From 8e26f405f96800c282f89beb5082acb95161195e Mon Sep 17 00:00:00 2001 From: DivanMe <48186011+Divaaaan@users.noreply.github.com> Date: Sun, 13 Sep 2026 15:35:55 +0300 Subject: [PATCH] docs: refresh GitHub presentation for Tenebra 0.6.0 --- CHANGELOG.md | 43 +++- CONTRIBUTING.md | 2 +- README.md | 384 ++++--------------------------- README.ru.md | 77 +++++++ ROADMAP.md | 6 +- docs/README.md | 9 +- docs/assets/README.md | 15 ++ docs/assets/desktop-advanced.png | Bin 0 -> 71360 bytes docs/assets/desktop-simple.png | Bin 0 -> 38805 bytes docs/dpi-bypass.md | 39 ++++ docs/installation.md | 68 ++++++ 11 files changed, 297 insertions(+), 346 deletions(-) create mode 100644 README.ru.md create mode 100644 docs/assets/README.md create mode 100644 docs/assets/desktop-advanced.png create mode 100644 docs/assets/desktop-simple.png create mode 100644 docs/dpi-bypass.md create mode 100644 docs/installation.md diff --git a/CHANGELOG.md b/CHANGELOG.md index 90f85504..16dd2086 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,13 +4,48 @@ All notable changes to Tenebra are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the project follows [Semantic Versioning](https://semver.org/). -> **Early days.** Tenebra is at 0.x: the desktop clients (Windows and macOS) are +> **Early days.** Tenebra is at 0.x: the desktop clients are > the current focus — see the -> [project status](README.md#project-status). Expect breaking changes between +> [project status](README.md#project-status-and-known-limits). Expect breaking changes between > 0.x releases. ## [Unreleased] +## [0.6.0] - 2026-09-13 + +### Changed + +- Redesigned the simple and full desktop interfaces, with clearer subscription + setup, server selection, connection feedback, settings and diagnostics. +- Improved keyboard navigation, compact layouts, themes and Russian/English text. +- Added persistent Windows protection through WFP, with the saved preference, + confirmed enforcement and cleanup errors shown separately. Explicit + Disconnect releases Tenebra's policy. + +### Fixed + +- Failed TCP probes no longer prevent manual server selection or claim that + the server's VPN protocol cannot connect. +- Windows service communication verifies the installed service identity and + supports ordinary users and administrators, with bounded request waits. +- System proxy handling tracks the owning user and retains restoration data. +- Windows installation no longer falsely fails while waiting for service stop + in a fresh PowerShell process. +- Split settings survive routing changes; unusable multihop chains are rejected + and repeated engine-crash recovery attempts are bounded. + +### Verification scope + +This release was published with an explicitly limited acceptance scope. +Windows installation/upgrade/repair/removal, ordinary-user UI, IPv4 traffic, +system-proxy restoration and selected engine/service failure cases were checked. +The complete IPv6, BFE, reboot and other protection matrix remains open. +The original unavailable-server report and real-world DPI effectiveness have +not been causally verified. macOS/Linux build checks are not native tunnel +acceptance. Android and iOS are outside this release. + +See the [published release and its verification notice](https://github.com/Divaaaan/tenebra/releases/tag/v0.6.0). + ## [0.5.11] - 2026-08-31 ### Fixed @@ -1481,7 +1516,9 @@ Initial tagged release. first run. Updates delivered in-app are minisign-verified against the bundled key; only the initial download is unsigned. -[Unreleased]: https://github.com/Divaaaan/tenebra/compare/v0.5.10...HEAD +[Unreleased]: https://github.com/Divaaaan/tenebra/compare/v0.6.0...HEAD +[0.6.0]: https://github.com/Divaaaan/tenebra/compare/v0.5.11...v0.6.0 +[0.5.11]: https://github.com/Divaaaan/tenebra/compare/v0.5.10...v0.5.11 [0.5.10]: https://github.com/Divaaaan/tenebra/compare/v0.5.5...v0.5.10 [0.5.5]: https://github.com/Divaaaan/tenebra/compare/v0.5.4...v0.5.5 [0.5.4]: https://github.com/Divaaaan/tenebra/compare/v0.5.3...v0.5.4 diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 4ef838ad..61060bbc 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -18,7 +18,7 @@ By contributing you agree your work is licensed under the project's license, - **Triage** — reproducing issues and narrowing them down. Highest-leverage areas right now (see -[the status table](README.md#project-status)): +[the project status](README.md#project-status-and-known-limits)): 1. **Live tunnel bring-up** on Windows (wintun + sing-box, elevated). 2. **New platform adapters** — macOS/Linux (utun), Android (`VpnService`), diff --git a/README.md b/README.md index 79ba3eb6..dee8f00c 100644 --- a/README.md +++ b/README.md @@ -1,369 +1,77 @@
-Tenebra — sing-box VPN client +Tenebra -[![CI](https://github.com/Divaaaan/tenebra/actions/workflows/ci.yml/badge.svg)](https://github.com/Divaaaan/tenebra/actions/workflows/ci.yml) -[![License: GPL v3](https://img.shields.io/badge/license-GPLv3-ff3d00.svg)](https://www.gnu.org/licenses/gpl-3.0) -[![Latest release](https://img.shields.io/github/v/release/Divaaaan/tenebra?color=ff3d00&label=release)](https://github.com/Divaaaan/tenebra/releases/latest) -[![Platform](https://img.shields.io/badge/platform-Windows_%7C_macOS_%7C_Linux-0e0e0e.svg)](#project-status) - -**A cross-platform VPN client built on [sing-box](https://github.com/SagerNet/sing-box).**
-Desktop first — Windows has an installer-managed service; the current audit candidate still requires native acceptance. macOS and Linux ship for advanced users (see below). The same Go core drives an Android client, in alpha and installed by hand; iOS is a scaffold. - -A total eclipse: intercepted noise enters the dark, one clean signal leaves it. In tenebris lux. - -
- -> **Project status — early development.** The desktop client is the current -> focus. Earlier Windows releases have been exercised against real servers; -> that evidence does not establish native acceptance of the current audit -> candidate, including its persistent host guard. The required packet, BFE and -> reboot gates are [documented here](docs/host-protection-acceptance.md). -> macOS and Linux have had no privileged live-tunnel run signed off. -> Treat this as pre-release: not yet "production-ready", -> and expect things to move around. See -> [Project status](#project-status) for the honest breakdown. - -## Why another client - -Most clients either lock you into a single protocol or are vague about what they -do with your traffic. Tenebra: - -- speaks the protocols sing-box supports — VLESS/REALITY, Hysteria2, AmneziaWG, - Shadowsocks, Trojan, VMess; -- routes Russian destinations directly and sends everything else through the - tunnel, so latency-sensitive local traffic stays local; -- falls back between protocols when one gets throttled or blocked, and remembers - what worked; -- ships no telemetry, no accounts and no bundled servers — you import your own - subscription. - -## What it does - -Everything below is implemented in this repo today (the UI features are desktop): - -- **Many protocols, one model.** Import VLESS (incl. REALITY), Hysteria2, - AmneziaWG, Shadowsocks, Trojan and VMess. A single normalized node model feeds - a from-scratch sing-box config generator. *(AmneziaWG links import and connect, - but the bundled stock sing-box applies none of the AWG obfuscation parameters — - the tunnel runs as plain WireGuard; full AmneziaWG obfuscation is - [planned](ROADMAP.md#planned) and needs a build that links a fork.)* -- **Import the way you have it.** Subscription URL, a raw share link, a `.txt` - file of links, clipboard paste, or a QR code (image file or pasted image). - Subscription bodies handle a Clash/Mihomo YAML config, base64, or plaintext - link lists and read the `Subscription-Userinfo` header for traffic used / total - and expiry. -- **Smart RU routing.** *Smart* keeps Russian domains and IPs (and your LAN) - direct and tunnels the rest; *Global* tunnels everything; *Direct* is the - proxy off. Geodata comes from the official public sing-geoip / sing-geosite - rule-sets, shipped in the build as local `.srs` binaries and loaded from disk — - never downloaded while you are connecting. If a build is missing them, *Smart* - routes like *Global* and says so in the log rather than failing to connect. -- **DPI bypass that works on the first connect.** Windows only: the client drives - [zapret](https://github.com/bol-van/zapret) so censored services work at their - own latency instead of through an exit node. One bundle release is compiled - into the build so a censored network cannot leave a fresh install with no - bypass at all; newer releases are downloaded as they are published — see - [DPI bypass](#dpi-bypass). -- **Protocol fallback.** A pure state machine walks the last known-good node - first, then by protocol preference (REALITY → Hysteria2 → AmneziaWG), so a - blocked or throttled protocol is retried as another. The last good node leads - the next launch. -- **Per-app split tunnelling.** *Exclude* sends chosen apps around the tunnel; - *Include* sends only chosen apps through it. Matched by executable name and - persisted across restarts. -- **Honest leak check.** Observes the machine's public IP from redundant echo - services and runs a best-effort DNS probe, then reports a verdict that never - fakes a pass — it tells you what it could *not* measure rather than claiming - "safe". See [docs/control-protocol.md](docs/control-protocol.md#leak-check-leak_check). -- **Desktop niceties.** System tray that reflects the connection state (with quick - connect/disconnect), desktop notifications on state changes, `tenebra://` deep - links (import a subscription or connect a profile), launch at login (optionally - minimized to the tray), single-instance, live traffic graphs, light/dark themes, - and English / Russian UI. - -The v0.5.11 kill switch was best-effort; its behavior is recorded in the -[changelog](CHANGELOG.md). The current Windows audit candidate adds persistent -host protection, with desired settings separate from confirmed policy state. -Its engine/service-death and reboot guarantees still require -[native acceptance](docs/host-protection-acceptance.md); they are not established -by unit tests or prior-release tunnel runs. LAN bypass remains a routing option. - -## DPI bypass - -Blocking here is done by inspecting traffic, not by address: YouTube can be -unwatchable on a connection that is otherwise fine, and a tunnel handshake can be -dropped for looking like a tunnel handshake. **On Windows** Tenebra answers that -with [zapret](https://github.com/bol-van/zapret) — a separate program that edits -packets on the way out (splitting the TLS ClientHello, sending decoys, and so on) -until the filter stops matching them. It runs beside the tunnel rather than -inside it, so a service the bypass can reach directly stays direct at its own -latency instead of taking the round trip through an exit node. There is no -equivalent on macOS or Linux; the tunnel there carries everything. - -**Shipped as a floor, downloaded to stay current.** What the bypass needs is the -[Flowseal/zapret-discord-youtube](https://github.com/Flowseal/zapret-discord-youtube) -bundle: zapret's Windows build (`winws.exe`), the -[WinDivert](https://github.com/basil00/WinDivert) packet-interception driver it -attaches to, the Cygwin runtime that build needs, and the strategy and host lists -around them. Strategies are a moving target — a set that worked in March is a -set the filter has since learned — so the current release is fetched from -upstream. But a client that can only download one is a client with no bypass on -exactly the networks it exists for, so one release is also compiled into the -Windows core: the archive upstream published, byte for byte, checked against the -checksum this build pins for it. It is the floor, never the ceiling — a newer -release replaces it as soon as one is published and pinned. The macOS and Linux -binaries carry none of it; there is nothing there that could run a Windows -packet filter. - -**When it happens and where it lands.** On the first connect with no bundle -present, the core downloads the latest published release and unpacks it into its -own data directory — `%ProgramData%\Tenebra\data\zapret` under the Windows -service — then re-checks for a newer one every twelve hours. It is a plain -download from the upstream release page; nothing about you goes with the request. -When that download cannot deliver a bundle at all — no network, GitHub blocked, -a release newer than any checksum this build carries, or an archive that did not -match the checksum it does — the compiled-in copy is unpacked into the same -place instead, and the next successful check upgrades past it. - -**How to decline the download.** *Settings → Censorship bypass → Update the -bundle automatically* governs what Tenebra fetches: the first-connect download -and the twelve-hour re-check alike. Turned off, it asks the release page for -nothing — press *Update* when you want a newer one, or unpack one into the -`zapret` directory above yourself. It does not govern the copy compiled into the -build: those bytes need no -network and no update, so a first connect with no bundle present still unpacks -them and a fresh install is never left with the bypass missing. Deleting the -`zapret` directory removes what is installed; a later connect lays the -compiled-in copy back down. Running with no bypass at all means the tunnel -carries every service, censored ones included, through the exit node instead of -around the filter. - -Everything in the bundle, with its license and copyright holder, is listed in -[THIRD-PARTY-NOTICES.md](THIRD-PARTY-NOTICES.md#2-components-downloaded-at-runtime). - -## Installing +**A desktop VPN client built on [sing-box](https://github.com/SagerNet/sing-box).