From 851de1d0a3f78992888437526d97272c55cb63b9 Mon Sep 17 00:00:00 2001
From: Xavier Puspus <36430014+xmpuspus@users.noreply.github.com>
Date: Fri, 31 Jul 2026 18:50:59 -0500
Subject: [PATCH 1/2] Rebuild the public face for v1.8.0: new demos, README cut
to 139 lines
The README led with a hero GIF from 2026-05-01 that showed none of review,
compliance, plan or integrate, and 53% of its 251 lines were six stacked
"What's new" sections back to v1.3.0.
Demos, all re-recorded against the shipped 1.8.0 CLI:
- Hero now runs init, cost, compliance and plan, and ends on the DEPLOYABLE
verdict from terraform validate. 300 KB, 30s.
- New review demo: cloudwright review scores the patient-portal spec, then
--traceability maps each component and resource to a violated HIPAA control.
320 KB, 20s.
- The controls web demo loses 15s of plan spinner and drops to 2.4 MB.
- The smart canvas demo is current and unchanged.
Assets: deleted 12 orphaned GIFs that nothing referenced, 15.9 MB. The four
GIFs the README embeds now total 6.0 MB, down from 25.4 MB across 16 files.
Tapes: the hero tape hardcoded a path into .claude/worktrees/v1.3-audit-fixes
and sourced its venv. Pruning that worktree would have made vhs record a broken
shell with no error. Both tapes now run from the main checkout and write into
the gitignored tmp/.
Docs: cli-reference.md documents integrate, the last of 25 commands missing.
Its mcp --tools list gained review, compliance and plan, which shipped in 1.7.0.
No version bump. Docs and assets only.
---
README.md | 256 ++++++---------------
docs/cli-reference.md | 37 ++-
examples/cloudwright-controls-demo.gif | Bin 347064 -> 0 bytes
examples/cloudwright-controls-web-demo.gif | Bin 3670216 -> 2464161 bytes
examples/cloudwright-databricks-demo.gif | Bin 1573513 -> 0 bytes
examples/cloudwright-demo.gif | Bin 2061529 -> 0 bytes
examples/cloudwright-dryrun-demo.gif | Bin 257947 -> 0 bytes
examples/cloudwright-hero.gif | Bin 1219554 -> 306544 bytes
examples/cloudwright-mcp-demo.gif | Bin 183616 -> 0 bytes
examples/cloudwright-mcp-showcase.gif | Bin 464742 -> 0 bytes
examples/cloudwright-review-demo.gif | Bin 512975 -> 326603 bytes
examples/cloudwright-schema-demo.gif | Bin 71309 -> 0 bytes
examples/cloudwright-security-demo.gif | Bin 102105 -> 0 bytes
examples/cloudwright-v035-demo.gif | Bin 1652539 -> 0 bytes
examples/cloudwright-v040-demo.gif | Bin 1449026 -> 0 bytes
examples/cloudwright-v100-demo.gif | Bin 9276032 -> 0 bytes
examples/cloudwright-v110-demo.gif | Bin 552682 -> 0 bytes
examples/tapes/cloudwright-hero.tape | 82 ++++---
examples/tapes/cloudwright-review.tape | 42 ++++
scripts/controls_demo.tape | 42 ----
scripts/review_demo.tape | 38 ---
21 files changed, 204 insertions(+), 293 deletions(-)
delete mode 100644 examples/cloudwright-controls-demo.gif
delete mode 100644 examples/cloudwright-databricks-demo.gif
delete mode 100644 examples/cloudwright-demo.gif
delete mode 100644 examples/cloudwright-dryrun-demo.gif
delete mode 100644 examples/cloudwright-mcp-demo.gif
delete mode 100644 examples/cloudwright-mcp-showcase.gif
delete mode 100644 examples/cloudwright-schema-demo.gif
delete mode 100644 examples/cloudwright-security-demo.gif
delete mode 100644 examples/cloudwright-v035-demo.gif
delete mode 100644 examples/cloudwright-v040-demo.gif
delete mode 100644 examples/cloudwright-v100-demo.gif
delete mode 100644 examples/cloudwright-v110-demo.gif
create mode 100644 examples/tapes/cloudwright-review.tape
delete mode 100644 scripts/controls_demo.tape
delete mode 100644 scripts/review_demo.tape
diff --git a/README.md b/README.md
index a6e1e63..b9294dc 100644
--- a/README.md
+++ b/README.md
@@ -2,17 +2,9 @@
*Describe a cloud architecture in English. Get Terraform, costs, and a compliance check.*
-[](https://pypi.org/project/cloudwright-ai/)
-[](https://github.com/xmpuspus/cloudwright/actions/workflows/ci.yml)
-[](LICENSE)
-[](https://pypi.org/project/cloudwright-ai/)
-[](https://glama.ai/mcp/servers/xmpuspus/cloudwright)
+[](https://pypi.org/project/cloudwright-ai/) [](https://github.com/xmpuspus/cloudwright/actions/workflows/ci.yml) [](LICENSE) [](https://pypi.org/project/cloudwright-ai/) [](https://glama.ai/mcp/servers/xmpuspus/cloudwright)
-
- 
-
-
-Prompt to spec, cost breakdown, compliance check, and Terraform in one pass.
+
```bash
pip install 'cloudwright-ai[cli]'
@@ -20,83 +12,93 @@ export ANTHROPIC_API_KEY=sk-ant-...
cloudwright design "HIPAA healthcare API on AWS with Postgres and Redis"
```
-Cloudwright takes a one-line description of a cloud system and produces a structured architecture spec, a per-component cost breakdown, a compliance report, and ready-to-apply Terraform, Pulumi (TypeScript or Python), or CloudFormation. It works across AWS, GCP, Azure, and Databricks. The latest work adds compliance scanning that maps every finding to the framework control it violates (HIPAA / SOC 2 / FedRAMP / PCI-DSS / ISO 27001 / NIST), a `cloudwright plan` step that proves the exported infrastructure actually deploys, and live import for GCP and Azure alongside AWS.
+Cloudwright turns one line of English into a typed spec, a cost breakdown, a control-mapped compliance report,
+and infrastructure code. It covers AWS, GCP, Azure and Databricks across 114 service keys. Only `design`,
+`modify`, `chat` and `adr` call a model. Every other command runs offline and needs no API key.
+
+[Quickstart](#quickstart) · [Compliance](#every-finding-carries-the-control-id-it-violates) · [Agents](#one-mcp-server-reaches-11-coding-agents) · [Docs](docs/) · [Changelog](CHANGELOG.md)
-[Try it](#quickstart) - [What's new](#whats-new) - [Docs](docs/) - [MCP server](#mcp-server-works-with-every-mcp-client)
+## A prompt produces a spec, a cost, a control-mapped report, and Terraform
-## What you get
+- **Spec.** Typed YAML you commit, diff and review. Everything below reads from it.
+- **Cost.** Per component and region-aware, with a confidence flag on every line.
+- **Compliance.** HIPAA, SOC 2, PCI-DSS, FedRAMP, GDPR, ISO 27001 and NIST 800-53 control IDs.
+- **Infrastructure code.** Terraform, OpenTofu, Pulumi (TypeScript or Python) and CloudFormation.
+- **Diagrams.** ASCII, Mermaid, D2, and a web canvas you can edit by hand.
+- **An MCP server**, so any coding agent runs the same checks inside its own loop.
-- Architecture spec (typed YAML, version-controlled, the single source of truth)
-- Cost breakdown across AWS, GCP, Azure, Databricks (region-aware, per-component, four pricing tiers, optional carbon + FOCUS CSV export). Each line carries a confidence flag — `high` from the bundled price catalog (deepest on AWS), `low` from formula/fallback — so an estimate never silently passes off a guess as a quote.
-- Compliance report covering HIPAA, SOC 2, PCI-DSS, FedRAMP Moderate, GDPR, NIST 800-53, and Well-Architected, with OSCAL 1.1.2 export and control traceability
-- Terraform, OpenTofu, Pulumi (TypeScript or Python), and CloudFormation export with safe defaults (encryption, IMDSv2, locked-down S3, sensible RDS settings)
-- Diagrams in ASCII, Mermaid, D2, and a fully editable web canvas
-- MCP server for AI agents (Claude Desktop, Cursor, Cline, and any MCP-compatible client)
+Exports carry safe defaults. S3 gets a public-access block, SSE and versioning. RDS gets encryption, multi-AZ
+and deletion protection. EC2 gets IMDSv2. A compliance framework overrides the workload profile, and always
+forces encryption and high availability.
## Quickstart
```bash
cloudwright design "HIPAA healthcare API on AWS with Postgres and Redis"
cloudwright cost spec.yaml --workload-profile medium
-cloudwright validate spec.yaml --compliance hipaa,soc2
+cloudwright compliance spec.yaml --frameworks hipaa,soc2
cloudwright export spec.yaml --format terraform -o ./infra
-cloudwright chat --web # browser canvas at http://localhost:8765
+cloudwright plan spec.yaml --target terraform # proves it deploys, never applies
+cloudwright chat --web # canvas at http://localhost:8765
```
-All commands except `design`, `modify`, `chat`, and `adr` work fully offline. Set `ANTHROPIC_API_KEY` (preferred) or `OPENAI_API_KEY` to enable the LLM-powered ones. Drop `--json` on any command for machine-readable output.
+Add `--json` before any subcommand for machine-readable output, or `--stream` to watch tokens arrive. Set `ANTHROPIC_API_KEY` or `OPENAI_API_KEY` for the four commands that need a model.
-## Smart Canvas + Module Catalog (v1.2)
+## Every finding carries the control ID it violates
-
- 
-
+
-Drag-and-drop canvas with per-provider resource catalog, approved modules, and standards checks.
+Other tools scan infrastructure after you deploy it. Cloudwright maps each finding to its control before any
+resource exists. The fix then costs a spec edit, not a change ticket. HIPAA `164.312(a)(2)(iv)`, SOC 2 `CC6.1`
+and FedRAMP `SC-28` come from the built-in scanner, with no extra tooling. Checkov folds into the same report
+when it sits on your PATH.
-The web diagram is a fully editable architecture canvas. Edits (add, drag, connect, edit fields, delete) are deterministic frontend mutations, so they are instant, free, and reproducible. They do not call the LLM.
+- `--oscal` writes an OSCAL 1.1.2 component-definition with deterministic UUIDs.
+- `--traceability` prints the chain from component to resource to control to status.
+- `cloudwright plan` runs `terraform validate` against the export, and never applies.
-A left-side **Catalog drawer** has three tabs:
+## The review needs no API key and no network
-- **Resources** - the full catalog for the active provider, served by `/api/catalog/services` (case-insensitive `?provider=`).
-- **Modules** - approved multi-resource patterns from `/api/modules`. Bundled: AWS Three-Tier Web, AWS Serverless API, AWS Data Lake, GCP Serverless API, Azure Three-Tier Web.
-- **Standards** - runs `POST /api/canvas/validate` and surfaces orphan connections, partial modules, unapproved modules, naming-prefix violations, and missing required tags.
+
-When a module instance is intact, the Terraform exporter emits a single `module ""` block with the catalog's pinned `source` and `version`. Modified modules fall back to per-component resource rendering. Mixed specs work: catalog modules render as modules, ad-hoc resources as resources, side by side.
+`cloudwright review` runs the scorer, the linter and the validator over a spec, and returns one severity-ranked
+report. The same three critics run inside `cloudwright design`. When blocking findings survive generation, the
+architect repairs the spec once and records the change in `spec.metadata.critique`. Pass
+`Architect(repair=False)` to turn that off.
-```bash
-cloudwright chat --web
-# Open http://localhost:8765, use the Catalog drawer, then Export -> Terraform
-```
+## Canvas edits never call the model, so they are instant and free
+
+
-## MCP server (works with every MCP client)
+Add, drag, connect, edit and delete are deterministic frontend mutations. The Catalog drawer serves the resource
+list per provider and five approved multi-resource modules. Its standards check flags orphan connections,
+partial modules and missing tags. An intact module exports as a single Terraform `module` block, with the
+catalog's pinned source and version.
-Expose Cloudwright as [Model Context Protocol](https://modelcontextprotocol.io/) tools so AI agents can design, cost, validate, review, check compliance, plan, and export architectures directly. Almost every popular coding agent is an MCP client (Claude Code, Cursor, Cline, Windsurf, GitHub Copilot, Zed, OpenAI Codex CLI, JetBrains Junie, Kiro, Antigravity), so one server puts cloudwright inside all of their agent loops. Tool groups: design, cost, validate, analyze, export, session, review, compliance, plan.
+## One MCP server reaches 11 coding agents
```bash
-pip install cloudwright-ai-mcp
-cloudwright mcp # all tools, stdio
-cloudwright mcp --tools design,cost,review # subset
-cloudwright mcp --transport sse # SSE for HTTP clients
+cloudwright integrate --harness claude-code # exact wiring, in that client's format
+cloudwright integrate --harness cursor --write # merge it into the right file
+cloudwright integrate --rules --agent-file claude # a gate block for CLAUDE.md
```
-Do not hand-write the config. `cloudwright integrate --harness ` prints the exact wiring for your agent in its own format, and `--write` merges it into the right file. For a manual setup, the base shape (Claude Code, Cursor, Cline, Windsurf, Copilot, Junie) is:
-
-```json
-{
- "mcpServers": {
- "cloudwright": {
- "command": "cloudwright",
- "args": ["mcp"]
- }
- }
-}
-```
+Do not hand-write the config. `cloudwright integrate` emits it for Claude Code, Cursor, Cline, Windsurf, GitHub
+Copilot, Zed, Codex CLI, Junie, Kiro and Antigravity. Aider gets a CLI-pipe recipe instead, because it speaks
+no MCP. Every client wants a different shape: Zed wants `context_servers`, Copilot wants `servers`, and Codex
+wants a TOML table.
