0Y=^BW?g^PsM@Vk{WC=>f%M&|Vr0TbK<QY2bd>$T%YX7M+)BmEFWh
zQMkrmZG$Qhy*fTr4aT?r`*jt~3VOb#>Co3UT3i(8j6(5n0zZy$ywHQ<Is-zjPb0Ow
za4A6_y@S3J(*bKNfP-Nw$2l0_-j51l<jT+wR~W!7SNRrnLHmvJ9LglzQ$<}C#1XKy
zmTO8K(B1q$AsjNfhlqsMzFKrb=N&N3{+01DC;#;|lFc01bcpRowsWhFR+kJ=HEQ#M
zTAjcU`6c3%p7gtEE0T0qtnrPLoswp`)|qiHBpdE{!cq;e<pF(eXYV0-G2_~O>05h1
z2pD_&Gcf8TR3H@zbfBVY3gB$IAC^&5h`UPU<&!*bI)t^qC(daoj^eU?!hL)TpD&Ax
zEG)Y`ymp>tM>UBqs_XLyJ*`Gme<xm!El`EXy?(Id+sKoFLQlDK3;U;cqg&LYAV&EM
z<AnOd^`sN;lZh7+i-;rm=n^}0HxF>0TxKSb!x+B;5y9jdE7I7#{I<q}mx^WqK6BCX
zp&hApF`0NBDHG=`dscE!yg3tV0T2}fuT5B6rSU+4vLMQ`$6&gs4b<Y5`LT9L`e6Ae
zv>B7uBZRmPttj#Tx&HiDx(@t5cb#I-6+M;RXS_vSWH|Q4lu(5!ybr%;At%mMVI0H`
za{$?h97Np$kX9Ve-x&Uj`a@_OCYuTMGRPiI!X8Mbj(k6vMkL+tZjx4pL_}R#3q$Qf
z9af?9e$8V`S74!bx{z(?z(2V2&zqYgOBY0*@(rWc5<QRNkhp}}cf{sCI%G04V4lYN
zTzN`w9^HrF-1{Bzd2(Gf4oX=`>U&3)N9VhjP-CGgYF3Y8f$WU82@18Gf=9fOSOX?D
z3Rj)X8Ix($R8-^kpE%aKj4wU_v*wFWw}N^;<w;Qv;O&8+w2mnxao?1ik4i{AnzQVX
z)*(+Y_M*@#O$@JGZ(ZiQ9@VS5ll2VVomME}JAQ<i_3tzW!!FVu*#>cBAMrY1elm|N
zU1KZ-bJBiePza{8hIeu<OOFue0uf!R78x?=W=h6Agwc97JI`ewVd^)C?#T}j)GIjV
zfPHUP7$jRUZAZfIjNJs4BNl&XoRzTUsLWOFvHc6r5EsZtt7DS;r)AppbYUWcVVnIm
zF)HsYREUj9LSA$s6`s@oV!Vy&!RlFdOh!nbTc$zlaJ^`kC6pEut^!gqY=X4nC^z{J
zr5H{I*(-(n)44mWt+JgxSf@Tzy!YT1KcClho%#M^D*g<#0gweJBbeCg2i?zQN{gmm
z`Hf6f<YaKAkmx!|9I>vYoBB>~p6vrGWzR$-<Am+fHqLx?UtsXa36Ggqu$cKt#tEz1
zl6K3P$xZTe5c?5q0r{!p#}rk)cN1M9&ZQtCvlRl9jk};+gLk%dXz*#QMmhVmR8Nk>
zR{ROm8wUAo@&+9}T;!-&r-}Dd#u)oV<SCQ{n`stthh^!&!va;h7~#bh{B020@R0rr
zM)bJEU8;c|pGt3h_KnAs9<q~P7;l#cuw5-@9&Dnff#3r2%Sa<*lGEtChLjdw$S022
zA|8O&k1bWrP;odc%#!Q6o!<meM;zYNiF<^+?hIt_p%jZ}Om&zy!Vyk{=9)5<PtQc4
z>}9@-wn+J+v6%xW6O<ZG2#FK|D#$YJp{Y!<pGyoI88*^Rd?QOO=b$ZdgxCcU5RS@T
zVu+ANDKD~keSpx(;Q3A~6X(XLZf^9dC`Yy(z%47t0~)1!T;{LuRdFm~6pJmrD|6`4
zA7)(<1o{jHX8>M8ZamJ9BdzLRIZ<R#)tVJ7Nuqi`EO<qBv1wgaZ&?U<-Ya_7k){^y
zvM(}hxH?xD?bHn^29)757l|YPQojtZ4GXucB}x{Y*N7dbgnY(9Kw|!l@sREUGis)#
z=$dGvyF!+}iMoTD>GPACXR4UqacSF(U+JA&$2x)_6hQcx)De18kG#2@8;NGu(=?hm
z8=BZZnH}*QVvWlv6DKu}LXsb@JeY6`{HY(kn+VvDwE{chF{|2B$1HD*S=UAoZxYBK
zpgN$aC<-(oaW02!lcL9-!4kS*u7N-sYD)>aF}k?6B~0K|24FZtT6J&8Yr27);FW(h
zZes9x?CNrsF;%Cw;52iu&!C~YXk$%D)*S;}q#Fr3da<4!38pFiM$)(%`g7(k4%{<i
zA`9P%-dn&F?=MjM7|)*LHJ<|>Y%0V6(*Uwp2{G-Nnt+2VC1-x8)#xrcM|5>0xr18{
zMqYK%(@r$tM1qa`FW7U@>QRIDB;7HgC)K-UqsP(KRelmUD<_T~Wh2<m=l<{xfMDl$
zgRmVNrgCST_KCEi;EAGF(%q3Iw=4_qI!T&=K@Z{U84vB#&N1HV4)t$FFS;+?Z<$kv
zS50Fw!gmt``NMHg)RuGdZ16~a(Sh%X5sl9hrMk(wIOuX7_#{&o?cWXrM;4=?fyzWL
zfrgvT^AkRW@VagV`(l-q<>m2cyjdXE3KzqX-YXg>d$=8sz1+IeU7}M;$9zK^VegRY
zpuL|c*F+MHN}^f-(z2~JSgY-(w36}cUIF8oWe)@`IVs-}Q~QhMe_)PA$SN5p4nZBs
z&Njvgmu$>gy5Rc5q9B-EfpD<w!}F5tyR3EqhA)Y5J~018w2WZr#Gy-<W9goXVAF$Z
zc$2_>J3$0TdamDOqTIErHEHhlRzKu`{Cie>SS|K=n9mOxc|qy~?0pflYnN92ei%#8
z+?lax1BP)C!WwD>B`5AWTv1AYJmc9dB$yFZXwh%#GkwBd+Qc|<98dv~uMdGCudB^F
z#4C~RyRw7|9bT)t4*wk0Ji4?&$inEMyMxsEq5-^tdI=^#FSIP8Rd;;)gy(A?t&5EF