** -**Windows** — from the [Windows Package Manager](https://learn.microsoft.com/windows/package-manager/winget/): +Bring your own subscription or compatible server link. Tenebra does not include VPN servers or require a Tenebra account. -```powershell -winget install Divaaaan.Tenebra -``` +**English** · [Русский](README.ru.md) -or grab `Tenebra_x.y.z_x64-setup.exe` from the -[latest release](https://github.com/Divaaaan/tenebra/releases/latest). Either -way the installer sets up the background service and the in-app updater keeps -everything current. +[![Download Windows 0.6.0](https://img.shields.io/badge/Download_Windows-v0.6.0-ff3d00?style=for-the-badge)](https://github.com/Divaaaan/tenebra/releases/download/v0.6.0/Tenebra_0.6.0_x64-setup.exe) -**macOS** — download the universal DMG from the -[latest release](https://github.com/Divaaaan/tenebra/releases/latest), then -read the [macOS note](#macos-note--read-before-downloading-the-dmg) first — -the build currently needs a hand-installed root daemon. +Windows x64 · [All packages](https://github.com/Divaaaan/tenebra/releases/latest) · [What's new in 0.6.0](CHANGELOG.md#060---2026-09-13) -## Getting a server - -Tenebra is a **client** — it ships no servers and hard-codes nothing. You bring -your own endpoint and import it as a subscription or a share link. Two ways to -get one: - -- **Run your own.** Any [sing-box](https://github.com/SagerNet/sing-box) or Xray - server works; point Tenebra at its subscription URL. -- **Use a provider.** Any service that hands you a subscription or a share link - will do. I run one at **[vpsxd.pro](https://vpsxd.pro)**. - -## Project status - -| Area | State | -|------|-------| -| Go core (parsing, profiles, routing, config gen, fallback, leak logic) | Implemented, unit-tested, no third-party deps | -| Control protocol (core ↔ UI) | Implemented; covered by Go tests **and** a real-binary e2e | -| Desktop UI (Tauri 2 + React) | Implemented: all screens, reactive tray, notifications, deep links, autostart, i18n, themes | -| Windows tunnel (wintun + sing-box) | A background **service** owns the tunnel; installer/update code coordinates app and service. The current audit candidate still needs standard-user installer, live-tunnel and [host-protection acceptance](docs/host-protection-acceptance.md). INC-01 remains open; cause unknown. | -| macOS tunnel (utun + sing-box) | Builds and runs — universal `.app`/DMG — but see the **macOS note** below: it needs a hand-installed root daemon and is not yet a click-to-run product. No live-tunnel sign-off yet | -| Linux tunnel (`/dev/net/tun` + sing-box) | Builds and runs — a root **systemd service** owns the tunnel, installed by an Arch package or a `sudo` script; see the **Linux note** below. No live-tunnel sign-off yet | -| Android (`VpnService` + libbox) | **Alpha, hand-installed** — a Kotlin / Compose client in [`ui-android/`](ui-android/README.md) builds and runs on a device: subscription import, node list with latency badges, an AUTO exit, switching the live exit without a reconnect, connect-on-boot, a Quick Settings tile, in-app logs and crash reports. Routing is *Global* only and there is no DPI bypass. CI builds a debug APK; a tagged release carries a signed one only once the signing key is in CI secrets | -| iOS (Network Extension) | Scaffold only — none of the Swift under `ui-ios/` has been compiled and no framework has been built; the plan is [docs/porting/ios.md](docs/porting/ios.md) | -| Release pipeline | Tag-triggered `release` workflow builds the Windows, macOS and Linux bundles plus the Arch package, minisign-signs the in-app updater artifacts, and publishes the GitHub release once every expected asset is on it; Android is a separate workflow on the same tag | -| Code-signing | Not set up — the Windows installer is Authenticode-unsigned (SmartScreen warns), the macOS build is unsigned/un-notarized (Gatekeeper needs a manual "Open Anyway"), and the Android release APK has no keystore in CI yet | - -### macOS note — read before downloading the DMG - -The macOS build is **for advanced users right now, not a finished product.** Two -things are not yet in place, so a plain "download the DMG and drag to -Applications" will **not** give you a working tunnel: - -- **The tunnel needs a privileged helper.** macOS only lets root open the `utun` - device, so the app talks to a small root **LaunchDaemon** that owns the tunnel. - That daemon is currently installed **by hand** with a `sudo` script - ([`scripts/macos/install-daemon.sh`](scripts/macos/install-daemon.sh)) — there - is no in-app installer for it yet. Without it, the app runs but cannot connect. -- **The build is unsigned and un-notarized.** First launch needs - **System Settings → Privacy & Security → Open Anyway**, and updates to the - daemon are a manual step (the in-app updater refreshes only the app, not the - root daemon). Since 0.4.4 the app warns with a banner when the daemon has - fallen behind it; re-run the install script from your checkout to update: - `sudo bash scripts/macos/install-daemon.sh --from-app /Applications/Tenebra.app --allow-unsigned`. - -The click-to-run macOS path — a signed, notarized build with an `SMAppService` -daemon bundled inside the app (so it installs and updates like the Windows -service) — needs an Apple Developer ID and is **planned, not done**. Until then, -use the DMG only if you're comfortable running the install script yourself. -Windows uses an installer-managed service; the current audit candidate's -installation and update path still requires [delivery acceptance](docs/delivery-acceptance.md). - -### Linux note — the tunnel needs a root service - -Linux is the same shape as macOS: only a privileged process may open -`/dev/net/tun` and install routes, so the app talks to a small root **systemd -service** that owns the tunnel and serves the control protocol on -`/run/tenebra.sock`. The app alone cannot connect. Two ways to set it up: - -- **Arch Linux — build the package.** [`packaging/arch/PKGBUILD`](packaging/arch/PKGBUILD) - builds the core, the desktop app and the unit from source and installs them - with `pacman`: - - ``` - cd packaging/arch && makepkg -si - sudo systemctl enable --now tenebra.service - ``` - - Updates come from `pacman`, not the in-app updater — it can only replace an - AppImage, never files a package manager owns. - -- **Any other distribution — the install script.** Fetch the bundled resources, - then install the daemon from your checkout: - - ``` - bash scripts/fetch-resources.sh - sudo bash scripts/linux/install-daemon.sh --dev - ``` - - It is safe to re-run to upgrade, rolls back if an upgrade fails, and - [`scripts/linux/uninstall-daemon.sh`](scripts/linux/uninstall-daemon.sh) - removes it. The GUI is a separate `.deb`/AppImage build. - -Two limits worth knowing before you install: **system-proxy mode does nothing on -Linux** (it needs per-desktop settings a root daemon cannot reach, so it stays -quietly disarmed — tun mode, the default, is unaffected), and the bundled -sing-box binaries are **glibc-linked**, so musl distributions need their own. -Full detail, including the systemd sandbox and what is deliberately left out of -it, is in [docs/porting/linux.md](docs/porting/linux.md). - -If you want to help close the gap, the macOS `SMAppService` path and the -non-desktop adapters are the highest-leverage places — see -[CONTRIBUTING.md](CONTRIBUTING.md). +[![CI](https://github.com/Divaaaan/tenebra/actions/workflows/ci.yml/badge.svg)](https://github.com/Divaaaan/tenebra/actions/workflows/ci.yml) +[![License: GPL v3](https://img.shields.io/badge/license-GPLv3-ff3d00.svg)](LICENSE) -## Repository layout + -``` -tenebra/ -├── core/ Go. Platform-agnostic, stdlib-only, fully unit-tested. -│ ├── model/ Normalized proxy node + config types. -│ ├── subscription/ Parse vless/hysteria2/ss/trojan/vmess links + sub bodies. -│ ├── profile/ Named profiles and their atomic on-disk store. -│ ├── routing/ smart/global/direct + per-app split -> sing-box route/dns. -│ ├── singbox/ Build a full sing-box config as plain JSON (no sing-box dep). -│ ├── fallback/ Pure REALITY->Hysteria2->AmneziaWG fallback state machine. -│ ├── zapret/ Drive the DPI-bypass bundle, embedded + downloaded (Windows). -│ └── control/ The line-delimited JSON protocol + the daemon. -├── core-bridge/ The same generator as a mobile-facing library (no sing-box). -├── mobile/ gomobile wrapper: binds core-bridge + libbox into one artifact. -├── adapters/ -│ ├── windows/ Spawn & supervise sing-box; traffic via its clash API. -│ ├── macos/ The same over utun, under the root LaunchDaemon. -│ └── linux/ The same over /dev/net/tun, under the root systemd service. -├── cmd/ -│ └── tenebra-core/ The sidecar entry point (talks the protocol on stdin/stdout). -├── ui-desktop/ Tauri 2 app: Rust shell (src-tauri) + React/TS front end (src). -├── ui-android/ Kotlin/Compose client: VpnService + libbox (alpha). -├── ui-ios/ SwiftUI + Network Extension scaffold; never compiled. -├── deploy/ The privileged daemon's service definitions per platform. -├── packaging/ -│ └── arch/ PKGBUILD building the whole thing for Arch Linux. -├── scripts/ -│ ├── fetch-resources.ps1 Download pinned sing-box + wintun (Windows). -│ ├── fetch-resources.sh The same for macOS and Linux. -│ ├── build-libbox-android.sh One gomobile bind -> the fused tenebra.aar. -│ ├── build-libbox.sh The same bind for Apple (xcframework). -│ ├── macos/ Install/remove the root LaunchDaemon. -│ └── linux/ Install/remove the root systemd service. -└── docs/ Architecture, control protocol, the dev guide, porting notes. -``` +| Platform | Before you install | +| --- | --- | +| **Windows** | Installer sets up the background service. The installer is not Authenticode-signed; SmartScreen may warn. | +| **macOS / Linux** | For advanced users: a privileged helper is required; setup varies by package. No native live-tunnel validation for 0.6.0. [Installation guide](docs/installation.md). | +| **Android / iOS** | Outside the 0.6.0 release. Android is experimental; iOS is a scaffold. | -## Building +An animated eclipse: in tenebris lux. -Requirements: **Go 1.24+**, **Node 22+**, and the **Rust toolchain** (for the -desktop UI). Full walkthrough and troubleshooting in -[docs/development.md](docs/development.md). +## Two ways to use Tenebra -Core tests: +**Full mode** puts connection controls, servers, routing and diagnostics within reach. -``` -go test ./... -``` +Tenebra 0.6.0 full interface with demo data -Desktop app (Windows): +*0.6.0 interface preview with demo data; not a live connection measurement.* -``` -# fetch the sing-box binary and wintun.dll into src-tauri/resources -powershell -File scripts/fetch-resources.ps1 +
+Simple mode — subscription, server and connection in one flow -# build the core sidecar where Tauri bundles it -go build -o ui-desktop/src-tauri/binaries/tenebra-core-x86_64-pc-windows-msvc.exe ./cmd/tenebra-core +Tenebra 0.6.0 simple interface with demo data -# build the bundle -cd ui-desktop -npm install -npm run tauri build -``` +*0.6.0 interface preview with demo data; not a live connection measurement.* -Desktop app (Linux): +
-``` -# fetch the sing-box binary and the rule-sets into src-tauri/resources -bash scripts/fetch-resources.sh +## Connect in three steps -# build the core sidecar where Tauri bundles it -go build -o ui-desktop/src-tauri/binaries/tenebra-core-x86_64-unknown-linux-gnu ./cmd/tenebra-core +1. **Install and open Tenebra.** On macOS and Linux, complete the [helper setup](docs/installation.md) first. +2. **Import your subscription or server link.** Paste a URL or share link, open a text file, or import a QR image. Obtain connection details from your provider or your own server. +3. **Select a server and connect.** Start with **Smart** routing for direct Russian/LAN destinations and a tunnel for other traffic; choose **Global** to route through the tunnel. -# build the .deb and AppImage -cd ui-desktop -npm install -npm run tauri build -``` +## What you get -On Arch, `cd packaging/arch && makepkg -si` does all of the above and installs -the result — see the [Linux note](#linux-note--the-tunnel-needs-a-root-service). +- **Flexible imports.** VLESS/REALITY, Hysteria2, Shadowsocks, Trojan and VMess links; subscription lists, base64 and Clash/Mihomo YAML. +- **Routing controls.** Smart, Global and Direct modes, plus per-app include/exclude lists. +- **Connection fallback.** Tries the last working node first, then configured protocol alternatives when available. +- **Optional Windows DPI bypass.** Integrated zapret with an embedded bundle and controlled updates. Results depend on your network. [How it works](docs/dpi-bypass.md). +- **Useful diagnostics.** Public-IP observations, a best-effort DNS probe, logs and distinct service, engine and connection errors. +- **Desktop controls.** Tray actions, profiles, live traffic graphs, light/dark themes and Russian/English interfaces. -## Documentation +## Project status and known limits -- [docs/](docs/) — documentation index. -- [docs/architecture.md](docs/architecture.md) — the layers and how they connect. -- [docs/control-protocol.md](docs/control-protocol.md) — the core ↔ UI wire format. -- [docs/development.md](docs/development.md) — set up, build, run and test. -- [CONTRIBUTING.md](CONTRIBUTING.md) — how to contribute. -- [SECURITY.md](SECURITY.md) — reporting a vulnerability and our trust stance. -- [CHANGELOG.md](CHANGELOG.md) — what's changed. -- [ROADMAP.md](ROADMAP.md) — where the project is headed. +**0.6.0 is an early desktop release.