-Zed uses `context_servers`, VS Code Copilot uses `servers`, and Codex CLI uses a `[mcp_servers.cloudwright]` TOML table. `cloudwright integrate` emits the right one for each, and Aider (not an MCP client) gets a CLI-pipe recipe. Full matrix in [docs/integrations.md](docs/integrations.md).
+The server exposes 22 tools in 9 groups: design, cost, validate, analyze, export, session, review, compliance
+and plan. Full matrix in [docs/integrations.md](docs/integrations.md).
-## Analysis
+## Nine offline commands grade, lint and diff a spec
-`cloudwright lint` (10 anti-pattern checks), `cloudwright score` (5-dimension quality grade), `cloudwright analyze` (blast radius and SPOF), `cloudwright drift ` (design vs deployed), `cloudwright policy --rules policy.yaml` (policy-as-code with 9 built-in checks), `cloudwright security` (security anti-patterns; also scans exported Terraform HCL), `cloudwright compliance --frameworks hipaa,soc2,fedramp` (every finding mapped to its HIPAA / SOC 2 / FedRAMP / PCI-DSS / ISO 27001 / NIST control ID, with optional Checkov deep scan), and `cloudwright plan --target terraform` (proves the exported artifact validates / plans). Every command supports `--json`. See [docs/](docs/) and the `examples/` directory for end-to-end samples.
+`lint` runs 10 anti-pattern checks. `score` grades 5 dimensions. `analyze` reports blast radius and single
+points of failure. `policy` enforces policy-as-code with 9 built-in rules. `security` scans the spec and the
+exported HCL. `drift` compares a design against a `tfstate`, and `--remediate` turns the gap into a cost,
+compliance and plan preview.
+
+`review`, `compliance` and `plan` are above. See [docs/cli-reference.md](docs/cli-reference.md).
## Python API
@@ -108,144 +110,30 @@ from cloudwright.exporter import export_spec
spec = ArchSpec.from_file("spec.yaml")
priced = CostEngine().estimate(spec, workload_profile="medium")
-results = Validator().validate(spec, compliance=["hipaa", "pci-dss"])
+findings = Validator().validate(spec, compliance=["hipaa", "pci-dss"])
hcl = export_spec(spec, "terraform", output_dir="./infra")
```
-
-
-## What's new in v1.8.0
-
-The web canvas got a full interface rebuild. It has a dark theme, it works down to a phone, and it follows the WAI-ARIA tabs pattern. Twelve behaviour bugs went with it. One of them billed a second architecture generation after a mid-stream error.
-
-
- 
-
-
-- **One stylesheet, one token set, and a dark theme.** Colour, spacing, radius and type come from CSS custom properties. The theme follows the operating system until you pick a side. Every text colour clears the 4.5:1 contrast floor. 29 sites did not.
-- **It works on a phone.** The layout was a hard 420px sidebar and no media query anywhere. Below 900px it is now a two-pane switch. The nine tabs scroll instead of clipping. `100dvh` keeps the composer above the iOS URL bar.
-- **Keyboard and screen reader.** The tab bar is a real `tablist` with arrow-key roving focus. Every control shows a focus ring. A live region announces design progress. `Cmd/Ctrl+K` focuses the composer and `Cmd/Ctrl+1..9` picks a tab.
-- **A mid-stream error no longer bills twice.** The stream could fail after the spec arrived. The fallback then ran a second generation, and that architecture replaced the first. The retry now runs only when the stream gives nothing.
-- **Panel results survive a tab switch.** Run a HIPAA scan, look at Cost, come back. The panel used to be empty.
-- **Three more export formats.** OpenTofu, Pulumi TypeScript and Pulumi Python shipped in the exporter with no button. The Export tab now offers all thirteen, in groups.
-- **Failures say so.** Diagram export, module insert, the standards check and the download failed silently. Each one now raises a toast with the server message.
-- **The YAML tab shows the server YAML.** A client-side serialiser quoted nothing, so `region: no` read back as the boolean false.
-- **The catalog drawer starts closed.** It opened over the diagram on every page load.
-- **The composer is a textarea.** Shift+Enter adds a line. An input-method candidate no longer submits mid-word. You can stop a running generation.
-
-## What's new in v1.7.0
-
-Cloudwright's design-time checks now reach every coding agent, not just its own CLI. Almost every popular AI coding harness speaks MCP, so one server puts `review`, `compliance`, and `plan` inside their agent loops.
-
-- **`cloudwright integrate` wires cloudwright into 11 harnesses.** It writes the MCP server config in each client's own format (Claude Code, Cursor, Cline, Windsurf, GitHub Copilot, Zed, OpenAI Codex CLI, JetBrains Junie, Kiro, Antigravity), and gives Aider the CLI-pipe path. `cloudwright integrate --rules` emits a gate block for AGENTS.md, CLAUDE.md, or GEMINI.md that tells any agent to run `cloudwright review`/`cost`/`compliance` before it writes infrastructure. See [docs/integrations.md](docs/integrations.md).
-- **The MCP server exposes the differentiators.** New `review_architecture` (offline critique, no key), `scan_compliance_controls` (control-mapped, with an `oscal` flag), and read-only `plan_infrastructure` tools. Every MCP client gets them.
-- **Review and OSCAL on the web canvas.** A Review tab (score, grade, findings) and an OSCAL JSON download on the Compliance panel.
-- **Cost stops overclaiming.** Estimates report `prices_as_of` (catalog vintage) separately from `estimated_on` (today), show a "17/20 catalog-backed" ratio, carry per-alternative confidence in `compare`, and use a real regional price row when the catalog has one. [docs/provider-coverage.md](docs/provider-coverage.md) states per-provider coverage plainly.
-- **Web hardening.** Diagram rendering no longer blocks the event loop, spec payloads are size- and component-capped, the container refuses to serve unauthenticated by accident, and malformed input returns a clean error instead of a traceback.
-
-```bash
-cloudwright integrate --harness claude-code # MCP config for your agent
-cloudwright integrate --rules --agent-file claude # gate block for CLAUDE.md
-```
-
-## What's new in v1.6.0
+## v1.8.0 rebuilt the canvas and stopped a mid-stream double bill
-
-
-
-
-`cloudwright review` — offline scorer + linter + validator in one report — then the same findings exported as OSCAL.
-
-The design engine now reviews and repairs its own output, compliance binds at design time with OSCAL output, and the cost estimate stops guessing silently.
-
-- **The architect self-corrects.** Every `cloudwright design` runs the built-in critics (scorer, linter, validator) against the generated spec and, when blocking findings remain, repairs it in one bounded pass before you ever see it — recorded in `spec.metadata.critique`. The same engine is a free, offline command: `cloudwright review spec.yaml` gives a severity-ranked architecture review with no API key.
-- **OSCAL + control traceability.** `cloudwright compliance spec.yaml --frameworks fedramp --oscal` emits an OSCAL 1.1.2 component-definition — control mapping a CSPM or evidence tool cannot produce before deploy. `--traceability` prints the chain design intent -> component -> Terraform resource -> control ID -> status.
-- **Cost you can defend.** Region-aware pricing (every region used to be priced as us-east-1), data-transfer/egress estimation, a per-line pricing confidence (`high` = catalog, `low` = fallback), design-time carbon (`cloudwright cost --carbon`), and FOCUS-spec CSV export (`--focus`).
-- **Drift -> remediation and OpenTofu.** `cloudwright drift ... --remediate` turns drift into a cost + compliance + plan preview (read-only). `cloudwright export --format opentofu` and a tofu-aware `plan`.
-- **Hardening.** Terraform exporter injection hardening, `cloudwright plan` no longer carries the LLM key into the IaC subprocess, the WAF export is deployable, and the "compliance overrides workload profile" guarantee is now actually enforced for sandbox specs.
-
-```bash
-cloudwright review spec.yaml # offline, no API key
-cloudwright compliance spec.yaml --frameworks fedramp --oscal # OSCAL component-definition
-cloudwright cost spec.yaml --carbon --focus # region-aware + carbon + FOCUS CSV
-cloudwright export spec.yaml --format opentofu -o ./infra
-```
+- **One token set and a dark theme.** The theme follows your operating system until you pick a side.
+- **Every text colour clears the 4.5:1 contrast floor.** 29 sites did not.
+- **It works on a phone.** Below 900px the layout becomes a two-pane switch, and the nine tabs scroll.
+- **A mid-stream error no longer bills twice.** The old fallback ran a second generation over the first.
+- **A real `tablist` with arrow-key roving focus**, a live region for progress, `Cmd/Ctrl+K` for the composer.
+- **Panel results survive a tab switch.** The Export tab now offers all thirteen formats.
-See [docs/](docs/) for getting-started, CLI, MCP, and troubleshooting guides.
-
-## What's new in v1.5.0
-
-Terminal — `cloudwright compliance` maps every finding to its framework control ID, then `cloudwright plan` proves the Terraform validates:
-
-
- 
-
-
-Web canvas — the same checks as Compliance and Plan tabs:
-
-
-
-
-
-
-
-  |
-  |
-
-
-
-- **Compliance scanner with framework control-ID mapping.** `cloudwright compliance spec.yaml --frameworks hipaa,soc2,fedramp` maps every design-stage finding to the exact control it violates — HIPAA `164.312(a)(2)(iv)`, SOC 2 `CC6.1`, FedRAMP `SC-28`, plus PCI-DSS, GDPR, ISO 27001, NIST 800-53 — before any infrastructure exists. No competitor maps findings to control IDs at design time. The mapping runs on the built-in scanner with zero external tooling; when the Checkov binary is present it is run against the exported Terraform and its `CKV_*` findings fold into the same control-mapped report. Per-framework posture table, audit-ready markdown report (`-o report.md`), `POST /api/compliance`, and a Compliance tab in the canvas. `pip install 'cloudwright-ai[compliance]'` for the Checkov deep scan; the control mapping works without it.
-- **`cloudwright plan` — prove it deploys.** `cloudwright plan spec.yaml --target terraform` runs `terraform validate` (and `terraform plan` when credentials are present) against the generated artifact; `--target pulumi-python|pulumi-ts` runs `pulumi preview`. Read-only — nothing is applied. `validate` needs no credentials and is the offline proof of deployability; `plan` adds a real `+add ~change -destroy` diff when credentials resolve. DEPLOYABLE / NOT DEPLOYABLE verdict in the CLI, `POST /api/plan`, and a Plan tab in the canvas.
-- **Live GCP and Azure import.** `cloudwright import-live --provider gcp --project PROJECT` (Compute Engine, Cloud Storage, Cloud SQL) and `--provider azure --subscription SUB_ID` (Virtual Machines, Storage Accounts, Azure SQL, AKS) join the existing AWS importer — same lazy-SDK, fast-fail-on-credentials, non-fatal-per-service-permission-guard pattern, with security posture captured per resource. `pip install 'cloudwright-ai[live-import]'`.
-
-The demos above are reproducible: `vhs scripts/controls_demo.tape` (terminal) and `python scripts/record_controls_demo.py` against a local web server (template-matched prompt, no API key required).
-
-## What's new in v1.4.0
-
-
-
-- **Pulumi exporter (TypeScript + Python).** `cloudwright export spec.yaml --format pulumi-ts -o ./infra` writes a complete Pulumi TypeScript project (`index.ts`, `Pulumi.yaml`, `package.json`, `tsconfig.json`). `--format pulumi-python` writes the Python equivalent. AWS, GCP, and Azure coverage matches the Terraform exporter, with the same safe-by-default posture (S3 public-access block + AES256 + versioning, RDS encryption + 7-day backups + deletion protection, EC2 IMDSv2, DynamoDB SSE + PITR, CloudFront TLSv1.2_2021, CloudTrail log-file validation). Aliases `pulumi-typescript` and `pulumi-py` also work.
-- **Live AWS import.** `cloudwright import-live --provider aws --region us-east-1 [--profile NAME] [--services ec2,rds,s3] [-o spec.yaml]` walks `boto3 describe-*` calls (EC2, VPC + subnets + security groups, RDS, S3, Lambda, ECS, EKS, DynamoDB, ALB / NLB, CloudFront, SQS, API Gateway, CloudTrail) and produces an ArchSpec from running infrastructure. Captures security posture (S3 encryption + versioning + public-access-block, RDS multi-AZ + backup retention, EC2 IMDSv2, SG ingress 0.0.0.0/0). Best-effort connection inference: ALB to EC2 via target groups, CloudFront to S3 via origin domains. Per-service permission denials are non-fatal. Optional dep: `pip install 'cloudwright-ai[live-import]'`.
-- **Two-stage prompting plus boundary-aware spec.** `Architect.design()` now runs Stage 1 (free-text architectural reasoning via Sonnet) followed by Stage 2 (strict JSON projection via Haiku). Stage 2 is told the canonical service keys, allowed connection kinds (`sync_request | async_event | stream | replication | batch`), and boundary kinds (VPC / subnet / security_group / availability_zone / region / account), so it projects faithfully without redesigning. VPCs, subnets, and SGs are now first-class in the LLM contract. Per-stage usage (`stage1`, `stage2`, `total_cost_usd`, `two_stage: true`) is exposed on `/api/design`, `/api/modify`, and their streaming variants. Single-shot path retained as fallback (`Architect(two_stage=False)`).
-- **Workload-aware safe defaults.** Pre-v1.4, `_post_validate` forced `encryption=true`, `multi_az=true`, `backup=true`, `auto_scaling=true`, and `count=2` onto every spec, masking Stage 1 reasoning. v1.4 makes these conditional on `spec.metadata.workload_profile`: `sandbox`, `dev`, `test`, `demo`, `poc` keep the LLM's chosen values; `production`, `medium`, `large`, `enterprise` get safe defaults forced. Compliance frameworks (HIPAA, PCI-DSS, SOC 2, GDPR, FedRAMP, HITRUST, ISO 27001) always force encryption + HA regardless of profile.