z9J)*mH|-{FU_6_G+WqM?;@mNUNk~cD?>d2vjOu9{;xWDK9SCjq5U(@dreo=y#amu(
z0XoJ&u59nfWyV`og27FnX%h>M264_D*^o@-+OILqtO79J*cTG&c4Le9!sAqpY-R8K
zOAz|(4mU#af+%j~JOY}1z%*E5)6|z=B)G(2gb;gAdaq(X+XIhJ)w|1Jq;L+%^D%1G
zlr&=2$jpLT4;1KeQuY#WHa=@0Z+6supR5-hO$5n#1jz!%+ZE=8opizRMgUemae}xW
z@nO*mzuCXNw=z>>N|@Qi`PaR~)jIvg-&0o)@dgAIRuDnOuz!Te7h40m4XB6M>!7Bw
zN*~?rOT2FAUEz;&I3d?uBom|T5+HWT3X*n`emKN~ig3bRkY@RTNT{PDxi>PLgfwYe
z*RI#qugE~A-5iHtBH-v1$Z>$6!tc=oW!#HYjupN8ufh8!TD#oxA#FIW;9inW0H;lM
zcu_xq&#IboG($7nbXa;6H}i5FWEQdZOs%BbaC~4ZXx0|Gl5Ri9w+$Xi4F>%0dd9)u
z8PUacoNc)8gN3Dx&0`xGjAPW5DKHX*Sxp=PEL8h)&If=?9B=0AASV!`tbPsLJ3^xn
zmP}4Vk?9=u1QFo8&mc;$=-r4xUhF2XiVBfslY2%PDF#ck6>p+C4nZR&DbcLdf)$1b
zpnHy669;<!(A`nQEPY#vF0SZ=ycd6iF=Wv8ZI-5a!4A$ZU4{+Bk%9ym4OwKtY6c0v
zyoGqEh2h=5RoWm}n^5h)s8W7~;T{5omUUMcFxqKdP5y9+d`q<~9ESZ^APF?|c(c74
zOFxBUE6avte?sRQ{K~-oKna(sW?uZB`8D*2;0P;V)T9t6i1C5){+q4AK0B)!*K`_0
zyGTDo7V?8ft^#s8QX5Ca8|0MR-5K^O4g%z8m){sIEMvt*wGrxXh;s+A<=)(IoN4AV
zkVL1Dk#Esipc!&qq^G;KEcfg&Lp3wJ0i6(0$|TxR?k`pS$K=*SEUq9n?K!w06&Bn;
zu_{$9fVTvZ{0tW(zVM1%gJAOR7b{CQiQz<Xvn45<I0E72O$3$nqU;Xy-tyCoXRk=3
zjf`gETm+TSV(|V6O7=G+{D9$aj3kPQ7pz4xA&!(VPPpoDQ$=n#J+DIGwrLoW##wfS
z5uK%3&Pt6f!vs%>|7M(sBR)W4_m*kjhG<pVO`IAQ-|f<gn4@v2`n6?7qU4(V>qr)7
zU<+O)Q9^@BdYR+;qe7h~D1oU$6OZYb7p8+6W9JB~7;hUP|B!Ww;YHJv(lAEvg*t?G
zMs@?k=9VR~T^9h&;~{{|L3oTfH$`=h&UY$?IxLjv55|eZFhd5ho~Xq4Ys&lTNc9-Q
znEum^&j2|Zz;}v@s9$g6{&KIx-dX*Ka|!L&B%qxaz&Hrh)x|!MWjCd}pmbIh&X^Y@
zb9MlO4K^7pOmN`m7ggZ^$9p)b`Mv#;l3&TanMjzl5#<0_uZLK(e~bc#9xII0@iw)m
zi4lDM662um)dS60`l<bZQ-FlA%OuUzBq$YH)UC}cAcfq^cbCjEo~=V~z03%fj5N3R
z_N5BXGQZRM)k(C#c!t!ZK%C#$An$ukM;7GNPg&s@-h+G`epLl$1aDEto(rWRSK19c
zI*?Z(#ta%j4rir389<$2rxfCxZ1g@`S}l(WwN9vZk^r4{<GzDgPDl!YFP)<PR<(Yn
z?<#R5=b0XH?%wGAVybJlCIq*T8|LjwWGEbwVC2ND=MG)NruJ7i9&9gK9YVC1J{!Fs
zBMg!45JYI53KR~*XpN6MH8sdPXz$3yJdV}TVHYjk=0*!N)d7^OJXN?dve*EMQ#i4Z
zW_U0Ao`6mievgFWtNYeX6plbTA?zZfLyUqLT<Mr-3TKmWe~sLmnnRr9^f4GHB$;R=
zS|Ary*?BJN!3340xpR#Br=TY1y-T*HH@yHMZy2$e-z$!R#C*Nz4Svf+-7%{BQaj_u
zSC(MIH}^rxFQ>4MYftWa;yw;jBlZ)c6piF*)w^;3b`#zV&A${{l!b%oT>Tn&eeZla
z+5AT7c&kAW6w+bNh$(VP%_)^TkiAJ=ISvxe)CjU91z%x!$Zo>9v1Ww@NaxQHxfNh<
zpCGLTmkF86=+?8Ww;-N-^zB9%8s+#G;QhPxK=w|Zs+w&G;Iu_mO2lI-OUrYh#%X1u
zgikTKCLSLZsZebJJU7CZ^Pa)bmO~DDQuI_#tg%bz-cMCo`txJG6}tPuZ<u|a$sD8B
zRZ%s$m)`C$(rjJ!j+8^d*oyZ|oJ?YV!x4s^(xa>!f*2tL;JR$#j{y_V4vkA9j<i!D
zTz-tI9S!m3^z)nyX(w^+IPMQ{?LI)op(f0a;-QKkJl)W9jp6lu-`<gxJss`y8C1*Y
z{KQy9hK#=>jtQNlMo{P~^QkFllYYg1v<JLlej?=ZiooD>El|wCq=^${L80ps=;mI9
zIb3zP&%qQ1<+vNC6)d`2^$n_meFHO+!y~WN;ZVAuGf=Y&V-Gz-xApGSZLX@wqHL(m
zM@AaKt+^jy%F~(*&{-Fui~tfhSJ^jZn)t7$zr86-mGhxRi1Xn$hFy>PER5HHn{q0)
zML=xno0UWnUE>f}3KG&#<|Nz*0Z)!U(&JA$PaIjP|DR5%I^x93@B|Y-Q>>(GMNGeu
z3{du?e5MZ*kEv!~Z=WBhZjLUsjfWt4qtvbE5+em^OF+Aj_G-}|;Zb@sFMU8u04O9&
zpiUDx6ZFS~)m`Q{aRs#?1T4%vcdK+OOp6pbLv6*oHjPeEKr+PKFEM5~&!I@-RHEb&
zwMh`>38Q^VAsgIP1k<ahB#ST`T57pSFkhE8>Mo^Gp;FFx1JM<{CKqIs-f};Q54Iu?