** Recorded Windows checks cover the nine-step installation sequence, both interfaces under an ordinary user at 100% and 150% display scaling, IPv4 tunnelling, system-proxy handling and selected crash/recovery cases. This is a limited acceptance scope; it does not establish compatibility with every subscription or network. -## Support +- **Windows protection:** the complete IPv6, BFE and reboot acceptance matrix remains open. A saved protection setting is separate from confirmed enforcement; do not read it as a universal leak-prevention guarantee. [Acceptance details](docs/host-protection-acceptance.md). +- **macOS and Linux:** packages are available, but native live-tunnel acceptance has not been completed. macOS is unsigned and unnotarized; Linux system-proxy mode is unsupported. +- **AmneziaWG:** links can be imported, but the bundled stock engine does not apply AWG obfuscation parameters; it uses plain WireGuard. +- **Diagnostics:** the IP/DNS check reports what it can observe; it does not certify all traffic paths. -Tenebra is maintained by one person in their spare time, so please keep support -low-friction: +## Documentation and support -- **Questions or help** — start a thread in - [Discussions](https://github.com/Divaaaan/tenebra/discussions). -- **Bugs** — file a report through the - [issue form](https://github.com/Divaaaan/tenebra/issues/new/choose); it asks - for your version, Windows build and logs. -- **Security problems** — follow [SECURITY.md](SECURITY.md); please don't open a - public issue. +[Installation](docs/installation.md) · [DPI bypass](docs/dpi-bypass.md) · [Documentation](docs/README.md) · [Changelog](CHANGELOG.md) · [Roadmap](ROADMAP.md) -Response times vary — this is a side project, not a supported product. Thanks for -your patience. +For help, use [Discussions](https://github.com/Divaaaan/tenebra/discussions). Report bugs with your version, operating system and relevant logs through the [issue form](https://github.com/Divaaaan/tenebra/issues/new/choose). Remove subscription URLs, credentials and other private details before sharing logs. For security reports, follow [SECURITY.md](SECURITY.md). -## License +To build or contribute, start with the [development guide](docs/development.md), [architecture](docs/architecture.md) and [CONTRIBUTING.md](CONTRIBUTING.md). -GPLv3 — see [LICENSE](LICENSE). sing-box is GPLv3, so Tenebra is too. Bundled -third-party components and their licenses are listed in -[THIRD-PARTY-NOTICES.md](THIRD-PARTY-NOTICES.md). +Tenebra is maintained in spare time; response times vary. Licensed under [GPLv3](LICENSE). Bundled components are listed in [Third-party notices](THIRD-PARTY-NOTICES.md). diff --git a/README.ru.md b/README.ru.md new file mode 100644 index 00000000..c0e8c79d --- /dev/null +++ b/README.ru.md @@ -0,0 +1,77 @@ +
+ +Tenebra + +**VPN-клиент для компьютера на базе [sing-box](https://github.com/SagerNet/sing-box).** + +Подключите свою подписку или совместимую ссылку на сервер. В Tenebra нет встроенных VPN-серверов, и аккаунт Tenebra не нужен. + +[English](README.md) · **Русский** + +[![Скачать для Windows 0.6.0](https://img.shields.io/badge/Скачать_для_Windows-v0.6.0-ff3d00?style=for-the-badge)](https://github.com/Divaaaan/tenebra/releases/download/v0.6.0/Tenebra_0.6.0_x64-setup.exe) + +Windows x64 · [Все сборки](https://github.com/Divaaaan/tenebra/releases/latest) · [Что нового в 0.6.0](CHANGELOG.md#060---2026-09-13) + +[![CI](https://github.com/Divaaaan/tenebra/actions/workflows/ci.yml/badge.svg)](https://github.com/Divaaaan/tenebra/actions/workflows/ci.yml) +[![Лицензия: GPL v3](https://img.shields.io/badge/license-GPLv3-ff3d00.svg)](LICENSE) + +
+ +| Платформа | Перед установкой | +| --- | --- | +| **Windows** | Установщик настраивает фоновую службу. Подписи Authenticode нет; SmartScreen может показать предупреждение. | +| **macOS / Linux** | Для опытных пользователей: нужна привилегированная служба; способ настройки зависит от пакета. Работа реального туннеля 0.6.0 на этих платформах не подтверждена. [Инструкция](docs/installation.md). | +| **Android / iOS** | Не входят в релиз 0.6.0. Android — экспериментальный клиент; iOS — заготовка. | + +Анимированное затмение: in tenebris lux. + +## Два режима интерфейса + +**Полный режим** — подключение, серверы, маршрутизация и диагностика под рукой. + +Полный интерфейс Tenebra 0.6.0 с демонстрационными данными + +*Интерфейс 0.6.0 с демонстрационными данными; это не результат измерения реального подключения.* + +
+Простой режим — подписка, сервер и подключение в одном сценарии + +Простой интерфейс Tenebra 0.6.0 с демонстрационными данными + +*Интерфейс 0.6.0 с демонстрационными данными; это не результат измерения реального подключения.* + +
+ +## Подключение за три шага + +1. **Установите и откройте Tenebra.** На macOS и Linux сначала [настройте службу](docs/installation.md). +2. **Импортируйте подписку или ссылку на сервер.** Вставьте URL или ссылку подключения, откройте текстовый файл либо изображение QR-кода. Данные подключения выдаёт ваш провайдер; также можно использовать собственный сервер. +3. **Выберите сервер и подключитесь.** Режим **Smart** оставляет российские и локальные адреса напрямую, а остальной трафик отправляет в туннель. Для маршрутизации через туннель выберите **Global**. + +## Возможности + +- **Разные форматы импорта.** Ссылки VLESS/REALITY, Hysteria2, Shadowsocks, Trojan и VMess; списки подписок, base64 и конфигурации Clash/Mihomo YAML. +- **Настройка маршрутов.** Режимы Smart, Global и Direct, списки приложений для включения в туннель или исключения из него. +- **Перебор подключений.** Сначала проверяется последний рабочий узел, затем доступные альтернативы по протоколам. +- **Обход DPI в Windows.** Интеграция с zapret, встроенная сборка и управление обновлениями. Результат зависит от сети. [Как это устроено](docs/dpi-bypass.md). +- **Диагностика.** Проверка наблюдаемого публичного IP, ограниченная проверка DNS, журналы и отдельные сообщения об ошибках службы, движка и подключения. +- **Управление с рабочего стола.** Меню в трее, профили, графики трафика, светлая и тёмная темы, русский и английский интерфейсы. + +## Состояние проекта и ограничения + +**0.6.0 — ранний релиз для компьютеров.** Зафиксированные проверки Windows охватывают девять шагов установки, оба интерфейса под обычным пользователем при масштабе 100% и 150%, IPv4-туннель, работу системного прокси и отдельные сценарии сбоя и восстановления. Это ограниченный объём приёмки: он не подтверждает совместимость с любой подпиской или сетью. + +- **Защита Windows:** полная матрица проверок IPv6, BFE и перезагрузки ещё не закрыта. Сохранённая настройка защиты отделена от подтверждённого состояния её применения; она не означает универсальную гарантию отсутствия утечек. [Подробности приёмки](docs/host-protection-acceptance.md). +- **macOS и Linux:** сборки доступны, но проверка реального туннеля на этих платформах не завершена. macOS не имеет подписи и нотарификации; режим системного прокси в Linux не поддерживается. +- **AmneziaWG:** ссылки импортируются, но стандартный движок в комплекте не применяет параметры маскировки AWG — соединение работает как обычный WireGuard. +- **Диагностика:** проверка IP/DNS показывает доступные наблюдения и не подтверждает безопасность всех путей трафика. + +## Документация и помощь + +[Установка](docs/installation.md) · [Обход DPI](docs/dpi-bypass.md) · [Документация](docs/README.md) · [История изменений](CHANGELOG.md) · [Планы](ROADMAP.md) + +Вопросы можно задать в [Discussions](https://github.com/Divaaaan/tenebra/discussions). Об ошибках сообщайте через [форму issue](https://github.com/Divaaaan/tenebra/issues/new/choose): укажите версию, операционную систему и нужный фрагмент журнала. Перед отправкой удалите ссылки подписок, учётные данные и другую приватную информацию. Для сообщений об уязвимостях есть [SECURITY.md](SECURITY.md). + +Для сборки и участия в разработке: [руководство разработчика](docs/development.md), [архитектура](docs/architecture.md) и [CONTRIBUTING.md](CONTRIBUTING.md). Подробные технические документы пока на английском. + +Проект развивается в свободное время; сроки ответа могут различаться. Лицензия — [GPLv3](LICENSE). Сторонние компоненты перечислены в [Third-party notices](THIRD-PARTY-NOTICES.md). diff --git a/ROADMAP.md b/ROADMAP.md index 5a0d8e74..1a0517dc 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -37,7 +37,7 @@ Working today on the Windows, macOS and Linux desktop clients: release replaces it once upstream publishes one this build pins, re-checked every twelve hours, and the strategy that carries traffic is chosen by measuring the bundle against real destinations. Windows only — see - [DPI bypass](README.md#dpi-bypass). + [DPI bypass](docs/dpi-bypass.md). - **Connection diagnostics** — an on-demand UDP / STUN check (reachability, NAT type, external address) and a speed test through the active tunnel. - **A support report in one action** — state, versions, routing, the last @@ -54,7 +54,7 @@ Working today on the Windows, macOS and Linux desktop clients: the unprivileged app attaches to it, installed by an Arch package (built from source in the release workflow) or a `sudo` script, with `.deb` and AppImage bundles beside them. Read the - [Linux note](README.md#linux-note--the-tunnel-needs-a-root-service) first. + [Linux installation guide](docs/installation.md#linux) first. ## In progress @@ -113,5 +113,5 @@ Bigger ideas, not committed: --- Done items move up to **Shipped**; see the [changelog](CHANGELOG.md) for what -landed in each release and [project status](README.md#project-status) for the +landed in each release and [project status](README.md#project-status-and-known-limits) for the honest state of each layer. diff --git a/docs/README.md b/docs/README.md index 82a4a564..030aef44 100644 --- a/docs/README.md +++ b/docs/README.md @@ -1,7 +1,14 @@ # Tenebra documentation Project overview and quick-start live in the top-level -[README](../README.md). This folder holds the deeper references. +[README](../README.md) / [Русский](../README.ru.md). This folder holds the deeper references. + +- **[Installation](installation.md)** — downloads, Windows setup and the + required macOS/Linux helpers, with platform limitations. +- **[DPI bypass](dpi-bypass.md)** — the optional Windows integration, + bundled components, update controls and network-dependent results. + +For developers: - **[architecture.md](architecture.md)** — the layers (Go core, platform adapters, the desktop UI) and how they connect, plus the project's hard rules. diff --git a/docs/assets/README.md b/docs/assets/README.md new file mode 100644 index 00000000..5da2cc2e --- /dev/null +++ b/docs/assets/README.md @@ -0,0 +1,15 @@ +# README artwork and interface previews + +`hero.png` and `eclipse.svg` are the existing Tenebra identity artwork. The +eclipse keeps its animation and reduced-motion fallback unchanged. + +`desktop-advanced.png` and `desktop-simple.png` show the desktop renderer from +the v0.6.0 source commit `15a4dec70c4105bad02462d0e69e29ade3ac59be`, captured +on 2026-09-13 at 1280 × 720. They are unedited browser captures of the actual +React interface, using a synthetic native adapter and demo subscription. +The app is disconnected; displayed node latencies and usage are demo values. +These images are interface previews, not measurements or native tunnel tests. +No production subscriptions, credentials or server addresses are included. + +For future screenshots, use the corresponding release's renderer, retain +the demo-data caption and never reuse a real user's subscription or logs. diff --git a/docs/assets/desktop-advanced.png b/docs/assets/desktop-advanced.png new file mode 100644 index 0000000000000000000000000000000000000000..402c7e700623fc3ee1a93a127270e8b9f834b6f1 GIT binary patch literal 71360 zcmeFZcUV)+);Amr76iR1K@4CCO+pheXefFs2`v-@BmqLv&_feK5fHp>2%#t-y=kaP z2$;|eRi#KrO6Y4=F zef!@4zv*h~XaWu$0ssyj`~drd01d#gqa4RLjvhP4aqRfX z@(T){tLk{&)@U{pq{7g#DA6uF*veOzc73LVs!WKj?1_|3}>i zZ69Q+@f?ia;lsyHa2)11dicm+N*p@Oa|v~XSK(IF;!!@Mdv6&X-+=-ik3WKqIrtTC zFCA05>M7d!-lnC~ktzfV^ibuGLY2LEuRXzjRlXDLo zG1Afm_BhODjiB<{dy!R{fBgIE-y`wwRq$_l_*Zm+QBg6UN;bb&Cq%jf2yC8J(CzfM zxUm!T=1*ONApBM5{0>mjyCCT}^X@GEeVW|RjdX*eIep7cT1rH<;+%q2bgHmbj_c{* zN~n2}>vrvfw$m;GPdL(;Di2afOzm*zc)TkPoYs&&_dRwdUQY|K75Zo|!{^h2>fF*D z?_nO#)%gm_D z&WtmsdQtFQ>TPfWH7g!QDaAhlFWf!QxG5BGCg8X}X^br5%K50#mtb2h72|4o600`O;8y~6cC{I^3qXcUhets%tA6L1u8n4FbQiXZsn zpvM2rWNWMiLddK@t$L)*!x1IKxb?E_5~;l&{M^-@&Y-s!w(Yc5GIk3TNa3mWay5pP zk~5$d%iwf>!*0yW*;0IxF~q0;g}H!a151z5gyvYI-6EBMvu$7vQzK1JJBiD=qOYRG{sL z#=rF^uddH&BXdt{<@8%hEe)UfHnht`n;LH8hiQC77W`&A``6m<{8>Ij@Kl_=l7>ky z83m1MDaQO0H2KE#o78H#kEYE~Vgi5wp zwCq@4Q;l99bi?rg4*8d z!-}30cE!RL&`dDc6^)*_8B-_5r^B^W1+(#F%=trL`3NSNybL+C_>X526Vv&9V{lFE zPktG_Z85x4l}Td%l|MO-z4ohldLOV^SUoQMw*MmnZTYQ90%fd!XMHr1n9K*92_=s+ z&j&>*@aVPOUthhRM9mj1l)JJ%0=T)s_sMr3z-72aJTI1;OC^y=$w2;j<`KEws1M9^ z?j@hnA5>SIPENk>e_h>1qwAoMP;XBv#L}%Iw;~y)pZ+ZG$;V4R+CR8HUA{sc2sck7m7mE>6n~=~?Xbem#*Dnor$!knW{QS;P#5VQD zO&s)yQo7MA(eqiFnq^^+A$)f^9~b5&_GsFb+E$DFM%cZ zqOCgCs@FcCFeN2(@$2KyhA-+QIKuBBF|Um!h&KLEcUvp?02@AmTQQw5l8J4)$;oe~ z`fN;XJMAp$PE&BF-dAyZ0@*<)g|5jECRID9@;O|}@eTH8RY-Q(*%|PE?&|C+OG-au zr-@e}k<#6vZl$=rbR!~2FLW_N4!H@hRZLP-FRZiJD(a?*$DR{inR{6Zfk+IxLJbDo zM<$gQ@$TDI!zkYM@WKWcRh|Z!TuMR1oV?`By9R3%0(x|gI2?h%=_G`fv@*#f@eY@^ zY}YGp)*REn`+76-!V_Czy-ywjFzHLtmHjKQL1mWtta1}2DXq%wkw6q`8D=`vjYexO z4=yP2L~NA@q!s>5GWG4EwN=xA)AaD%tw_yQ5Cg4bOaQ0AYBE~% zdKJ<~&;Ls2(^nBp`@9bzBqpd*aHLK-(erU(x?h##C_dJ1-GdGOr-9E9fBaDT{!Uzj z;W#B8FrMj|w}90h6w_&$=Y?dIY&H44LNLF=3{B9EKgPCt>e%B3B9@`!Y8}QkGHj0y z1oXB#>O85>oGJZtr=hf3{nv_f%zG2)xpQP~!iuz4CmZ`|OnZ9uGPPlB1&gPrI+x7Q z#~G8OJF+dv`JZO>t+D4t?lfFpf`qsRHyXWivY;g8BOzHVKmK_&ai?9&8?5|&0Ocm8 zXS-Zw`@#mMW7$P*3^MY%@LCQwbvV4%hTgUhxC5|z^N%&zzm#)K@6mMZg|?T=74?cX z`vAS%UtW)5ClpYFcf-RjQ?BF*P*nyXoA{{9RPx}d0qP{Ap_LTclsIo)Cs6nO<6_bS z@6cSKJK-PBSuo158J3DI5p8HK@IZ3|DZRrdCHz5;6!7qu&!HG*D9XHOKD7}XDLNP$kdCC zf#o~%;h{i*sdSH*SYvfNjTy*foZoP%S9GPtWDum>Bz_P3GjS;qe5LRU#S_a#{(OH| zxk|*2&1R}dI$5NzYZepFwwmk^N~;(5#&X}OrRRKnmsOjYjmXc8_HCQD>rxo@1ZzeW z+Z3WHUf#X&G52aV>&s1_1bXHe9^t*7*;%flOg00tD?9kQpGz?w>c&Ot>RMRMeziGS;mdGhZ!LHx4)P z+T3%!0csgA75h@!hHk@T6Ut^PW=PfDbzwaD&z<5RO>wdi>c?d17=(A(gzJj?h9LET zXx>&HCbg~KvSkIC_kU_XTDIE<#QhNbKfN^I&*&}M{MZM86$=}0o_o+``nGi`C@4mG zd1P+Bb#2AJt?s_Cv~VqCMq%bGeoG(m!YIr8`~`u;_S8;wv4BK=hICqwnB%M}zMLTS z?RULl_qJx?