-- **GitHub Action for PR previews.** Drop-in workflow posts an idempotent comment with architecture diff (added / removed / changed components), monthly cost delta (head vs. base, with annual rollup), and per-framework compliance changes whenever a PR touches `*.tf`, `*.tfstate`, `cloudwright.yaml`, or `spec.yaml`. Reusable composite action at `.github/actions/cloudwright-pr-comment/`. See [`docs/github-action.md`](docs/github-action.md).
-- **Refreshed Smart Canvas demo GIF** (`examples/cloudwright-smart-canvas-demo.gif`) showing prompt to diagram to catalog drawer to add resource to side-panel edit to cost recomputation against the current UI. Reproducible via `python scripts/record_smart_canvas.py`.
-- **Cancel-safe streaming via `AsyncAnthropic` and `AsyncOpenAI`.** `chat/stream` and `design/stream` now use native async clients instead of a `threading.Thread` + `asyncio.Queue` bridge. When a client disconnects mid-stream, `CancelledError` propagates into the SDK's `async with` block and closes the upstream HTTPX connection, so the LLM call stops billing tokens at disconnect rather than at completion. Eliminates orphan threads and queue-full data loss. Sync `send_stream` / `generate_stream` paths are preserved for the CLI; only the web routers switched.
-
-## What's new in v1.3.0
-
-- **Safe-by-default Terraform.** S3 public-access blocks, RDS `storage_encrypted` and `deletion_protection`, EC2 IMDSv2, security-group ingress restricted to listed CIDRs.
-- **HCL injection-safe escaping.** All Terraform exporters (AWS, GCP, Azure, Databricks) escape user-supplied config values before interpolation.
-- **Per-model LLM pricing.** Haiku (fast classifier) and Sonnet (designer) billed at their respective rates instead of a single hardcoded rate.
-- **Anthropic prompt caching.** Roughly 70-80% input-token savings on chat follow-ups, with measurable latency improvement.
-- **Atomic SessionStore writes.** No more session corruption on SIGKILL or disk full mid-write.
-- **Constant-time API key comparison.** Web API auth is now timing-attack hardened.
-- **FedRAMP region allowlist.** `us-east-1` is no longer flagged as FedRAMP-authorized; the validator now matches the actual GovCloud / FedRAMP-authorized region set.
-- **Health and version endpoints.** `/health` returns version, configured model, and catalog status. New `/api/version`.
-- **Request correlation IDs.** Every web request gets an `X-Request-Id`, plumbed through router logs.
-- **`--debug` flag works.** Used to be a silent no-op; now prints prompts, timing, and token counts.
-- **`cloudwright chat --web` pinned to port 8765** to match docs and MCP/Slack integrations.
-- **Cost in design responses.** `/api/design` and `/api/modify` now return cost in the response payload.
-- **Swagger UI gated.** `/docs` is off in production by default; set `CLOUDWRIGHT_DOCS_ENABLED=true` to expose it.
+Earlier releases added control-ID mapping and `plan` (v1.5.0), the self-correcting architect and OSCAL (v1.6.0), and `cloudwright integrate` (v1.7.0). Full history in [CHANGELOG.md](CHANGELOG.md).
## Compatibility
- Python 3.12+
-- LLM providers: Anthropic (Claude Sonnet, Haiku) and OpenAI (GPT-5+ family). Auto-detected from env.
-- Clouds: AWS, GCP, Azure, Databricks. 112 service keys total.
+- Models: Anthropic (Claude Sonnet, Haiku) and OpenAI (GPT-5+ family), auto-detected from env.
+- Clouds: AWS, GCP, Azure, Databricks. 114 service keys total.
- Install variants: `cloudwright-ai[cli]`, `cloudwright-ai[web]`, `cloudwright-ai-mcp`.
## Contributing, license, changelog
- Contributing guide: [CONTRIBUTING.md](CONTRIBUTING.md)
-- License: MIT - see [LICENSE](LICENSE)
+- License: MIT, see [LICENSE](LICENSE)
- Full release history: [CHANGELOG.md](CHANGELOG.md)
diff --git a/docs/cli-reference.md b/docs/cli-reference.md
index 4f42d26..2215daf 100644
--- a/docs/cli-reference.md
+++ b/docs/cli-reference.md
@@ -17,7 +17,7 @@ cloudwright [--json] [--stream] [--verbose] [--dry-run] ...
| Flag | Description |
|---|---|
| `--json` | Output as JSON instead of rich terminal output |
-| `--stream` | NDJSON streaming — one JSON object per line (combine with `--json`) |
+| `--stream` | NDJSON streaming, one JSON object per line (combine with `--json`) |
| `--dry-run` | Preview LLM calls without making them (shows model, tokens, prompt preview) |
| `--verbose` / `-v` | Verbose logging |
| `--version` / `-V` | Print version and exit |
@@ -139,7 +139,7 @@ cloudwright cost [options]
|---|---|---|
| `--compare` | none | Comma-separated providers for multi-cloud cost comparison |
| `--pricing-tier` | `on_demand` | `on_demand`, `reserved_1yr`, `reserved_3yr`, `spot` |
-| `--workload-profile` / `-w` | none | `small`, `medium`, `large`, `enterprise` — sets realistic traffic/storage defaults |
+| `--workload-profile` / `-w` | none | `small`, `medium`, `large`, `enterprise`. Sets realistic traffic and storage defaults |
Examples:
@@ -645,11 +645,42 @@ cloudwright mcp [options]
| Option | Default | Description |
|---|---|---|
-| `--tools` / `-t` | all | Comma-separated tool groups: `design`, `cost`, `validate`, `analyze`, `export`, `session` |
+| `--tools` / `-t` | all | Comma-separated tool groups: `design`, `cost`, `validate`, `analyze`, `export`, `session`, `review`, `compliance`, `plan` |
| `--transport` | `stdio` | `stdio` or `sse` |
See [MCP Reference](mcp-reference.md) for setup instructions.
+---
+
+### `integrate`
+
+Print, and optionally write, the wiring that connects an AI coding harness to cloudwright. Each client stores its MCP config in a different file, under a different key. This command emits the right shape for the one you name. Do not hand-write the config.
+
+```bash
+cloudwright integrate --list # every supported harness
+cloudwright integrate --harness claude-code # print the exact wiring
+cloudwright integrate --harness cursor --write # merge it into .cursor/mcp.json
+cloudwright integrate --rules --agent-file claude # gate block for CLAUDE.md
+```
+
+Pick exactly one of the three modes: `--list`, `--harness `, or `--rules`.
+
+| Option | Default | Description |
+|---|---|---|
+| `--list` / `-l` | off | List supported harnesses, their config file, key, and rules file |
+| `--harness` / `-H` | none | Print the MCP wiring for one harness, in that client's own format |
+| `--rules` | off | Emit a harness-agnostic block that gates infra changes through cloudwright |
+| `--agent-file` | `agents` | Rules target for `--rules`: `agents`, `claude`, or `gemini` |
+| `--write` | off | Write to the file instead of only printing. Creates parent directories |
+| `--output` / `-o` | per harness | Override the default write path |
+| `--force` | off | Overwrite an existing cloudwright entry without confirmation |
+
+This command supports eleven harnesses. Ten speak MCP: Claude Code, Cursor, Cline, Windsurf, GitHub Copilot, Zed, OpenAI Codex CLI, JetBrains Junie, Kiro, and Antigravity. Aider speaks no MCP, so it gets a CLI-pipe recipe built on `cloudwright --json`.
+
+`--write` leaves an existing conflicting entry untouched unless you pass `--force`. Roo Code, Continue.dev, Amazon Q Developer, and Google Gemini CLI are discontinued or superseded, so this command skips them.
+
+Full per-harness matrix in [integrations.md](integrations.md).
+
## New flags in v1.6.0
| Command | Flag | Purpose |
diff --git a/examples/cloudwright-controls-demo.gif b/examples/cloudwright-controls-demo.gif
deleted file mode 100644
index 11f2fe41ce9690a03c493c1173929b8d7c8e1f1a..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001
literal 347064
zcmZs?cRba9AOFv>9ebT)bBKfE*g7N}^Vr8Kp*loHDv44_j=dccvN{LZ=~!8%V{eX8
z8I?Vf$|!sMPJKSt_3irpzPH=?fk>Av9dFX?FoTCrVV*eAKjH8U{fI
zW+5gPab{KtAd3)?U4n&GgoQ(ljZ=!9U6`E~_kuoRdd3g&kP3!VjwsPXed`2}G70`mMql%I-#
zfQ*2UqJWT^fCyYbR83G&Mo>^zNQm--2?@c4L|{T>msLW^Dw)a2pOuq$l2b;(V1Y1YGq{owT-{nh38|p!prB^1c-mS;
z^{$EP8-(_G4J``|opV~+Xe~YWvxb+o^&Pbh
zowX@{j4-v-Gly!W|_w=bNpyWo7|f=iH-YoL?s1LrHz7u_FSa%#Wi;*Yr+
zgz*Tua`m43wQ%=qS?<@P-EYKQ^$GR3_Q>OAtjE3EUOo@JePexYMc=p;dgE5q&07(^
zcam=T2H(CD8xZv5?t`QUA!)&3nIVz6VUg+KaRrfa&tj5GV-pJEaL*IdUgAa0G)3b@0gr+P)T@InsG?_(fYuWq(;!
zPdTyUMOF8U&o3%^U%jmEeEDj)@>O4T)BD<{;kvgIjV64ZRq_E^1IdH_iH2XzKl$6k4+#BuldaDa+sg|(zxJq3sKifzmWFn=`be~)GF*{{nu>}_
ze2fBTHyf0nxN^iDFb>To3;`Zvtp6a5ZXS!j`!lpIF!}+MkvKM=6
zN=A#&`KCFhwWaUM9ICxP_12bsc!_C?6*hZSK2hyCT6(eX)r+Y*-}&Agv$~2;O@Ujh
zpZe-vPQMMI0g9N{6KC6^x#ceP*H_MW;Uvs*%^Ru~`!ZCneeQ3lULL~h$B9@p)_fT)
zwk^9f&{+HR1Mx~FhwCwUUFI@yHR2_}se5iGAYkA`9^w8T!WHyXs
zJ~L~fP&F;<_NOkr;A6FwnJ^AbS{fFmb{vw0#T20@@}nlDO=U9LS3h+0Le%AOXkl^Q
zBgJS^XarbK5&+Q5n6nU5CRN8#L&J^pbRK5c&*2RCdW3jy(QZ&Pis5ELBNSl<)Iu$5
z$^)nE^KK`|$KaqjG5lber3|-yqX_ZH^<+9miPzCCk@RZhF75C5dCQ#T{V>0SZq!+ZqX6+|9tpz)2TYiVM{r%*J!>foFh`5VJfe48t6xaVI$z8mjc+M^p{^In3Pw4hfl3@Heemf(+c?E#
zRh2&R;g}t-dz+cp)>|0M7F(;_+J|LDol!1r;nf0TE#iyLVTq?l>$g}{`Vpb{^cE?f
z%^v9O#ZaCQgdhXIR!|5vBe#@fC_A=XFHt7AKEGeU54LeVbe1oBa~LI^!^7fC)oRG6
z?n7<~%@Z&{a=%ioj^JM>*-+6!Xb&Y??B%X+Pk4S9Yh|#3F#+fS{0V59`(uy$nM=mD
z80m)DPOe|>@nV4Q&d7C;U4e?>vULL&aegS4D1R;EA#oki(`Eb2~SdU9+
z76@!TgqcHf2AMj;ba;9qrwe|t#u_o0ym)0^TJziM9g+HPg2)d^I!8P=gEo$-GF!ek
zpZ;;UMc<&S4;$;!i~IHNt6%44zy6P-o!1It&AV){8QneL3fuAi+UaS%6#^XfYwp{J
znMKZFK+6Go$#-RT$RHEE~AxbHP^8m@pxKkR134?dMLObPk*|*
zh3)=&m>3Iz(HParmAM`cH778i?{4L5T#rzUC$M;++5{%oBN6=sw!7VJBKzx6x-5Ad
zCsC+&h`>fP$~=!Ny}MmXb0Y>FpT|>#>X3EZh;``ClF?rvb-Jg=^8V&yJj-*au}QB@=4NWK`E%LxJ-z1|H=hvWpTj&%
z`Wz=W)9U-5!|(R=UE1GFC$SVNMw#@x3T$O`n-?ml_w--Y+Ap=a<;<5tdke390&$Qu8N)Bca$p+H^S9@n;@*pxEei?{MP%pZQ{}B`9Ol
zk(A7z1yG9;)APL}X^lUhD<+hfdzg-9PW~)J43t>j?H$eC|5>EVT8fS`9m^B=RgAJI
zwMp+CE7bf|f=(#4D>8jo>iDbFVW9L}UGKY!`@hOCtYr>erthmVf0cV$lsSIregCTQ
z*9+f-GUsK}4~>(*Dgp<}F75PwXx{(zGK94p!(cYvDzHtAwkUT6^^JFGZdc+G%H5>R
zCVCyWt1<@4ub%Fk7`(q-jc0w~X>2w*lDS<|Z1KYTeBb2z#_d{S!V4b{v#H6G$?aG5
z121me?VI|%zgS(TFBzaVvH
zuLqr2m0D!JDC@M>>o8cAR@c7>f3VkwVXMyQGG9{8+UxhUtj_$<{A-YYL<-zL+}gk7Nwi
z6rLXVV)^UlDJ;Ddu{D)xF3gXMat;Nc9T
zRedXHa6R(O;Vef|eY>>fMy%7}9C)a{^Yq|G;)BC^G4_UTW6RBytiuK9iB&`I`N7S!
zro%7l*B
z2gh4@_BSiWR{JAa$3Kg$-mIP<+JE14{EL|MX3fLuU~=ksyME}+_q#&}pAU|ANbJq)
zQC5d@f+xG(R?VB~Lx)RePWH%2%|DB*j#iyc_Q!{sx9f(EzCSoQm|=fwzT0JWyqR@!