zvI_m#RkSx?Z^Eq)gFGqgmma_i&2t9u#<pTAmWFE^Kh%XiD>8-oZ=mEYN%!}T;FnB4
zJb*gXVeTs#<|t<dMkr{02qPLPu3lsJb%nmDo3i7C<rRI=PoAW{qF{9T*p&5-tSPCh
z1K;Mg&tP^vb(MKBU#x}AJr3s6LIbV6OS=)b+VbrlP;zEeNC&R%(f2M>;m&t0pY8Kt
zJPU?~I7YB2RSNZ`K{6~somTYDrFcO!+xUzi`>=P!x~0!x1~P1`d4rD6cU^4&V4(4J
zg|~{IJWH+S+y-|_uJ83I=a12CvRG`H71>$`8mgDSt4~@8qkFU}-z2-F^l5h~xdX5-
z8rKLZ^&X|v@0(v#w8``!F~Mmet3ISd1qq~R@}3;Pj7)Zz><nc8w$w2qJYlkJuCtjW
zs3~e$>hNFmz7T!2p|11;FPqe`z7I!TT}xBB;~I+eRD&8j7)eiJZsSb<m!*U^_b&Al
z#o=|4PE{MJcIL8K?xm^?^jmM}9=<v9fx5+kS5oTx7paZUetrvytL2Hpdw5gzlG%A8
zu;>+rz3(&$(qjRvBT_6D+9Mvx1A9QU5ypa2(+<=;%PX{0RiLMdd+f3K$(wTRsy?@5
zj!AOgwkGyVhKbPvwDgh|yO-vZh;!~FA++oD=}Gk$*XrnvC+T?=REVsI$F75*7KL3N
zdtTgKS`z0BxcVY0c8GK135GyNdaCQCyE3)w`1?bPcL_@T(Jl>nn?g(3WaaGT-lZzc
zRq$q39dQOJoNsp)7v=6Io`y4k^6@n_<rZu(zs%VCJz*g+3>9fBdhi?LMAtGS;aCLB
znRQrPYfgJpIQ$5v;)W4pkn+&2ml(mMOThoTVH~wr&oCl%tO}tP!BD-p`w$?0nh&uH
z!0SV9lDGY!*~|vnTcx1{9a}N0Dv4Yc7dTz4LUuMUwI^>%=_~6}8TZ-Qi=HmnO13mF
zjwf5{=%PK6KtZU%lo^#q#$~eC5K?NoLuO4dZxAj&s(q$Rj)hpgcn3_I=4f4E+$0+>
zT|?$pOPF|rhFGV(sQ?&v%CT*HmVlfAq;<hI>nBq4QbC<8ZxHI&l$>_vle^T6#L7_P
z{z;L&z67_2p?G^ufdyM8P&uMip^8^l7h6ZtZ;~N4y&)Ogh^IKftuwFS#Y?|);C+LZ
zeO(%_I>WI+BjNT<4|CJyNEvobX%I!ZoWB+4mm>gNQ1p#bC(%m?v*5rjHq2aE_Y#uI
zI_0b@cw-bS6!JlEk}lhyX&l3C|Co0C=s+Lq(wUXQU+yO8qxi*mCBE4C=<9}`yOcwO
zx{)P2U`!su5g1H8={vK+yVCCohA3_%`+!z_XsL>96&7$1ty*}lT?VG_f6;*w_NwdB
zSZqN(1slLYSIv5ycml|UFq9$I^|BA=Hr!2k)YKabSPfeoPg$<R7a^%ar@Kj}DQtH@
zh2yo$)mj=EcIYey@CNkQ-dX|y2P0KN*4F|2hUMzNB%NsHz39>ik(fjlCqZl99CA4*
z?2q$(W3pqDP<?{(lWfP9vnhBTZZ2G7=a`0wuya7z$3zSmR)a8%+QZ*4)@Flz7S*!0
z+>hi<={$~Criu49^^H-K9J#Kcxqx-+|JrA|Yj-JFdVM(g>Y73;CdyF01sog~8?t>0
z8&vuv7?<QVEl0r&Il^?(;p~~FbD{c3ppx-x-tnrbk76ju-xZqI9$Nl$Xl^yd4|c5e
zBSglA#cekNlMVsSdd}xazvW>1**8_s9it%bYCYP06F(Za9<XXhg#ixiL&SC@5(Zz8
z4PD=*fA$)*ob7htDj`VJkkwq40q7J^tdQxa?m3y{$zz&B7i%N5fG|zch4UY~FDwg@
zx6Tm9QMHCRY-UB5ZM{H`&QzagQMwGr0MxGBqjeXj{9N99%2(w)9CbxG3msYtRVP2g
z7Mgf~CTzAB%J}TTKU4JYZkte8?qIuz5_dsIn?e*xYNaJxZbNpj)K)^FIvZZJn%Sjp
z2H1Ld!{><dI4e3lkw1swFF#><BSalA^=k22ev;*cl_=gf5U7I|<+)a1m`yex-}Zk$
zIe!>~+nMK!S8kB_LG01U<JY``(4zN<g!_p%N0z}Hzlp;A7--5q4!{|Ze_ZY-a>f?2
z0qHrd!LEsOD-@t&{`p0^Us{swTKJx#KLi6Jv4$n;2Vt&j92J_uT!H<Brd=8lOoMUf
z;#$m6Xv<vtIMxZ9A1`yp=GC`aJdQ^o2fBA5ZAjnlM5N@)uLCaY-tJQOoTlHE)yr37
zbKg8Ein<6<T+TPsWm{#=1YLk=L$askWuza<NE$jE7T}ypVzH<4D60(Pmz#m9d$fx4
z?L=Wa^uGM_>u$o{*VVP%4*fskwfQ9vF6QYxj`f}{R+pedb0f%W9NBYSXs|Ysu5D;X
zcuaCaGO?jpI$QdcLqB1VjYZ@1I>Z4Ed_@837n`mMuKzXW5U06IHzUsbD0gO~(GkG5
z5UwBq>Z;pBX%fXMI94^7)cC}xKJ;W(D>TS^V^3{`Bq0l+KOqcz0L<L<*yb;ui2PcW
z22WkjKOR~<F7v^b<8V=i!WGz4l;r+fT`Lj0N3Ao?vm;Jf53GHprT_u{buRR5Ma_eH
z(4~oDu_rxog}Bm-PzjS))}@_JQW%8)V+;`f?%j8;c8G$L`)rbVdK4@q{EfH3-dAOa
zzsAxZbs0=@%0hGZhZeRAEED>%)5Te>M)SNqK$f@|2QDJBRe6q3q+WE7v@(g}F-n5e
z`aiyqSExJ0UKx23{HHR!Ih}j-Y1hpak0r4VTzp5YK?=9IOKmL9IE8&MnTufczUB-e
zsew}H7q0>?J;g;h@+)j90OL>R{#liWgFN@WWZg!JN^tD|&tjxi$(#@-x>MvpFi}Uc
zh>?R_^UxAntZM*7Z~He)oPs`PVrVg-!c%q@1M~paq0c<D$P;QCVsZ1FJq}z;m}Vd_
zeMbsJ->K+`Q@v6A2zp`u`E@sCFLa$pmPY`Nh?prrz2fXNMTjA}%?8J{xl7w!Vlz<!