&B|uZ#_*^h$zW8qq=T1foTQ~54Qnh$>{7fuFh&p+!%T|C8qKCMl!rdl zFdYupF@utYYZP5$MvcGdiwTOMl~^(Au^_0w-?o;tX(^_-F~EiK#On+%V?UP0mWKHk6T zCP_0kL3Q4a<>`ioT@8Ee_(Z))$mTobSG zKpaCAhZ*MSh8ommhrza5Jyla5j-v_I1i2cdoW|H#pI&4(*&E7bO1dQ>i_IqJaI&X5 z7Ln<1eG_sMskN4*S?YN)4j!8GkHRL=rBUMK?64qHm7DPJ1G(d zA)tyOF*QO~lTK=5aR0BSxnZfT486@|^GMneS33b@^@Rer3(wVG)6jQvYhw##NFlwG z_FMG6F#F|Y@JMaM^Bb~if%%-o;ZTyYad6 zAt*GwaM%AqB~#`C7YVW}#PRVv?QK>QNf~*SXfQ3+w@!sMt!u}%c;-3I;(C3}^qdr> zIlPTQ?}e!M{m6N7r5C(SO3AS=qj=Jt6@aWfq&m{OSF5t`j6>)IFZ|oAK}Nq3{p9H5Dlms-zz37wtVxy1IUBfki)GI}U7i z@Y29OeTJ_Fhl?*R(n~uF-(~?<;N8xkS~PJev?T($vLf71AW$e?Wha4QGR}N#*gyqk zPe&wzd*WYAGJ(E?G^J_qx~a z{4k=4Wwzi;u(bs%U(c#6OZ2Q*|5PjDmArSoGEAkg{#E%=lhSbW_nkG#iLU%++env= z5yNKY#w4TOHX7Vx6ZRwn3)E)c?>0er7lo!KJ{oDMWNot$(7RlV9m%uma5w7^ixXTI-1peL2AMbC`8p0?RLUppRAYSWuK z-BvL>GX{I3lRTKRr(KhtAgfP+vCNI1u>P>>&i6oi zAFvmHcH!$jU@pxH(C7GWp+mlAAMmE*-dD2qi+zBG6-To&NJg~?xwsFQx@zj{82^1A z@TK>$XKQfS>3QDWo7>z1A_L-^k5-}IEDBY$b9t}H5E}}Z6XYDoF4u1WVCL%k!1X7~!RIG2TH=Ov6 znvXspODYur`P)mvA!WG_fL3}P12h$_GITpX`zkI&BC#EAZ5gX~@g#rUbqzEYP4v(H z2FUy4Z}1DS6K9d@Zsyv@yU^9cS`uro(3@u>Yn`IA?gOx!hO7a>;2> zk!4xBk71_`K+)T=-228{dM4p-r2vg=@_hFWGboCN7^H02?nzuZB8dqrHC|}k)})_x z%lR6!n(%?^KUbx6?roOyaR1=dNSlOi8;g*5B!o(pRHOtSSZ?|MnFp2DnZCa>za9N2 ze~qE0IheH2gAoXSDg+v6TkN!*=*$1-Y4V9Q&9J-qeFi3-67Qh{`1jSnN8;bB;NSA_ zujqm-C#MNlJ;;?|4Nxd=7z`@BktW%fAY83 zX=1>_finG*pEzf-1kKYC(;K&Dvd4B!>Xb$rL643Eg{J=K>t-y4_U zBspcxT32NJ^$L)kWL3P=bhUG>VA$v`=fAW5KQ$UF4dc6*u@4s-$u4=sq;8i8Bvn#0 zCN$W^X&=xYq3#BU*2ew;KpaX9{>hT%1Z4&U& z=MqZ1JfY?j1;b$ts4IVQ1|NQzllXe6Z8Ot_7g8K8jRuV)EqVL|dJRM2AC3ZSYc!0Z z+z8t{tnTgwXS*mED8I_RzR8CFP>i95F-ixG=8_9khd}N9J(XZC@w+DV0KmonJEB3u z6BI&q8%b>(jjWa>H&&b&LD^_NHef(!|Fe851cVN zqOEYEWlG(c^&bBwWCR{F;@(k9YWO?THs{}Ih$qJa_5s8p_i+tC`=f<`h~39A=QR@8EHf-3**8u1jFQkQz`7DE5`zA0XoU4&g!o28`~#%~#7 zz5|m>_j~?)tQPI{#l!@g_gfW-&`Z6QM%NxmqQl#e)a8{&GiIR?74xex-dmGr6;Bs? z8b!SB>S-o54Z&VB(2DTPikDiIX32@^ww|!F8?iT*zu2lpqkG7PXs8%SxKZkIs@h8( zTpHW7qcJID7>(|4hzBv_UkIM2L9TdxTm22JRQ0Z_+@YDQtjQW;7Z{O48L<=@cSo8Bp5mNRYLOFN3`*=ixZ8;Vv5~0 zqBw3*P`%v4c>LT-{6;cE88jk65Qx`~_404(qT`&DQnO5>lnSfb-23%r9ju1xlI&qS zQDL`FKaojDRp6xhQ>l)LI#*Hp;=`0*;5m~*G&ZK&1>$LZBVU*620=EHl zr(t*5f^MQffrn_Lrg|Mv7o_t1OE_i_521dAJr8~-l#){8G^-#r%{Y7G+GnBIS5CMi zSy4bft+Z7W!t!zsl%+Q@Rz5?e7P-3t`Hes8lWVQUW3*S%@N&_?0J%Z1d0kOF5im90 z2+5tf6e@jr+)Of1sYg~UNyDURkla+u0u0LNvktlKVHv!=6N=95 znQ*Xf#gWO7hdOq|--pJn_za)oljyQGki?9L8M+p@*rLANbs()gtAN=%NYvvay#5t+ zwj$lw!o_J1Ebn(C`+f8~z={00xC66()6n2Z{VVg4rdKoMnoG4mJ|(}_jjVNiN1=*G zzO_XVjgatYdvH}luXJAM!)^nO_IGnOd^LjW-`_{r3EAQ*r6#=`$9Lu^o(jF}I$XXM zT2)#pcEG2BBEIK0RC*0+oi?k)^8)sDNat2eOI9s|)8Cx%mE)+fqu_Sj?M93(o`&8k zAfkb1kn;DCnlfwS2x;9jI@UG@W6~+TLm;fKJQkcs_9<0 zHrf-C@}?`^O35FHG>wM={o-TdCdhi$yfJ57k0v~~$;CMvmpRBdxfv?2-%Rk43b_~Q z|Gk)P5(YM#HB`!IGpuTgKO6Q{R=KcX*`Avy@h$LhX0c$(YH@hPPk*!MVkP;&I6^tW zwWLeYar*9uD@hJ_DIxW980s;oZIlupEHr7T4$)?!ACDfhB;8*Pe32I#90rnxP$MW|M9E_62cp$9rLKcY22(S(Oj6$43+cQz#hiGrAxW~!!uH-U zBaZ6;Nt4QLnxa^kd9wV*(Ad2?#$`ua@{8Z{A|sKL9~x7l%63a#=W>QjhoymHUJSf< zOIAd~`t5-i8KB%!gywKVZuukLE)#g&PH1TIU?uxj@IC1AX!Cg?5jC&k)glIz*+5H} zw(6CRwJ1fy4UiJ8Ad&E3ilLPO<#_*VEKvJN1#=S6_F1sMq^^)Ba&YuR6+t5+MJ*5P#`u z=)LPUnN7L^_f8>3;~WqeWmYZOCCKzdGw@zzf zRRbC9*2mx5qo4Q~f0!tPP((OHCop;pu(Ua8AE279ZOt$(y*e)|dmEWi z-ycJBsrvf3$KQ#K!4q1BI_NtCn(A9jh<5Ebx~+9E$jZ$a8B6WG=chJdlqGGcJt?N0 zZ-Q)^r=)r_m$TS@e)_6Q4|Udfx^MoL=e0zoiJ7J3yKcFZmRUsDxuTs1W||Ubga^qo zOlh`Usg-p_9f*@cm2j|a`T28gU_N`gOl69iW3H5T15bfwU+87wdL0s3)CPS#{AOuhZs3w~c{hU$T+s~-% zZz{K-=2xpw_cmbPB;1RID4vn|7UF%xjHkaBEp<7FVpXBhG9eWum25v2XZeA9)hyXe z3xPJ2zC`#aZ54qCO^ooAwusci#WmZN&0PhQMt|wU;+gC(2+emN`FRXw=3E>pc0sOP zg#6l8UmzXw#0FEey1rSeQZ|A7t=Oyy9Ip-&Dy}?4)u&PfTzV z@}ipeK#kDO;yBBO#2xpfu#)u&#&fOLY?F6i6ke|uc=H!TpF7_R>E8#qk`j9`1>YYT zC0&%GuW6!YxiW(FB)QpAM)1f~UK96pJ2bkz4PEAfTlsaYT(H)@j&aTz0;+FVCD_-K zA_!2P+)!_HUq}j-dhd`I;Lz{?l?eP7X+jpNBD9*(jL1YVJUdAzIfZSpyI!2{T+(lz z+l>sIu|vLIsX7iVGEwMu6o@UBbzY4K^|2TKn!Juxo*~T=lK^Ikuf5QTSTtH+##u{4 zxKKs16(uB+8P%~Di({c~?0_wPl}i)Watwju!n!k|kd&Sbwt!ZlLUVCbxf{*h`s=&N zLy7gWVu(~_jtG_$?gd8Yh1Tr`OHc_DmeS}BzDcO_1(W9yNI{l$=&cYNe*%zjiwmV8 zl!31gOXx-xpCyQQxCWLKuP0r>eaBxZS2|6%6Jy@+hY)%ihS+wRfibQNq+Te>$G2PA}QH7SiM4{C4zMF}3&5XDiN&r}*S)xq?03aD}!>yJB^*tClt09$R+exFk9{}J# z{)_4PSCb(9=6RY;bv|yjCOG+TN^fSyfAXzHb0CO+{TDu^!V0L}6Z-?$_LLT1Vc7Y% z5`e%)2~Sb;p&m)_qnVr!hi(_8#h^#_s~?;i3(8AmoA{S(1UVR$D@S-m)+f;KV0d_8_TI<)^k6Rs$3PC}~1HTJ>v{HZ7k%h)1%z|P46s%zY6dQFute9HOzOnMQ!I0y< zGU|astzu*$C_1f#KNdyDOucQ<4+TRk-J2Q4_#CNJM|Khur$4IX2LK#E+5QI|nGW}Q z=`6@54wYzQ|+h_Cr&{z-1MP{3)OxELzZ(TBjY&X_~TS>8sf**9)QNQ%ljz zpkt?D-_m6l)#O~Xct6-jMhZ-7Z%&ZVHhygL&k(Yt%HX|(<>jUH0XSV_wH9>nQaL@dTQ+n;@)N0+X5JRa)8ln}|=Vzgm5p#t$ zE!nLS*9j;~;guQc^&0U0-2`>`vXQFd!!;Kjp)yE;iQdoh*X47qi{%N&en31O&Nk}l zU)g;__7*W`h-t!Fy$4F+CKxJtSss=nrr*=^59Z=uNap-2vNMzPSDy7xNX|8w$Ww_s zcCyC=w=fb0Yi<6X87S&_>4+^3gkObv^8;V8JDR2lmps*9x=W)uU%E6uI`%+B4%vhL zj%q}rwN7QXnOUqxf&PO3n}k~-UDdA4F~dIHP=9$3`GS2TP4I$k)LndWrzE9`T7L7C zuw(QE@}qvq-ITmtsp>uBm9d{hX|VuddVuW#nxr4)-W2q7A7Gol>{+;&y$@J3Y-iSQ z(b9$Wh+_{)J;js*B-|X_(2Op>Q|-9ymcBkYyBUhn+Q!w>-ekOl$J;-!6-<5b5@5bt+~1Q0Cu4N zy!zwICn-2klQLaaA2EYDI~RZwa_pmYq9=ZdL2q!S6zl`+=coZyT^V%rLJQWFFmVm; zF|pufIGrsSXk2r_;ZoGEQ&$AW;4pOj=Fq171!KD>Dgh2=?sjMl3ytQT>UN#qEBeKw zs0Ch}13f7Rdq!pe)2ObeoGv7bg%!r4c&Nj+%#vB+qgPgEuTb@(avJkkA9{If?zy=r zDk|&vkmnFKd1>xSQSOD&I|gNX&l)}>qx;>X-MnuIz7Gd!TTM!fq(T&cJiQp|jRs19 z8Mpp5TG^5y4~Bj%wIuCco6)9lV@pcorpJYoW(YZvtBpP%b?FGgz*f2WxPQ(Kg3Hd9 zfwc@%N&JGu$>UG+Jaf+F*JhhW$LX<&#+l=q#b%qZig+uVgQ;=mB#bpxNKiE!-V<|I zJybW0-~q9XoBg2Gq0Uz0C3asT4 zgmX&x7&ap*B+PCc3C`}q{_5mkd$(y^5XUI^qR(%T?YS)DSc@p#2P6vn8$On(3j3gm z>c%(F-^7?d)R6>#Cc|-oO=F%x*A$eLGN=`dbvLPEua4x@#`GhCa#7Xx?hc7WZW>cx1lsQFZ0(3jp%)Vofb>&VlPxUxA$H<8aap4IoIRVlV9eG z*iFezcATa??0@?0>BorE=<#EBzME-5U9a{TWdNnbY##1TLVK~$Uc+k(D!TF;$6?15=u#w8c+o&=!^U0mVO0S}!5@0no|G7L1d~cQDf~ zpr}eYps=81+irkJ_NI~(M=m6|BSow#t4l18KPxx}Wl6`GTvrB7OOMvlDKHez0n~uY?R?{gZl`oB&<9{FFvN|0{ z9>iIMqb(C>gLVgC)NKFCrjj!2czja(dSQ0{^3$VKfA#z0*ik{{a>ewz?Dd@ue#3Y+p z4|5)T$uOxWuO-Xz3?m1 zD{9+myUB5>Q_t6*CH#2N_*RH*3kwzZATPn-Q1QJMrjDq)Z6I5qfyUs2qWxF}g}ICR z(fv9x=!E#E7H_DvkjowD)iuZXpymm(y@EN-j!A{cZ>UQ{W<2dL9D&_5e)%2xApdBC zQ#?XTG%>?cBx%yDwcopRl=5zLS^ksn)1mk{#+Gb!!o2E4ga|5OUOu6j&K806^UfAw zOQ<%!*I&1eCe4>7UvEDe#CcZ6k*W|*U~KvvKN3q5b$JXktZdNLZ#lp%_gHx0_E1^J>#jVPN?VRH`mT(O(j*-6-bef`llU zVYTB7zqeHnJ=h2Q0WwcY=j;=um`;kFjyAJMiLkecLI=%KCD$}ehP{%?W!sMtO0r9Q zCufEp6>a?LI>2XeoY@B`jJ=@m1OBfG+-FwzCfh8f2WuJtB8mU=-PI_)6TA^K;~Wuj zGZXPsvb&d88*mg`^x*J5fHlnbXwz^XAof|~Tj_5(i}5ji7;chwcaudTB{)CW0jJ{c zqt0rn{uYuPHmjxqXbQKHoLW+`02gAP@`l~QeC4~4X%{Q&3#JBU4a8Yy%N+_IJ$EzA zc=UlflHyEZV_@bXC1qwl5D3H!i+^k5rh4TEpJL3OaztqwAJ2ssGjj@}dlhyw9}|DP z1Zq%*dk>I9rNzH?YuX<57kfTdyJT~UB~SvpC(gVq)a{B0cW?`dK*Y6 zIqBbVo(;FIRM&pw`SR0g6FWKJ=nzpL(C&P?Y0E$IFfag1sv!HggIaEPVNGR8)Mu@YsA+*@E)*9w+rzHvbB>-#6tNt)M z)-=HNrtu;9g#<(9RKlml}`hCWd zuuqA3(`Pc&HoDQ)01iijC5J*noKNcMX-X^I2blcNm+pU8g40+t#stBaX{#U5LEYGk z`|5{Xxb4vGZaU^X=rTctIDjE8Yvehj`XM8qyFW!6D^yQE1=(5Z{mj;tXlg1&F?uXj zd6&!)T9(SzFqqGvQ$DRxS518(NHpw*idIX5Qzj`!ds->OC9#cAsf6O0uVUl!YjGe_ z3%PdYTl7i$(04b~dFy~`9!l5LFEHo?u$(8Dn$2c7D$)d>w_&>LccyweyXr*E^9ay< z0*o5r3FT3WZr(@=&3SZvTS9H`Qi;!PgWm3I7WgTA+Dz1(*HR_!t$qbHG$m}t>h_nh zB<-kso!Hy8y_WoigxrFN`5YbL#Qt6k`D@8q)~_EaIZeWtG-X9dKTjU5HwMPjoLyYV zM$1({nd7lLCdD_jITI^9Jw`!epzfjrbYe-4$^m?vtF1+O=X3RwpRV!ZQ^m@o`gIZ( zqFA$3#ZItpWT)c_ui6e|#C3&!Pe1w#GHz4iqzExPyVhEt5CPK6Z6x}|VhP|~J-s96 zqhp0Q?7S8`KA$4n*kq8hfWoVu8Hr#rOum#rkL$VN`SP+@tztw%D&NHOFJk&nw9J?i z5xF5hui<4o*Y!giQi92N2?^ro>6c8KYm@T6#@~%49q%_`*xyX9Bd^qBTM>CEbho}- z0FPQ@G!Cp9>sH%3xMBJ5+lZY6*2YhVA7ulKh`T)IMUT8L`kW?O)x{QdMzvW*f7L(P zmXI(o)Z+Gc$B67#|CBN9cffJ-CU`M^M@;4 zBst2>=!Inm<6HuqjrRfCuXcAijG;DCf~xW-tav#MZ}PS-x|5KNOT$vs)-@%!BpGLL9aoT~E&2W?9W zM_N}k5QBbG6W=nFJ3S|PB=bWBW=~vcI^CDyBO8SRg~Y>g_RBd^lXnf2yu!il?k{S3 z%AeQh$NGr||M09W)j7ZFj1KgRwCOne6B%@Z7{se4H_EaLF6GS0cyaP$*EN--vkubp z4Uyh4t@_D4eA{V`M{5n(p(UR)do~Sw9`b2L-MHM^;w+Rud#%bPcOSq=+`!F)(mBlB z$4;a4Nt@NyoyIEZi0lsY1;X%F{?sxq<;S7i#L%SDX62BO94~caQ8n2uXzUg;@1IFWc8$H7nE2qI5V|^#=JI9Ao5dEVybBN_;{k zQ0#2w#=O7b^D~^rO z;cG&1>SbD$AhuPUO~NW-S9bH#D8MC5VyBYtlf!e)ypoK}H}*iS;CtOKI}yTG0Ryv; zz;f{zcQE*oF}ZOcaC+_CUD;2}oWq$-g67?L6(=6jdX7FYUrT<(c4y&11J5%(nI8%; z^&_7go?TaLis8;AHx3Ac(w?`O7Rj|8gqTt6i+Rd})2^B4){66gy|^eFod4q?viqUP1AOhW2DcBNvBqiXr&|LmepY#2jEa4{eT7yYS#$*-+c1( zlwkI)Iw;6kE9AQ;%a)zC2V%@N<$1^TP9h;eLI!Ws&YK}{{0Zl^@AcWKj(7Gbo&>$5 z>=X`yaPAN)q+sa5A2O{=TDb2wWgfDcyz8MNnu|=4)5*wn_fl18RW+&+V4s9fD3WPi z|Kne`{7f<3CDq)6dwME8I3klYwGuTDd6mSdrhJoj*C-{wpjGGt7k=a3DQ5`b-s9$^ zMsSWxB)T$s9$U;eTHW1~H-h!IKK1Ta4`!^G8yX~jA;LjdO<@*j34a~JZg0aBGm6D5 z*3gJ?Oh2C!rwrc-YId#jIZ{s+H@`>ag1Nvnusz7N(5s}M;hx&29TpSZdzHIh{Et@s zmvzrO8e-jZJ7iU(l&*$~qRhO|D`-?B1M84iWF{WojFREXd2Sop8nHnQIM_&~Sv7GSp($wU1RYDPydp@SEP?+3VbELAvI*uk zB^Y(n9c$vQbW;y0g^YKOF+ym(8 zm#+-WAupR*avR<2%Q7ewjw+^ImDhrqv#2GOFAq!vFh9fan?f~@6Vqp>CqtVDan==_{STLB?&I2S*3Jl=?am!snVA3~JoHaSKFvX;u z435s$xtHhx3ZW)n4b|c-a}w9euwp{KhB_R0XG4A1zp(}w=1jQQFY3OWNRZFhfpSQ$)Vt}+xtFL9J#HBSRVSQLR#TH^DFtxP2{J8~hX;TTnzVI?6b%Co#s2g9<-aTWFX$dX zpY6)sAl2WS-lxi(PK^ivjk$TV`C?H%k2FyK;VGGapwg1_X>rGfU4+s%q>k$7_QlQ< zWy%m}xMo)L98yxzzlAiH_UQ_{K9klvL3-XzkBDljht0|mCM}!lier^scB+=)R`P8( z#~qFfoF3$9oIA_;^fwC4M-+7w{hQVia8wk_Oa>{LLS+wx&gfTruiM@fb#$Dl6{Du< zP~OsX9dY@$bm!Q3b&LFXJXJJG38hTmIz_uys#*95H(Zo?NPv#eePU&+gq!D$uc$|HFR$~R2|I?e=RI6?3 zOk*y4QM;b0_Bn&62Sd$g>&F|`mK6qwkM?>1<{g>7$8D~JFwSDDa(<)5#oRb4*rS!S zidSi3qX#I=>CMt5rK73ERI_fM%T+wz2RRVC)pkb7tI#(?BS-M1mT^7XYC0Jtk-J7LF%KPm`T-=kS za~F8g2u|(E;*f6Vv~FiUH@3xWfuw90-o9P+xLt_t`k5ET-J`tS`dIkaQ|CBjO$-8T z{bA^W1GTcn3TsGqO9_^LcC0pm&F93PKK52O+{_0iM0PEtx8GC1D|mkEH~P|?D z_0rMF)*hoiN4Ka*DLUT6cP z@3y4S(?E+;;QFl}sitEANt8^7q_O_iO{pS_w2y2?Cxbn0Edl&- zG}hKWR5)sqrbKkh%?&HrQFbxHot(U>5y+Z6D{#8GaY(xUhB&rov&*Dw_T1c;$*H15 zR$^&uNz2@VmCe1FJ|CgyHZ7SZ^cX%p6`fRwdYMpFYFle-Yh_gaj@eK}U6O0i&qwgk zN>(#_^38l|bi%{yCI%Fmi?`>OS=ZRLFA5>!ZbX|e)MFC3X@jTP zMp*l*LL0pdy!xtpZI>)kYOd%9`ET@ecPTQY?%JMlabq$rq)bX%B=a=H!3RnQo|USp zYbUR?8C(_dF-Oe~AAI%XaetX_SM6tYS(mB45ZclW{HH7Cd2TK@QWXUIwXy=?o!Xye z!b9`1_DWDC3u?05IK#F5OQ`4F`6~}oKY7G|Cw9^U)n(S)GSgtbPmuAS!%r9x_y+Tz7PT>HkQpudPDw z9*=o2$zaIGJ~|Ars`&AOMI$#o_?&S*KRTOa3A9t|US6Kit;6r~hj!j$R+U83PE$M^ zId91Lc&}2p>xxnq*n5VIeD&U6t#!|7i?a<`A3E-;i6CrLk$5ZzeV7+%pRj zO`^3H^NtLi0O~riEuW|DnbpMO|de zdr^E}jcx%^Zeez^D%0Rd^bUdAE1%ypxc4ChK>7zOmoX;)_8xx<>b11OJ#xepA{G!8+ z)_iEBa*d?~ipMA^RD`yC4c72X7toop3xs>pHIk-rP&H45HiB7x3lW{0n=BVf)Z>_R za_noN*3QgO;?n$3U-EwDwrWCe)_Q_rK9WPpFs`|4QcEt%oDUplOnbUmmYiiLhNogN zvq_T&0OyLSFuSX7tn}%b4;C)gKE4{I-G@Qgh(CdWk`Rc%j#d*~Kgn|;Fs-@TLp&W+$Hco;?Ps?QH?+d+b8Zq54u z?r`lT|EbRBLMj8nh@`Z6!h||nnATWIkd$o!$g3iiu9g#u23Yr7V~W$er7d{ zTj`gh1e)I!ozn`fIYrhX2LKnMc+DS-wGgX185Zo;>czh9Lqp2Wk=T6D!0~4O*Yo)L zRxzH+IRbsImxgXNWC2e}7~{*D9n3>|OkVsx?ycsWX%{66mUj6C-@%S)=y8k{dI%Wd zJq%Hz;*WXX(p?y`GDyCtYKL8@8v&Py;!?x%<<(KwQf}KNJ*+QOHxFe{Y{v{y!N=H` zI6onV_;awGnroN>W`-Rhl#oj+b_-58 zmEj<#8lsc84+wAQd@Je_$}bZkQ&;X10YCU$il^xgy-CJ^(NX2}L&prP7hQMMqoKe+ zOM0N282=M(Y;@3F&)uxL3zppWamTuA3rrq*F_d5yaXy}+s0&`>ZLAksBy`8<8G6=3 zkG9=0Z?Zi;BMQ}+=rRa_%oT@Ulv7%=uqp+9aqcXhJ|b{EsUcCwba1#K0)Fs4fy{cw z(cA+B_%CUxVz`fu4{7wH35tak%7{5uT<&ot5pFDmu3<;N%s^Enc|dM-RZ= zGgYLWdy;k?PsNK~GWV&x8)2PcV$y=85o1fN5ID(I4b7u1ZQXqX2fjKU3-uzyILQxv zJra4ZG`B!?d)@w}FunzZ`18@V1RDoC(I46qB~j6z8qE({B3hB+4eZ9R04nBXS%tM8 zLt4D98qNfaNp4gO(g&)P)-zG;BS~?wRe~t^v>JoEnTTAXwW!^}y3Icj4owy{BsXO$ zB>UCDx2W)fvG$@NRaH!19n&>JUOA`~4oCF2+iEDgyuqpxvlfob^pf#bng9Z7uS9aZhtNHQxwKqul zqhdSA9!j*Lx1tBq=y7Av58M&Qpdoh2g zTg&9SaTe^qVA}ox9nyWI9X4!8$ydJmXE1`!MF0D2se0?B4 zAQseZfJQ4Z&aCF0`o%r6#wS?h9{hi>_ug?$WqbcGGq$l0y~9YA(4+(mb(Dl&3`yuk zN0o^#I3dG2$c=f3XmckiA2 zlfAOnUfFx?z4qSg`~7_1U$u5&7+>cx2L?8#(o$vL{2R;tH(5#BIjZFb@zAhbI)D1P ztgJhie`>bHpDV^eKhxXxx}0l+ai54q~Az(-YkLI320N2TDXl*@ulpMSS^%G8}E zJ&P3bH0rT-Z~0{Z<;B5U1!j&tTYx$85Uc;KJA(D@F00o_h@I;)1FkZvNST@L|n!M-zP(7kYbfY!I0jN1?%{+ z40~4?YBlndjT))k^S}lAsQjYUmRFxbwHk`aip&P5!^0eCDpuhZl zV3>XxvFd4IHOZ&gnUNVo%Iq;JXqmg-rCZVZX>&Dow8vr1MbV5eY@1bFn*AET1a<|= zr;Dv!trsfkwm4j@)Z$P4QZsC(U(x0IRDr6$BpHvTl~kgZINMtwH8!19Y0E^)XZk9> zm4suIeMt6)53XhC4ja!6P&RS+p?%YR&_w3EvbB9Q0p2Hu*1PtsFzR$(UKDAGpy%yx zF6YbS;y`M=#%hgj$!i?ePawQywt#4JM)M+Bgb82^0sw^DwL6Ks?3>E;ww1})>2077 zZqq}s>{BeZ+9oC@)l*||B(~l8^2Z0RX;|NrJ00`aT4~I z*`7^8h_5cD!!=4n^Fr_TbYzj!Q_R=2h7Clxi}xI*v-6@Y2O8|l4AP^N}ik9 z3Ee)vnhY7YLFc>T{x6ZpQ0XkFnZS=G`a?ix9CnmUJeakZBz0tT_IRToIN1PepglC_j?{ zcW^*z-TcNPmpftBHK2NVd2yvImV9MInS*(URn;B&NF3Bt2iEcjKx`$Ns~?@(3lN%) zaKl^w>$zv88D}>SpEsNzpuKgY?Ra%rvz7#U+LaL&2mrG9nsDHDs6>`S06P| z#9!87wvB`}0Azv|O$ zR<}>47s-wViK57;`CL+AV)0hl&wE^8l!DM>zuaPEEyJg37O21)8kFaFA$S3er@T_& zGX_Z)-j6k#cb9f^$?V#yMUP-gya$p%KYn?0#qhu$C;#lx6QmM!Ky!nt(#o(EAy-3L zwKfY%>0W}>nh40F{svwN!vHUz+(&$Ey2O&+#N{QQDo2oPx69r=3rNiD5!@gSpmQM# zPhRHJ&t*>KprT+rb%f1f@uWN5u9_5MM6qKAhw zF~WrvU7ohYThNHN8GH8U-AC z@o}BWmWlX#-BV@X{kkKs_ClY}X*j6=wu2Y{qwda6T2h5QSB2&MH45YY_+U=8DDSl$ zoBJ4@yngr7Y7^g@RS@&F?XC9T5B%ZCy)OkhSKo)#zum}|7yRuQPyI*T&>w|41{MS^ z{@Eda>%2cZC#Y}#*-tfHxjx`g~7*P6D)+X*8eH9Bhyf>dv-TxXx92 zd1lq~R(Uq-a&MD!IH#b6s5v8n^MRE}kCBI?C})aqN&6gP+xC;rH8Z3&4>_jP2L<^0 zG4317^Fs=SRGeyL4F!Vh@Ei3GjhrGVjGIDMNr=rf5#up>ab;{CWV2;KMoS%B9*a#+ z@uG@IDuT>DmTTL~ea#XuKM{ccx)e0%skGhyiOBZPCApy@{|(R*63bc)Ss06pTn$_K zwHiqkWLM=!E-i+id6ll87ppZ!29Z{1JCS|>OdQhaG61JUu$I8Gzq=uJ<}Vu%|3aq! z&r9~jR!g(!{!S558z#Dd>l@3+-e0yd_wlRtnL{|*5ILEa2m`io8XOH9_FO%hMR0P_ zQ*Iyt?qI5kh-BR}{eMK>|EDDbR)kk+lpTjT{v^3Letlj*@85;7fP7R)pj zvi|&UpGbea;`@J&Kq6f)?VsPBWTJ!r_Wk4E%tbtZ2P<4V-e8*ZI_Ge=DRNzVPGkPU zKNM#ABS%Y@w9FiTW-23@)LNR>?cJN-?VZ|s|NB2b#?47FJf~Pv){&X~xxqGM6KXLv zQpT=y%Z*G(OD{x!tf8JcV*o(S_Py$KS7Qp8M^z-><@e}t3N7L%B1s&bJ6HbJ;sfn-&(3E-&PY*gKzx#EK3FbRNMSu5yo z#l)5r_rwSsN^lCXBu#T(ZIy*_KtcT~^gzUF{FipK38Z>m-aQ6S#Jf>HLRlJcN|Aftlt z>i7I%up3<8$0;PpuPybhOwMTsfOo6wy(>g`N>9+0sPZ=3DC;lVFBDS>t_ z{ddci)iCEZc=sH5+;`Di(SlrAek?zO^}YzMuMBDqk6`-x(8JEwmOgI~&&lZl1rs-O z^ZOhUmHnG%xJMNh&c9@t-TwXcaO#&Y#@|>PzN8)r9~20!