zxMKBo|HIJncGJnxdeYm&Wvi3@sgvW~p|{67Lnp@vCnr?k5C9^C)**yGFoZE9gtcid0+_&Jv*d4Ok~f50FGWl2?{xceU#!p)K<0
z20vz2Z$>u^Y~SvHkDJwx;sm)7ciHJ#;_2+`(JLDgZ*e^G${I175vGZ71f1zfU4*jh4m21fn%VD>oHf29|J|*-S+oI`Rk9Us-j%&gFRU4rN@bSYe
zjX?NhP88>1-_+9|#&6-Wl7(w!L~I)%jO(Lg#_Dujxl^vueWzFGp@&Ghju+!3rAJ38
zazB=bp22HPAHMaS6|*bIQ;QNzp?`zdur?8unal$*>sCIUp}P
z%v%4hg@Bs(qA8Q_SkhAKW5lV8wtU@PkELwWV8xz1UV}GU-y>GYNZPn$qif9VUL}Ic
zngX6HWDaVV;ZpU-HV1_)Pd~ZmL=M8d>_-N#PgPvslJZ`0$~@O6dnJ`V@e0g#=aPB+
z6N^x0UbsI_R~6>&a#PCOf8&YlT>bg51b!l^C6oy>n>gTg-BH#OubZIRu2;BR&w_Z`
z=5aIk?1Q}!7Y+Z6mjfW-8BZ?598DQx%^<-y>sm$;v<$6Lp3*au{wCkKfHpqCoDcW0
z3~GB{jo&suxI-4%C9tZ<MF1lhR0Qmb$r03-*d+AUK-Z|_;+X9{`@5A0U01{nHzmBd
z7Iki)coH2NDi?K<8eL+Si{ks;qQ
zv$^5t%IA+@0xEvHJ{<_*ci%dI0-k7!wov1esO%JN&91`dAUS=y#2}+rrbKcC8F-X%
znga<@9q!dA2?mI&{}XSV<3fZzX3jlPQ9S{;QFB43ZCQt
zqH)o2jH_(r&e-?Y-#eQK72C%JKMX%Cef{xPgU(!^#6&5)|MvbRO8E)@r~LjMq%4rV
z`7WZ1{(XMudax&v(${RNzixLYUk;Dqk>|6k6dUPGWcgx3C9{d?d<+#gW%06(7)XZ-
z2J<-FYNcW2=8_D==w7i5mPH7f_Q60>c99UJ5Y7k*QO$;;|L%D2ze4_J+=>Auk9K98>&esEY)Z$x*}HQX
zy+{^e(`ZyB-Y}m3mrv^Wtr=q+^Fhpl!-$w(D)Z5c!yT)3AS)ZZ9UQIFYL+2;rXDX7
z)t2v;AykYZNh~;LB2k+f!yl^ol%sg24cdzd@vA}W?IA8jX
zNpJU0sWZ3wHGwU3l3Hef&F-c~q_o{nueX7mK+o(<<1(uFjedT5(Ho1LW%q{m?R;a-
z7K9T37ZszFS2?Op=w#~`taMn^$MHH34~<8dtcCn2FMP$TIJU}mJ+mm$U~n89L!1GG
zC}fjE0H9P|atu98EI*zNhMotU%cSveidxfLe!_-b1cz2CXl#I1;)1np~`tulV&Z&}YI
zZMvdHrA8mM9|u&;0G5WYm|!DoAnWw8#b+N@v0Sijx$siCq_jrXZc2yU@Ok7D=+9>n
zc}An>7Ryv_I@g*VG^@rdmzU!sh9QP54Un0aerHCW2LgO&I#Va^AG5rdMt7uJxta;w
zLPmA_vSPj(H>qELBnl!5H$3hD*i^cHVz!j4_qAZVqW~8e!G_V1L5N52vju&NXXKV@
z2J;TKzrJ>17Ob(%4eHn$zl?dLaV*-gvohb8ZZ&`T=zy07@PDRB2qj)Je~|BNP&UVRsCwqaCk^<7|l9~QxS*R)`F6hm#l>-;3fm6qO!H@x>rCRIRz
z-D7*Y&Xsj4sY0Imkx^*LF7|!@0{I&KrbFx{vP6FMNl4-)^?GURKTC&%f
zyqFRd9yMe3e|1k~(M=!jk@l7dMW1i67n4FC^tX6SJzAhc;TYLeNjY*fT8h-6hceJh
zVZWHhklYc6w|cdjW;na~&DV@=FoQA1ecGw8kYQjFv3fvbxBhm5TGdZH#7clqm0G-@
zfIw}e+HcJ)lc(C_CW$&k*yCtBI9dR_?PxM(`S_C3FT-(jmk)_6(}p0Ka5B~gVD#>(
z=bZv6{o|ikmUHgz=Nr=x%7dkm-pBI*u1d0vCoD=}6$obD-&;m{Yu1qpQZ;o;sDqB(
zhVyCYVsW=&2x;%)yzQqPMGAqX=#ui-Qdv`CAvklj414T$?U^cB_F8$({mic~Pk#Qg
z`g;zhQHn+6e^*Z^ec~_5>Je`Xu4Jjx%NDlHFW)2hY(v*P~5GrCtS7(Sz|il`v9kFz;}CC{4jfuDCGv
z&dnM5WCULHk!pwUXMoV1aY6*hm66MkVYNsUcq$V0DG2a%B`pL
zCu-V&IQ~z^=KcSZz{{lfd;e3CFr!N3K#=h*d=OIv^Yz0IN_X#frJJSO?OtAqCrmJ(roW!iM!oU<672Dh+GqTcz_y6iO?w+WT=;N-|YYNQo$NbB|Yw*SR(AoJ26QOz1eILTWJ
zf-u2?rYo-BE=uAFY4Runy7|p@gsUcBdeg{bGM4>hxIuDSM}os3jGh8e1~imzY5{a~
zq=Rf}W5o23vbup;-lGYsqe!6JoRyAb8fs3DEqY-#inc)!D^l0a1(a9mMdZuM+O$KE
zN^V3_5*ro&LXt*rJH+rLx+WvV4DP-V1t@_orlKHT9B6B)lEqY2yDy9BfB=~#oh!^d
zf2FO0lD7X~+dm8u2mOa3M1`1Ck87d3c^xq^3T#qt-Q>%e6skDN*Y%|VpL-}b^|vF0fPql0qP9m?MJv=xcv{RX*3Str}WnH-N!HO4^tl*OCjClO4D+_+v*_S+v
zrD0$*Oi_}(t?Hl(BwQ|
zypr8V)m`N!^Gq*gJ0Ilw?-2(v_a%$dx8y=S-uutab<$&bNaZ%2K4T>p9|~y6f7vQB
zATVNU5X0eoTK>zg9zO8+LUKrOe_m0(Yt@12Qxf2vMom9^jx!xeF)LePDlnhX-Ns7HsC{sWfYoy%V?ZU2lG#>ieS8hp0V
z8;N-G<9d)EPb##sSIrlTc3(9#)1-E{mI16FU+rm_kVg!sW`jWddIi28%#|i128BI_
z$So%e%YjPq0?)}4SzT)rEc)L#2~S9jfO|N4
zIx1R@Zk17vl#KAoh|^gXw8HDAvMC{RwN#du?Z
zi8L;xbw=gcUJ8?>@<3Z#Xc*X3sRBrIbEd&Zj^7K!J;q_~-L$hdX??~6`I4tzk!M$g
zHT}QmHe@jjCDS}{aB4oRQ{!y9==rL_*6mAH8H?x5CD=roupCQ2d5`ROJv|P0`iW^c
zLBd+oRw|Xy)UuFC1m82fdek+p#PDO}hskRvK2AvM}0n~VoWF$d8l}+CMO3pWv
zFnW``wK}wV>1*1XryCMMrRJzMX~&By!cSESb5Zm0(6b7Vm^^}nog`C}%7~l#7x5Na
zFbh|WXEKQzH5Y4<8Sh^HcUJT32zl#hj0kbJzwgQU@5Cjnxd3BBrie%-p#Y+_SQ#K
z`jyx?Wh2p|q-#jKHd1d>;kvPi(9Br7~9hsx7m)AAHbPJ&*ylsBHg
z`uese9aILC6~fFj!QbpfG!+jM0x!)F#VW;$)qbQ3$(_6UB~Ivr47#$Em3FGj
zNH;{Y+R$n{#z~BCaoc&1Dg0~pS*!d9H*(g-srS4MKCE9nF#0y7ZJqztrVhr@!z2)8
zH>?-X%~_&BkGm>#k%h%x51{N&i3BiRgjt^3-r}@uw?TplbL{3~q4hXw
zt{W&E&BH$}L#&^RElxe35u?z)J_JC(XF?Ls%tdEgz<9T<+&}0ZQ4$QxQ
zhGsaT3k%ncv@5P$FyNI%mpW_M=(S^|MGWdmq!t=h8O{o~r;!nHkGSLtp4Kw+D7)9w
z3uCa05Q`Mf6R!|*5r4z=@67{dd?*08Ox)?JJ?YoeH_qqAv#ZYcQR&q{Dj{ddcLa;5
zSr^7^3-ede!QLnLG|BiORriNtc8J^G_=Vc^jr|VW>xb0bd}RX>ZSjtx{c_y5ZyeTJ
z(lC3;Uhd4gdwbbqT8mDMs#8RT-QJ6ParXx)OnYcaTyDYR+#6^5L6P^_wWM1grv@+f
z)x{^!67;!Ga5%Kp2=vO4NeSkP?OO2d3zX(DTnHqnI@ofT&Yn3ZhT}?F*?~_B{(amLpW|sm?Yg
zr_wQ@{C{Qakdm?g3KakGLHIEL2o%TY|Ko$8cZpYY?0`_m_KaKet%+osu&m*wpkdcg8derAL);pSJzqCu|Kmy8u4b}!`U&b-7Oof(I3^Ne68tUK*`ZjP0LrU@f@KS
z-l%hB=Y@N3OlLD+?Qwy4il?7JCBJ2Rg<1)nxEYO@(lajA?|+tha-llDA$=()=aUKZ
z(e0l)?y5!^XFcLt!l?(=o^CKZ-EgOc_2(VDVj3#GJxgWwedXYCRMi`@MP*hOi)f>P
zGT?##4J9N0seFS8<$#_xreEw$P0?&?Q@J$f@OWJ&IJ6z@td>yojJ>s-n~`OE!*1r9
zvLO$bivkP*R0|+c(IC%aM~9*%Q#@y#>Av8jq^vOup|r*A5DEE8GPqB^P6$G62H>>=
z(6YqO2{O!8qX!slSgbwUm-DL)Q?TIU?v=>qr)3q!$+*9psOx&NS
zdde(ix{j?9OF}a1
z&!SW+cr-A(oUU(G_%XPejP=mm`?V}YpD&7T9Z%^wZOCEl>6S@a4+XMk@Lu8Ev`&fv
zx){shd@bQ-w^;xkGYD>{OT}ycw94L5gd9j{iGsTKJ11m%_WI`nFa78wHKT>D=@BBkEh|9wN$GZ4Imb%sk5ud<*7Em;lbf}1i>JlJShVkradcqK
z#W>rjb62iR>j-jii9DLOSZLMp#QT!qJHD>e05&il$s!NMnE1+rN$ql7F$`RnKvK6_
z=_0~!TgU`1AbVipsvJnsk-#gl!udgMnQ`oU%P3aLUco|_`?t(h*4MUrs9`Il7|c+R
zKAU!nnDNsH;X?@=<5?jaW>`(eW)Hu>YhNT!Vzyo!G$Ps$MT^>|l>pM_;HhXW94e^+
z63rZKOiaFHS~>yqIjUJLEjuo7
zvd(>4C=$M^BW-ZY3|2`V`TDZ%V->AK&HMe<7Z`UUsS1c7tyR&Z{Rx#_pP6MH#v4hz
zKxdaY^o#e9tZ()0dH2bc$cSs-BG%H%DxR*V{j8`}J+%Gt=6^(g5lX%N-^vS+_^Y2F8gSgVLVNQpy0N?JE_CKi3yb!G&@(&nJVXGc?h~KWsxN#
zTIDZ8T<*_=hAm0<+Fms&IDH!a$?K;K`ni6IW-X%{^lgb@-KE#DD%TvIU94QydXQRf
zS8Xxe7{I80W2(UY!(?sj-7Cg1XF$ccsdPAn%W8?Cc(M2IL^GUM7MMEbDL+K
zuGAd>xBL>c$gI(+$4ld54dVh}A1eJhQ*`aNt}+1qzTOFWfTc-4Bd1)L0S>%1!y_|E
zKbU=QbD1U|6r^3*2oz``m`xvNck28Ym!YTr>%}HViOPR$(33Y{6j6+Yws@angZjGY
z_yC<5VWQx*YXSpnRsIY{
zxz6{n&RrTzMt9El8ZQr>6OCIkF^j=6K?I7}&id*>u1#Btw{p{6d6!Vikh@NO?XyTHP{y_{qZd4e%TPAqW`7IA2pK;^!qN(Bom{(`(EveCkaDsfS&v?RyR$xhKm!`?