zH+{Px|4`N8v*wp4F41aPP+63I^ueV(sG*NtZdFBxy4ve-R$Q;plK0RGM@pS8^Ti-_
z+;?D>+Cgk1MKc&O(*OLr433DkXA@WT3CYYnPvQ&*tHYbvuVWY+gDt5CXqi^Sbdqr}
z$rDNV$9cNN(ph)dYaf$z9wQJuO7Lw+T0P%Ka^UGY@GKqrA>lv*)`koSq|w}(cq@|?
z=Jprwi&)<0&1d?63m*xJXrw^gcxjx|bZ%a&_PBE{=x2k_0uQqKC}~qLNqaP2uY-g=
z{UmN>(36X_kMC`ES7v5*bmCH;`L!p%NF1TU>eyM}8K^s|%G-otXCj;EQ=ZP{hL&;_
zO4TqPHOP$w6kRI})HC>UzIt{MxL4&S6T#g0@@ueYH}1D!$<0u@0d)gJhi)6R-2w?1
zTiC26QDFZoZV%dAC>@S_y`bb4hVNDyZ)yYW3_IgidM;dre$bf>r=X(IR~=w6*Fu3a
z2Kq2zQ`kY+7bkO&O+bF~34{Dh*rP*V<{-BU^6;L(NstQo2d9I$qU#|%$lWhENm=Th
z7dnjU_J4i*ReHdM@GC!`>KMnQQdz=|2QTLTqBp##oq787>5RWkiA|5SvE82NR~rUy
zuHCb7_e*`dJvJpj(R}LvUY%}(Do*%sG)oZMH;vK4to?1>%9RH%&R=`C$<`$57^d+3
zp1lvQEqw6O%QUn2v5~vHy4AE>ira}}Z7^h>JYK^Oi|pG}!*_V>OxxrTi{25++i>~e
zgH=|g&K%@Ne?lp^eoWPBrs_BxCDUx2sT~2|famMnzrsoj*Gf96q=tz-dBs4*-|g4q
zH5|La9hKJppT9!}w~w}I*x*Y&$mpxWZh2FrcHzSZ`g*0zeAU4?C3<MT<(bxe+!-8?
zli||0s@l14S+z6ACb=Je?O&nz9}}>vjkjvyILlP*)hhpfu#0TsB(XlT=6`GWSK237
zo3b|4@{N0nH07F^%Hw|@bO&A4Zx|^#rneKv)eqW<W0Ia-Hx9)~ujLx3XgR~SFT#!w
zKix%H=_JP6eBLiSbilx+vW!%6y32yzb<!L3g!<O7io(i$?~R2U%Z1DTKYyBlMoF}y
zIfNU<o&tFB_S92%@r8G*wtw+Rpn}_ZyE9U(BT2_ddMI;mrFGIIHb96s{69*;TO71D
z9l`iXRU$dq8wC~dG;9CS%XR^xwE=PKzIfTl-B$OWM6-vTX-2ZBOpR{b57q<sH_+m#
z21fsQT8g#EVTSAP5UY11|3am8ScIbxKNP$Bi*5ZW-ll7VuV`p3ZIj1m>h;>e?&C^a
zs2aA+wO=ksu^M>(SZd!>7(!8-<k_}{Ra%FPZU_)L2ax_>kE?Vyk*t|0(8L#bvyECc
zRQxL=jc?-f&XQMt$rJ+y?v*|5V`QhHFs7;nKMnb-_!>5@h6{xG-@>rF%Fd3`HY$b=
zkK=T<hE!Ugog|ctd~44B-(UHU=KuKjg<F!<HGOe|VpOY9#2Wv@Z)&(V@wxl|_bC6$
zeY-IJz<0FPeAOD3J6W$I?koSwPWQQMxg+O<`11HK{?t0mWn1OK3~_NexIi}n@X*@-
z<>+H)`s$82%|Z-ymWRBL^35-HI&dCW*^?gMQ<y=~;mfAvCLKE}|GuRoIgs4Hs|)Rc
zlRn%<UI{$Q`}mpPe?0Uf@&aK&u+FT5IY%S1&oYIZU25&$uWuw<b%VA`9wFCBi+yt4
zRH7fvOZvo11KT=ckSFZhW$YiEh;|ZY;48fQEkr?;)^QrclGPK3xGU;-e5QuV>@D4B
zHoB%S^y7kVzXvL~vB}PA;Msb~ssx$I8JVs8U)BTL+_*SG5lyyIjf$P@A8UP(;m%8<
zs!n|ru6_00zMmKLs@jj`4pY?lvUGsn-%*+DGbMA*E{cgu<|+{iQ)AUTPNY7jXz_7p
zKAw&C^N#V9@l%sOe}2;)68)KejT%;rICz@-UFE*|P~KIFZFa6pbh=K3Wc4)L*7^02
z4ZbXd68ve`*Jfiu1VA9qZ}=%PoF<K5+%b`Nx6;~l;AWTUg6LoF9{Dt>^5g5>h}LoV
zR`IEUZ3`8O4UE?O`1fDu*+KZ+yP^H=Oba;0(Y7$cNehwxU`CsSiizRe5{NEb;O@Ye
ztA0HFd#x$mFFJ<B7K%qTZL%7;)Oqr()T)NRJ5wd5U&p_4E&-%NEnU2O@I=y0e143$
zlW7rgz1=RF4eWR7<BKP6?|hIpzU+gho8qa+V`x*$v-3~m<G5#;s$1bHB&A^ypSrB!
zdK;aph7zew<mbAZN;c|9Tpd1&$-uU`Kv{$0g_8c-{!$d)7Zl1PB*=)<KU;@64T&`-
z%2Yz<hYV$a@Vj1ay$wUH*BBD*ui<@?AGe>zQ@Rfo<&@-*vNqWx`xyQ4$G_RGTw_A{
zT|E7W+$7}(>p$<`65|&2E5uFd?ks;o{#9W*<+^)B9|g<x{X~%O5Q0qhd$TRVaxNp=
z*=J_#?^to1Ks#Q;vj?4FV&z}ict?L&Nb54Sy`CPAWjV?8Z<IX1P#+lgl-v#d#0<w~
zff>3Db4ore&neHHJD@n>CM&CfN5_^MQIy-{K>(>7o1bevFcMpOy2~hC(z=kUF)WIn
zW~~>Hxcasfts@_g_x!Q(L!IxV7NZ89z2K#ak8}<2$p81Wbi)dgIbTNWGH{P=gNF$n
z%=@n6zn{|)MrWGT^&9RaqxlrwSD)l5X{1vcv;Aduje<v?|9ku4H)Rw!kL5$LE-l;y
zP=+a`F%osTYCzcaS5#~a$j4a8D}0G0wEq*Gf6wl*{7Bu4fBz?}pH4OB<DC3|A1$L`
z(j_T9MORRdmuDB-I;V2Ouq@oC!}T9M8-mE!z-C};xLZ}~c(%+PmHV2jh1N6dD182Y
zi-`@j-1qo=jUma}@_2`jhY{u-ec{}>upbaEL-x8ql6F-bAveo3_gLdUdaZ$?ZqD;P
z%iB;c#9=uN&J`~BisFwPx$iw5lpXNExgY<2d7o}7(_S>oG#iUE1rBW@0w3229kEBA
z?qn7vN|&|pm9T8==Syx*5{7*8_n}hjv;0-=!sl|&MaLVbvf%!DpzkEHmD}mOA=hx;
zV}vWBSw4y*^8fwD;vVF;CKurRRMUA0O1dChpQ#mL?cbtygsPh^UdHpn(y2PH@D-rC
z6mK^-h5NjYMaz5n<{O1@@k-HJYv3b0s5%Q`bj@o~7;kqC57YMfBl}A~YKP4(m6`Y!