-ZlHBcmGptB$F&hciPte zC9+=ItV>({DE}KvoY`S6-EM%d)KA1~zn20Th?u_fV>oTseh=RB>Pl=`&7noss!O7( z{sKr~1;_-b13Br9ej+)9nA*>qDmTaEGIrTxD(qE1O0ox=CCR0SRMxUR#{hy|?js{o zdctDJgJ4~E$x*m1!75)u-xB`XX5Q#~6T>B|MXz1i8Hi&l=izKsWxqTj1At#>Qe) zHIp1mE)}_io&Nf+13IaGKk3wAc7miH)c|W(Vrn-|w$?hMUujgxT;0Z8eQ!P7*M;~o z>(#UGBjk%$0|W+k~buNGJ-}SuJ1NH8yM1orTCI2E^Y#F(lNFKHshAfywk8fu_Yrf3z z07zY_F))8_e`BIU0^5jWWlCt`XbA6svi@ULw%kK8E%QeX6bL6G#3k?>OJ0v%S5$`7 z3-{@_u!fXei;_H?L}3QgQ}-_4)F0+|!5^V)j4&Mzmq^HxRf2?yceg;EIA1|PXFk2@ zPq-_{w(KDh&XA2%cZwD|7LU-m7ClYlI2+a1-nQ^&c*#vSJlRjK^>7EF&JvJ-g?q&W z7e0qtZX5Sbc_B4>P%X8~E4eq^S1H?uyVZo9b!raM|P^jH((AG$lkLkcrzZ1vSOAO58ri(M` z)dG`dZ4-m30#jF2eqOLhLB+b)m>a zKW#pLSX9`$GdEI{Ssr!FgZQNE?X$Ks_KlEm$LGBs_RDTFch5`L z8&CLt-!*k>toKO=@c0caOsso?#PuUtH^mr2y*=pgu9>l^}=8(e1 zdXf@nzTptrnJ?4Gf}CM5TS+ce8wYZR-+G3=DF~E1s{>7vwl*msmwF2A;RTJo7^^EH zMTQd#l|u+7Bqs7@8N2!^#S1Gu9p|(j;gq{be!~Mrw^E88KuCUM(e!p!^cX2LpW*A{ znSaVoRev;HQ8DsJl;T0ex*MkD zha$1c&?Svu>-yVzo5ZcCDDyZ7C*0(b6}&(*GLgGvz84V7v#YAYRqeF`RLKoSu+eLS zPZmwvFWg)7%Q^l0d468@1Gn6K^r*PnP!oLKW+>3#R)$!|Oc%nPJb-|St3THryrz<( z(s9I&L(A`%)JSG#&c-yHX*>12&uPSm6Po-oK+U3|A>$k_(RjBCyj_ki8uVsbjhUFA z{l^+;vCju;iBwtd_|p8?Cwd)@ro~w+Uh`s?tJi2BG32T$5j$%U-`)X6^Re=F3`dh9 z;gn^iR1T$A%*ep@96rIz)RtVX)miQ?p3+%4BxxD-7SZ;wr>JGQ?4124?9_~k9*`uR z(KBdS4Fxe%=>%?g8Bxj`r`|T~{&XQj`U; zCO+qqW&mG8L6b{>ZC|iJ@&5UvQj6y<^^(=3#PfnWq&bY0yC*KeHG{Kc8(__O4lQaT z4v9#2m(EYL+XV$PES3vES@iwXLq*>Oy*&rd?q3?0k|Nc#>6;E>_x>AznI!k5t2wdj z%W89|>N4#f@LV?>ZW{@KS)E2GAe4+(Qz`;_5?+>MmBnq)Zw4TA1FvV{`8t={225rNu^{yG>jA+UmbGB6MTMVYoR0d7#Iv zacxs8ZfD`K_8+$qCekn{{AUw?>CZp=;yPpT<*!&LEM zzSE5@3x&;46O{sm{d>n2wXXc-w)e*rmP)fNL-{%RgSJHJokb73Nn&daa6c7fxj3zh zckQxrI07E%3Nw-7|!aAjW zC4550I_PyRlJp`6MRP*>lYq2Ov%*V-M3~d)}&&k9-?%8*6v56n=E%ya&%fY5MWM#=2Z07CMS0k4a zBwFXd5V$Ul-Mg|-Qoh*aGIz4u^xb?@v9cALsgwEo)b4|d6DaW8H5Hq}@D*ml<@}Hiee^59BCN0nq z?4U}BV+%Jkg#q9UIqk}F`sFM(9rJlLM^IIu_iAdR_|P|&zH>ja-WtutmZI@)#XBJG zMKFuj95abf#$Ml%W%{NQbl!;^*C|$PadckKar08CSkVa&O*!H4Msvttzi;F_=68Rp zW%Akn_WhH4>?%=!QqslumkXjCNc&`E#ci`m^P3{+ydi}j ziEld@+5ralq@JgeBbMXO)x&n-Y2W|3>VHvh9Q!(79p_H7X$-MCV&VKlK@y^nn3!d$ zNFVk>+oeJdZnO_)j4U0=AL{-n+ut=AT%V9L&6LIh=Xca1ncffRFDE*c0{&LG@mp1H zneM+W>p1wj6n<&k=K0yKT=j3u=l|Y{(|3MF!`vu@$7-)Pv77BgXh9O{3JIP z03TbCe;*m(J9G3}uI;35@j>JWYO3Y%e&AK@5)_RdN00vemo%UMu+={<{_)F9LvH*= z`w+NI^P{b(O)BCjs#_7w53jj7l2~{k{e}0o=7`&Q{bfs;0AQDYqA{a9Q8_g2F=QTM z0kRw}AN0iiDr851JQ?aj*(Dff;3uUfhOfkWuZy!I;OJOK9eQLWmEL%tMc&~~(*&ar zso~NW`RD3CyXDWz;m=|4zun#8kn+0B@M?-pol4~oNw|$y^Mx%pUa3^z(0yHr{as(O zGuLb#KRVikw+*SEV`cO)^w<>7ytGv(xHUt1&_c1x#`7Q;!*9Uu9Ye_>0bhX1Mc+7I zpb+!gQNTb@?$P=lv3htj+%BqUMPB2-@m7xK30J9(fx+D8J@UPRhw4j+sa4ww-BD(d zr5|$Ep%MP7U@(JKF2trF9gs%1FMagn1S9+6HmIMbz;`CD48?yTPEW+U%VI$tr$U(W znSv5KHR3lsB{v*7hPQJB`-@HEbnwrq3TWRstI{ z>dDuljk~BUb|t%PN^v7uvRK!Awq6a%{XiqDZCs!X_F6+pX_rY4b0&l@k_Sh7FlfT2 z4>OJ4=2k#I7#6X(72&ETpd+?I^iw)Vx6UuLk-6^Pbk5taD5ls_gpxP}-V8^DeuU0l zxG1(~`Cv{0Y7_&_Q>1FhzC1fKC@}S6r#+^Yzr4pjuFNM|9f$W$c6?!%Nm+lew9f0E zONofmUKcUm$&Khvau%_dsXdKwB)F;9xnd&W;N88e7taI>M$cw~t{$kNNS18Ryy0U( zz|j(0FYojele*ojqFeJ8b1AY(R)r5S8d9J2&U=e1p~|0oW=V6}Omxi|5xfzj-ejcH z7cI^xWa=*y7K!>VzJ3*t*1179L3;3u>F>6WB;gRgpSSG>KLAY^)9WOrQlv6k6dIg! zcp|Ksj=8iGa&TlT=R;>UGeKF{yWyHsBAPO7>ds_<9|0{?k8!yx2eN+3R>hsf-}b!q zgY&d$ldwTyv_XKc1ZtjKo)uY>!IxRwqHu91_F2bn!`06izTt+eqVc3GiIV;L9vZ_E z6uh>}rPA!K^ugDH{A56Ba%J&gFL{gA$=WE+Y3pO?^E^s=Rze7&+NO;HwP=qGl_U-c zF(Vbqd0x+V3V2jQ^pdPJUao##$(9>h7Q>1KrNzXMnYbt znhOV$E@GV*Ll-KRGN25)C^5$8|x%NiFIH4%!i?r1yWE?|<4 z3Fy&c`a`EL4&Yr9oW7iTG;!+3wnbM@{(B-0Jj&_Gn1#sLj4GGF!b$Xl&l3|Cjo-gg zAW;(pp1*bvE6OJuDi`3m_HA|u;%gb6qabd#KKQuM-X<>QjcAPq!Qtl%(PxS~MyN23 zg67-g^v5BVv|AKjHQLiEWM6lEY7X8v!Uy_(Uvd)1i+tpC9%8jDVFD;r_E^vif|?9) zQxLHku%hL4v*V0pq4OeiS~Kfrk-}hSbRL)g9nB%n^3BRs>S6N2wvbyyJ%&d?{)dq@ zS<@S{6C*03*QN`co(|`d(~BUZxm5t^ypcHn#);b?o&%jr2OP++U~Cmz(;b!OHX}Yw zzFDiWC%PrQ_42zs>4Z)7$~OKGv&okQZiAmjKSWyHWzp7~i*R(g8}!gCo^GROt|VBB zz!a2uq?Ly9QRdf-L;(3iL;FQYq>9x2*_Fq+XP9;YQSRn&M5?!7nAM1GF)Yep?XFAS8szDxVDe+L8M1 z8;ehHrS#Z0mILqIMs1%1ZRLkk8#$L>czKH2pA=1oA-NPzik~G(3qRCKx=!9%0GEKf z#|A@2Ef=E}-Xwrvv3Kp>P~}LUTavc@2DD1V;;V>(ejwH!czxYaKK4f0<7Ri2&#@BT z!F0KG;S+o62Do5!)XkTVliG~TOZ9#o;7Tsc)W}2dw~3;@}9##*{?f}Z(1=Trb;p<6k}CeVmcU|q`=CG;4PnyJG=vQ@JJg~P@4I%oC_a29@*Ua`u^8S zL;ata-dwv((xZ3-$`yALjaaT&WOz1y`5h7t9;pqqO&fGAuysyrF#7@yl;k{NbVYj5 zsZR@se+r^VphQHxsb%EU@!fQM)#+?@XOYdOR=I=zi(a1}#SYF{-pkBsTc;(2*{8)V zZ70VUq47r&y+Bs&fV%A5=GMIjBjAN2ej6(bLcwKdI|JK3=tm%n4-dvrK0{Q#G#C$k zFve}mJyD2{Ut~H^tA$Fy<#vPcv6lM2^FG}6a{MvZtWD#sodVI&4u8jLlctT5pwTBy zpLbz-#<4FzRB0ISW2k-D!JKV%u%-9T#DwkH7r7hIB@Qp|aKKP8d}~9Oyya;w20@qO zDyiZVwZXEU#eG1Y0-giSiVblvr}FlBOFiW?tHah_BqnnYAYXj`ArqS-8P;i{za$8g zHJNAwh_t6*Q+lYh_7v)5xM5TyM{|zDQ-z-%q-UR`xI}RTdiqo$HgO1qX1xgXP3OPQm_p`S)IDrYzQC|Hp4EhOZjmGXa`Vg;Eus=&u$hzOkJA^ffj< z_)Yw;p<$&)m0H+27S(mv394)D`Y%~ZSVV_e2CXj_OWvQt2NyY6d`PDWaYGAwhOHLn z=f@R$Exzt-IHqCq38V_s{qQkLuE(uH8{(U>DbMBzm-^yUPFx01b&isz*;X-c6A{gi z;Jg}XzL=_p$f& zXGa{G!m5ZA4|R5T`4;C|I=G*@IJZ^rj$r*tUElDykHg%6JK;8=LrRKwv)n~w2Zk^? zOn^pO!L+mU=Q*bDt{dom?|({S{Of5spCHcfW|zTC35DDmrF@Y!Zhbjs5t+k82Dh7i zB^ewJ9!9baMnWRZx@2*1<-x5RoyTS3J4BSajqGLW8jq!_3zRVpv2lAHdvoMI_Un}sT%?Nf^UpY{`km3_n#Pv|)86Y!;*JyL=lTqek|PPOPWnxQco;kY*f^`Jm1J6W&&P@ zJ4nWLD36476PaY|Gb)uJR-c3}PbkwT(Pw-T>7&wBw1J~lwr&oYxPyBum?5A{%*5p$2cLI6je<>;YbnFso-?p!+3)ANqm!R5(2Ly9r*b7?%5@JcR9mcSB-9Ou0hAX0Rx?S82i4?xa@BAd%%lAQ*hcnL=nLOpii&+e z7p|l=9U#xE5JyvZ82*+Gr~>b-DsKj7#HJ$-@A72M>#6o-CP+y62NFM;r?v8+(i6(| zjU_xG>~x#Q?eWVX&SE!B65H?8ceLH8Q#-(Hzli z`B|$aQShuJKe8s*?s#X_kZ+kr1KrL%i8H^X*<4>ik80DJuVK<(O&ml`@?kP~-WmA` zypULto!@;oG0kfdH+_{$@Sz1_>B@vA!sB^gnKG)b!B2cRH48qe$7I`ywob*B^PumX zdNt;*pS*6}M?*l#6BCmdO6Bm?SMW+^m-g5pC4lkJ>5&v^W!e@h&P)VYq>tk|Vv3Xo z$2*xmpQM<(y7W37enKnYPOJt}m*J|^#&L&YQ%58Y5kTC7#6qzjOywFc*NM&fFtdZ1 zJa%C-GZTo%iFzrtGSC)_%g^YB3&TAWh0u`*p|D3v3|jgSEzkOs*=45C>6E9h+4*5)-6y4HLiC6s7L@+AJST;RV! zbB(;!g zk^gvHJU*E}5kro_)KR+Jr-hfSxDWUnmnDD;XH=N9%6Ij0BVYBBHCgc{_gZ3gbe|f2 zJ!!ryjmU$eT1hnj;HtT!f_&RM zW+JW(>XYgafi^zhiperDXcchJTT**hiLYqw^r^7XxPo-XZS!P>F>p_Mvn}oEv98;H zA^b*NJ~=HS@^%IRgLfmmpZ>QWFN&8%9-u}{D1mSG2aCYBQ5XCE^cB)gi5u+KPu@`j>KUFowp*1V!P?Q3VV ztod4Gb)Zm+Xi~~bRaP(vVFFR5Rc-c`tBr?dKGWn)i#Q=}uc0OOh@>KSpt1y2&ES)U z3hx|EWqt9QRo?yrQTGGlUO0WczfQ3ghv*dh;O(J>Oq)iH zLxEVFX$+RINx~psAHj@thm!h z4;owDV=LmAWr@G2M{It9zw=nmN_sr^897|UgS7}8>!Mp`L!7H+wP^_KrL{+U-uw`B z!r+lJ5MPsj!fvm-*9XI`wiIeFlbJgDCE4vXronpJjn{_yDu!D2Q@{u&)hNHxOHIwd ziO{NOdIpp3wG65IWBNpHa3l=+K7hf=0WG@V zjF{}3?DotYD$XP(z_(>fJx3;;t>%ScmOr=#t;h*S6Fl~1>u)#1k(X72bEvAmDVE(C)fUiG zzPVZIT?j#eZ7*ZkNLhzu4Zt^1003L3xgHpPS)c+E=(E-u;~D=Y9wVl@7Ocbb-PVqpDn$sxWH>_2k|c`JxdkC>Xu?=SEvP+b^vBje@JKN; zcoy$mI>OzLd|i7)aB=Wb_zjoAxA}-)az)G6A=N8fl+IsskWm`PRZM7FB2)TtP+_qj zK|?hT%dw$+le#7JnxY;33VIEY8MnC8yX#9mh_<&(erX?Wly!rNc(}U4oXMR8T9^Tu zGrnpigpvwKo?d(LrC(3{dP$W5z(8YznyZI2F^7cW;%f>s6GBQAy>u#Iyqia1nIdiz zn@4teceNx%CBp6oxQw2K_E*0EnJdFFwo$-`4+77SW z>*Z&Lm6kAz0eBO?16B(^Y+KETAFf1sk5rD;g1Sq<#TwQ+7G>Q~ib?{xpT>lu`Vv2hp-?dE7a6~lS0$Ad=G!B?#?Mxp8!@)J*Snil8JX-LrR=PUQ zG$a~1*i+V9OVy{##V(=5%LN6r4f2{GohR*qtrp%#f4ump!e?D&=lu9f0EPR*4 zPHj?5S1WR(i4>L+!+k`SW32f^+K1FY*7Ixox1OK~e!+DGCvASFpX2`i8KlU-d7yo9 zMO1$d1?r}aV5(y(ZN-m{{EVFf8dUsV=*WV*qOw&xrH6q-&}mZP{px{hGTy!ZL7|*XIZu!8bgEGyu%{shut-Au~Xr!{RTLhWgLiMY?m|IAG3-2%yJC|bMe?b?#04Q+D>hK@!^l{KR zKcXcuvXmDnX!V!`*B5x9)=%CLwRjh_rCLH)^TyHu_GfQDYU&e+rR^dhl|iGkj@A{# zP8-YV3R+RPj`I+Kn2oQvqNJ(-%113|b#`QVXXepV$GZ>DGQ2ZKyL*$Yet{>O8lnm< z20LX!vP;%P(R^(V6BPgOJuQyuD4M71R;$nh4llP@tTd^cTQ4FNkiB(0*huMy7z0)`ui*GOL&gY$ z>P;m`^u8J@R%#U4obP|ntL^xBxaqhu!{Ga#5x1MZGPX&njO6_}`R*@_J8j2!NYV}mpVU4Y52IyE{YPK) zJ729o?_j2wZUTgaD)9>>+%L4 zw>V|HT`lUUSpGm0U&|R$geXeEVPXzZQwUh24f{$G z*8m$;XHnP3epq&K^@Pv64d|V8OW|~Zb^B3pT*H3F!~16;C8-&s9fR-Fie(f#5zK?) zFpL$QEey43v9;zzsQ48&cRueh_M_Uhf2Owr-Ykt#f8Nrgks?*y##h1H&skwy*?^X{?gUf~3r%0Sez~IsA^BPGIQK{+tFq>b_JnqzgFAYYl{q(^ zm#ig3k0TIEwj3{jB_RZN>ja3OO*;t*u?6^Dj$s057KFdw?A2I9m3d{B5{jEe3k%5P zd;+#BG5@K$f-Id(@;8f(zi=$B`2mzHx3Ez_JPqm)ZC3AXuk_bW|RL zCN&O+B;4#6V739%FDU0k-n8n{1YL?9V;dlUNy&qG5#7y}DtePBYQf`Tw`D}h;J2aB z>lO=&l71=j`mbjHJSK69#>1Q+l2#P%J9~A*S0MQ6wI$VQrSX2><~Jv4Bg-E$vfm{| zh-%hL92oxu>?z^>%X-rwniUa)p)4!hm!QQ9fG7U=Rk=XBCZ}}TKKHBi*9fPa6zwH! zBuHC2;p(bi+o7WTg5=ztHX+PTU9#7|7|9B30EcqE;Zx=i)L*}^{aq#V{NCS`ia#37 z{+g!!gv5heY`|ylOJ~BU z+57+WUFsiJ@}B#~VwSO2b|@6?1XprS%NIN$=TnAI`soRXnSh1);5-6^l^<&P&bMs^ zA3UdIKd8(uNrWU2vUNN82XG~*N$%-KaSrlj`1*oglMdsI4q{o+vu6=9%i9G_()=3b zABfn2>UiHTWqThj0kUgll=AfXEJZHt7u-4jFWHw6diK%z;cERKOw;p^LdvY4dooy| zP#^L>4}v#9eVMZC@!3l#fzZIrUyPTU!Eu4{tO6@Cn3!6*6tEF_)i&p@`!529QHgwz z+@@tI7lPr51dDe3s(}R@ffgEe1X*ICoFJ%i%jbrv&AoE#%?535AI~tp8z0O{*N1K} zv(ks@%BX1y2~pJ`i4yI@(iXb&qk=S*u}*sJIg7iR`FX|Oa_R}P9Oct~AN*_hOtf%) z)qG2W3st}>G%PD{gRd?~UO@wyNG(W@Qt7ZiACjj~O?;9d7F!JNu~h}KyO(BxE|f|r z4yDwPq^a4Z-^KG|I%32)IS`6Q-`CLR?pp^IGqk!eL`+NpK{QfbbF`IdKwlVD6F#;b zV56&2S=_HhCa2>+GZQs)zOC-+Ne2fI^g!g8>^pM_5EL0;4Rd}z=3ISud2cxb_V5F4 ztJ4w&)2EfyyA~Q`msk+Wm^o;RS7-f1GNCbbRVuECNUXs@{=r9uE==i$ly-7sRx5~v z{Jr|p>h~snW$TwE{3b^HBV)^U^9oP=RE_wm?cK<$J$j&VP+y>*aD>^6#)#=pjUh12 z$SsX^IP5OjyQ+JQqGyrFfO5y_CF@w6FHHKD0dWTO(?8rH91+9ruTS_`d!S$fod1&ca{lRi&feoNJ)oFDr!34u z0;tVx8+!)x5_P9eMGavIGcUTWJ7*-ly6smpF^tZv+y-#rG30pr4tu3sLh)VN=k?eF zmC-*mtSyy#w*2=DYbM#o{Y|#XckN|iO7GLjS7*H$O6etFcnvc+IC?^{<9JufX<>mP zKhP6rGKids!DM1k_?R@jL95^q|NZx0nv*wFVk@9+jzFbR0jj!jE10UX+hfPfm4k+P z?}*bsoPIbk++e45hIcmU9AyB)RZc+BC`eRC`X`VabCQLmC47gY8KZzWB^pT%&ngD5 z$kGn|G^Z%mT4vzsQk2A29B${~X1esQ)Hwt@T;oTKZOSY%Rbu9b7`JG-7ON8l9due> zO8q`S2f#1g*GFN~0~Q;N!kEZlLdiS(C>7C%H{r=r#=Ee53(E2J_DLrs_ER^aXVYK5 zMGqiCnB-(ft?4|D5VhGew;Y1kz~h~Jt?ejjRkgkmkeb!~!Tt40QDSABBV}-mNIHoh zQyz~j5A|D1Oc^x&vnulyc8goCdTdK(zyPTESP5|1?gZ``)N*V zH0dQc>BFXxo?%%L4%>NNY=9z|`^aGmw2#IH0;;+lSA&;_hol$$7=zM>8VDtILj=Rh?CCVCRMb<;fdwvZ*J2w6?1sp zcm_>$gC}(as4~7`ezce>OX)TD1%PN{P+C{98@Kvx`-muj*MStpjH6TSRa?=geZ!W1 zYpBJzB~Bjwu&|jz$~s1(pq%}A$2b!#fi69B-PF}a&A2L|R^A)5b1h{jdy2dI#f|z# ztLjTb$CfF+HtCq$3+Qd*I}7q)g%J0?X}JTQim#t} z`68X<^7g|>yseZ7smHT!0c5-58;&oTtGbjIIw?A_TWz;1%b-^w9Ia__QVO?Td_BXn zyk?}M1|KNb?NtOL-~np^V{;=_CWRVatr2E9m(S!(#8Q)Y6ETbwyk`H20BM})hh@!Et zu5Kb=$j4qfLd|7oP-jBuSz>V3MbdaK%1xy`Wh5gI2=Z;$kFB4Z&dv3x8S_s!EcHF~ zR@t8(9t;6DY#f??I@^Rd!rm>HntzsVlg>40CW2@#LFUKX3i$;3{VM1hn*+~*8^52k z1liRxmEqxf%4I6LZK5Ni{ApXBIM%fq+0>y_u;XI1eg?SVv6BKwZNih4@=!AWS?h92 zLCtgLM1bQY!CCy1k1nX4h%cU>qpoUgI7gpNI`bySK3b8CntZ2eLoJX1x05AYoRf_BfXgv$ ztD8xKwd}qVk1&Kyr5=SZZX@c-gjbG&vR;FH#WDc{{rW>%2CQpdx8^nX(UtOJ-IblA zKhAGtKQV7n;yM} z>BLSti8@POb}u4^ZKFFiK8-DjhgA0*AOcC*VVX7zE&mmABQM8jDaJ}*7F7@JMvUM) z!ZCH@oVvM)ZWG1AVjgnT)gRgiQTsB7WAVDB)ZR%_0?WTC=L|k4HD(=uY??Hl9(xFH zWnnUuE%gL^dc2IgdbZaPjvvWCvq+gOv4(bR16y1FmUcB(no0Tphndd*EsMNY9lvG? zZ{qi!wkqCk+*Z?GP};oYBtD3I^3~O`$BaIc@Q-qeR?66abE0_c>$qbN0=%C%C;ZC1 z&wuJ=CWNrmc<1Ub#vFfPEV16I@trXJ>Cckn|BgK&JnTl;!;o{Bk!>gbP%XtY0|>Ul zz9_a)(VVXqDOvhktpcqu`1M^iF*J@HNH2y!jAs!ewcN-aOQAROuN7)maE^{+wW1Dfu`HNH~?r2E!;*rp**_fC;sxBAwaW7ckXsz95v<;a$3LiK2Zp?+QCKE#j;dP6-Ml(4Ya*`h z@gfSmH!g}3n#Jys(qb@iRVmB&V(P~DnEUQ?`*9Yf<%)nWS7GAG0VmnmP1;9zXrkVH z6_Aya+gFxx{)+6QR~O1pw#&G1w-=d7EdhPG-vV-HLK)&%zIaPetS0~{kUI9z)p*u7 zrn}=F%Q2Vx?`dCVw-ub8=Jgg9CX#LI`7_wrJ_a(zea*druRgJ;%5;oX&4%Ii6R#1e zw9B0M&b)qUrB9x=DpTQ~x_*dzKkz>p;QvpJ>t78(|D(?zliPo05zhCd4t!VqIoj;O z^h=z;OO7%qV!(pxrlw}tj^$e3vK0aGr?1tj_<2h`M5}b2W;lx?^PZJHXq4unT$1>{g8GrwYSrtbnJJzTQBItdh!xPMfeyp9zBv+ zfOD!Gwr9Se&>PA(+xb8BtcGbIDQgSbmP=(f_w zi~QFfmBbUrbFsZ6nJX22GuAF#HzN8M?`TBCR+wgIp97*tiu*iO(Yee_DN63lWb%7v z-yLVP9(=SSkE_=S7v4E=Jn6=IoD&3t#A#*lJxfowUO(d@Fw(D^`>s`YXc3U9#Bp(tU=eUPV9!0Z*LqoM)by zdB5j*-t&Iv`p$Jt{@K}kt-aR0?zQ&XYp?she?RNVhPUMX#xeAU5l1QkO`p*7@A-6m zC2;_DPA~DaZox}pc5mhbT=HfxT+cFxLUu;|q~!d7jJ+Qj93@$Ii@eaD_k zKlfI_&gVQRq~$aMeM!jE8E4)b9C#2?mf6H)U@Ln~sc8Zq`_pSB#(+%kFgf|Gqj@Ih zyzgRY$YA#ma77}r$PCr^&NOQF44+tJIcH1vsQ>c)bjbM`~#EXM$d#ch|Q0;5-o04NaHo=<`B8g4+=fahpP#w3y zg9x|9%DEDetgL&_8tOjCC%oD;3Oh6D_wem@Xf!?Ay=mpB#%jQwl3E3!1lja-n$LJ! zV~CE!%w14x;TeF1TZ62Pz|w#3M7&rgpcrr+a%r#n@uC9B<9f?8#7RDc1|HNu<*uvZg41 zMd=mCs7{oce&o=Ax@=)M{n^QmA&_8bP|;X9$j@`+{Kg~w$mkN)wwB3^Mzgwc)Y1FP zPB2q?o#7`LZ%g@4-45FPEM$dB&!oC&PKns@2ehR9k>!5A)2;jSK^}Sj*nvxd^ZEno z*`6zj*m-b4?9*#$h5XqA7|hAhm*SP8-Mf8k35W`S^}_oZrg7`O0-0jHM58qGNPtoo z9=6`A=Obk0(ghK5Z0ZZ-eP8AGJX^w=q@Ua}i(lt#Haq>}op-ONGWK^)z)t@#dvJp+ z2sdrbVG*w`_Yl7w+w}f56hrEDJ%Kl;^OVJnn^6H0M~Rz+%E4KTa859YtG_`-pZUHb z7$1sZYuohN1s@QuRnYnwKX*mQ1O~59Dl+Qt({$~9$x4Jqb?_KxAsJ*{a)l%tiWbxB^`VPDM^{uIW`~Q}FCNgZ&3ZOZ|()gcNB@*JVi3 z;S^vpCbM-ENdp3MwiEcet#OV|)jxQOrXH z?^(*I6KQ&9;++NRDKwgqOxar$K$;lIrUgwhzVIE9*FpTUMy197-~$3uQxC2v>%B!) zsL%GguG87H)(JDa0=I_pUW>(yzYuT(nB&Ko*D_~#Xd>O`*LyGm^J=fdt5VLV%nKPG64 z2a4U_pze1%oks-tILI9nXXqRpb0OZlpo~as36dXxZSTY3YhrBS$p*K_+U~+p80+-a z0xKC}iI`zR36DX~N+l2&k~@ygGH;P|1m@qo2mNTE_5eH6->#O3&oKZhegG;Hh5R3` z7{xly-08Bwh&pr4aubZCQCt~M|4^^z8X%-)yP3gp@^Fz0^abKg`2kBC(+eBqYtMC} z2v$HXaC^HQQ%Il}Vdwcc&F8~M!zz>c0|K6E#^ps_^#|mG%7~uN8RY8f+3Iu}Yctwa z#qh0>#Atae6x%#Jf>D}M)ENY``@Hj5*?=@jUFAGVbW~!OY7TU2ZhtZB5w{b?^!IGH zIa<9*n*}M9QVeIWuqP?qZ3Z&$YkZTs3k&=v2QJSVu_k;j{Q(-~Q19+LmR1+ITokv{ zTv9+!K<3npT6%E@t1&1*Ep*#by-WrtrZsb7%y*67RO^^3rwKawJk1a4oy{5;@~ZyA z=S|*}K3c%r5t_yBbIT{wmaEJUwn>m2J!?c?jrNuN; z9b4p6^!>G!E_TsPdxBG15RgY=l=oriQo8(iAP>G>e_XrnR@efZ4A7xG?ti%fz4$)F z^s3B_ujJ7Oy1LEnq~B5q&Oy??y!}cTm|En$um(_=7Gk5%*+lkTZ^~PH?4#%*mv@un zT>*-&H0eQ zytmMe7}j>@>AUr-_GaYp436i^I#2q7Pz!Hs#g zrG*nSl7%5e7NQ-Mm*L{&)c{GqCY;Y`-VnEXqa1=bAZPeC^!LqcX=5^w-a2|}=+lJgp#L+jKBh@|xL zwIdqsFpJ4;g*nTegkYyHe3!XvXq8*K?^nvo@M&J?3TC_S<867BeXu(^luv$2mF}3X ziuRDUr~SKbLNd->P}ksvj4z#3TN! zRIqQvXpsckN;juIR2*qgr038WMRY2Sz%Qos60(F(nsGr^;s+gX#NKaEgf9dld!*BV z9b6-{FA;x@@`_oa{(fF(lDF|TZKDScvA^$W$J)!8AQa5$(+41k`W@#z&W_vqGexi$ zXSPhO_ksLZ#ecG+6a=bN>AZ#RZbz*lt?oA!d&_E(3z&H4ZAziQ#BKQlJUqReZ694# z(IzvI?RJ#sSNImT5N!dv6e7m%>6rlO=wY-P&K3?}$x^L(#Z~JY4Ho7nXT>B&o3GPH+~NuvS*4H(Jj_`gm@)T3@CQ= zxh|v-dy>A$3p0Gy2P=Ql(R778FU;<_o~JfL7f){YW92i1)PW(>A+N8?Nyl*+>VihH zCe5j>gi>kCUOEf9O_!FsGsZ01Gju}LN4RC($rS|Ma3QKRA`QT!RS-HY>~RnA?2fbl z#)$vxd2YvQ6XYXD&rX*6c`R(!H>|^L@|S~7xqc~J)}4afNqJ98K7N(8H&^q(b`=qJJd4pmcb+*?fWfD*kP!P~B{Fg=6P{XF5@_ z`taL(eUQ%ZI9h!49Fyh`%&|%%T_a@OUXq_JeM7I1KarnL$*oWSQ2Nj(85X3NFk9W` z2KP5*ZEpvijXIB#_B>Mk9G5afNOR>xwi_x*|WV}bN?BrI;1Kctsd(QDFf-;!eMVW9E2D3NZN8wRoCuMRc&j?TD61pw;2{3=0NQN2 zJ0oV!DkRU`HZajqbU8Sy)jsjrqxlC7uFvMK)PWM!GrC#Uy+cZ)dZqFw3o^&kOx5F- zI!R;xrc-sxllgZmaM$$>-&opUXWhdZuW1#=+HKm`3AT5XJ(Ii8{g$+P#nB|_O0~|e z{QORsA`yc2!VT!