zxE~6a6dK_z(|O@=(%}b`<*N4`yH9V5p$tISj93`E0Cd=R>8K3=zxp>#YM?h3L2q8v@U!lt~&tU}(6o!o~pZ60QQ-^vnCymmdqaWalCU@a~fm2aCF5@57v
zXc&o(cUgGR(S$C*Fcrx-+ljs}{RU?vaQstZHk^B31rr9S4C#=s^zU|o)dYe&9Ko6y
zEfh_op5k@l$FV>kwcV#cSa~g9yy_BTzR9WMu=yn2V+pq;?J9S-WFMxI1)P-HUTX^4
z=;i7?p6HS%?aYB(T9>HJi
zU|Q?hn}1qbU|cq(ZCZK+kTdf2hqJmK3!B!-X%ZK;(RpxmLos@(^DHF$An
zda2`HXt`naO=_!nrFY-nB_RU7rhOyaKGfzi^*p?cBe0{!eV64
z!5r(ZPc<8&^dkE+FSu*OtDk7o-t7L~8R|L?vuwFF1<){ZC#3ex_EZtf{G4ad~Jvm2ixnjb!NABm8;McEo
zXG>ae*=^v*8mzTrDVHcAJp(CzhXb=m*
zv~o2&_PP(9!0*|J+1sv|Qfu7eI#52#D!|d|A*Y22&MMMIJhwdi0DFg;`@Qwv*j;*5
z$gnzxebMW%C+D0w{XT>|nR+=Ljg(UH1F%>cKV_KDv7<94+2d$SgBorbwDyvh94q4}65tn!7r8Ao*|g$Qd#Ab;z-u9O=3
zkG}iw+d1^#ZhMOc(z0oxtV3HPSr1|yXIvqMVQ`qM&n_;Xlq6=D=scd3YLY}}Ukn9r
z&Y31Cu;vDm#IRvN1@8*yT{6-bpyW&nA+%FO!xn_SCt-7`Gx0>Vew`e4K{IIO`$dW8
z`K#S|!nPWSLpI%wGx4(8N9JFT0^3dl$iju=J$nP|t
zy=HXb)7f)yj`=tHFVp7bw<~f?pUb{0u?_#8V)t=)YyQEIuEA5`h?qpCOclT5We2m@
z*F0GezL=0mGQpEh3Q=kBDf@Xd%@)uI;WBs+Dj^PTRjr
zh&X`fp+DU}waS(775367-kPWf;5w&xE5v&Dd6$4WT@D$`NGt4NZwXa{QtKSqc@iRy
z>%;BCSuOFV6q@3KMAx&%r{UFLk;U_(l_KA
z7>tb1Cv$xpA5Jk)@0r&{Ys$F)?Opj$^7G$!7t`TR9_4CBfd&8X{TY$pch*%58O{iT
z1??*4QS&{L-i7mQUFI
z-A(5&TcSX`K*Sw4&Gnw)f-^D452B*!?Q&E~n0?;mN0^nn=z4X_EzBPr%>Tl5Namblc}sW@YnTol}zz^XD9AfTHuxBJVJ&yOR)~e`!OQ&
zlcKNa)E?yq%%IMff2g_iwmG7g+Ayxvq!Wk1P;B64;Y0dd!WZ{=zy+f3DnQb3ktgA<
z5nQn`;A?#~NV5BA`qvNDsyHUm6NT4%n|y!U!1pQ9`5%&+0W$giCMlfDTj+@$qbkLn
zVB(bK*uU0&>oN}?H}J+daVb^K6v*Z0GtS-@gQHO(^%z>_ym6-Cl6CHRxyS^j7glUN
zU2ef6#dvq~=L&=#$;k%Xt4z
z&Ozk&DRsZwqWLn+mJ)4f|Ro?%L|lF>8%+c(qT`LsW?6(k0Q?KVQCw1EdYv+KmrKDF}e(JbCgT;<0EcJ
zjC3KREmo><#Wnh*9VL#G&-9dtS6a%L2LgU|=O>KCi4~$e$CR
zM}*(BPsSVaD)4B2WVD{saYz#*5gj=4!xMxkviA;q3o1pyuHKi(ajGqmo9-25rWP7y
z9r_-dt&178aI;ByVsIfX;g5C0N(;KF=7CD>rc9I1S@?_D)UGohEtjswfdf`e^3~aM
z&U(RH^Ms}h+kqgZ6_P|3%t8S1Y|e(xnsq^z%NH5W#@lbrM71;%iY!GmE)5?
z`1NgiRRT+QxErW3LjnLxeU5RmE^r?-OHsAK(?AZJV(|!e$LQH8-m{3|
zNR5DT@o2C%s!d1k)h_1m@j%h&{$B`?rC9U_0k)k+=B9yh^eUI^qS38Fk2v*Lo#t9Q
z3={Y@?)ZR}=L|q#YXQ5xq5QTqcH^|vr#9j&V3vbVK6@h(H1YBfgv08L9uO-prI_IB
zQbJGpMkpm*!?Y_}swh;(HZq=@ja4!vb+R_@f~>h4l65!Z$>q1uQ=9@NGtlfe*O!-`
z%JI^L@;Ysi8@66u|Ez^^7-2bO%0++*LzetUMh*M&J*IyO5&g`Br7U-S>HKQH;T9S-
zFWM<`%^N0h0>Yz{xml*g0R=^GHm=;Xr?LE^_ni9aujhtwN{oS}r`GsYZf-O45>v`1
zvUE4kah~9Ktj3=9KRIAT)=*vE8{{AUP0Z$H5{1rc9#O=72
zV)d{=vDzq@c1^n1@7P|7gPB}a
z;fRr~$NhDDeb>*XT{urd7S3FX@@iATA58kktJmH0auSnS^ZfljNDly)d7zw7_dfi6X)~cnS@2}}}jws5T
zD_(psa=ZSLT!r4>f_fpPs)VWjaWeh`1zeN=Ah^XpPyncp1Rq5Bi6ze=LBfizL11gV
zF@+9d-HMa*d%|Sxc+5?1F1AL&W!j;EbJSt9Y;duf2I6xAT1C55PaELVDomh%wQOW8e4gLBZ)^9tES)pQV9Kc(F}rx>XZQtd7<1t1WqZqulULv
z1U$Dk+eGnl-2O3DeHAzS&UUf2;+^rPDJMqjo1LtEiDk~JtwX^?f7TC~Hjd{3si!nG
zq2;ALr&g7J6(lIlh+(M(;L77_2QSC4&=+gpYz#ceP)B9cq;mO<)KD&r_o76RxnT4C
zVGqHFpP|-Ck$m!`Xw87HPl{2h;oKcrGXU05Uakx>fY!4&PW|a3MLdsQ4+Y9xptm-b
z7S6!va2SCJI)V-BHeqnjKRhrZ9woA$XH3gyIVOe#78JY2vK2t7LqWMv&QR4xk{*Mi
zav%h$whbLl5@D5Gh*xxE3^VvUBScC@ME{eK|6)M#~=hRk6qP@^@pO
zG+Icbg=uU_@3j!cs%#JUta5bu!(Y!cSx{;iAt~X8~;O
z^`v+<@(Ry6(M#=lK&eU$SJLS!2kS(JBW{YL$fi+%q~-L_Pex1a{m+Tf>p!dS-;Vj`
zxEjQ@wEK?Z|+uz5ivP}2B96AhHQQ2%?J!P$nOwo3vPLXvl
z%}dbLpf>*|SWAik=xyD1&lr6#-y8G(l0AQjw`lPo>wZ0VWQ4z0)XjMtA*8NKF}0HR
zP}>uto2BF#I%PyiARjjkGvrGdZ-_spmq*;3Ty1_)_Dl+{;fb8PuFFh?pB&LwJSO|i
z)#de;`*S4C^Ywm7-Wb0X9{F?W*|Q{6=hHN2L)v>d61~NWt}dOb&mz|y@mg|=HEn|b
z=tB`~jZLKFC&{_!W7zDwD7paOPWj6A*1S0R#^Sd7BEevNdf-Cwl|(k!Z(ylM&zqhQ
zF$?#RQY8gA{ovi96tvBPi=mx}Bre5@-o*OvjoJNorv77ONUl@9K_I+Eu{kpec@pzt
z!OVi*l#vGMh^137r79YBDWHREg=&E%^i3WM(^Ujv(FX=gpv^2MRn`O14d-
zXBDzOH<~-9(HG)Wzg6r-&dL`yNoQuU_abF~iyD*2lt@?l&LO@*l+3MYmlw(zQDfW@8Zx42V9BhHS
zgCB&#qdEFQYT9jPLMlJzMbWMu?Suj;$F8&CZ06mVuoH`)R;EIYIAoN-ch$$b!f8;a
zXh`$=u)(R3nb0`yzmLDiC_#t*JHCD^Zhy`-Ia@=-kybjv91=!rMQt5#L!~Xju#EL-
zJ*I~urm4j*^Ww1bLB#+%gZWO7u#P5=M#^O!Nth+G&#Ymls=V-}R&&OAQBnY=1A17gmp^~1X{wbl#C@`LHwe48F#dQOb3F6~9duaEz2u4H*ea&hRrr
z?^+jr4DNcPs0Uz*U)N(1B(ES@1TS@AY}k}f@fb6eaOek1Tn`Av>2t;4lEwCD##2K~
zz6@c^)lD2931|P&7yyMCn9fjJJ;&TA+$~|)%u?13&6%qVzU~@s#!UR_k8cHSHh36&
z%{}#a7QQJ1%~TMcw0@=v{&3lg@$Y1>Qj+~2N#T#YiU)%DSN@>~W43?J&Lbnid%xm%
zl3iQEgq78UR!AMd7!kQf93EX@lqh9wN%@*2uP;LK3g6fa2??MV;P@PLVRM1REd-#m
zErex2xr7~K`@Md4FiGUq3`o=sT&m*(-Mj&dP0<7SO(ULYs6@RtE#WUQ)e>JAeSJ|1
z8dw|>VdRj0B_Nil7ndzVuS6T`%eh(j5hPqgwbfao=lX;zl3rbQ&cwx*6$8EcaZt%1
zN7~n+wXUxvjEN1$$P27qWkf6t=4@W^;D&({E@}rWc@Zme1*`ymoEc90N
zn4Hsd$N*n(V=0M?ok#L|Wh=q$>Wb9a*cCEB(mCGFR={BVW%JR&v8ueUxXN=NUnMOV
zC{IHl*e8D*MS2!Q(?BGJv1<}T!r5iJFFz8w7)XwU`Pa|th$(xbSp?H|#iOA%lEblL
zB0t$5f%2g9@v0+~SHbDejIMvrxSx~^{8u#iGviu9>0SS|U7A^b+b)!oF!~$v{^J~T
z06rcCNAvn*37u#z{aDzFD^~9@`$PE*D7t`|m)5B{{0nCR2}p0H<%<(*iQv;T^IJ37
zc*YbenNe>;`G%@MK-gI}pgVPL6r>zXpj7Tk5tj<-0NGRL6;O&vL1P(_dZRr+hNtwN;Mub;0m8qZ~indEvR|xWoz<
zs?VgDwQd!U>F!6n@T=fh!Dr9d^r>v?NYuzd!$4kPVZf%Jzp$@s^KTX@7=*a)#HZxg
zPFJ+d9(_37R0IzpWw!3T;BUU2a^E-ou+obqRAA7-)vzozU*y8&GdC4*)Po>JPc#+V
zIaLZWn8Yki8A|(;^(+a$wmB{2Dr-XE$3OFDBae3Hhm^QWYizs;?XD2{O1$TsJOM=l
zSg0i+h5@RY===oLM!bYO?=elv|Hs~Y1vI&BQKOKAmO$tb5Rl#sp+)JE&_PN-niMJ0
zMMXpbr6r-)(2IcdCL+D7p-IfuwfI$~*-lo?Dix$A+e)>zRtWry5)T=uNk=(CO2(zcC9CqW@L!fk6L@
zVkFRq9*xD37Bu)#4)kbSN>t?OeO{jpZtX>#c(A>)L6!N1lZO9i{0&M1!XrJz9!u2vrMO1D`iP?)MN4rXFetvy^b0wxXWywB%)n#Z=|Wb
zCA?3dJNM$Tr6I{ZIEm%rWZSu0O^1gEf)j+W?FKa7Xw&IDYz^%_-E%FIceZMh#%C4RirxtD
z00ShtFO#Z6?>K+)IWK1z^^#0U%K!f8+(Y|XiXzio*QE|huisl_y>bsbnm*1h+%UxT
zEyKZt+>BNa{ui_&<@32M!PPg*JMWxm_c^?Z@CUo>!}@FtUL+XmNOH_>WZ;5q8!P4v
zhd-R}1qntQWP$}ROX3Xp9}1FSNX(jR0;(|9H3s$Et29voDtRGM>0d%)1Q3M(vqY%D
zvEp&RON8!sy#ty=1cSIGLK`F$&ZhmP6fajgoOEcp_jMO1+J8$PnKu?|5e3UaiKKOV
zDMXtj9doG-n6VHwPGF~R4PwFe5g`o1`7ASw1may*y;^n4>6ItpqR!no7g3wLnspgc
z7s|_tv7CjZYLguZXta(kMVRqd354t7^TG~o&lJZ3I)0;j*8<@MYPODCe&Y;VcVT$R
zT4QbQ%eY*0F_}+!dLzF|oS57pa*{0M{y^Qyt0@>W_9Dj6|3C>?Qe
zM2*3tqT&gZ1}|a9;nk9oMhvIpn{A3xtUSMBUF&$*)QF$o4o&0QJ3Bw*c%Ogpn)tii
zS>BUhKquI|%9+#fh}l`i1n?FQ=aeQlqvc%a$^+a4b>-`(5jI-M&A8L|spNS4=^OAM
z4{O}D;|vfiMc=!UVjick5$lS<3-#!g_*z$8Gv#K2S`whQs}!FquFX#wallvx7BurR
z!>sX;X6sKrR>zkGoMc
zWdi(qHRWD!uj+6Ph)dw;S31f8-wYow&B&i;Q;owx@e~ukHMY^RHe(-eWN6m(8cb5-
zWe=z*`leM?uFp@;%0tWPo|1&ddBWZDJg%E;HMP%2q-!dE4olTByzxoZ)e_?PL{B=7(4B}*s{%Sh3J)*7Bq_Pd%fm(X