zmY?*U{79ymJE<BD{_iyt<rWg>Gnv%ORotdeWXL)}O-M-i$Stt9OYItCqTofZCBqw~
z727K#cU|r(@*{hg^FIl)wFM{e<2h}tj5JXxmF~_oo8(%EjtDIM54WFVAL+6PjNkHU
zH>hXtkl*&1nfN=FU6(uDD4P}T=t3*RWA);)bkSOc{J@`Nu4<qtR8$ykTO}&N-m83)
zn=U;Bcw2C*HtKbuCiy|1^mgUnd2e%I%L*wP*u1ea)A^lLdr>7*eQZZ%Wb@@Jz7xg0
zmiI}0`8yUED~K4Ny{6H<4-f}osGETvBA^>|geiogyHy``r2oq;W*jrcb}yLt2d9Eg
z)3+i((d^wWrD`}Nn+BQl4C@u<)0KVLZZXxx#RVP&j1W*}Z82y^C`y#!GL0wujAWE)
zwqr7ArJF+{rHOJrQ^9G#+?Sl`ABe~rP4QL(>h2YwqZ_F@?&2fz^%JG0Om!74V8}|l
zT2_o?3cp&x1n{Aky~BfpH9sK-_FS<2@Y7NXHc@JA&Tf-$PGQ}W?@C5)j%Iurjbc&$
z@iYF1uMA3h6$ZiciS36El;LQbYPd;Mb4V@AS9;N^TVpE!{`S0BE4$D_xaqTPdics>
zAiUF6#kF`W#rh5T0>|IpynnsiY*FV%Q3c61E!Nuq@TLp=dU;3}>NC$puDdGkJ&o+n
zv=6jJO<z5}JVs<Qamq>fN{(@ZL($ReDOH!QD*qqt-iN?CQ^-dK)SN3Ly@G1E*l3PK
zzUD@W6W|)6yUE(yDy=Qf)OT4dh(GCFf5%I+w+06n>l9~{hw*pp^>q*{N3(BISH$$C
z0&FNDr5}WM$04N(i8^(~r|a7K&%M#?97lvMZa@6^_kY6s<FGtEs(z=qQLg4iGZPdy
z!%F`JJ9${9`B8Bp2ld(lXx^jHGVrl|FRJ*j@bs;q@A?uc_Fi-_9UEPF_Q;L9T<tRl
z0Z-gLckbM*;x)AstiwDmSFv~3^tDk}xJ#acQd-%YdtKn*|1#SFE~{KWoZ=EfR(t6r
zn^aI;`+MuK3?3%lyn&)jlR0}8IEjNZb;jb?`oBzhEVIroq<uC7Dt9~zSZn|?1|hHZ
zyHXh#&&D;Zy8?Q()O8WMdfp52%s?n#&Yl;mF0S(CD|89`spHS;QWVI~V}%&2xmHGc
zo}sL4qpAjqUUg~205AdtxNzyvEBTt4zMv|_HQ-<Q_a6DCrNi(kh2FT=x2>{~uOA=D
z@x}5_cPaIjS;>`CIN8%28~@*#>&12x1%4DbL1b%{J47*(4xr0NrO7I@4!OE%P=qfR
zjma@7yt6XjiIWe&M{uiML!jl9d3^D?98S(ActeGx<0_j_eiZ$!nOZUISy2K)6!ng{
z)7D`hF5^q;BsA(L1E~`A%yOv>mdjDd&&v;{aJ6Uz2v_%<GL@=kYIF+Q1aLL<(y1#^
z;x#)FBEa{XuVz@@=g*znq>$8?YE}bp+fLTwb7LgCCrYo1I>~xor>+Z%bFIU2YPm1u
zn?B3g@8MIj7)eg;xpT&fQ|}qr{=3&MW|1!#?mZ_nWX2OE5%A;Wi^_djp*;Ty7{svb
zvswM{DsBn2cpA1Eq9D}6(e1x4X*<&rWe(;nJw&!sB{s=0Rti-2fs!EViUrXs-Y1&&
zSi~<*%2N{)5^5Fyay$ff>^`?GQKlat+A;x`Aic}Dj`wwCru;Id>*yKsGH=dx{AYg4
zIA-zz`ym-l^A}|0feg3G<ef(3Wm^e(e3?O}ac^E=9BLk9-3zN?e+I`|W!1O<i1ion
zrB@U?t+bxqhn{5j_I>bx<8eYr`0_@XwdwfsL>azZ5<*=T!<iy$dX-%e<ST)9`WFT)
zcGe0DR(9hN-36g7zUcFFQXd&FYEAOZ5Ott93a=l2w9b*>1B3?%MG?|&z^2c8-=#Lr
z46AH<s86S=R*1tg^(XtYXNTdxmV5VERef@M{#MozZX%TPrG0~ggA~Q7?l@>YFj*Cf
z<DqN#afH%giDs8-r#RgIC5upDA*SJrC;6$zKb#?BP(pMK$ER|~i#ka|OG>Z8ny@IZ
z`?jU@NL47sFp;9;Cwm5u1y>N>|0c=#LO|3m!w<65?T!FgZtgDX1mwO`NlbMQ=l<_1
zd)n**gkxQ%A51DjWoPAldDiSOdU4qY7$?>f>DsY~;(uZ~<Y|Z7O%c(iEN`G-dixV8
zdN+!Og`20jZvHP5f*eHqC(6cU`0TPZ$^97m!@46>tT(6r^D8UP;_$gL>*H6!g?18Y
zOh7ANI;f|L$vzwZm)GouL~AB0atgXB<~M_r`<KzHNW$xzO5aH_L!a(E1@HW+ysfe)
zB&Za}^RHp=z~|o;lxKlFMlYDmuso@lK=DuR)ofpf*y{9!4cUctVuQ~@qo78ll9hjO
z61oAG%Kf^sXT~9#dtI(H!*2|gCIk(NunAz?r_L(RaAPEAs}z@n;#2VA1*O(uWve^H
zoiZc2TM8$^-|crh8+;xO+@JCo$-g??xw?)d!*1u-qeBvniDEzUXRAWNvIZL~_qomk
zxW_vPZKzc<{VU6ojjxJ#Pn3_#l+W~Z?;ng;3Q9dxYSm>_AyizQpVqCkPqrR-H;2wN
z$|?2k-z5Nd&%MG{s<#OCx^L<AZaYI9eN*Z6_A%*K*`*DwpX^M<hyPv)XBDkY@mz9S
z+PY}&wQgWrXMTuu;|ym(YHjndPBpU6cW2K%tU0SfwqoehWv3u<m<o`%TFFfkFV|Vh
z%G9&?ai3Ln?5RYGM|Q5QlmMT#Go&cBVKVA9YGFtbD)Ez;DVA*lgX!U|749OGEJU6)
z4P-7mXv~*w$UZeI3BgzRHn!!{tGI&aJbalS8C4z&fr!uVYCT|rtNi<d7TIM<Imfg&
zFKNxaCpwapiHaDZ@nG2XPm4YPS?iWMd~!=Zez<8hEIJgBsgqOO+rPeR8?0G+1dL*l
zA9XoD(nJ$qL9YsDmNv*dCn`RAA)nS9t@_bA^^wV<8?0D397j_`Zz$d~{qL#f4N;pl
zyNXn`n(^i86!+-9FE;95>6&0Y(3|9OqolVFtcT>E_tl>ls!rrtNX)TpOB=^ByECmP
zcL@$~uaez${t>VlFxgo7cdAw^D(7U*$y9NI)|z`om+>@PY5YW4gN%XV>+9`oEwz&4
zW>~)eBMkhK^xy53Iq@DTeeO~Vk%wUYz_w#(nsj4!z6W`Qo<;5IGZd{rA#S2f@5^nD
zw*F}Sf#)aflv)VKk<Yl&Y$@t9?09@hF=}|()<Kb-gLql=m$dwyS7vP->yZ|3IwZl`
zVB$18VqLZg90pGOQ8Xsqn8G)s8csROMCZdPhQ0k;uzdf2Y;t0I<?11czeAiiOpi>9
zx0sK0Pa~n=VI8q>FQga-inqYPJDKH~NU!)B)+T$y&#?x@IV#o`T4(2~GYvdiHQ$lV
zTDa!Ztad>~lz<k6%-KA33lj(1$zQEj+2pDTWRt~D6!6KcNAA4O1~>Ag0U{g^CdeVK
z1i080%S}TD19H<M^O9QC-?f@%v>J_(oaRaHX(E$k_IH)-q*GwKbxN|a+?xO6M*qs5
zL@WQxz~;EexV~juwVWZi*{V^^)b3`&Q!Fx=M(<jUx|y2r4JAzwUPZ?Afo!A3H!Z?c
zxBx=F-j|#5uUyz~J>YSUR8pKizoA1he6=IaBP~|Fg=G#V_%s`QW%KENcw@(8){3oK
z)_>~r@VV+zt3~Bu(LXlU^q=jOC{ip}pB~ByOLgm80r6aqR*Nwpc%0LGy!U(@(A+~Y
z+114@9tc(n7hBH-4M*_`bJhac=pQFuiP~p9ppKh+xRaT`e^9IyAaw44F+;JY9dV{<
zao+P{lWA_dpdg8f%4k*hU~aAK#c}(dBfdiMJE?WRmzrZh-L3NP!{<pQ8fS1*#~?<_
zS!R{Y*O~5%o@S>^^S!27@JqXZZYC&SFF1wnh}GPN**@BvYoJLrMu}-%C>qZ8OMW`b
z*$#(OVrLWV5U117B!GFVg=T`nL&#71bwM6nV%<zVI0z4>rbnx>RdWCB5+$`@Eil^b
zhJ+zq>fXTWg`cl)#gij9SoyaY0^N?MZiGWk=DH$}L3J}N#=wdIUX8O&gITzO(p&Hi
z%;pxi_Dw7=7!JShk~>#9K)ic#xi|anKW??k9VrNR!#*LzGbCCL?}boMWHQYOnC7G)
z<SX+O(6R)1S%Rl!mtlXi4|LDq0Eg|Rh>A`Z=@3f(c}-TLxZ5F8Rf>Cj{mwF#QiSOs
z%3%7AX_`S^-@=Wa=DP|?E&ys%;RDR}hxc_I#n^I*wVP;Lrn1V}(dAdg{u31*GE6}H
zmqBN1i}OEPn?fMnAsi0J56J)+Kq_FoRR!qAmqsnxrTIs@bM<%NX=kOnI>HdDDvS)K
z1;z{iI>$#Z>U;MG;fpqXc|31!mst;#93RZc*g8=ff#ZGMj{%KI$Cq!#pUk701d5cG
zmgRuRc5Muh948d@@;veMe;$URmH*3!k$Hh4moCGt_nsKa*6D~<droe}mjvPIr|}i&
z`B<ky$1=SxQ*Um(+;!;7i2T5QS1|2nOfvOyP?LQr_rAZ}b&`(H)5DkN;ZLeim27b|
z+~w$n-I*)jWs#>S%NNA&sLS}RUkbSO*$3Of0=m^@oMV)8YB=_*=l4MUI`fpHxp6)D
zQ!+xiWO;zd!SO_rhg4(YWK?jfaf5Vi_Ni{!#(!=F@(tFhsn8QQF87=$%56%#S;ajb