`m2-8Kb9I7PKLhane(|_kSYYK?yRQ_JL~3oGJ32GjZs%4Ebm(i% z+I6O9^`M5>lVwg+?i26uN_+L}TgVV?*d^a~AEZ?~!fVve%nQ1CfR!4#=;i{~MOoc( zWB8wQ4wb$@pJhgMK^8xoL!pDUwdRXqKkxRJdX1AT%=0d#P-u@d_2=!|n95R6&=M%4#u&!v4}xY(g3+CvH+ZNEOe2e|V55kJ?y{~{CZQ_p9KeT?dY0OHJ_4h8_ zH`+wsn2%{IIhX}3jTm}d++oykDJ9c*;)h2i4vC338HKsDhg3gp{F$B=)<74h(J5iZ zw^HS$%LMAe=W9aiEvLzYt(D~22n4Ff6t2a{kmUX|DM**TGi`WB^^c z3n|ij_czX$dnby1Wq~2MhE}52WWG}@?CgWp=GbHvC5IUC{eAYgCXDz_tmg&Vysv4Q zwE~i!@u2snzwo7Za>7B0cX`n3U0?VhS*g1O{>RrkJFq~T0^Cn|6xZMtZD~RUw8NW0 zRH=f%_=Au0@7Y>EPEbFyWh<}VfoP{kwNBty$UO!D9Wdp=WW<{2qw($IN{3Sm^9{+p z?28*za!mU0IJ7EZvD5*qp0Bxs{uiO{8q9SFSV!y*%Ce>K(^EBHyi1Y>eg3k_P(EOO z+~Gob-p5mC=jT)vJT~19B2B2&ytqvL=3-}%Eo=(iVP~Th$wRkTE1|{6ET5U+Un}1vQ1p*(cC| zz`;JYB<*81{`8FK^tjJ4&q+GdvtlqSVB=zy^y@ZZI$d|Cb8P+7G3w8r z5xEgcSD#yqr6~0q#HH<|W!x<-GVCwJvV}T>><)%{55R>&46AySTcB#5e3p}(X7(h;zD7&C(mmAvE7)ORes`0aBcel4iRzrREPTMQ;wO|Je zZJ4Ky{H#apZ$#=@`Wj_e>TOG>Joj9g|B&NZvEuKOsTje%#7)^kqb@wPI&^T*MnYJa zSmG2oV%uXNhXskaB&OYSXx&c#2tGBq3>nJ2R_kpi2MVS$$cf+O;Z5E>D{JmEX(krx zL9Ku_&FMvE-VnW;7%{EL+0)gadSps`yEBKRRGsM~No$|e%Gy!NqfSV&=(DV(lTx)1 zGnYKcU?O#TvBxi2eWvt-oy5U}q9^r%J_H?CFPL8OJ z3F^j#*hD>(KOHX?x%p~(^NDlYIjcjvgi2qUv_gg__0&?REkdjg{bIo2Owh3hIZu9` z-$RitYS{$ZR!TSfym-cdj%1m;Ml-dgR}LrbtxV!&vq@sfW(#o_(q6$(bLX z?*j~O4u^{>nNr>*iadQWHef{4+K;xk1;yh9` zJnnUfB}z<^P|BXS?w#?gUyqoZZJE z(I-4x$}p6mgjZn-oSVT)Nll9nRmn+MkD0l5Gp^y-Kz9*6%N%bd1@Q}hN-TZt79`NXU0u=^jjGx_)qWgd&hUJov>l-!av0gDavvIxgY zd#5@lCQHiWfp9r$5N+0}`^^u<9r^UG=HW@U8hjw8dxA9zlYF95zVc!9PPtEKkgim5 zykMhTL3C<4CsAWloqiGk0MfGoKt>S@I#}@N$zM6*Ey?%vNr->rBA2Wn+>bwLmsX(=I1==|DEcSW{swa+KgtL|n!za@(e1}{W zXWsKdIkJDuH|))pNyQ6$yA{(;R@_6F%uM>mLk+aJ&0)t$FE}ku2!oR5$q{~wnU5-s zn$SV74NFm*{ns}j^dbJDFwZMXnOA2`_@H3xEOJ!57}R#@%QpVgT8$@A25QfRyGIVoJ+yXP0&o(;O$X-nr5;zN>V(pP!A zW+5!3g`?MYNMB~K_&0-~r3KzyNSKr~S=V!3b=KSXW=f@%BTW)#sV4f#8Ab6y7MqOg zO`34Mi(lU@y^Towo=(rrzoo9CAak|QQ-AOj#+B0H71n6xpF{~XN(1u($JD$cKMgay zc>sTwi>fECdK&x?)%5}+{;kW9gMq>*x!warIPq8ZtlgL?eKTi)%+nnj? z@UFNJwHP>)ncQ8R&MmcbqYhZ9?+@>8F^_24zy?yK$v1gagdlqM7ryW~^A-NyYbrxS z7|9$^u+e=*DCd`wa%^bjW=CQ_*qw5&ljGq|6ndl4)=Uf?!GHMO`}C z_H$Os%kU)XfMa&SO%G=Z$=TCe&-ng(Pej$xru7PZcWY*?C8=oDiZ|3~CB+Sjpnc*S z8Tu$M=Uwsl5IFdQXb4wf@A~#`Fv`I?(eo zkDKtqX7dowS+#mNX%k`6pf}+`!KP5u+m1--Cg^S-Z+VsRh3^wt$t?atQ9_z^K8;iH zseGxE&<91wbhce?JnZY?UW7NP@(5H<))VJ8K8!w;blgEKR1J=~{hq^B0!?5`Pq#i1CC(ZlR8dI-ExKv9R(zE3wV*^U3n-Rd4|7`OGB3c*>sPJ%di|2#gkF zxOkxajjU5PX_>d8C~4(l-)HCloKoH&i&?t&=NIaq=l7kZ?*+f`HQFffFg}lc;fpj7 zKhy!gbWw);h3~T!FUE3U^d>xy!>sLXU@n!tv;2Jf`Poeokr1TxBsE&S5+dN@3JMS!uHrXUhd_&4?OnwU-#8u5ye6$iZekL==V3fT zSAhJgOe1?Ekf?lG)Bd}(A0qbR{X+IzX<{cWq@|?$W4-XhG%{^Uxx25@6CG{${j(D} zt;4qAjN@c7fdu4cbW5KU*8-z+Rv2aY7_ZR2O-hAs5ajG-@1|&SyueL&fRlneCC*jJ z%O@w0Zqv${u#)Ea%4>PmL-p_f(Y;` z=^hrTs|13Z=K+9p8L2i9SdpyTQM2$U!|&n`!oWVQ!%uDdvkQXFjmaKw6S|5B^ydDa zm!D)xmj-17V{mGOv7Lp$^Ic%S3>agrYaHbMgglL=U{a=VQygVS(1P)JTOLOuFO zLfX!tzWqrL*Lxm~U=s`!EfX<=qi%qF)rX`zDu?6%g9GS0=+&OM%nU#Gfpi91I?=FC z8t+_XJ-kq*6p*6A(wGV>zFBaWJubX>6YH+ssonKBWF6~T_vsWMhvT<@*1n18q z8WlQOmh4Dx)gN1SUKLt>Vadu7F&rkcPMM+sCIf1Lkj|m9RH4IX+8VBkr|TQOLVaLk z2mmJ=3F}@kgvfwGCy?V4NRX%=`IY}qe;)S#(Ul!rxZ%#yDUEk_$DZsRC0{K0+JUwa~FZkHF_kCtkvObpywFNO{JWPD z_|&k=wzI9`SWP-jmO_E)NhCX6-$>YuDmhqblG}J<=6F6OQ%-f44<@u&yiFW}v{Kje z3i7AFSIGZvdI;_!tiXHctgf9PGVKekpwDZ;*9KAAaQikMwA#bX+*U~xvD`Gjz(+zq zL48*{c2at~4~VaO)xyEvc-+Cm)`+p^N?l{hO^hpe{ZWMjC zs6A7I*-oIhT#D1@y)TD*Rd8fp_+?T}@kjC%yVeR`Oep#uOqdmCkXuYhsJ6J4;CnHubP1hfN}&P6eZ z>e>0n3%m=`i@fP<)NDaV7~de@pO)=^H3oLL(_O;F-Vi>-`R6#pad<7{=(WiitAHhD50Uz}hgp_pVS9g^A8Zopcw@3Y}oNwS1n z!IjYnF8FXK*{#x`vN_qC!S&1v_-RkuzNWc%NzH>|7Fy~^L z`)Jdm=vK)Z;=P912X?WIlP7i6+oqX1jd;9tTCsORt=EQT2m zn+OUuXaCs12fV*c6sgX#wD_*kgRJ?1~Uo5zA4 zv5HwtdxHC6x^YC~2J|M{aZ9v{@=m;d19Z*w^{&6q|JKL<&2cAlhgJl(vLe3?boy%i!xQ37b0@~-3B)V4I zho4j}Zk1g5XqBh@%L|t2{+?W1j*)V3qaPy!&zb<;;B&@;Lr?at*{n&aL|Atf#T(%! z-MroG@N7?b+zz7lA+)wE7^$bUY{7L?64U|XWZUhuKy4+x=oqiFpr^#h3*0fT8KptN zEtiG`R4Tl+9*v~&?3*K0YW`YEh-Zo~X+DSQx9hUuD+?mT3D-xY&)JA9{?xRme$UgZ zl3v)zM`Q>#_m&94u)lk@f2eh7#uxm02hr}l)i00o{FGMP&X{J(kio7A8X?K7O~yqR z(`aX>6cyG|pA&z4^g1d-*kH@lviem(qp&)?bqW6gwJ9Og2+ z!glN4MEvCk3*U|n!DsFIf;zUBJ~?wgZCG`r1fh*2h~;J&c5-D-SM!_$R$jSIz{Vgk zRsMFJU|~_qTEloK;uDRGT_0pbVVqcWokawa7rs=1UvR3&F5ByuR%#AbZm{R1+c}vw z=`&(!A3P`Q^4K+cz>?vMj3PWr!9i6s#KXckqH@J{(6r#gLYdb6@-dCfFMMKA@1x?Y z)C3FMThCA+8`^yWE#E(Qa@8~CnSzv+S*p{KtCl(;M}5G-6WA6eoL?n*kY(nlC~`YE zmD*UU_tNpmi_$WFS`Ixwr+^-;$}E8_*w4U=D;4qn^XR%;*J1DDC5ekc%jrg)zB7m^ zWlJu~8731`v5@WAF;U`CTBRVLDK^zAi7|Q@*m5MEK|)KAzM=+KPO}DlC;NS(vC){5 zaYuz$%9p)py#ue_s_CY@UgIP;bBJyGJ%x+1_J)cai*u`=4A*4K*ir|~W^9wai*P)O zOS~8IGr`PG=2(g5HH-22R9%VEsFng9BZmxk$<)5Yj>-0mIA#Fk2c`Tbkfys+cou(Q zwCGfCN|V_nv&?o73Ps1WIExnjMR2F<4GO}_u^4cdbT`xmX*uELElce6E*b*nb(Dc{ z2G`!c#F#RRC3HIrCb4J0sk-J?!Y4{G@u{4o+bD0DtJ$8R2_Nj<+xBT22zbG&o@(4) z0_HX4_`CSuZY+WF_MqaY+}zkYb9PH-t~6&>7G)=pld|an9v(gk-#Y- zMtx&q5ExOEAuJ(eA2>h1&~yc&RIY91`06J0`RK=*Pm?F6bWj}=wrnA^v_*U1!r=JiMT8nC zD5P3$`^@Vy9fufgR&ex_97ZAi*}MKr&t#u0E6^q=1qDvy!2wA|Hh>&5qqcVeSImUO z+8(^uvY%dk>^pxxMnQ2)_?!3!2^)1EIcu(0Y)3nDu)qa|pFHDV0QA09bj=(Y_omEb z8f{i;WFwtkqP3tpTjzpjLXO0M<}sR)bm>Oi(3zjHCC!5oIjM&jIeIl+NyrsTM>$>S z%epUoeT7$S(g6b-p@8c(_0NQNL>RrEI?%fBgj5XX!X?oVHAl}loVyc>?H7?_A3ct& zvi!&c3kp~Y-vlP^Z8MyqiYYqUiU$bEq`qfx(}JhyjM}+@!)9k5@;cJ@dM%(2J7eVE zQzLRVo#?$4KQ{h3*2LgP2Jb^5*tj&i$QKKep_00_zz~61I?EjHn^nZ7YqW1}dEFlq zUR+&u`VZd+d^;cW>;rpG6TB?y_B4(!qkpmBh1;}eLD~;fKnfeFwN2Ab5x$-k*-K(};CZLn8C)T)4{s}99pKf?}C zQlUQuR>Sc8Cu}E>u!q@=?;_5}Jw1O&shk`luAkUb>g(^{;BDBH!vpQgR!|P%c~DaJ zqQ}9;&Al4J&+MlVl>}-6Y|1R_3m-wZeqt~!v~v`TD-8{l6i(x(QS)(FLCw>6K#j$0 z7EVLWC21zZckO_qp9iPaR=-VLdl69wI3A9th6rW#%^sK4{zWBmTj2?o-#2U7Y>!Q^ z^XP%|4(G$$Ev9YP6=kCqf->Vs)Ml>ukY|69gOvi6GC$JrTjre?VsgLmMPJeSp8D>& zbN8DfjE6L)TS=^AB_CPkJTcCx97TfBwz)SeuB_a2r`D1xj2@uqKK?mMVu9 zY+ECfhh_y$Bh%PYzllLWN@EBYp96at6i6Lql%r|S1{-T6G^yYurioekBw^saFhQAn5|9&ezDw&7t#i1ba zW+=82HCX6Ren8K7bRQRXZZzt%dDy^EyUAj}*3f>{*`KR_$t04HN5F848h$&qF(2!3 zy8(D>lHCCQljys1%IDMj0l`H$e#02zP~kjRkRr z1|1V5HB*bwEGQH)&O>ITzjplj1V!fE~kAsy53^xYdofA%xh&`Zr?<#Ny(Pv$-17{o6 zQr_#>uP+h}f9e3ct!B-k8@~HAMYOZ{)O%*s$_#nL5zKarkKzr&GA`aJn>>1EAJ>gIAO+c&Di&v3I zGd+l!+8qvmEcC{AC;roy$k+V7Yc-Q$uUK+J$ zPP{2;{j;;3>*W0B;EIdqlXr0=ujD+Oc4slPlr!gsI*C)T`YC`thJKi2RIwX)Zns|0$z z0d^Qs=HuZt>pWSn@Jwa6X#Y_!Z%!jL}Fb5i4;Yc?$I@UWo@QzI5P@-zGU}2t%)}=I1`TI)umtYa_B2*7et8lVR z?(wM{-qM}FZI_k5b*}=ZL9Sc~wG(X3z4Z{A+=#{v?ogHhxX~*DC*6 zp!{;v|As)n>foC|v<1P-Jb}Je`Awi-#l?}df2W~83-ncg|4KvV?*FVIUMF4L;C$T1 z{MIuHabNX6@LQk3f9pWdlX7vcYjYp{Gh*uv!N0h?bM)721?u`$$U!&WK;VYZ|1l5- zYhUVK&-rcG{5BBQq(`K=-H;CN_XSC_`OQ0iH_LAahw@_iuKeol`QMqX{>43tMl)AF zFKi@yJKp~jZmMd=j1nG0mm%~gZ;iikyrGuP#SS!6>jE}GX=mDD>Nfn^h7-D#oGss~ z**#}LYpEME*LrYjYu!s!F}~-$ZgY9B;J^B=KXBf8>{s`7{a+p1Z{9l?@~dyV_}{nw zAE+jNAyjknx878SwkFx+B0k08fJ&7A^;(rTrwZqngV7E5zWe+9Z+-kvjt82i z1`a?dTFdL3r3dSedop|mxX_b zLh3M$!fsbz=Knu5)s)j)JRGm*Ky3*Ar-prJ934%ixt#rHTl3BL%`SmxV$Ij6-Ynbl zEt9I~oz`LcDl^r4zBSr5l!9&)|1|~lO#|P|(qNB`)N4nuFV|ETPc(r4$%4(zpLH3A z7nt|7J@pL%I0DvOqURiB}2sq!ZF{9jZh_W=^)#%y=6$h$%LC%wz?75#nwyK(rp zKK>pLzn_=>j~x#}c^Pw-`+)|`nHCAltal*e?m&B;&!G?guq;2zr@7xGnM$wsn9X5i z8)1(pUH7mrHoDl%ZJrBAOnjLG^*IW-jh)^z6xDDk`yS;$zzCl{-m3moNY~*`DobCtehz zcLXeP;J9V1qaY>$BkCm<@m$l=V=m7}d>wg`Jlx9;P~RZfq_Ob_Lyj$;0J@P_DIb|Yn!Sq&EoHSPZovaL5pNVRw525+3(m74NFt%M7&X(k{AdI|nfG&(_c)RrzNh>XR&d#1y5EM5mcJX_~(u`J`}5m=90AV$gFz z)(`0-yIVT5R2P6(^WYR0$=keLWtuSqvkOLCNTJa>?(6 z8mRYSa|XFJ>D+PF%g^CsigtG}BnHX0TtOh$y=_Kql)zjn?W;S@dgI#9yfOW#IxWOG zmO{h(2_dJtm3n#!r>=Ua!I5wu79QrQrw9HtDe|V~{3c$7X(VMe(B9rzm)2UrWJ4QS z1-6IoT$fXnJ%t2~kvj8}H`#V(Yq$@@l zOPG~`Ib1S9@67$hcA}j`W+c}R@Jb^!blC$|zWcRzO>tD4|71bJW@}VP*3P*f9~9Q- z8(!US9Bo5lH@Cb+K`i@R%zp8$o75T(o47#x>gM^s;U^(}MxeIrAhqFA6#4#PPJ$Ju z382~6&Vxdt)4c)SD@SlQYeJ2jJd?;8a7sde-A?O79_)%_GVW;P5(o*&aC(y?TM~K9 z>^Xd@G8=g_>R@5=CUnB74C#aZsM*#wD}2BD)Pqrq(OZ=QN`7<_B$wK0m?R#V>qLsW zCKqJSs04Tehc_DDV{(3I`2>Ps-A5BlWmKXyQ!;63X-uJF`z0omU)@G1;DTM?QrX!< zc}I6d_Bt*x^6$poWCYEZfr@>slf9YI><;J@LQnqAC2oIxzKM=-%LCUWq%Q#jN``hI zy|eAGp_17zOH}%92M#ATp|Fu_)-SE15?iF{0K;yc>q!oGfX*|e(FOcXG41ueOpmmO zhUK#(YNw(^%ndTK(l${Qrysq%O>a$)FL*YK&CMoszc_cqyCCC~7fF1QwTJ@bl=+Y> z)>)rB7nO<3sJPzlOUs&A_hXW#!7KWWLBkFH7)26w3eSsX=7GChRA-;PJpKN>BqN^} zP$uK!YM`mE)WuxVXWPz!(CI9M-F!c;#8a+pUxJ*Ke$$LiE}^Tn#hS+`Gd)S?FT?a*%(oak6(n!!S9`H*^ zQsNObR@%=u@Nko=^U7BmRl0BIQ(81Dx-jsTU2QRzJ(l%H_}N9c1Zd#sj4z@L4u|7i z*d1-Vh&`1Va4AKHRCnI0*lq~Jny!0cVq!}A$?vhgKC;~g3A@;<>ThAHbhQyFn4VC= z4=;uyQF0^f-tBOPx0|r>c&_dB)tJL&nTgM{yL?wu2U4s1>QtWco`fgEWpY>DkjS&M z*WdW5dy!VmC9hU!;etOx#4Ai`E7ySQ;yv7&_iC!(?wTY6PrX{K zjS9UW$lez3x9D@@J3iGbv*NM(CHKp(<|gXQMi%L30|0d15AZe4jlLow9-PAS<9E9y z`XI1AB|Z?Tms7RfDw8@uFW^Md^UCuEFZdw_glv>mB$Sv(UKm+fZx}Qxb(JhDBB^w0 zu^zH2xt-bF(tUn1M^@2J>Hd-X9!LafG0(-s4_$y4z; z$$Mt)lN;aC^YU#`wZ`dN0?$uf#!iM*v5QcY%i3J!4*0rkY{|PE+G`G3gVSPBBot-M zh5D4I4p1ZMQGOTU9x5+xF@4`#All5;u`mfzQG1~F$&b7}<}ZADGJ5|qW@rA&CY^G7 zPxiCPaOh11x%^D`H?FDCAKA?%wd<{Ea3MN1I@!GX?TuPtDW*PRY{R&9T7bRA^j)^B zP10xn6c4hdGrS>4OHO|(4fme*5qZD=l%F#7q1SQg@g|#STRRbquXj3VogqmMOfOwFO3F^@{w1aPS08^^(hKPVJS_y}hW)&sJ$0E{;q_ ztEBcP-y)5T;&iT! z_=qHSB2e3h$4ym%n6S%UIJKG?f3o^jPOK#`-qV5!@rv7y3YEE8rY-U`T*LH^Mf2c% zUS7^a@~Io}C|PBhMpV!A8n7PM>ws>WF9vCvej-O_Y{GWNg5W|zNaaTj2M$vbN~6p6 zK6{f;n;Bkl*hW0c%53H#DbBm{gTA&(G(8D5;E&hfw3-Nz>8sr`S12;273a)TQyTNT zW^9K5vRSMlk;OBwg=gFzToP@PxXm~u^Z1z=flP5Jh*t2q)OnYK1wg11yxEqKFq{^^ z!5YsW75#Z$v-pTD$_kn zs8`VR^q3PS4uP%IVB1F)R}S!7v`!3d#eM(XwfN{dgP754UAeR{&b7xpHr+g&x}Km_ z((KYS>$P#xptGKxn{-;mlAigNQH_PhDmf$6>}8i}RQHQ^b4#UyLRF*zbAcexCLz^a zXg4}cb+?c1144v&%v0vCqgXowVrvr)9=`oUUQu|Z^%VJ9%T5`bc)VekU?&b~#X*j< zdem!wD7_W2BSP3O)VtR8SwFdVq?x)^jPJ5b?^#LstP*+kNeNB*t?Ohgz-thl}?;pg;o5lD2DFZ6TgTac$tmeSO7F+y$$V(tgrDev4z1!I9A zsmUP>9jt~7%a;6J5V^is!teS~tU+P6^fDjCxj+^PG#enoy?T6;v1oslw)f(J4l7cN zy6T70iWmGLB{}tJFmOW z8J#cgG>M~(`=!C>Ar`Xmh3}{q5I_eku-fw9M4ULlAWSLBIoMTho>w?=>^5rb zK9TE=ipxyOcn_vdxf+*3I-$t+O15WIsMBYa3u9hM_NI)Y<-&4t@)L&FP012>()#*9 zZ~IVMT3g4}*Elon&27WTsJb(+7nWmlp5{>-6{jU4H7hF#SCZ1x<>E*Z|l9twlup zq@h`d$35Sfo!JVp<=Z9YWjvv$b0DJoyo^AbjNc+Pgv`Y@O{2ifbu<&znxx8Oz|HSz zXw5f5!Vap+?4Oq-t3Optf2H+HpR_{>Yb7}uANP}ZZwAdRyF%sBC;C;-R&4&uzS5+< z8X%&UeshLoQo9|97m5n=QBHJh?RJU@@BL-)#A|XikB?Em%mO-)P6&kXcLNj?6H|L9 z$4}kBnXy>!G0Se&9J}2)#f?DstjLz)?w)6bWMK{c8Nv1y;#_)iO>ay4qt<%W(&)^% zqy*~;!PG9Tmu03HHBzw;Kx@l&~w3XPhl?-mxb3r}qEMSNC47|0C)feWyV zYoru?7qk*$4rVU>CbdlCV1Am8ei?Z7k+zRmMr&$8*%JH7ZQGY6$~FDw_gA@~?skh= znxY5DpbzY;gmc4@qS?I&&b3rdbXq{{h7#kMdqKBh8d^z5J@ojsUz)1GT?Ib)%qqB5 zA5(pP{4^hIrM{c@eD$JPMsJo|BDybea*AlA8S55{)X1qxn1sMQY`w#zv7c2}IDjD` z*xGw`LYb!t5@UH;#seqbBLlF z4HEr(v;Urn|GA?VLd}PaCqo91lkC2(|87|S?2##is)39sLxzw$eqY;v=jeZi*&R^2 z^CObIZp!bW)+tk9?bc^qD)Dhwf2~9@S}DJH-qYf#p{GwR|F90pFAP(KA_YT%cVVx1 z`tJpF)EmXc&`n&>QEz0|DnceIU<2$(hDx-d3~i$X4{Wp@GQf_-s>aVM>wy=g?iQXX zsMGmZ;1|;1`vMQqQ64x7MneKNAu}2h0fbDs13KA-cv@B7DI`F!r{&Kj3uv01h1j01h4e0Q(~VJ;3p!$BrL6di?mY<0noWKgn}}hv(EO9{zLZ z&s-4XzjR5EUqC?kvXq#xh=izsz;{=_laQ8?1IY=ADO^*Ky(T3qC;KNRhfbV0!E=&_ zkB5g(R#-q-_WwHU{|4YadHCHiz>!1ZfWy3pj_@AZe+v-(Q&kTi`BQ!W8jc)2cIfzt z!zT|?VHW_0jvN6TJ8|mhiK8cv|0&y{!w2cS$1n2nf3N%_44#<8Iw7uh2XW6op$zEv zOYcbu6;*6*#jSuxWdcacX&|kt|pLRh1%<>>fi}%m$ zkDWMr=*Zy{f3DG?!@S=se?D^YM;Pm#UqWu#tI4B$;=iaIyR&jjk6%Jn&Hqti`Tj8A z%#nje@E+j>+ys34iiD|RTnxIz#dTr4q79PO>D$~e3}{!;CvM`7p#gB*b)jI9^ye%2 zyJNwBPSyPL)##Az%)?r{;kZ9v69K4@99n8s-k-1eKmSqi58?bVa{ibd|E=o47m(7~ z*YXMzV0KSQG`l4J5}ATGE7kLdOM7R&jBQ9-{!Rgh*VW1gEnk_MKjjvMIXZx*VrUnV zG@2cxUEcky5!`Y8(`q@`Ll$Gl@dv@pD*F*L!G`+)6R%3c_Pr!-xafxUbx-TI?~|M* zs#XjspIk46C4}%NvwT?E;q{)DR&WNyukzStB{clv8q;!lHELs}^_1)4PF!JTCHu zn6XC1q;i^UTz<>N=YYPnztj5vpWPnn5T0!)c0_jjPxA7CsPACE-N<+Rn80cqR9-}S z5T;)fi$EYTNdVw*Wp?WMmI<=>@ATGx>ck70+CqDqL;HY+);%Y+mRY@<<0Ch>YW4x0 zQ5rd~!?J>IZpbZ1U0&X$+wXp~Sd%MfiR{kw`4$w>$7uYB)qZ8C7(&4ceIeOgmaT6m zde-Z2IprU871qGb*O5+l==0GXj}dmq8?zn6Gd5)g-gbqVVpHeh6{z72AJpvi=y}#=2G4de%dRFzbs5QcbEu>lC}`nt4GsYzvlY z1fb85vGp7`5d!s)rhc1fxUq{)l=$3QJsI1*^`rwrv_3*iu052G%2G9{Hg&EuHk2Su zquZWYYQjj=cyKp@xu&EXTSPdU7ku{YOLy~M3{l3%nDolihL*dYy2vg_Hxk~BnT;s~ zg3n&o$i6L;sQW#O@YKU{0n3o`koxc?L7j*+)a@Qbu3he|AF_jUw<928i6YW*cOaG> zUA3GhugsQD_rXh0#j2_Y(=%L6jrxcMuHcqk(Bf8g#o&hnfuwA)hCHsK7UJ~Fh-RTt z2q&0s1ZU9vWYcP$5R|f_-UzL9iG>VtFt0+WNuQW*;!bSdqMVlj{&lk1Rn$h8tK+Cj z?G2b-Xnm6jX$i4HH1o-&SoU^LbM-@=RX^{n26`P^&AmrQx>J`o>*CB5c3{s6o$8#8 zSXbB{(+S%X<6s5oHyPf`X>T9QE2KtcY{Med4|Q6A4~*tmjTgZ@_u#K7RVVM&3aJ9#mAca1Za9FD70jk zI+jyS@*ULu;>^rYN~YyhoTH7!?3cCG4_#udSL{M}we4af>Nn$;pYH>*&Z%YWPS@@O z!cxD@V~G>Xx_LX(H)r+Yr1t?KicRC3eSmgm#Q1JlgWo>DDwCWF0<`J72&zZf}YsOrc5VIxO6eZtsi@xyKj{3 zU9_OXVGY#z!UR1SPxDjB$plRL5sO*yD&b#g!xCF5)EZXY^ z<(X3cp7SB)v3gkw4PMH{N>tN|yz!xnj1C_7qLz3_#~WO!#gTJnN-@M{#QeNA4~0u5 zrUs>eHQZYCNH~b0`0OL!fhqjtuXo2(Y9(n2BX#53)t0)pS76K;Pj*at3z3dgj(^)f zyt%ab)kR4;WO2*Fq|)D%2WG^fyl2yyZz%=VA=V{m5IBa~8xxxi)~H(Ke<0Z6NmFq0 zBIi3x>5&t-DqT<11A%_87)VHuG`PDITM|=cpe@W}B2BO9FB*Kk(v7s6RgBfIfz0wS%Z<@dOB$`5Kt7%U)EKD^q9Lc%}r%fFpPZ=sBMRBc}OFHN@ z?;FPxH63+5q%t}yQQG&pit31WUDY@tTM=hAdr%)~=IQL0Q{QsB+5bgnQ1Ryf`-bpF zo@0JOaU5lq0V~nxAmM##l)+MBpY=y;ncBDSCoaB0@+aQZ0jZ}A%4a;GDDgujEHrZ| zgs5^J3Q9sIk}K(LnfG!UO`NhLUxGb!R zKD5EGY8$VV(5~;R-r`GZ`mAM!yJxGNHtw>}aV|9L=;YVbRIP(qMraVsi=?Z=YRgSd zITnrbKE)+kN$)W~zorH{LG)XYd`Z$J!#1ITSCf~h4&_Fg?qV8~r_uOskc9Q9qJ%$&76OkZ z=9v1Z7W2%frI(RSS|kxHgJ>0h-2+J?r&@LDXQUKXIYw*~Oi?o-itYULX&nNhALN&9 zsC3R;e5G`-CqA-rVe9kwkmshyC_Ay&(8j_Pa=1eRB%kY1fW%tAH5MJ9XVzo0AGc!~ zL@HrbwGC{Q{t@nn$OQ|tgMQJl5-l03waiO@gG9-WL(GpS?aI^^I3UWc?{oSCyp6cu zJ4$+_DjJpv$2~+1KyEnnnr0%g{f1Z12CU?(7$lc@X1|?=#G~L*+NbVUdSuh%28%k} zi+0K_@)n>&iK(AR$dUxOtw`}64=JsuN$i)j-AnnoCE=zR4-r!-GkJybvbMn{k0%SD zDSXLXYgT;Ce06L?;0zH=gL~!U)S_ca1M_7-Brh*1`Y|)d-)>0-KJp^mGz-{(>@Tq_ znr9;g^Wyo<(J9hO4<~}WG^!ozjB_^^Cws>Z+D|PZMT4Yke&l)EVpKe=E4fyHL@?*4 zW(uW_N5U)(MLQ{}!GyRwf_cNF?J-w%2}r8|r3_WXlWE={kUTbJ48w>gNTzR`t}2YN zwYuEg?NWh)q4v<1`nNjpx|h`@)yV@5}%{-c6O&;ofNwL`|{rC zcY2$;&S=yOHwOMrkMi8j{8s|f@839wHlmfhqX)qwD$Q9C zqqI&}q1|NYs*GF-Ai0kpLXOo7Gb;!)sitQ1fC0yT`dvpHsw|&aveZxg#Eg1FN1$A! zZ)$blbQct*ws{m0Oroa=uJW7&<`yFaiS(yDI1J%`+XcJSfu+;jW29YJ$-e)G)BpQQ z=f6Br-k9tA&1*aHcbfdWi^c$nST;#dxOn5d-QD5(eSn|B@d9F{UZ zXg=943pV?F_y^kOeSoDRxADmR2&!Pf1mKSxf5_vH@$tuO_(MA!=t9e+-pMZ`8zOIZ z@75K50TyH}z+He0`s{Y?1IBzx8-Opta5x;K7sm)C3-JCcrxb@{GsV^Wx*3tc&^NuOA zI{A`L_J}MM<0e(&h3MeX0Q1JM4Q6#HbhDPA$|OL3I~@p_z2pMsv?