zm6(r$|8loelB+`PcPq^MxA&Uy0=S?qd3)G$BNw8T>TT1(F0E6*dI*|u8638a5P?7UkKx-
zp=ni~Sd4-(#Qc~J-EIx;^91Ecb2o{Dy3_jkj
zm`?GRckTPsqF6d8Zl1J7pm|&@#lISI6$`I*?(+B;H;)#XPWo;QO=OYeQ4Lsey|F*i
zFrXi&Mh9`W?pV$x
zeg{iuMkcsq89_n{6PcdGpHLp}K@xQMWW6%m1a=>WI2FMR1Ab|WZVv}d}4(za=GOx|jNd|>59+W!kaOqVoXmj1DDstiX
z*=3I5`cq4f`_K3GhXI4@@8qnh1$SUX8*J(J@-r!Zxg}W)q+-caL6TTtGLrE~EaSBa
zVK={5(p+x7UQ1DL*8ijODJC!j!2`S-R4+`KQD+J-owznIEqymE-9Mku@s&(^qweJ(Q*LC@6O
zMd<_@;Mzy?sm_z5X$?qs!l6dnW?_=6gP?d2L!=85VkuVU&lorW
zG5EjB%?o7n-?_PL@V~j4AOhrOi{_k$<;UUD4hG8Ga?Abk+-F?Xb0;r6%0lU%Pn5bg
zZ-|iQ?+o$2s%3@;SO%8V&3*_SjBk;HL9y7F)y!_i_1c0Hja;p7fr|=9$&>J7H(R|h
zXXc7&t+?C|yjh!4EiLmUJ)8z}r7AGtCgtBD}UpGyoDvmWo
zq0C*ZAL>&HG>k@xty|XQrPN^Ld}%AK7$-J^L#NN
zgY3?$^tHby!5i(V7wftO1C;=}9i@0I?p52wdZLCAHM}u&j!g_V%oeg$BT;);ijB<>
zK?*!%*Sy>NGl7d)lng-mYf1&-beAmIJ+vp5dWrN8F~I!1*WyzX#M=NDO=jW9dBejh
zNDQhWBj`+=*d!b5to3lpN~lEQ|*0f>==1`U@!n=gWA!hf|x7%rHpSe`uR)<4Wzl0eU_L+?wCr=}59z~vjq
zrI(LdA8undBUUWy9b44R>kXT$MgtG)gQ_UyS*rf;yj+p5CI%i^GCMa@CTQT|L9IR|
zmbNWojQ)pw-EIp#eTBjJVYbk8bQXcp
z%~pvdDLkPsO~$+&S|UMmZA%>u4%nAS#;4wkG96;1#FGBZ6(K-?{@syd2`I+3zwrA5
zR~{D0qmG;*SUzN}{tH&(Xd65SzwL`6f?z}m=Eo)J~4
zkxoLmk_UHN{2V?AR4j$PkfH98xLMYs`rY@-*{NnOKJKdVEILjT--TDtk#kBqs*qRW
z(Dgf2XN0>2wRj7gwO~@o{S@k}Yt`S)K!<>^6)Wf92ej&vWDJ8C|Jm6~x;&ypk9N_96pY(LjQKgC@*i$Fu33f^81x?dyL`Jp-@>>*uG(+$
z<~)Wj_4id1dH_cqFo*_eMGkO*9g&o2GZ*a`7BRK}^6+z{1D>~=lCyb1`zD*PsXDfg
ztNYqlgG*k;sikK~3Ji~(OZqY%Snvg1-roIMoDfUnB8WK2Ty1ej^T)&}%hiE60<6mJ
zUV~mwk{xCZsK!1a>_~Es*VW@)gm$tx9
zkJupg=*?xg(*qYzc;^04w%!JTw^IiYZ%!s>MP7(UBT9(`Fdd@#;*H_Jk{&>+sl1N(
z-tyxs_#AR*`F`pCub-=cV&CP-JzFZ^9z{?+?ghbKeaudUz>xD1L?+eEB5LH&_S>*h
zjTNmZUVr600>rRv0qD~`7BQf5#G)o^%TP&_cp<=&i35VAq*Hl+iZ?TX^Z%FRqbQ!u
z;IF4nQ-j@sBVQTF{`}A*@oeg%4yP=e51=+E(I-gT#`1NLN)0olU9H_3h~<50G-`4N
z>8*VdX{|jzT0Gz2>GWXQeVOsH$LQ|O&wd3K3AS6f
zd|Ba*;VwF34xO*kp51&`d*c`g-)2E_5szyqar*i)9iDMS?2jC5uj2Zv1=`DodV5NP
zJy~`?UK@&hA3Lv1ljX@wH-#PGv8Z=Dw=QCo9y_ljB28dn)gFkVHHqNx@)PXQt#^@U
z_np8(un3uwN15SlhwyNq9&iTgfhm1`3D#u-9MC15A+ns#8Rg+`7sL@{+krlvPn8U?
zUO`?F5Z;4pE(ETF(&A`jeS1lqgm~3rJo+KMNTMu#*%C&sw`eit)Z3s7$vV&<%uM>?
zab7M%{CzEodhmyAN3KBlim*Llql}q4A|PE=WV39Si|z|!kuWNgSXhK5
zf|YQ>X3U`AsaG5Kg@zH)G^CQ&GdceVA&u(w+LB*3
zE}`L3&e{3I0-D$AH(siE^bp2-7pWg7&}IQ*g;gU)
zaFO->&S!nX(aD!yJt_Fr`tf!>O2Cy~(CP^=#JcG}F3(~qIT6m`+;4E!BU{zncQRt4
zrvzW>xrW5bYs2OwC*yPrFO$-Gk%7s^mYd{8D&(z}^`I?(pTc|m$(Tls{ijh02&8ZI
z;kAIJe%NP-&v@7KTArqh-*d)?pJW{m{48%o(b9jb{?m?9kY*$e@^94kj(5zUV17L7
zJ%09G2dVIMY%R+`lrcTtHuSapP%rXbMk5}~UO(SU{UEcKnwk+op<;rmbG$aVETfEr
z71e)bl#HcJXfv>|d>K=!+`z|(*6S!x5qdkGFrx_tE^>sf&AD-502HiBCt^Tkk+Ww9WpBbCwDq?nL&EwdZ;4>NUJarISLiK
zbuFUD?o~(mMA>1ppcb8sPK!&~DU+KdGZc~~UQ;j=%2vIvQ$(t~)7ejeTwAkX8?9{{
z^SO9}Yj$W|4;B0yo1^lr?*(04tm!ITw$OSTJV=N`pz1RApa9IX$
zM}%kxE?++Oi2y3UyU~FHq}yGer2lOFTmN`{|0#6T{w{P>xR1Dn-lznzzivOkEijzC
z9J$sjf=v+8MJ?N=2{R(3EsMsg(#resGOFs%^AXe#E|kS{(Of-jBDYw;a&eR~kAk(9
z9X+S_*SSb;=2hD>fyunxm;7{$pA9KENzn_WWSRn}TJAnQjm49L1|zlukrM
zK+qA%{J}j@55j?YF~71a_V=t3d4uSUvXR5#x5+`9&XH;8kZ)xz3JNwWBcldh^cxs(
zUG=p&lp|t;BpMkm*V15NGgs1Sudif7q3aO@%3fNC}DY$SSn(|O6
zVlN(E9D6vP-{-!pdo>KHhE;dbVXn4mHg+T^;v2oUMOiJC?LY+3acf^cDjLN%gOfTk
zvA{40?X2fZy!gp>;@@(`Z6Rt#CEYa;FqqDECRQXK;2@k0HqBzh`J2fJazLAqKx@DP
zzJauehv%4a#(IyyqzK+OF?Jn9MwQ#4_v-h%4DT
zf2K=TU~a4zB>R_t9>f1LgW@lX2}cISA?E*UP`usVC^1s-r$O<~u;qUZimhUdL(l(X
zQ0$*1B=^Cn;ctUt`)Fpn9IGF#e;E|tGXy<;oqp@LLGk81Q#kdpzYK~ESHz?LGAKT2
zRG9zUpqT%}Pl;aHca$T8;w09hILck{@g*v7!+
z`}|Fz3b
z1`LWd^?$qzrszuM9bv1f?L|f5jHlL$w4PX%5x~j2OMr0Ue2$AIv~zPlMo?j`Ad;1D
zky#V)4-kgIqSqD^7IlNp$L&{niD(Km(=R2fYth}tKs{K9Bmspo0z~|6l`Eav;c$RW|JQ&!N)fNpJ354IX6c6NEJ$|!_6P=scx&)
zl~(|7UK(cQGIH#-#C#46O5p`RFl--qg!#G%d$3mJ7Dc&*Jc&0e@vC;e)@$=a7YW;4!)
z{a6Ll{V^$Y8}c1QO$9i9(*tIde{!t<{~!KeI1+IxQ7TpdNv5LL`p4Uo0HP6ah{Xy0
zVV+Je3vX_3aMe%b&?NkAp6(QDe2%ivABj5N8_96BVmw9ePf_y!H)A77b%KhKiW&H^
z#Z-q3dx0fHS|)xS#yvW)9-E@qScdl`4lu*2U7x-C9iByxI8^l-K6(Ef%6_!W3b$p}
zR~Rz%kk5;ZpQ7g!sIT>ZQ9~xfK_~KOTawNaqd-y_46Wl9U~UxG<@!eGn`&B_61Xpx
z$a>mUQQ6NHAMJ8Rag1_OQ5TwnW)eIMR@Sa9?7X&-*27sv&`XxUa|HL8Up-;Ne`qJ@
zSOr-6{g)b*146_B)caKQt4IHJ<&ped&Y96+R~8S1h&>k9PSIsF0sQS5qsp}zxxtQW
zn=ew_9;J)#^QX;&$}p*Wu8%h)((h<$vDvoo(KS^(4LfoD;l}&3tK<1Y!!0VmfJgi*X{*oV3WVM~`N1+gw3BTcW9j=Wizd@_B~PgOT$_&*p`dHB
zhFoQL>7ip#o8-%G(Dy~L6ZN_acS1kXo?g#>x0L5_B4N8NrA+gwn3ZsAPDOyXGGI@G
zZz}y{TF9?DJ&x&W{V)Q$5aK)BrSvJ@I<&28n5$ETNPW@
z*iL;($4m)k*|&AirV~px$W8mx9&da$`>CnBR>!LoaFNk{!gl%hYF^Yt-(!N+v{UZB
zohOP}0?jRL5*H7$V)fG4=PeAYoaotBQ>S4Rt7kj)R|
zRWBE+^wU<$#UC=yn`_+SmKKytIGrp>MFf+kwa+lFe5}OX|+p&iC3v+X`qJ6i8_y{wbvJ8;MHqH
zC>2wU7{7K}rX0=54Z-vT5j}_bsHc7ouysjy1myBo=QnwSHZ9#Z^7Ska44n
zmPi9qPs5P#T`NOi8vtuPMGuD5qrGays#k0TlWApUTmA@pjRN!rOIdgSNEF=%im081lKEJA>ol!!*h@fj*`WWiCQVdxo9+@mnrUp*P`
zpB@)tKnmBPhf3%k-P!v|z5m`U1;Q<*@o7V)SxPfJG+A7%{VUDcN=$->vwUWGEL;ZK
zx+d5gWmc<`By4hXQ5VK<*S!|8MbP7s(TFN})_KDj#^f2TODx6eWCsn3uVHTAIAMYJ
z7sN%B*5>j-qd&^u_PcTa<=~;QP)==PuE3b%s(b>4=Y(bTS!U9y&>rpe@p}baQ8JY0
zsdO3Muj*oMZ%tK&(ww3O9OvU+%qG)bV;VAbM!h#6JxS>?
z=`l&WH#IudkKE8_=V-N}MaM(oUdiAovOI33w$I)NGrlqGrfwGml{4lQkI_$&89@Ij876qK+URvy>IrbWw2>weP{t9hkIbm8KJjZ*R)a
z{2h$V{mGhK5nvR2*XG`r58M~=Fm7&!bzi?x8*cE!X4ip{XD4j&PKsgsHG*~;XmCxP
zxqPw-n{z$5d#JGz1Z2@FT8tk
zV^Z+#SayRap8I^2-|}Vqy7P0C^3htGE$bI97e*s0;2BZWbq}l6)Dw4H+j^X8ZL=@y
z!dRUO2h?8MUwyYW^?!mGYK|D9>9G<@Y~CFZCzTMm@z{FKoH{D`Cu-
zst>xFlMZae@TF$*0HZ74267Ly63}ZLjUbu|-*i)6P{1IMAFGiBRAnxIa^zI!`|O-6
zEO3rjFjaCdTMf;YoKK6GpT*n)x&pmPkFg`Q83jVFOu9&vc!In7;h+
zyC5(%<4&=W>1N4>!D`p|vjCk33rzC|`*fb~YOkBEs|pZ$TcA`d2ztvv$HjwQEzP~=
zLBY~Sa^>M6*B)4VBr=N&Ym`nJhOc^(nV$s*1h~
zYxGG{wJOSi3#&HQ&-4ci*nb2kYn
zh{pKkVt?K?#~0zQ2eTvZ=(HGEWjNFuE2Y_1+S#EALVh&@5QHR$ECC?+f47>
zB2To~VT?bDl+SZ?8^r7l>R&{GC
zoLy%%{NW!~J$}QsexyLby^CO??J13MesijUs7D9)^Jh};ky{*5UyEII3N+i{IPSsk
zfT2^^%_sCo?i!~L5kI$RXV{?lFr%kaA(UZ_KC*m-_b8Kf4r4&EAcS2Zqln0ip|Eg8
znuU5!VP$G}v|z~k2u_k&`6*G;fa=YqTiY8R78Y`mD^Ig9)C25hyd0U9Sh@Q8em?Iq
z>XSO^3&0RNglF2j62?<6Cv0`$A&WL6=z-MQZ868(3>dn-sIMr>VjG0D(c+aX
z$(WS;*IVub1YPQ%+rQ7g_4zMT+n}D!C^F#cU6W(b;MyN9iyAYpNS>*HO7p6A@5()n
zgaG|@KFg9&AGs6B)Yi2#;R^l_T)$lJX=saBLKP)!