z$qDNznW8MC$*|=lrTCq=x%n2>oS<TTaH8Q=VcbM<9fVQ7RM&@nfu7^zVClt(ZVKWg
z=fZKVOSeQsEJq2;yGhmHlXa%ZN;e;Nn{}Cw#dR;F>I91UU1q}~;^(-O;%P{1-a7S#
zNv3fQ;8&WM-t9Bp<;+^OHRP&>W32fUS=o=WLR|_jETv|SmCQaSsCe<P+ZW4K1TG~1
z$a)}QaqCo=z|vO-wQjtT)PvmrKEE6dL3g{$RiqM}A&z!DnFX_ibK6r(G%jP}(R`_L
zx%fDi(}*vCBYcH<C;WffyZWD|t}sjsh<8FqOKAZs&WbptmX<In(wH~|M^qL<)G|JD
z>Gfku)!r~C9q0-=L3^dKX3(WovMfTJ5vW8{v1n;aiGpQD1yQN}Ah0-PbSgS!y7%Im
zls{m<*`#TIIO%=Q^FH@^&w1Xq2M*&cQmt@~q%`<aC(HwQ&;T~$xcO&Z24ZF!?uDKT
zyXl)3ARa=y#2ynxKzj@Jmc+6Kfm+e;=JHWW{zGM9d&J_h2QlRUuik=-)jNE^)Fu5`
z4brSNrjqcgHadq>O6-ds{;<%6^p^%Mi4w{nYo=TLs^~}doA<^Z3ws!F$1=u*Dp-<G
zp?#+4$5`bOGnMZVj|tSkWn>E0F}ha~We>RZ-nk{_H5_|VMRbdt-eMTF3T>YmSs7hd
z8s%XV-I)~>cECzmv-M_Nj%Fyr7d@SR_2>b9(=wO~(x*jZG3c8K8w|t}!azX(EPkHE
z%pH@{*#cE)zm)Y%Yvql#D;51xS|5aF-~6zqtyEck5vze}rvhtzl1uXh(L9^<)(d@D
zQftpanQt&rbd-&=4=UH;Gp?PV;e)0V38hN-qpY{g?+JC~UNUdl`E5GsE>Z+a<DW?^
z;_cwIKoD?Q&UPWJlB^^e={#vXC}hlfi6sR9f~SQ{#gnJIdzQk_sj=U0K<+{8EJCsR
zPz4f(hqSrF9d4?f-&Smle<OIFolp2uCahoL3rozQfr@c?Igx<qe2QuM+wi966U|zb
z5RzB0Ytfo*yi&?~iH!?u%W<F;q@n|&BAc2sxb%n{V5dsVbOO(7VGehWosG^<YIY7s
zR?3sE9{%Uv=naXD<8U+U-3sxcOi|5ZW1TQji+cWwL(`^8GmbdFribCldwNGi^?{j6
zxV#I3x>o(CXQ4+|k_N#@>|7S)08l8`TC<AGVv>S9lvQr5186Aa5*q`?Fd&H#Gm*u^
zV*B`QlvXQya;FUc`=&Rf#0EZcvMZ+E%XE0etm1-Tnf1l12wBf>#}J1rZyKy+1t)NS
zp*aW4JT6mGro7m_qm6P}i%^~3kHPhOfDUzl0Bsy66UG@MyRKNgO552f>y3CNYW2D2
zd$|rT)!~YUY>4WDE0B)C)0A&r*;OA^3e3FI-6xH~`#rOCujpd7Mz%Fr)*Ui{B2k>)
z0+`%0;34#JNm>Fu4{zfY!W)3^@#B39R#$iNyGXPf<cwN8vKEi2om}qlP#xH<`>AF)
zOtHzflJJGRjeF_MG0mzuTP{M)8D{F_&>$KzDu)EMNTOCskm^BZ5MI9<x%0Yx0er>T
z@aW8bdWWbsUsV5#s15`>*`3-T=njc08w#oflhT&Qv3)#wKwMiu1g3BF*OeOBpGfIT
z<qV96E`N8a7>;f0e!)KlZqFJM!Jed+*b%)Yy~td1t}pV6AvoE+Y?}Jg6FN&8u6GKc
zp;c(nm`-*Xk+jmryFa0{4w1S;bc79BX#oX}-B3I-M`A9oKwf(D-aDLrZtvR$rox^n
zPj-=dqw|_V-@S-qR*4Qb;^8}R`nXVa_S_@pIy|GfBD5ti_N^me_nJ<wAS-#XQ@5nZ
z9IChEnd->O<C@Dy5p09NusU4Ooujui*UwhwPAEBwjLhl8tIGN9Jr8tfY>SUk?-I~l
zp8)N0y;Rouz1RkWUkql{_K*8tXhxsPfT+<`%*-|&8qb!qcF5yup-AD8VK^gyes5s^
zHfJSqBH?;rtTb%(Asv1yZPoEcJaWLDZmQcNpToxK^ZaJwdo3S4J2Tq7s%p-Vo15!l
zf@apcB5AHHy<I%3(rF^30NCbBp0A!*sRxfQoeZbBKFxKfI;183vOq#h8ihH|8$nTe
z^KH^i*~zh#N&GF*_X96fM>OA_wWxp@-;D{h4B(Rr&ip(Jh#bwPxDP`<;PM~YK9GUD
fJN~zu<n_CtH|@Jonfk}^Ab8|t<*sf09Ig2mQ%B4;

diff --git a/src/app/[orgId]/settings/access/roles/RolesDataTable.tsx b/src/app/[orgId]/settings/access/roles/RolesDataTable.tsx
index 7d2ef642..8073e166 100644
--- a/src/app/[orgId]/settings/access/roles/RolesDataTable.tsx
+++ b/src/app/[orgId]/settings/access/roles/RolesDataTable.tsx
@@ -9,7 +9,7 @@ import {
     SortingState,
     getSortedRowModel,
     ColumnFiltersState,
-    getFilteredRowModel,
+    getFilteredRowModel
 } from "@tanstack/react-table";
 import {
     Table,
@@ -18,7 +18,7 @@ import {
     TableContainer,
     TableHead,
     TableHeader,
-    TableRow,
+    TableRow
 } from "@/components/ui/table";
 import { Button } from "@app/components/ui/button";
 import { useState } from "react";
@@ -35,7 +35,7 @@ interface DataTableProps<TData, TValue> {
 export function RolesDataTable<TData, TValue>({
     addRole,
     columns,
-    data,
+    data
 }: DataTableProps<TData, TValue>) {
     const [sorting, setSorting] = useState<SortingState>([]);
     const [columnFilters, setColumnFilters] = useState<ColumnFiltersState>([]);
@@ -50,13 +50,15 @@ export function RolesDataTable<TData, TValue>({
         onColumnFiltersChange: setColumnFilters,
         getFilteredRowModel: getFilteredRowModel(),
         initialState: {
-            sorting,
-            columnFilters,
             pagination: {
                 pageSize: 20,
-                pageIndex: 0,
-            },
+                pageIndex: 0
+            }
         },
+        state: {
+            sorting,
+            columnFilters
+        }
     });
 
     return (
@@ -102,7 +104,7 @@ export function RolesDataTable<TData, TValue>({
                                                 : flexRender(
                                                       header.column.columnDef
                                                           .header,
-                                                      header.getContext(),
+                                                      header.getContext()
                                                   )}
                                         </TableHead>
                                     );
@@ -123,7 +125,7 @@ export function RolesDataTable<TData, TValue>({
                                         <TableCell key={cell.id}>
                                             {flexRender(