{k!N^DvXL}2f@#p=2EU6N*^92Pi<+E4W9xGcR^HJ3GyG347im82uI~PXpXw2sFwgpzQkO=)r zCb$8(lg zri;X{tJiejFi+sME#wA3B0vG03SkFjB??V(c4`+vzBec7EGiD~ePL>YV+1hcJegf2q7|I`s(nX~CCoV$@2_j>vd(A6~b;=W{!9 zLe`7PHdZ!pew>{F16a}$!uM#!&awMjd5CVoyCzu;P~CNb>t@UXoRbdn`-D>O3RtM1 zEcr{3vV%-$T4n)(LRUwMiZ26CEZJWbR1hh%l2ZzW>!%)PSrD|5`iR6}aiXuCC@=8- zs{bVFcx-zx{yHjoh*}&tU;tyjM{>>Ndx>&HrUb(}6E62g^l|ifz2Whq)6gc7Uq_l) zq2U*Ir4@qa1?FMe<=Rh$<_~t4*gFaS(M$TeNgdLOZUa#W8=t`p8}I6T$I0s7IQjlww4YPNQZE?-pKPGn9>9d8lw=@up0zhvVv-pBON7@k+}aup}E7 zEZM~l3bY%%r!ANc1fDnp4a;{{~R+R0EJ4jx4-H3(+iPC`wo8{96t)U2A>1Uj;w`rKYd zz}k#Ih`@btt+Uy&@R4@Zg5eoxx07Y*G30BCYXUF0zn!ux<@It@AUoE;CFT7fCZBp| zK-Z=>VIK5QctQgHcxlB&dZppj$3`Pher*fRMV4Eg@-mSWkYP|Z&$higIt?w7;n$-- zOcYjkW!cJAzPl^yNGz~E8cL6$(1KW8JQ9gSi~AvU4cl{4tgkO+sv4G9gD(TmhU=F@ zRGmCA{YD#jTM=s#4T<3dGIm?Gm|OUb)v)mVs)7VXk!BTymu5o>4Lvg@jO+QdI-7~- zn3rZCBB*t5L?_~Y*|urJJ+e}$m4Ox2+FI}rcO_Cz&bZWl7fqp-QtD}F=bLBz;2N#l zx2%^#_0AF}^Xg8Up~>b$IV#4F{U<43HvDjM$q;l{hiCBp3RPY{)OJXd;*s$O6U=s*4OB_N;^0PhlZs%1XnvYOy=ZiezShDcXS^x4ZpW-xes_d7qLFq z)bss9w&}Ngx2@!G>F5msL>2ckzfa-`YOmRSwmLdmnu-j;Qpn5ZdTj?A&=X&>&hKRj zew|kAb^Y8};p!?tC_-P+0G#~?wn~(W?#D2IyzR+IbHwyMp!}EL{z0z)yQo9f7N$?8 zeEJi9r@1ID_JQ|-59xP$5^(axzvOtR=3UR$>*n3P^Ydzb>DxE0F4yjQm1LC$AlS;# zbq8^V^&pX^+VdNm4@0z~DM8$WiuohpVGmNie3ybwu9HnYa*HXTh} z-jZobIN!Ii56D0F3;J#g`l@DVp|bx#kD>WGgbQtRG~U*8!Xp7ktkE%!9) zvL$#z56{2U*}0PA7B%C;dtpgf)$l~ZK0qQqaNuq=N#em8rt}m@Z0D+v#iq>{r}>*i zH5{QmKe3Gwws2_{v__#@oLf!e2yYd!I}_(N^&mWySBB^AXzea^&pKvBobkWh(PoGj zQA*me9U!ck`emDt(<{jP6^T}&KM=s%8%$dwzal;g_GNeQgdXQh2My`uZ(a-B9om0&pJcT zAs}cEkT`J?2=AKV=;XDR;;(DOjH^X%i5#K2D{d&^`^4$ao)`*QxNIC#BswM6(ev9< za-&r}VaO@mJKhc5za@#uyTSzB2ZzvyIhMqo=PgXlpnyKq$*B1jGQqcbxbg^OF_f26 zzTsJ=*qzcQr0A5U9wG#IJaO zL--W+nL9Pv+-KG{2Wu^-E+xbx z43(O6Lcv`Y95aRm&X~8(a!YG|)koTLxQ>?dUXCOY#xZ%HkM!9T9?Z++Y>A7Lx5d^o zX_25x(66%e^ELTj<}mU$-`ErFX8LxvY8T&_=@6uHSNklD(hw$h<*fGs(VZy8n@8SO zJ~2}iwkY(qUoIUClZtB>HI8Z(u}ya5MJ;peK=qI1xl;sOOAwwIkUUZg(=d8J z%c89+ZDd^pnz9@eMZtIt8wI)(25(w1M}4t`w8>saM?N4@wfOsnLbYak?10+VK49ZU z+&8s-z)n{%_h;(ncwFIq@3n~ZqPx95a+YC5DH#T-eSK&VuY99Kqa2Zo&g_A1-Yevu zUWc#uS0gd2zxY-5Tag!DI7?c@aV=Zak!TV*4t4#-EPwYRFOyQVp?PzZ688P*K0t4I zvoUcWa9C_jXZZ$n{+?^9h3tBFsN`y~igNw@K%r>UhUU!uqURB^K{+z)!H`n5jlS}7 zts&t%$~c526^|{RStn!+CJR5Ur=r}Wo@ryki-%XrbIGZyNZz}fbR^DX_x~M5_@JG%}yXjBG zdF6BHWHob-wCMt@L^LiGBu-H$rK2BeDQKqZ9`6;_5`+fa!o<|{oy@3LSMV{XX3tQ< z->V4+b5aed0k=vG)=eSe1urNL^qsfR=rRf|FhdkWF3FZ%^yZ0v1?{@|n5FeOAUc{N zBSW@v&+ipu6$+bbE>I*Z@}Z7k^rp1vM3VyIrf35$Zpm@DBn-vFhJuuCWv5TaGdZn4 zz}8h>ZAPY`7D}|6kSuTry48;}i}`FH4Ai~hqtIyPQfiu9D}j_^=}eQt8`GTzzHF?0 z$)Kc75T;`JyT~!FzcM2X@vSMRkB7TA5!b5rQe~UCUAewBHvZyD`+)V3cT0qTo_&C9 zM4`ZG53eP!Tjt5#Nw%UjZ&pdsaZcSZuu9R(F`b$a-CiC{F!xF{d%)75*`Uh$uCynn zo;1j4tNF&a1cb89R9l1#gI!3oSC)2jw}dVB0f$E9FAjHfsq2=I6)w_6lRW#*djo+$ zn038!XUNruch!z-(pSE!RM8g^mW-G1gNdvCuz2B$$%9hF9RG&e^Ls=I9=-)NF!N$-A_o`t3j4r`B?;v*EXr5)K1?{usCw7{p%ytU36 z`p{JsVpZ5@FS{*dumgdV-6JQu)Q0fF=Du7Rn7o!rnSMs=kQOkKF#ZoQEks7hvy z2HJ>&(d2hAr0JcF@YWwzi#UpAYQ3i61CK_46w?Tvkh_cSspkeTj8VQvg)rqe^34{o zioNG4@^QaZTKoN!O>xF(ARb+siSmqazq=)UV@W#LhgZkpp>RyKi{snbEN z#KbEA26lJj=3C{r9z{u0;kxoU(?t_pn|%OZ?mnQ8xDU{I;z?ZnnpZ__mQs&3l&W$Y zQJ=W(&i&|A-e667`phGNl>VBs0HWP^Xv?X9E^Y@FDvy<1V84M58~jj0@vz=?VKAvt zjP`gixC6cHJ@TYO&0uNE=gkYi;h+DDwLfm=n)hxWa4dqfcB#F1Jyh&N>Bbd=uxe)E<6yiSXXhwhapU*vZU@s|!>fYHmbx6r-*9mR2cMv}=v>f2p1^fO1iUK1%yBb0S~3tTnMX<63lJq_KI??P6U ztlS6D+*3#HyCr=twd@be>i z2j1vZdsafrKlw1A6M%pBOjt6b->Re+q}&m2D^YwhRjOsLoaO3f764Fw||S<25PS%4hphZnf=UDMoKFM^H z(UQqlKfHVBqA*e);+Q>t2{}dW%sMPm(5PWTF!al(VYp|oO_sS83wq@Uj~Wn%JVV@l zzr`0UJ9w^Kf0h=0#o)XRx%Ok0P<}8quqAg86XIrj^i$G3;hReSl!tGCHD<`x(R=O& z&kcjWWt9q$jyfWaz-;Y7B08BF~ zA9aFtTU(&}eHKWPhA?zYzZTn!{cWcGr;>V=kK0}uLO&j%NC!~JugF=5*Gic+Xc>m7 zTNYE^X-mi{{a(VlO6%zaAj++VZ7!M#PhONS5QthnWy1MIo(qyGHX}@hJ}_x%NwXM& zpg>A83%V^O0=pqorRO}~b}f!@qMF|1YqR{FuL6~-2Q&!55)SyE{8j#hF`eR}E`g~P zwz8YoIaO6To{L6RFTsSRId6E(ZfnS+wY>F|qH>;=8&<(mC|!`4O0mDPU3||xOZe$0 z3G6FyNGh;;!5L}WB~Js&o!M%eACe56TaVOuT8f!c_)xqxm7pa|aM)~oxiFo8SRGKz zRZrm_^F&~6JRGTbRnhama3%UiN1a2?IhETw6vrgmIAcKt-Q9xlhAZFvCu^9iaubpb zR>3BrJSH{Y+4j~@JmIP zXuGh7InDb3_JRSaTgRlKL5j-1Wz^WCLqq6%rRPf3NcrSKN}z(74humKw3NG45~_5I zxYC|r<;q}zyGp7p;f&&8hSV>eZ&ad-8Rk%mbSPqEoVF7#RgL%&t|#I)a>lP8Zm81o z)`25czq8DKgBe9 zS{?sNXzKk!Rf$MR%{x>VKT@Pw$Ilpe{U>aew$XvLTbmN~f67o6FB>Z)ksit0hRqi3 zu6q@Q)+$9SCx0{NDh%{UU1m-kTYOn%<0T~-s2GLt7!xU9M|dFHVzQU8i`64$`iuD` zHGN$kk3jdQ16bxmg#n%jD+er}>@wK;>4tubih{r(*eHFF%aU8v6eei0``#ftjGEuf z-~_>O_F)OvqO9M0+$+p^P;Ki#fjHb6W4E!9{`5e+FS+?z8ie^-Baj{d9N5uejSfNQ zPhJ#+8H*CS5up?YWq|r%8cjnA%60q5`t%19VB!8qZ9}wTa%ln5qv>u-PjR8@v{6urqqrOV55b3BV9H~b}U7r)aj@n2hM74@fqdCya`VhV?c+~>(28TOa$ zmg64fn@=XcNsVFL2T5xYiCN{dfw`5VOU6=NgQr~UTkp&bw-&xCYhZHx8N9%6fe+Y- z*Zw((T0OTHl!QAC(jLnf*;Pj353NL>Gf3-(>RR+}b5Vx*WogGtgRabOKH9_+qwLn8 zM-*-M#Xwen8yhPgex0?X52X-6&M;nn?baZ#FgIHdn#rK1ZRLXbF0r~mn z+s2UolYBf39qdG zf_f=J`HI&I9J1EC*z!)fG(y?YpNfpr_n@QWrf?4ggQF^{OB2mt9t-l@Iv;Ta>){$X z_w-Vo9#6k&*>ryzugZbNi2nG1ul-C3J5f_!^v^K*psG8yu|Ld|ngl+ol7AxvG$<^N zW5+Q`I1Usfb1qp`P9S|);hvX1f3y^HN=+SEerwPqVMb@N8`8Q6n#F_hDnz;ZVf8Q@ zwu{#+=OHfU+&-W%(fa#GE8foh#gsylha5YlhTD78(D7VCxqQB%W&%1L`O%{oYpD04 z8Z-lgS==4|;^0JA`-H#Cc4YhFAm&=L5Q|nGqsq7KE#LQ>{Ai(mtKqvCW8^a{F%sL> zvPeEv^l6q%p52_gS6mZ%abVk!tt>nGKIe!NE(2Gg-;Qq=7DpyR+(PP+z3}haA6(m)$#rF%M8l<;8*9utsZ45X?|SbTNqDjTP=U zoEK;KlIk-dwI$oyw{@=@a>?>DEapyJc_c{28Dq=?uhN*Y6vWfmNaWPB6!)sj<5;Ig!GZJ2C-UBNWz`a+ zCKS38W70)JoyAMk6rNbiD5GG3e%T885IY@Ibm-krsElT*S_%$9^75~i^Tb6yecGz{ zirLCQQ>HP}50>n7jO$9zQ4iJ~>meoTI&Am>)X-Rs5<_YmrXlsArAO!Vku7i zM}zK!X7@)Wslwd%>(oNea&h&!XHVp_AZ#>^GK<6h#`$lk@NI|F)h@Yx&!eiXF4Fg(2_xckX>}JE~>x~}$ z4EPxU2!}{a;uH0^R18318fMa(+(xQrK6n&Qc6w0WXlyszwt)h7qpA21Br5;wp9=ir z@Ne1t`knRR1uI1PD^P!D`ELVNGR3iJtoo$bQbygQaeo5Jqwy-l)U7x%aTY%qMwpt z$nD7xyBn)NoO$oPB`dF4qXkx#KkqO1hrm^JC6Ex6ue43R_YuG_rUwp zb^!v+sfe|6dtyGJB(qb+3*eA z?FFOz9og4tP^Dw7XVPArmO|cwD`;DQeke7zR12M_vaaD;rTw~{2FAVdi_!E!&~VDz zT2_7^W3HJCEj>Z0}-urvf>d-Yr_g9K@qI-62 zPoklGCWni(yYrJQ;Jbf3fB*m?_3U`PZ@|60PDkkq)?CD+rv4DvGl2Nd|FwYF9Yaa$ zIs-7F%TUuwIoS?k;VX8)cN+(m92hF=VS885;acYStv^Nn&jL?xDEg+z!~B@P&;p(& z(~PO$14sK`=<^@`Iw${U?EdGu&JcPGbN6`m0k9e6zrE;^S^&I10K|v^jcZQtY|p#{ zJH9IsW|(5D%B`j;M280S`;W{8#~4~I2PIu$R7_Cd9BGeiHLbMkxr|%J*l*Mt0WZp^ zU!y+O*Wbl6LE`=(xeSgy#HZHm#W-~D6}^A(lb4yXfB@$b4JYaxQW5#}*o)xAQgO|? zhtG{qD{bGRw9RFRgF7AQ!ju}OubDH_TnGUrjLh0!@2Xo$wp)Me+*;fHYu-bn(!n~Z z%LCRUx`iq9wqc9Pc}qcrYZ8o?nz@E0$9b-z@{z-VFrvSd)aBkwS=zNk!vg?zi|C*_ zH5vVRvM*EV$Y{WxeE6C{fClT;EMwmkU?Eyv-BODcdX3sejr@&uy}5gt zvxgsS5DSbcKP{3sHg+e8Iz)>Z^bnUZDb!^e@4+uuOebg(cgL~kWh}lYz@;vulLLcH zm`tc-KmP`S%}ZHTZ>LgXaau?{o}KA1BL!`+O^C^e`U8IXm>Lo$#p*l6ZoWT;=&ahT z5+MZ=HEbq%)1?X+vWfLmHJi^1y;-&A z<&0>Rt1dzzSw2#!9h>n5tJZbM?A}>SD?E_=UIo&vGk&_~4NkSwBVgx;W$W{Bv&)k& zjgP?tKTrxE*54_*0fY(a!0~*^8y2!DHic;+;_rA$_=*S|;~!0)BjLTohEJ)mIA)m^ z4M?*H!nPHP;h#Fc3_1UC>?O+ibMtnm_*9-P`HRwzCHdatqtavBop~Zb z&Esad+p5^!g-;q8R}~T|`Y2GtaET)v-)-llS3XgnGFoy01|1o|jY?2ToDVCU#dK8Q zJ02TKQMuZ6xMYIThNgCZi76YSM2;*Zx9)$U9&ayX!S}~{;+Ny zH_x&`HOT;@rZH<4T;!CD1zQipI493)s=DdQD*?Y9xP6x4b_ zpQxhXr}e2l9{*2;E4Uyk^Ja&Qsr^dF%GVIJM*Z~^Vs>q)Nr#k~mugVO$i3o0N~}&G zy5E~}eXQ7B&9psh%IH&ky@FRE%fmS647nEZNl0QX&hoPzc(PSA1l(h>`hD)OVV>O` z+E$!IL3Y%H@zI@T^up5_CXqw4A2t^rGRNr{y9Ev}`mqLk(Uph2q~FbtWcIQ;E;`%| z%nvFj%JA!>l*BZJ?62o#X{JBLDNkxv69zRYE+JnggHuYAsOtpZT_Dj}A+Y^vJeFH% zcxwP8zCf+H#|s3*b>L6;ptb z@Vi&;^n5RDH2+mrERgkn=~VF?SIl~v;3Bg*+y$L4HTf_Sa(dOz)HYu*xwmR~Lj5Qf zUQ$ks7;KhD=9Jv+d(`rjW9CV5%}6j?4Eog_X~?}YQXGI(sFuQlw)XB;DIA=ss`ZT- zv$GF6i~AMTXWL}drA?TSaE>v3@Vv~r{>qH!-A@54m@Ex!s1LYH{oa@`Zq-o;2fyN- zJI(AW5Z1IR2ndx6WQkv>KbMMQvE$~nAuVsYjf0OK)RQHe0xvqmXt@NKFrfz5Ge$*(Z z9fMK@6+%JIqU>3So_UxU*YasL{2oG|Ig*Rq`r4!8%hB&_Q9ycp0G$2qU)$V&=OXp@ zrya6{TgWU;;wMf6O(f6cR4gcG_2$(D|DxGvA-4QIzKIWbSn?k(Vg5sH{~M?M*Y+}kzb%Jshg8)kQT_>`+(t;5a6xnh(vB8zff1N>Spkutjw*mrGA&}lc4r7&DQ5PfZ_Jc9=mteQwF)J^ zN^B66Z_E7F@{-?EVX&^GiWnLj*j<|#!n))B9qEC00??ntfiPFNGJ1hE@8C%IyFqpz zoL%7x<5va8rPssH>!ZP1rN_ANGZ#ERZT}cjUS%*u8$2E6gl>?-*b7uoP{>IFllE5r z)No`Ag-9#d2hi14uf_+DbI{~xfc9#%yaL{gT*dB(^;iGuT$I3SxWR!yRFniq8n})& zT?36D%4XqVqzAQ(xdG%W8o)cFfM76e8 zs*OOY5h#&vvX&b-ZMMYKJ500G#xTS&rRKtzJGdKkU!7Upy#5BhMj8EOid z;kw{gt(K6L7j>`A_IA(V+uu>x&@=!;LWLVxGd6#RxL}X6y&X+S?C<2FqgkmS@|J)7 zm?9pA7+pfr@yhBVqIAAm!!lm~rw1@TeaOe34n6Oz9rG59$tTyL*n>aeB+Y~!5g89TXBW)n6f;uE&AAa=`7+cmV8 z##f##tvWi(KyS%s)>Ei>xTC3aF+re5!m*$*n4eI<6|wz18{70c#sw3D^(KI5UQpZk zrtX|t%hx$y%?wJrv=Sby8Sk_^1;6FMo$H3k`+)ERH``u}8(nBPLTuY$2NS<#85yw^ zQv{BfGf3Y_0_!g{G*$3^qdZ+(uY)H(%XZrb1YeE&f+l%B?9V&c6Sn*maWU^E8$984 z=i%nN;=N_WOzE!MWYf)&8@3kJ7F(@323HQwgYRwFs6@=rMVr(=Y9yEMt;*b5ww7WB zq26|mePW9-O33*U5UBO1Mb-FS$@yaX^Vi%d&p<@i#|pTvq{qXnem-9kPH#!b8NWw* zwCKKH*lY1cP_% zoFW%fq6}+wm>c?NA}tX9C?G7pL9NK9An|P#!+kzo7?FRww+h)GnP$IO#$X$)93c8= z_opj_3dW>uoF5?0&{Cqv$#)cmZqH>VFv7cA_`kf!rPf%yd{K~1@pN@PirI23I`ww_ z`iNAVT2vz<;(efH+xK}1s15(?8`g0?D%3#xWOJyZnN$={%G;f z!A;$FR0fEJ4Ub-{K|&B$n+pS5Cgk|;M-QOBxaF}H`tkmETHR`D3pMg`PP=E9VwA+G ze#v_FIx2mgUtHr>Oq$u)gKseq8hB#cLgN$?K^S?qq~$_`b-SM7)#Otu+J%~4SaNZ~ z=hxzj>R|12)FS>qlzZp9w{<3j)LZ@WJ1|BkM$-FZBR0Yrr9(0seVRFT?{kN!U)z`Q z_tOwdur&$ydeXQ4n~8-X{P3-czAj-XfhGT*OiORE$wutNMI|F3QiH*H4;!TTE~cE2 zkw~bgSws(a?*n+pZO*pHNBuhJE{g2(5S=lFSr2|KwX!QV1dnERw5A``H!JCK@j9b(zS$@p(42VqE?c>$hncdn~GvsDe#DjwePcD+s%SSgVI zqE6$kPer@+yg+A7lGQs5N433p2{LP^M{)P`zcZ{B6w?ron>u>YD=*>Nm-pqMG8*J# z>@%8R`faF_fr73=;sVNu9#F;Pa^YZtb}%CvXAkB(aoVL;szH8W#5x&780mgBqT?zw z&~p9iehn1cObvh zNc)1WmAZMOlHcif|9Wlme|R6`z8KESPZ)l#x|y>NaN@#e2*7Mx1i}NRp2?ZU$bfQ? z@ci21IN(deS8@A*+MRw9qTdT9BogGSxp_AS$-Psx5WwyZEwke1T}ccnn*H1{F}K+0Md2p|aEi$epxHeGMOafP=i!tU9H#5EL@2b9 zNgpi@!!w&=G7Wi31$}QVV$`oi|B7Jo#tV21vk^8=6wd^`=5St%xgW+dOplnmdy4cH zoj!~On*x-xPA4Vtgu@XQhSyyRQ;ej2B;Io{MIR%(MGp)#T-;%SPgyg{dmmuvzvlfe zU$s=qS(O)v+6$8Aod~`6aE)imn-JNFqDnn7SMIsEU??7zT2vs&lR0#=t*)zVDxezu`(8|K_t} zKKtnq|6j7p8^hJ5^kfPXSkRuKun>5Z*2QE04YPmpjNhaGjk{t;q<CqxYHAWjiPHK!hIe z5~`uwpVN(|lxkC7P>jx2*=^07;jO8UFCL zZm__q)04MY?RH`Qg<0(qu3f4UsMO-atxILI*HhEarwQQ)?DSR6!l7`1D0!MkMjJq_ z?JtctaI2WrOwBrd_?#DzYp6P+7*?s+~FQWLj%I@7M|GCtO?upigt+Xds{mT}ysB;(&5S-jrin$t>9vuZG zd^tExW0AA^iuLLr`)B`L|9@_v|NAcgm#P0oB+?~ZJD8^d2rl5#u;6M zEPlXJFZ-5s`r9hP$!%8$i_VZTh4uG$2I`aQaUOiyO&`&kE7#_WQpyj$;4xZCaHWnm zfT(y4{-*hDbsHs#`9f#y2MTLr-ws@aM?2QuVT*(dBh1-*YH*8X`%+6iIFc0I>3@j* z_D^j+&hhLr<1=M;)^?!k@((a|)XeF=ONBL*%@1Q?+Eqd0Q-ZsIBc1?&mcNHOETpZs zN8vIWc>!#tresJD1q#ZdTe7ZwTTlFp3JQ7-Z#~=I3s)C0yVKIIAKf<4pi12Xc0?Sx zqBQW%q-RloI-$w`bMRiD3U$}ffKEN5+a(zg8CW5eEMoyKigcsVoNF%FG)SQ6qBnfPlBbAwf=ww5v)q9ft% zCy+mAHO8G#D3LkRNBLa$+o45Ime-};j+PX+0o>hmkNOd30~VB?WKv!Q-jG5`WW^65 z5KydtMvz<3uad#Bc-?Yg0?4Mq%M52lMGvSyGt18*d5j;}lK0(0ufSifJ_{VXQf@Bz z>0$VZa(BoRy~>CmXo4V9{c13$uHWVW`9lZ|zSU*sLd`=vcOqJVd^)pniPC#^e%M*2 zCxGXl$@RaF|2Nupd84iZ^wo{*{ykTq(lCO#53rhV>MSYUEilezwVniRd(8=NGH@U}IOF zlK^uc0f3=7cEMI1TmAH9(jd)lAApQ*MsdD%mME6Ipwy^{KqPO&?o>Op(sj7LO_kK1 zY@fZZoTRr1m*~IQLO%lLqjts`-_f~9gt!#b3%>> z)@`Jmt~cF{jEZO$Ej~DeqF&iE)c^KC5OYnP?}wU(Qpe-Ea&$k6?RDMp{|shj+3vkt ztlU!z4r9_ihuEDx$R&#zqxRZ}O3KRM&2LP{%c4L0)#Co=aq>^MmCreb<%QXc;7c(? zdKVg`WFmSvj^1bNQ;l)yv-Lq~4+l}eWe9e=1Pq=46Qx9g0xFCs8Ro;(-C>u$hVs`3 zZsh6c#obg*`B(6C`11ihL!Hh+M_!>eTv!6BDTczoqn%fHZtrI2#pPPl=5E~dPMlOr z`RQNT-GK-=qnu&8V^RuX&dO)&m{|J^#;O(s5*K`51iT+sP%!<7nkquVb@Fd?leoV& z#jl;OplJWJJoW8$ubo(6a2VcMr4KnOFH>Y?85mGfBH-0T>(|KGvO}qxfrik_-y+h&e@_%pe0$t}h<*85@XFr3zb4+TyC4+td#NXX zO?3G5!yhdFp)9{9MiDjS*>PB#=KrU??+j})+uG)gqhlHM&=e_-1A-EYB7}~P1EB|m zBt*K>NhlHsRd94fX#oQS3{6ca$rBQ!lh6(*gc_tIbd(N3Kxrz7emQey&ilUS8qfE= z*EQ$QcTIjg57|6r@0GRpUVE*3-wTl<*w;A;zgqiGw8H`)Q z_T^MU9*uj6s1BNKrF+Z~=xK9A*ZEZPh3W0iy(IXj=I(E%k_BX;YZ79eO>N$NpM{Ej zxPDG01w_JuH?>`1>%&EL!4d2>gZjgmYq5O``DL~*TX#dJ7CMhcKu+HvyydPfnV>Gw*;+f zJeFA?oh?*MdNMt-3>q2KGcV8i;V)HRft8vlS6g#2A4C4?M}J9s>OAYZTzozTG<)l_ z&S6`t*WRKA&uMXO-t1*Q%6Aka7xW+cP|6(n?p_%EB(D@$}U>{!1m$!OF#mH0* zK{VDlr=dR!`SuE` z^l0u!vTVdLd+{;c3>t=~cEwqK_4wB*)Oi34CHcEk3(d6*-2C`0!?fNDbQ6rXbkkpj z_6pQf(fZp;b@pEUzzkpMB*E@SCPx4|6BbPX?pl5q3^^@o_U+pS9d}IW>qr3>=9i7= zif--8bPf!*U<>Mh61q5?mY?U%# za=5*8fGMyG*{}|pz%Epye-eMzxaSCPz=uCulnb;!i7ah@L8-B|MwPCh(~h7fZ6eag zoIVS^Rr1qP2+BL{Z(th?kgli3oPCH`46K{KghS5LV{#WiZbj9(e>ZrtL0N%OZUf7i zVc&l5jF^F)T6pze#*H?HUx|o_>uXZ+bb`MDyK3|pgLM(e{Xu$bENa`mJ^_*Jy-_db zrMqin>LM&x9CkGA4W#*;MLk=WUvWLVupmac$4T~#E>V2N2>-Mc(*}bna_W}WKV4N( zt377U&*EnlB}xd{{qQfp@NZxD{1b|jFX=)m7j$w7Cs9l^{juN z(kWfCR>&wD4-_p@;~Cz-JNOm$j4oDRpJ832GqqeR7s=D9t^# zR8~%y0?-7od;|=WXM=WDaRmIf95Sq3sx=|X7nDxr+6Z&pPRBRhNT4ix^ql9=mmL%g zO1|x~T6vA~Iy1rP41emgd9S6YYU>3L-W|v&ydy~j$(a;Z^&`InUJ2!odSwL}cji{fy|@ti0uAl2Dkw6CB`5dGM#H^NlkVM-<@ z2Mde(1y|?2Hlfc~ADNpQe0DA`x!dsZh`fAsDi>iBmE17x<=^Y=fmgN+?RF_PMtO#- zeZ;0o>pv0&E4l*Kho!^Srm?QJ1q6BKt4y{fUIU8~%pgk$d*aBhKVh#Fc?=@s5nrPBR041M|y*Dk5B3 zm0S`Y!kc9)$B^1hPkQO%MSamHt2DD37R@dj%!OCm10p_?3A!PK9%HgYq5?S0@j&72JN3I_Y~oap#Iwr}B+Cka`v zmXa*vOEBOSoLsQ}J3VE)BH6c7b(S31`2Ej9$PMQRu+|6Vb5}nL^=_kcw1az>9Brgo z-ID+nXyuov!cw$EYY+=y(F(h9XWycl!A_)%o?Qc|#u@tUnvQU8Pgga<= znB_DIqYM+ZHYR*<0OAzU!7H?`_TBV1TxrKtjjV`OgIY>bGe|m`L6&t4oWmBg zPCKS=R>$m_^k*SL<#g`aR)s`;a>1z6} z4C-^T1Wlkn>lLR_;_u5c)ME|dP#`|%=~g4l+BGUl;1`lAv%dzgd{0*=%+hM%ef?E= zp%)+?*3V|~tL~LKK;1)222wFib@}nO9(ikL7TXs^_Yfn5ytUQLGM%z_&r%^{xm}?E zDR??NE#*k{v0MZTLdxq>{YT&3ghwVJB+{LG z_MZ8}EgGuXlG~}qgCsra3t2;xFR=aS{K1Y~Sytd?acr8O+x@?i$XItbH629wB=u1Q zplY&zB}K}8?!P9I--c#AleBFW8RmFF^`ZfMLzx=yUQp~-$T>iOA^K$3sa1oqO>d3lRl;bWTcck6m@ zw|D0?f!QZiq)xWLx5w5nuMzn6s4FfZE}llVV*Sb@OR{oVRA8<|4j*x48@MgYy@_Jn zu~H7(&78PHNg(xAa5bQlQT1Qhbg?hXc0(?pn>5vmCt?>c7*NQkufNZ{h-OBlw^t38 zNxZbU%7$JB&Ax`LKV0!HjmUW=&%IoR@%bCK!r#hcP3ibCz8$!Nj;~ zdX={_%@-2LF-bM-bGWcK--ge@U#*;VW|%10U_yd0LVssdyD={Z1J&$FRkuh1*VXZF zwqGdO_r_3R)IYVf%<^5;!LtO-%A?lchM7goI#_$xk_(3&&!CXd*_VADo44mJ&Rq3* z0*#n!#X7#oRdq44di4AQYfuGiu2VeRBxS4Z2I(+*X%;EqQB`C~j;>2jIOed$J>j9^(0(;H~ z;riiZjY)K8>`u2QRDUCwCHXM_j@Mf0vKpX2H8gIgLW;c6&qrwp3L*y1$K-re$?>~Fd=oRd=nTRvkIN_|vk4_u0dz)U}7 z`C^BM1*nC4v#7LpNUZm}1SI&@0`e%+Zwfp1$V=cobh{P0S^iDHM69-bKN0Yb&J?WL zSN(@R$r#_t4`w=$cbCUqcP9uO*KIC&#U$|VBR59Sw2Z@`EYSwu#dnSZas4B>~aH^=aCgMLoSRIgbl+AZ5lD2G1CX9gR+=iCS=(=7loTdP;AMl zw4wqesE+TZ#)!ffqnMp-aYVtsFkx5_&DmGyiQC)HLL%$YV~s&>NrBoOh{|W74=d0H z_5z**KxrnFv+q;?;6g44|agjhm~yB_3T9v;%x&?=gx^+8A?1BwB*;%o)wAwJTJ)CfvHHQWUJbR zdC;1yEQY!^$4s`X7ytX>zffF^{6(+D9~hSWr9%5G(9(2cIJmr2TcHsY%@Jg2DCKZ6 zT*o^WocSF@tG;lF$CQq-Gp^%uUe+Ir90&fQ z{CCOi)Z~XXb8Q=a?A)csO~O}20;ze{6HujwGr(=<=8#>!rr2kpZVWia;cx3L43ZSWT=p290 zk?