zRlv9d?QNwb#^dR^eP%(?$1c`Sz=eGuD&upnO|u)Qy>=EeGJp+*OSJ9SpM*U>I#`B{gjzeKmHucvg3-hgScaX3-iHZBQ5JL3gJ
zvmq9=M1cgU_wF2eii7tm_Ffv>~sSm!}8B#vNFS7n)5(NkQVGkEhu
zzD+F{&6B10B;ogNAUZ3DuZiqjWM@puAOlyC2sE(+B>F8sSVUX3z<)$~E~F`5IQ_RfgJN?kf|M#jK1-PCKamwvz?qBC3bsRmvrv>vzD2+Ai=cB
zw>p>ToPlq#-8;h`#b@j0XM6umGGxMqr~kx#*w*B)l}`PZGn1MhzJ0jzhbC=#e
zZ1bTDQwS>)O0KrgMLwc>v!7it1i^IZjQrQ98S(o)I%==}TV}{PSJ@8LFJSO=B3y|=
z!oXk*?ZrX!tMMTGc*D&hf5UX+
z{JJ-ny}fYQ<4HZlGjf~T`Z+F#qSO$k&P-Atvtm6SrkV}$Oy_As3U;Fo1D6mWmi#bVM^CBp9!R>%@iYkx1!ZNpT>xEBV2B9Rz4`y`&~Bk`+#iy
zz?X*FrooSSQUNmT>{@XI?N3TkfVAqrLLCo;`uIPu&_BJ3m88QE3vD7E%xV-eA&dv6
zlGqa?4Ez>*xKw{vl+$o-lrR@SS!lx|WwLfZyto3`yBusA7)SwzDE#L~)&#e%8fu0a
zq>Jw;c~%-RIXlm;3zw{!mmB4JVB#7DBUPT}4Hr`~OU!G}-7ZNCa)CFw`*L`#;ZCkv
zHSaaoaVnP(?A?P~bL20$6CJw^az7bYe{v$Uj^y0)54`eLhDYLw@bl5HbNJSw)pC3B
zu~%*8?C2${?iY$~K`k7Sk|$+zz|XvLZ+L}9^zymS>F^`u2L%*p+Z!4`y?!O5sKFtf
zFQ2@3`ICx$?k|rDUsD?9snj=}t#u(!E`JPvKvX&{aP@o(s*1t)iDT&Qx7&czqf+>-
z@1MVmWj_x-99udExn{tg6v&^S`cz@}9_<{4t{Vep!BC0_QHE5hJi*@X61d~cwcBY}
znKH?F3-$vrmOn#@LQ>(AHNu=wb
z;34+z&MTP-EnLewhy5&I8|UcZR3oiuhSeOt2N+5o%~hbRys|DQniudqZuR!R_H<+c
z;S~5k!?`V|RosVXVKq9cB!O_s_Qy)H7DKd(fpAJGOy@J8Xm99v9p#Dr^SzPpKLc#F
z6a%m20=}1?i29u;yv$4Xehzfzel3C`{YYd<1jp@(yZYIS96>C))gCvza3}p3rJk4B
z-R9cB0JdE^66gSDp=qRbxpBusz^8Vs?phHgl3M!${#nzxuLl<=wCL3W-U*jpYhz5n
z7spOWe*+knI)~{eLchl18P0XtY+c?TbpA}FZJ{tU7Ex)z`f^X+4=XAuVz6Ili3?p=
zRPZUSxu&(YzZkf=5HRXtit_8YV!si2c0fbp()HCxv-0&N6NL7yPx1F2VYb%u@A8S`
zUS}oe{M6i$oc+O_aK&M4!Sum7|Z`?vNTogXcs~p1u^AxuaGDge@0bW
zf>@&9?qZ5cuc$<#%Y0U6U6|q$%Fp
zNuRy%VG_P4TJJpDSOle$|G}{G;)<81AHQv_=**PFSc!J2fJq0iBM^rxg%;FUIK%Er
zJ1D|Plx?F!ww?<1d$oOuhs`Mrwe`kaH$Uvcxb#WC
z#fP~FrRdS-E4a4U6Zdx#X16qZvp)NbGe&-19Vn1G)DE(1G#|uRlIcTdnx1j{I%ZqF
z+_~}TWw*`SFrKM9V@rxxRdG_Ur5U-+=gU$}HIjDFJWt++Ef930KhHOLia2AR(IgFO
z2q`!{Dtv4aOLJ1f&1_CXfA@8tM-2Q{R{G|pb0DDr5t1yD)k#}=~
zA{sV}bR%J$kAtYl(USZP$*tJw
z5HarbsMH|oX9Ccgm;pTlergUL4yH7o}8fJ#F
ztXc&7o)RU{Yaji31ry-6%*dIyuV1ujft;!GBG4w~Dwx=DWSBorToIMDOBD0vy7z)x
z#;YvY>S>|IjaqS*=>^IB_ctqRy^_!5IB9lz!_FhvYXzF@+DgQ3ZMsGk2Cv>&xanb*
z$pUU>xOnO34?;-@xsC&e>$8aA(n>Bky!H&!Q+RQw6LbI4FW*nx0-a<2o>1x@E`H2A
zLC?ClGc=l1mvB^wB9y>ea;cxQ&EzLDSZ4*&w
zfE6y1Jz9{3<^j1h7BVsXZ1&dHH~}stb~R?xFO_&SIwf0>xTz~|?u
z%_Gqq(Wd~o69Tq$4&W4$eA>!_Cp%>#QEfECVnlva8R+Pus(UP;=Qq$;16UTK`
z+F!j|{f$(#eBL-1U5mG6f-Y^$v!Bnj9NmGtyPP%(>d?5plGTJ1EBn;7S#x{Bj;G_;
z=Pq>n$@^_jpLgLN{^+EtfB3Jrw;%ZY{^;TYF-2wgds(r&blOn>;zS$xW2RM
zSQ_;h%gDrl5JedJixLs+QV%yt;%SoR$%*;XB=L-j+sao3MgXJX5pFbEQn?7z!@!B+
zA^|H$j!#t>?{8hBe66&~G*mQP8EiRWZ2y{a5i0)OrH|
z6TbMc2x$?c*X?t~FaQqVuHJ8MdkSgLfhiWt3lBv&|q|oO&o~Zge`8
zZ_`K(`ov~VlX-$Fl12J8Ig(NGb$ukbL*DC!qYRayISdI|6|#HUuygj@T=7mxnyu7|
znWedk*fWq6_PrLJInc0YJ68y;@*vw+*fTCQkb3fbzhq#~U)~9*NMjrDt}I|1Hw4xj
ztg5gS02Ucl_GlJq&p+GrCqRIY|4*Avb5tw&6=~z?MOqCoz{*w{3BJ>Uh%M&?furPV
z=pO^)KGY$v#o{1b;rq_t5>%${JW^r9X}NiCLbAg42p}fjX{S6!Rh2Ix3)dtkD)rRz
z)q_dWy%lCnyt;YK&IxdS9WM%H0Wx*xT(N+L3Z+k9*0He2<*fKHEtl66m*eeitw@#8
zlGz&1r}(DlX{k+16Qa
zPi2eimrtMtnOi)Qc>$x;Pdr>t?0!H+W4tiOeMVMsGvgb1g_3o|L4jlg%pLEcRm>*U
zDo@L4%Fd_R6{9yln>=H91C*CO^5kqTmNxF|zwYj`q(RpARE|;kwJcBA6u5nIP#l$d
zLuxX*xVRvkM6%MHrtG%{CIxSt-vzAgK=$JRJ}XkROubIAg_&%R8@q|cBH9Tnwnoum
zN7uTM0IVl9I>#-Uf$pfBDzy>L;Y@|Gxd9IC0nc->re~R&EwR8JmnF*x&`*jfa-YYm
zh`3(Op#}c&-s=wOU$aFofoKc7Qqo!pNnM)9MJ}2144GW&%+xbv=?VV|O1EaDR%Y-wd%H@~M#Xzb_pqcr(
zbz9X+`cYU7SG}KkvonX!L=N`CMQ$U}1*-!gC)cd;s|O~^2ynn`
ze;H3(=&jFl;OBL^rAcpg?~ze_iL0k>@hCchD``wWG+~3>-;~{NG!Tg-IIzEq9a
zE9JX%t{QeeGfp>l@eFq`Z}6V_r}T8Q)RkxeY0`ZrD5eR
z@LlW)qMTLPDw|3^po-!no_ah(jqocoUj{1U2BLj9jZ_+hM@OnWgTH;{I2LQnox{+JB67)iVgmT2&$J(HW}SU8dN@CLC`$LXw3-)Yx0gyfe4hZ~
zTu+$;F-XY!Z~$&*sj;*QJ4^a4K30A(hZ)Pf`hlpk9jh2zL&UV@U8`R%&+-%&82BG7
zv);s5OWWO@=c`|_!x3rCs-IX2Ui^l77B-{0VPZ>&<3?L$ti`qqTAKIy>|8dX7qVy$
zSTEZt{y?sC2@B?C@213X)n8hsoshZp4dps;n>`-qT+F4a1@*Fg=&RPEn{?&s{^iY*
zfR9~E=r*yOkRPy@m5O(7+|^bork9Jp)2pZ9qPFwtQIAd7<(+TmIUr*G?ZqJ^5QlqQ
z>9a6%eHeXSRS8t_(~K)r$~>~S&}!o2zz7?^&Q)WLjrOG{YHQ8cVhOWit=w?=ZVZuC
ze|M7@r;RYr3;W0;!D7bI0?3~it_Iop$Qf5o!WME{1T{acv|iAH?Ljg$^}i8CHEDeZ
zUL>OeHkpBh>+Q~KTi8Pg)_$4MlkMy=uSJWT7hfhp_e-DU`F@I;OqXt%6=%8vk7Uh1
zq!<#dZ+#2?mlMDi5Z3=dXAFBU^qupLD2bp2!T>o2@M6bd8zN(%Vv;oxyPtKz8bf~9
ztLyz-w3C^=)eXpiGzBIv@Q{UdU_yu=X_PfBzd3-3XM;yg>NHDE;QU0}*M2Pa6X~GW
zQAj{NtrHI;|M)Q2GG~1sQ2RPJSk|0tvbms4etiGZqgKCP#daj@{A?HOey1(0?f$C{
zH?^#Q1XKcyr;od)wNC{~1}P
zx&=m=OAow+4u5gMC!@Gd`xg^m_;Q~NY>wRg#B{FlO~siRTPe!Ce)Y`<$Oyp0V7Z7&
zcrJi_AY_I*+SdI9)xv;CM!tfX9GpxNP-!9+f#7fQr}|x!RIKOR2#)jgYCAdFaFsRZ
zDi_ooMk|%(d6nYg^<;O?JpE9)Qn*~nd{3N4kDT0+QWSYJh34hjP*L2YH-TiaUt_)0
zG%684fHp*D9t
zRBmORKl`(MH8eW2pOrD*dxg{1`9~?#aX$LQC+%eqKcFBaV`U$BPj`V`m^*)c(vG}N
z>LEkejkz8vbR*b5;lIvsE?5;NpG+~ruLiyE#UHC2n(iA>oV$Q!_AUf(l
z8}bk==_sMwaR9AwR6MJIk#fFd{o*46LjEy@6oDnA2x^{=HJ2|P=0>6SV86NG7=;Y=
zxQQrgOMu!LtyZkm45M{mEIUUTAQ)@@kos6@DRqiLOO{Q{D}!UI!uAK=p5?mqGn%qA
zkL%Ful8?EB(N!PGi&ZnV`-OVfZ8!UwWV~jIwkE+F&l>Fbb!bX^2NJkc>1CRfJ`0@G
z0`-E#Pi()@6oekL{c^(;aqs*GGz~^oNb_|H9Gc
z6WICf5Xj$L9$19U0jL%d0Lat_m{NBgh?gN9L8fKH{QPubWi!-?|1h(_A|8}w9eM`X
zTL7T>Kf&ojmE;2Tr`xcR<~bfNRHCrVOu9FvSeH&39g8DI!zIpJw)~uuvMkjyAO~T!