                                                 cell.column.columnDef.cell,
-                                                cell.getContext(),
+                                                cell.getContext()
                                             )}
                                         </TableCell>
                                     ))}
diff --git a/src/app/[orgId]/settings/access/users/UsersDataTable.tsx b/src/app/[orgId]/settings/access/users/UsersDataTable.tsx
index 8a790a2e..87cebf7d 100644
--- a/src/app/[orgId]/settings/access/users/UsersDataTable.tsx
+++ b/src/app/[orgId]/settings/access/users/UsersDataTable.tsx
@@ -9,7 +9,7 @@ import {
     SortingState,
     getSortedRowModel,
     ColumnFiltersState,
-    getFilteredRowModel,
+    getFilteredRowModel
 } from "@tanstack/react-table";
 import {
     Table,
@@ -18,7 +18,7 @@ import {
     TableContainer,
     TableHead,
     TableHeader,
-    TableRow,
+    TableRow
 } from "@/components/ui/table";
 import { Button } from "@app/components/ui/button";
 import { useState } from "react";
@@ -35,7 +35,7 @@ interface DataTableProps<TData, TValue> {
 export function UsersDataTable<TData, TValue>({
     inviteUser,
     columns,
-    data,
+    data
 }: DataTableProps<TData, TValue>) {
     const [sorting, setSorting] = useState<SortingState>([]);
     const [columnFilters, setColumnFilters] = useState<ColumnFiltersState>([]);
@@ -50,13 +50,15 @@ export function UsersDataTable<TData, TValue>({
         onColumnFiltersChange: setColumnFilters,
         getFilteredRowModel: getFilteredRowModel(),
         initialState: {
-            sorting,
-            columnFilters,
             pagination: {
                 pageSize: 20,
-                pageIndex: 0,
-            },
+                pageIndex: 0
+            }
         },
+        state: {
+            sorting,
+            columnFilters
+        }
     });
 
     return (
@@ -102,7 +104,7 @@ export function UsersDataTable<TData, TValue>({
                                                 : flexRender(
                                                       header.column.columnDef
                                                           .header,
-                                                      header.getContext(),
+                                                      header.getContext()
                                                   )}
                                         </TableHead>
                                     );
@@ -123,7 +125,7 @@ export function UsersDataTable<TData, TValue>({
                                         <TableCell key={cell.id}>
                                             {flexRender(
                                                 cell.column.columnDef.cell,
-                                                cell.getContext(),
+                                                cell.getContext()
                                             )}
                                         </TableCell>
                                     ))}
diff --git a/src/app/[orgId]/settings/resources/ResourcesDataTable.tsx b/src/app/[orgId]/settings/resources/ResourcesDataTable.tsx
index 8991a7e4..ffb6bf40 100644
--- a/src/app/[orgId]/settings/resources/ResourcesDataTable.tsx
+++ b/src/app/[orgId]/settings/resources/ResourcesDataTable.tsx
@@ -9,7 +9,7 @@ import {
     SortingState,
     getSortedRowModel,
     ColumnFiltersState,
-    getFilteredRowModel,
+    getFilteredRowModel
 } from "@tanstack/react-table";
 
 import {
@@ -19,7 +19,7 @@ import {
     TableContainer,
     TableHead,
     TableHeader,
-    TableRow,
+    TableRow
 } from "@/components/ui/table";
 import { Button } from "@app/components/ui/button";
 import { useState } from "react";
@@ -36,7 +36,7 @@ interface ResourcesDataTableProps<TData, TValue> {
 export function ResourcesDataTable<TData, TValue>({
     addResource,
     columns,
-    data,
+    data
 }: ResourcesDataTableProps<TData, TValue>) {
     const [sorting, setSorting] = useState<SortingState>([]);
     const [columnFilters, setColumnFilters] = useState<ColumnFiltersState>([]);
@@ -51,13 +51,15 @@ export function ResourcesDataTable<TData, TValue>({
         onColumnFiltersChange: setColumnFilters,
         getFilteredRowModel: getFilteredRowModel(),
         initialState: {
-            sorting,
-            columnFilters,
             pagination: {
                 pageSize: 20,
-                pageIndex: 0,
-            },
+                pageIndex: 0
+            }
         },
+        state: {
+            sorting,
+            columnFilters
+        }
     });
 