>7rb)lp3+HS#?hlM;C%6zcwT5V~d*vkpP2FCNnRgj$?d9~F=RyjLkU zu3Sh74z@`bC{5$jf#x$>pggBTV3+Or!FKmU=uB%Z{};Lk^`0p$bCcp3&|F6^jI2&E z?j_yG#Ystemi>_uYNqIa!ATkM;7V`4ASsLb=)QJf$lXgyNm#8(d_|DxB+uzH*= z3uQZ8Z=6f_ls|Mej#mKim z7@&3No$8UN-##C8-n9#AjNa8X*t^N)b&JqaS)&k{z>!k$8*4*JwMP`hE)Q&jFc@2E zE4uCoF3VulzFtBD`Tp(Qlskv~us~a-1KsQ7*6WANu$=hrj)(dok`t}lll|RVH>zqj zBfm}$@XXNJudU&C-|Jvc-*_`HST%0Z zpo}vyv))HSu{7W_2u^ug!i^b7``opz?y1h!m3fjVLeFqRkZ)ywQKsDq;p}qx7)BX+ zyalK+YW^(L+40atVQu|1;+<6YUWANf%iavoJ@W@zeyN&g2{IMCjGOM-Y_&O|>gJKD z3_(467q>kx`{$RBNkId02Nb0paZaH_!;-3w^MQ)8EU17U1xAPv-B3qUP{AqNY_8kGbB#m#=s5>w7UeRY0%0EZLFXWs<-4V^$gMEj`!YI)AMk zvH5baEv~ATWnet)U){PC+aPH=$8uDhj1`fTSUP<(Vb*>OZ{Uz(2UO++-?iF*-HDfw zkYWb-EZZ3BDUfj|>`hKqs0M#m!F8kInQ+d9njYp+y{}O9o6qCQ>le94=&5<7>EC%i ztMY^9XWf3#z9U^ssPpnZ0$S05U)XRtr1v^wslGLf(A&(YvTAXQ=!qH;WI)KZ)v6Ef z%=mu(6dvy4bzSAIfu=G08oBXBleOuG<*gw(qN}LOutG?8aLx?;St%oq*bzbTv=t=V zIt2F6u-Pp#s7ihE0OmMNZLYOH9i=!nS9!~`j@XK@IeKImOiy`q?visOL zViEvof8)=O9rc5;<)%Ek(Re#8fb5ccC>FvVqZCZE?mmCk=jdBDx~jST4cqKW=iN2r zkBjHyO9w(%C2NV&vr|ON$qROa#)H;A&Y;RGF9t78l|n?RC#);uufASV6Bc$z88E^W zT>|BWg)^bpl4!(_#%vH6m#o3{@JGpl=~f;_Muz({acI43mKIeLe%NEUZwjy-w|&u% zg7C}?4ZnovxEjcOD~7s$!B-JPBx!CZ9%f`QJq7Z!?(s}Wpa z`FDbs7v0nPKlR{FU;We}0C7Stat3z{!vd-rI(0|=(Ege^VD%NQoRXp^!530}`SY<@tj7xNM5(rws&bAXY!W$3t*In2_RgPLd z&-8mBx4HS2o>O#E+a=@zBV)`c&K!})dC02@lIwh1Q7if|Buztye$F&@87^t+9ZM1PTv#G$GI|*;T@k&4; z3UN%+u7z!kI#71-*3;buLQ;Zwksx^|0U1am-^oHzWW=y4gR#!LRU5mlXXE2rj{&Gc zfB4nk->3Uq`@U$+8Lo)A7vjnd>?N7P9OES=SZ>g>OF?fA?SEa#I-?@G(rIAAR}{w; z;qgm>0clA-&wKPRD>vP9xbUHsf%2xk&@$GEA}2%X^i_1ei@>%+zR~k+v^aIgK-eE@ znQ9W~*RJQ#!i(o1!O51N`YHjgmA=}~*--xY_2fHeoIVY3S!}0wEz)sA4+r3gT{l@; zE}dXx{dz4cE#60ZZy zx-f3@!-t&r`NJItnj@A;&{v4xg+sw6<$ML#=K(6q@~P-d=JJR5`rs zXd`|ci8y`-Q*=>&)s(WNw9(XEeDlHJGg05N!R!2CIru99iB0ls6DlsgLSFm1RgEr= zHRu`~JnH`hpaqMbGY@x`tu%NKY08$l7vcAm_qWte8x?oTsCgT~wHRmOsn&u_R!eqA zKOuxBIOyYYjJLjsouIv`-VuNxd2qFEw z0~hlc2d?EN-ZxPaX9P|pwj5ctadpEQ^o<%i%N(@3Y(=}m-b+SGZqqOpW=Ly@ zz5b1=(t(w${myN1lse&vNJ~e7&vaPHmXQpcoxxO{kdN&$vpG&+&d$v&>UlbIhBdQn zT!+KGURQ>!vGBbX6}NHlj&s=nW$Z?C$yktkUnEE)M1VxNvNb_;NP;7E>;*Z}dXe`q zf~;AyH)1O+jhWc=x+PYOjCn&ZrdktRpEorDj59fb&)8a(T*h#t%i0iXs#Hy zR2D^rCcYRe65mN4N7aw|9p3ftS*FuFBrAGz7LjTcjA1xU+A!y*OydTZN>aOe4tw!!udehWO&}^|OhT$c z`6;YkpUD|>trIQ~HP9mJEdM)e`>&r`wLBve5(c$aAyfAs_q&8dW)zaN$Bk2ppM+d4MU_%`Kz&e-X9RvP z`Ean#QrcG*1{~17L5qN5Ptm8;D+|(iMuh(BYul8vao+_VgEZ_c4sut&n7i!eEwN5e zV=J!f#WsKN$F^>UB`=g~P8#vUmv?l8Un9YiI1GS7l@rd-&RFd?rc9?O_AN4%%e|KAE=Nd8v%xyewAvic70?1tgpDf+Sl9gJdFbHf#`kxF)Lzg))%VB< zAdVT@4i0K^?Cv6-uQRZo;i9fx2i_T$tN_W!3|P2bP@@;wTe@4$^g9t4WKn z{2E((d0M?n1MpHml{07}mx0uU3OYd?wV26WC)CA1=iK|?$>fcoLFi$B|HFNe)jz!V zhct{ngH`1raj)O$D8AGW<+FcaD>=(u!&Cx-H`0=1 zXKgNt@}p!%4%Ya3S0POhS`tqLlr*dF9R$eqBQ1_Gu>-t}D}%2Kidb+2lY{FR>UC;y z=c=*sW7;KMBmJ(*V%5hlx!}BMZ03TX2jo-JP2?)WgDiuIh3ABIJ3iH@ z)-A8`L$Y-2m9>ln-rg+6J?)9~p4)97#Mi)aW2)kp(E5pKs}>=lP$_Cr0mXqpx#{yk zGrdzR0uFg54FDUK0BG_&B~UeUThTuZWKe&wWcW=#EFfqAr6)?}GBZ_Q5vOXbJixlH zHi4}16~qR&`_+)tw`kFIO*yo4Ec-CRD#pdF3-XlbdwjaM!P!s9^YL$!+LzCN^s@Pz z@ZOpk%39E^dlOu&gSAuv`jW5P!d#s;u^;UNBeLD0`4 z++cbIw*bm2G>^cm6?12;Vyz(77~(r;rTTIAcmj7N$}Q5g+YX#Cct(~~DH=bw6J?H~ zh4N^v=c|`DZcS;5_m=Nu)(fK@RJ6O+6TOo~R>YJbQFRl_++%vt@?d@2;$Xug`K3z7 z_cOvSTB@ui^pJJcF4!+~VO;;v5=yKz17(&J{SlThFQL0D*u{mWytIJbhm0fRG@*e6^J&VVjv6l;||JJh3?qR0NZx9StQ zyn@5Iqy#N=lhdU>Omx3%WM#lK5a%uVm(3R@Tlg!#wJAICeS)2*1VC&KCV57PX5T)m zlCdmX)aw8wfKXaIYh_p!K3k!_SkP&7#DkL7-s-})AtAZ%zUf31Fa7K=LKrU9j2mbU zzVY$A;d10|M=Bm9J*0Tr{+cmKwzPxUp(Co_ux8S?EGrvU`b_#(RsVb<_Ll8-1QFN6 zUTf}crLi+)lHbML=`~<23n-Yc_4n+-`-x_Z>^j`{pW zg8Q(NtCTdWUb2Ju$=!Qn)ZD*5#dE$~x-!^**KlzwdlawH^>#dQUfVlEEyc^Kdsbwo zY+)ruJ%r@7ZaNGm9+YLb&z0UPdl@ue$Z_24K&z|R4$v0taaYG$fg!E2C8%1ZCn7s!aKsNh2y>L+ac4L>Z35!QpZ?ve{`>#_aO?TMKm0%a_n(#j zPfPeq&;L{MUy{s!y8KVc|EDGVrRV=C`7cT4KVAN>lBdIq1z9k!;cjkD0W113YmRnN z`mS2x3BS@YK?I3|!y5wLO8uiaRS1dd@lKpu6|VFyZ&?qEKehMI3;vYDpZf4;zxZX? z`2T%;P_j@uRw!mFXKkQOs=fbRUCXaYg@5{&gv>(!8%Ww0hWr3OUN~B%a!`^_^joFncqLe`v^5_pI_XdMbm0ZDiWS{&MGm(YiV z*$dK!KOJSRZ`HFJ+)m%Tm6V78LcIPxFoQ6MsfA91P%o%nWY2m^LCHRtQXnf)! zGCT%}2P4!44!&dQwGt=7r2MgE#_S*xH6OoN%6txNr3m+hpjd-=Hey$92}K+_oK}v3&@k(yJ=N7k;tvmWS8$Ea-rm~a~1S~>Vvu+ z`#4^k08h;yy`^-kGa1KVYP!z>^im5C$;~Q{FXKC@+ z8yD$t#kV%(cSkE2@Cq>kqU#Cqt(o#)b=u+vL7qXmPSg5@?h>rGC=KYaZK-TZ$p z{zI{wzyDULT`_93SQ#AVI_yJ%7*Cnb1j~Ets*;@&-|3tWZRu0`x|i2)D}PwYw!YGa z1%U1ueKh9LvL2{9u)2fsz{6+E6pei(DlTTYyn1X^EK^UWJCzH2c6EtH%W7?r)%0Sr zXw;?~%<20e%v!b*Zl$kU<}~GAeQMdPivAn28(tjjWun9AgdL0{&RfO8dVVUT5635e zCv%WG5g#A6(TCd0TvYDw+NPiauE6`B&oM*0JUVDeMMu>Sux0l7l|jTaEtIIM7PbU% z$SOMHgj9Lxs6DuM*$7GU{ux^X4$t!$RFY0c(VP;~1*9&D*+F$qD}L^(NXd>WHB4)d zUcT|}Fye3V<8jqTlM~^AmM;^-3JDn_Lyz7(LfRY0xE33o> z1kB9391PLnD^ToIjLOW5-Hf?Wgb})xabbk8?tyq<-Qe9O-|-OozDY&}3sc01=_-W2Z@w$5%<2AO6&bnMAb8E{g8H-S;Jub}*a7ea{9-d{Z73_(U z+IsoC>e$L!n2dVO2;a{R(DSJ1NzIFRDd*dVb+_4m2oIUS%pc0L(jQx@BIRYIa-V>? znOL%?sOO_=NqA10X#LG@xZP|J!0MQgnALxkUny!KX49#hl6=~(bx;Q(k-&r-%}oJ~ z@ouzmHeM~foGHlNHDLJ&;^pl9?6Q7&kL7?Xcgd1r>3N<;OSbx1b}+1Ji&9D#Wj*V!INoS^1#Jpe{ z+CEG$8Y)dyBCHB-7;?JKoXk`3bAb91T+8$BoS?2$isRd_b`+bYggR{HgYq!4?nkYx zLZJ*zr4hsv z0qf!u2~XQ7B?yRdiJ8hsOrcBjT~qP#BEIMAv;R1X><#nXCPp39`sMibZRcMu!u@i* zeF_=+h?@D7{LAt2pEv#~oIf>3(1rf&9lxl-zYHC}@>Tz1uqg2Lo%6Q@EqEB2kN_Go J|LEu8{{sV}f7bv2 literal 0 HcmV?d00001 diff --git a/docs/dpi-bypass.md b/docs/dpi-bypass.md new file mode 100644 index 00000000..c143d645 --- /dev/null +++ b/docs/dpi-bypass.md @@ -0,0 +1,39 @@ +# DPI bypass on Windows + +[Overview](../README.md) · [Installation](installation.md) + +Tenebra integrates [zapret](https://github.com/bol-van/zapret) on Windows. It changes packet presentation, including TLS handshake fragmentation and decoys, to try to avoid traffic-inspection rules. It runs alongside the tunnel; destinations routed directly can use it without going through the VPN exit. + +A running bypass process does not prove that a blocked service is reachable. Results depend on the network, destination and selected strategy. macOS and Linux do not include this Windows packet filter; their traffic follows the configured tunnel and direct-routing rules. + +## What is bundled + +Tenebra uses the [Flowseal/zapret-discord-youtube](https://github.com/Flowseal/zapret-discord-youtube) bundle: `winws.exe`, the [WinDivert](https://github.com/basil00/WinDivert) driver, the Cygwin runtime, strategies and host lists. + +One upstream archive is compiled into the Windows core. Its bytes are checked against the checksum pinned by the build. A missing bundle can therefore be installed without downloading it during a connection attempt. macOS and Linux binaries do not carry the archive. + +Under the Windows service, the installed bundle lives in: + +```text +%ProgramData%\Tenebra\data\zapret +``` + +## Installation and updates + +- **Service startup:** installs the embedded copy if no usable bundle is present, then restores the previously requested bypass state. +- **Connect:** can install the embedded copy if needed, without fetching an archive from the network. Bypass startup has a bounded budget; a failure is logged and the connection can proceed without it. +- **Background updates:** when enabled, the service checks upstream after its startup delay (45 seconds) and then every twelve hours. Downloads must match a checksum trusted by this Tenebra build. A release newer than the trusted pins is left uninstalled, with a message to update Tenebra. + +An existing usable bundle is not replaced by the embedded copy. A failed or rejected update keeps the existing bundle; connection attempts do not wait for a fresh download. + +The update check contacts GitHub. These are ordinary network requests, so GitHub can observe request metadata such as the source IP. Tenebra does not attach your VPN subscription to the bundle request. + +## Control downloads and bypass separately + +**Settings → Censorship bypass → Update the bundle automatically** controls scheduled checks and downloads. Turn it off to stop those requests; press **Update** to request a manual update. A bundle can also be installed manually into the directory above. + +The automatic-update preference does not disable the embedded copy: its installation uses bytes already shipped with Tenebra. Deleting the bundle directory is therefore not a lasting way to switch bypass off; startup or a later connect can install it again. + +Use the **bypass switch** to turn the packet filter off. The requested setting is saved even when stopping the filter reports an error; check the displayed outcome and logs to confirm that the stop completed. When bypass is off or unavailable, traffic follows the applicable routing configuration, and directly routed destinations may remain blocked by the network. + +All bundled components, license terms and copyright holders are listed in [Third-party notices](../THIRD-PARTY-NOTICES.md#2-components-downloaded-at-runtime). diff --git a/docs/installation.md b/docs/installation.md new file mode 100644 index 00000000..bd70f4fc --- /dev/null +++ b/docs/installation.md @@ -0,0 +1,68 @@ +# Installing Tenebra + +[Overview](../README.md) · [Русское описание](../README.ru.md) · [All release packages](https://github.com/Divaaaan/tenebra/releases/latest) + +Tenebra needs your own subscription or compatible server link. Desktop packages are available for Windows, macOS and Linux; Android and iOS are outside the 0.6.0 release. + +## Windows + +1. Download [Tenebra 0.6.0 for Windows x64](https://github.com/Divaaaan/tenebra/releases/download/v0.6.0/Tenebra_0.6.0_x64-setup.exe), or choose a version from [Releases](https://github.com/Divaaaan/tenebra/releases). +2. Run the installer and approve the administrator prompt to install the background service. +3. Open Tenebra from your ordinary Windows account, import your connection details and select a server. + +The service owns the tunnel; the desktop interface communicates with it. The installer and in-app updater coordinate application and service updates. An offered update may restart the app and interrupt its connection. + +The Windows installer is **not Authenticode-signed**, so SmartScreen may warn. Download from the project's release page. The in-app updater verifies artifacts with the project's minisign key; that signature is separate from Windows code signing. + +The 0.6.0 Windows acceptance scope includes installation, both UI modes under an ordinary user at 100% and 150% scaling, IPv4, system-proxy handling and selected crash/recovery cases. The complete IPv6, BFE and reboot matrix is still open. See [host-protection acceptance](host-protection-acceptance.md) and [delivery acceptance](delivery-acceptance.md) for the acceptance requirements. + +## macOS + +**For advanced users.** The universal DMG is unsigned and unnotarized, and the tunnel requires a manually installed root LaunchDaemon. Opening the app alone does not set up that daemon. Native live-tunnel acceptance for 0.6.0 is not complete. + +1. Download the DMG from [the latest release](https://github.com/Divaaaan/tenebra/releases/latest) and put the app in `/Applications`. +2. If Gatekeeper blocks launch, use **System Settings → Privacy & Security → Open Anyway** for the downloaded app. +3. From a checkout of the matching release source, install the daemon: + + ```sh + sudo bash scripts/macos/install-daemon.sh --from-app /Applications/Tenebra.app --allow-unsigned + ``` + +The in-app updater replaces the app, **not the root daemon**. After an update, use a matching source checkout and re-run the command above. The app warns when the daemon version falls behind. A bundled, signed and notarized helper installation path is planned; see the [macOS port notes](porting/macos.md). + +## Linux + +The GUI needs a privileged **systemd service** to create `/dev/net/tun` and install routes. It communicates with that service through `/run/tenebra.sock`; the GUI alone cannot connect. Native live-tunnel acceptance for 0.6.0 is not complete. + +### Arch Linux + +From a checkout of the release source: + +```sh +cd packaging/arch +makepkg -si +sudo systemctl enable --now tenebra.service +``` + +The [PKGBUILD](../packaging/arch/PKGBUILD) builds and installs the core, desktop app and service. Updates are managed through `pacman`; the in-app updater cannot replace package-managed files. Prebuilt release assets are listed on [Releases](https://github.com/Divaaaan/tenebra/releases/latest). + +### Other distributions + +From a checkout of the release source, fetch the resources and install the service: + +```sh +bash scripts/fetch-resources.sh +sudo bash scripts/linux/install-daemon.sh --dev +``` + +Install the GUI separately using the release `.deb` or AppImage. Re-run the service installer when upgrading the daemon; it supports rollback if an upgrade fails. To remove the service, use [`scripts/linux/uninstall-daemon.sh`](../scripts/linux/uninstall-daemon.sh). + +**Linux limitations:** system-proxy mode is unsupported; use TUN mode, the default. Bundled sing-box binaries use glibc, so musl distributions need a compatible engine build. The in-app updater can replace an AppImage but cannot update a package-managed installation or its root service. See the [Linux port notes](porting/linux.md) for setup and service sandbox details. + +## Connection and diagnostics + +Import a subscription URL, supported share link, text file or QR image. Provider formats and server settings must be compatible with the supported protocols; a subscription from an arbitrary provider is not guaranteed to work. + +If a connection fails, inspect the reported service, engine or proxy error and the app logs. Public-IP and DNS probes report limited observations, not a universal leak-protection verdict. Before posting a report, remove subscription URLs, credentials and other private data. + +[Get help](https://github.com/Divaaaan/tenebra/discussions) · [Report a bug](https://github.com/Divaaaan/tenebra/issues/new/choose) · [Build from source](development.md)