     return (
@@ -103,7 +105,7 @@ export function ResourcesDataTable<TData, TValue>({
                                                 : flexRender(
                                                       header.column.columnDef
                                                           .header,
-                                                      header.getContext(),
+                                                      header.getContext()
                                                   )}
                                         </TableHead>
                                     );
@@ -124,7 +126,7 @@ export function ResourcesDataTable<TData, TValue>({
                                         <TableCell key={cell.id}>
                                             {flexRender(
                                                 cell.column.columnDef.cell,
-                                                cell.getContext(),
+                                                cell.getContext()
                                             )}
                                         </TableCell>
                                     ))}
diff --git a/src/app/[orgId]/settings/share-links/ShareLinksDataTable.tsx b/src/app/[orgId]/settings/share-links/ShareLinksDataTable.tsx
index 5e973273..612a1790 100644
--- a/src/app/[orgId]/settings/share-links/ShareLinksDataTable.tsx
+++ b/src/app/[orgId]/settings/share-links/ShareLinksDataTable.tsx
@@ -51,12 +51,14 @@ export function ShareLinksDataTable<TData, TValue>({
         onColumnFiltersChange: setColumnFilters,
         getFilteredRowModel: getFilteredRowModel(),
         initialState: {
-            sorting,
-            columnFilters,
             pagination: {
                 pageSize: 20,
                 pageIndex: 0
             }
+        },
+        state: {
+            sorting,
+            columnFilters
         }
     });
 
diff --git a/src/app/[orgId]/settings/sites/SitesDataTable.tsx b/src/app/[orgId]/settings/sites/SitesDataTable.tsx
index 33c54313..a30bab12 100644
--- a/src/app/[orgId]/settings/sites/SitesDataTable.tsx
+++ b/src/app/[orgId]/settings/sites/SitesDataTable.tsx
@@ -9,7 +9,7 @@ import {
     SortingState,
     getSortedRowModel,
     ColumnFiltersState,
-    getFilteredRowModel,
+    getFilteredRowModel
 } from "@tanstack/react-table";
 
 import {
@@ -19,7 +19,7 @@ import {
     TableContainer,
     TableHead,
     TableHeader,
-    TableRow,
+    TableRow
 } from "@/components/ui/table";
 import { Button } from "@app/components/ui/button";
 import { useState } from "react";
@@ -36,7 +36,7 @@ interface DataTableProps<TData, TValue> {
 export function SitesDataTable<TData, TValue>({
     addSite,
     columns,
-    data,
+    data
 }: DataTableProps<TData, TValue>) {
     const [sorting, setSorting] = useState<SortingState>([]);
     const [columnFilters, setColumnFilters] = useState<ColumnFiltersState>([]);
@@ -51,13 +51,15 @@ export function SitesDataTable<TData, TValue>({
         onColumnFiltersChange: setColumnFilters,
         getFilteredRowModel: getFilteredRowModel(),
         initialState: {
-            sorting,
-            columnFilters,
             pagination: {
-                pageSize: 100,
-                pageIndex: 0,
-            },
+                pageSize: 20,
+                pageIndex: 0
+            }
         },
+        state: {
+            sorting,
+            columnFilters
+        }
     });
 
     return (
@@ -103,7 +105,7 @@ export function SitesDataTable<TData, TValue>({
                                                 : flexRender(
                                                       header.column.columnDef
                                                           .header,
-                                                      header.getContext(),
+                                                      header.getContext()
                                                   )}
                                         </TableHead>
                                     );
@@ -124,7 +126,7 @@ export function SitesDataTable<TData, TValue>({
                                         <TableCell key={cell.id}>
                                             {flexRender(
                                                 cell.column.columnDef.cell,
-                                                cell.getContext(),
+                                                cell.getContext()
                                             )}
                                         </TableCell>
                                     ))}