zVi9QH5h@<}ETnbm;ZHQn37zS#Ti?f0JI!CLiIRAUy6dt-Y1
zwhKK%SKgjtB@5EuQQ*yzJtiKnw1GF>C77peS53Eiht^k}552LN0KT(PAmUlK+vbrM
zaN$V^t*0rG{PkHHdlhpr=6Y7Z?0A6Jm9?zxdt_l}P*gC7u*HRk#~L7D{m-P2-Vp>a
zTrR3>Y4DX4fFD=Ri%S(;F!%>@UIf3#fwYy-
z=7S>s%MseN>$5a^S7dzM&4FdA7%)s`nLFd`6CoNfqkO-!2=48r)mNr6&$cI14Ngfc
zTgui`zj5%K4X%o_h
z_R_RCl_cO^-Ms#^7*=>Wc7)wt^Zs7m>HQb3cfn0w&pHLaGZUZ%?oV%K{<@M&VhfsE
zzc=!oM+k~v_ypK4t~8yAwOUOYZI=|%Fn1Oe7;9EAMdXRWDqip2;by(e$^H%LhxK`4
zeeUquX5O|PcMG@D=~VXn5WtC0UuI}g=4Er^FpBEk=kl-bbXpd#UlnKK`|zTvZ}#fh
zPB(6z-UN~3;f-q3rSQY+PLEE9UMX0gZ3|@1od3lQ_TDR9AcTkK|5Ponv`S2;bjj;FoR&>?n~pz5q-5+;Jt^Ny1ikxJoQHElwk9#H_}OD69%J
zO2stKjqQtXmP0S}v&;KZygGz>sd06>DPf_-)W&r;zi-OGwtJ=C*4@l(wQXR0+jM@I
zqVWMdk9ykzIZiej+(-a1Hf^UWgs8}4>4sMCr3FZt%LKNOiZl{`(D(!{Kg?AGEbe9H
z$|l+FCEXOL)Ci^D;emJ(-0S*@3%9hXX`t-S4Yidny?U-@gR8lcU(cr7W%o(A84cH~
zu|(a>qZ&g!aK0a-GWxds%=b?PBGgX{Y>rz=Q%FRvDA7e47S%mb2g}!-)4ecN3KbZJ
z%u#ZPq}9-2v8KMPJZ~Wzv1Vp0SwWu+zSXjF9RcijlQe^-7l2&1F`df4yEOfq+T>5wK0&1h_Di
zjRQa&H4$=_2KfdP3z#Sbr=6R@(ovSu_K95pM);%PLO1-%jucD9lLmeho6Ex)a(tT~
z-rc|Rv``&@$H;_L&D%=HYGNCx_#Rd67aD!c_O3856X!=|MwryRs5~%WePBn4g4NnN
z8u-2gG8;E2<1)3}4`Wjp$(UfBh~-9m
zjAd-$7wdu`?c#Ac1B}o!azCaAn`sWNxg0|K=JP#24wdh|hw0)Y9H(tTUSvut?Km}zizW1g
zr<TzHCKb6mQN+yh^Hed0
zW%#D?+_I@Qe7J^3GsC~qtPtr2jW;J5gDag^V3VRXLPRL31k$a(8&C(TExIO
z$6S(C%G3q>gf_a<;cBfpXP>e?Ff{OnA7+#Z5?KtVNj3~frlRwPJd!*eWZ!#jJ)
z!hsp9?%Xh>DoR-RyPgbFyq+BQF2;obk_oaOh8%PsXB(yeH-mq+w9P+xI(r(#%a92#`rn{JQ>
zz*B+_hCKW`gvU(4B*CCS*S!2NBaix*A>`n{nM&i|FZAC`<=>F+Urc2&&IUznRJkO+T2mp06P=!S<+YqVVF+Mr3Dg3-^o4xQIFEgm!87PkYqOjoKZ
zyD;B->wKwtc1l4%oMrlKWYZ!l!oj!p+gzR~Uhk?SOIa5O`v28tkIQgTVYA{cR4=_ITcD{Qoe>U~f
zeYb3#wo~?sCEo{&FYn)ZzV!02L2Z%0JLt>6Q%&6`mt&(&&3V?R!H?hiSbbP^tv__`
zS^ZoB)y0`80gj(3mjAfKL{Eb*GFCY~-&$($Tt@Ni^pxjsne(T&aEPJW-XjMPb
zr&$3U$V#^J4Y^ruBdq95E&*F6o^n_eEY9SkwN1!^Xt;4Qq2}Wx7_WYN|4#enD#O3J
zJS!l!{}sD&>>epd0l3Xl{x7i`n~uSj&Jhiw>Ls*wTsIz>^>;}nEE=XWL!GP{zVF(*
zK{o}s{-Xe~+nSbEUfA9)HIvb_I4mC=$h)zbUNu#;U+*^bgZUlyu1zjH6hPuKN?GkW
z0A@3io{3jA-*3YI#EU9tI$j>?zF2M)Lyi
z?Go1r+3v71uRXFisjgLMx%SRpp=-}{&7_i*h;pr>Qg)XlN}`hA>+1dayzBe>e*cBn
z^Ywf@&*MDKIS({a>z*~csq(|+TYya--_LGD+!8m}=n?ki!x9SzOR)1^vq;%QEJzPd
z09f@{E_E9kK~i0orQA>Un9>aW@2-|crvv;AQm!en08Laqm07VzvJ^@%h@sy5PdwrA
z=Pf4>smb8_KSDVwQNChTg?O?aAz+FHU5?}yayHqRH_RT+mPD7V&3gdLNx9*MM4``d
z5Fpwg=;cFv&8=w=Y%+A{gklxLvu~-N-0^=@Z3d)$5G{o)f}w67F7ShM(}+*gG+QFGlh(L`Xfv|6Z}U-GQ%njN$0jg`#*F)ts2T
zsb6bl7?!*5=9-@|2rw;yHwT5>X^;K9jL&0zoCXt3pwZu%^!zbg&eeIg_RF#Qi8KZr
zC_Z$m+qV@CD6wx|dKWpjK1r!Lw|%ID$wr>)DSxi<8Q&Lu9b<8dUr!E??Pt~&3+lhT
zKuPD01j55W!ML#9`S|1Ru)G-GOcJM=#{OivnL4F%c`}?pq0fh{#EGV3cRFJ*QWHaf
z&e03um8si84fxshIVQ5r^}R}y<$h9$=U5umEs~p~s{B^(wQ*gKfQUFjTz_t_ie54ntUC$%V_vOSMH)z=vM
zvuIt
z)QbJiB0~Ly5{th`tBvttP6IQ+TAmb~-EE}Ifw}0`41GPHn+1ib_&F%f?~joVLqoT+
zczEh8A1#4TR89Y)1HUFj4m+fO!{3Rw5T7@a4RpEYDOK
z(A^4gT?!k1!HQO=U%iDjd?;^gEdN+FTSvDlmmQ-2jPgmkf6ut*4PURQi9j`Ies89s
zh!m0*27OtMK2!o2RE#!9Cc?_+o<*)LA4gRloG34l@0GWIqrgM`&(LU5dZOm4H%|nSjcGQE{W&GyV?ULhT2qD8AFk{-G
zi9OPeDRFWD(@=DKw)`;!>WqnK@V)a^Rwxb9(b>CRd?GOznbQ4(8I?j`v30st@2o=;
zT*OHzaD3TGRaV+bwTGr?!w)A7kE&B1%ccMel!qSzIa*I7!XB#Xj+KPp9fz}LRQBBs
zNW8%>YR#iGzFc%ljp=m4jMFAP^%F1z@i|R>)6nWEoA{7Kzwo9Env&rIRMi%DxI+Xn
zG6Q8(WqA~B!rokhr#`tLHqoc^!NzyanVGc`MbBS=PdxQ9v5x|&Fl2E%h6>1;
z^%vqUas|~?Q287#Y3OBnDGKy___4Oap@6
zrcvitM&F5A|2kmO>RSnLDigL4VDPdvC}YW0G7WGlu_w;c%$Iskb->PvW!&57IBVf3
zRrkaE{$~Bi?FS41wCn!4ct6AO7tPPVGI=wApHJ{V?FfMCwjL(|8gw=?X$DME!A91G
znQp1qfdT5wP|y;<)}OEp4RSYwnZm59#l#lM``Ee7Qh^Er_$E{@tWx{-#6jq!JqQ?3
z0zEVi?zg-2q)lq_+6*I*b1SbOXE-eI)zDDhzp={f=I&B^PYr^H+wtLvm8IB}CZqo3
zv;bQgN1HXnX(FCdIHfbVP`@NV_i+lOZYqu8WPDmazX-+1$4iZk5WaZU>@$x8k97y*
zM6N?end_}@$q}nR(|qES_t}c>rI%MHtkpqSucIYvdicDz=qPIi!?#{f6(!l!VJKfd
zMECcaHKp=J)C0rFRD>Jkc<7@0h2x!ex6?T?KDIwFkd)QF55GMKDcC8Q8d*+FVO?*EgcfR9m?VjNh|w~(RBm=$L*7ew7Ib}H#V%$Q!RO!;pZ#{+j_{25M;zW?=oICWO8`VmaVn$3%zDt_cQjB9%b
z#_#9S>6TNIs&LP%Y?FLOFFbe+Fd4O=X+D`SB>clrIOl-&Ctn4)JG
zcXPp7JfiMO)A|m5n=><;>MtjQXC-jL_u8u!3j9|`=J-_bxem|6`TSw0vuUCo$P}ryg{c0r>xASbEX}mn!&?tR`Rpf*`}xJ
zlr3y*n+X6%=2qvO=U>^3rd7A_&xMdpDTRKe4n9V=lB8H}0*A?JBXhv+TdXvCZz2bL
zI_LeZLyG$Mcy>-BzrP~RtBTHC
zz;M7VCDUa2!?={(6XI=4Pg;G)u9XEYdabp>bnq(lOjj5B;;6Cum%mT82~|yS%c}d$
zyjswm%(I99-LC%(W)OBE5|CCji7#v1oh{oVfl;!-%KG$u-}I?0Zo!N3f*KjUbP}~~
z&b8h2SJ2ez8kpWkY@5f?D(w}m^vx3%
z&A%>oq?u{SZs~#*_HvYauoW-Vf={I8cc^W?i)QeyM4QQ1%#=UBdNSi8zYXYN3j(69
z3u4ybm}p_rP@m%Bwglqc&=9#=1ezV_ys4P9G1Z0yJJXlGf%ymh2r&>koi
zjI+mB;RK(!IiS^6EOq4ev&FK?Guo$a$P{PN2w2(DKgrcldMs)N56!^k^TtX^7&)@3
zU;`W&z&CEIa_@?#^&6npCmGz3An|v2UqrT
znRrci#ou8`<$^yg)w&!;`8oq^EJh)JwiM45{&llGQszSst2|>L1~KwhXdt2t?z3Sp
zls!Zvb!M)lZZ-7kd0S~D*NJ@-HP{_a{-P9YuoMqC2
zsmwI!R>dS)+tN?iN_N;(<=UN(TgnF?puHKbfnB}%elDl`4bPSWV&6YIr*7a3{|mv%
zFDZbxB^lVPdkJM|91EwBO!$$!SFkNn)j~K0b|hJuh#STULiCACW3G?#;jX)1?)HP9
z#)(UZV_?WJV?fCb`gnH$42=^{t)xU(fO|_1VvWR~qT*0=kx{pkTfXR-U$>0gMKAVA
z_p;M4W%kFd;1bx`R&}8o9K$-TqJ+TNopao!a^6KiXw=0G=V*G&tktE>V)aW4hP)ZZ
zmq=M`KDx$Bo$UXXRg>Wv?@E&J*sXk1f^WucQE{
zE{p{=>^;#PfI!^>o@MKQus%M~VcI?rbXZ*08*x>}YE0u}tzw~nDAISpg1Vgmj1|4Y
zW5UOTafMcFz)K2|VSFKcNs3jh*!)!lkF&vv4y8#G__Y0$sZBV!cCnz!zQcPkQc}hIu)p=*mt7YbUSO5KV4gsh4
zUqRzP;%q8*>7&z&XP`e;>?gn2!vnlfZ-!V=sj(brTWiu{bm`FzoHgh(z<~j2JrT7G
zNr5xI0enHek4kk8+)uLfgGad)yDIOwf2r={A;(J_v`bH4d%(pL7g3&6@9J+hBUb2+
zvu?0$hEvQUja#rd^#|C6=yDVfeAG!e>>D#k*7FbT+LAkg0yU3cjYNK60m9pV{*nxoPJUh35nn
znYdtOF&)uxTK}&?K^Vk5k$2_2ce@R;BQx8GTF$yGT}6?)I`Pyq&2bz;FqA?l@Hu72
zta3~uv5#>*w6zZ+n1f1}H7XWjarW776^I;TZF6uJA!PJNEA|k3rItst7Lzjz6Wk-^
zpYbHps4UXO(4~fEk8+4G4)n$OJqC8p;QUz`(`4Ta2{FoQ3O~~fuI%ZhagjlKJMuCp
z;oQz_2BGqex)Hb&%NbNDFaiN>7;(pD?TsxYl&Gh;w6h@0^f_m89wMKL2XrzSU(D1a
z>4YlrYn0pOrqUFY0~Hc`J=A#_eOM}{V0n=QHU+~gT=TBC_@+>%9g9ULpz6debC;Vf
zb-5O%abhftLx77p5OmCD!%$3?z;6Bv^Ew+tL!g*xC4vemxkAVmk>%=48lF7Xk#k7a
z@fASV>?QQ+0et8+?*41-v*UO4?tS?5h>P?7r#pvSCjGXob6y)gRQr(x2<>srzuW?E
zfgkdJk(XPOdeQWN|5T)S5A~apOEk<_>}9e*`SYD_@uEpO2I;~QpB%mPyO-B4Btf`A
zR^3230d@%dyap0{b-^H|Sl#A92GM{-tT~7zAnGUe%nQuRj09);<^e3%m+a@>?*F3Z
zTPo9r1&Ah1!h4i}tk4@wZ17DIQDfbXPJrEBp1pbL0$P4Ab(}vbhq-E~PA9W7)}IJFcLnB0^y2Kc1znMjulKC)Vb?GiqUfVx6SLcM1Curi
zn>}O1g%TqrFU;Ky*>Zb4SY+pVu9${XH&P$|QbN7@GyRxk>D}XOTu)qCFjaRrXc^F!
z;8Q~P!$0Co^c&yNt|O>4p3W>i#kOjJ9cj}Kz91;8I$NPKH8L^JHJcbQt`RSx%XSkvW#J(Fc@-}!EQbbOL
zQTVLy83U=@l?fBf#PXPnwengY6FIpeK0#dKzE2UGw|vwdjbUPQ_wdc`#hUAIAc
z34`;IvDw8z6H*o>;3~j)09V?rDUIb~Aek!Z{@MAj|IagaL$U&j1;CZMK*uc3ry^iD
zj(?oOL@qkb=+tCxbW36-d3aaW6AJWGUWVLk0LNxvC1H9U$jWzH`&|+E*jFhTR;y!RbH)*%T?c@}e(FO~Z#!<2r{2`fV(F8d
zCFe)9U+c;J__AKcA7(vM;{vx?-xZw@RJ
z*fcxcvg617z*a&1C^YFi^*TBc!$&)jw%e`Y
zqm=??9{;}h;9~&Oy@=qX
zR}6SlfJZaNaiFl_+-yOMUH5r}H<{9s_HwFeQ
z44IpnVw8TEGCKD9#7yBjn`^%cx+oZO7g6{F(Pv*qORD?Xzg`%yu5iDRE~~L6
z!yx2MBq&(X4ABvSniZ>z3E(OAQ}Du8yD=A43w??wg7-NETd#Atv>|%$oqW$FQbd@b
zNdNp&#>q(?CgzEF#P4zFB}ey;WsD^zYH_KT|5J!!h1Nn>@U&rD4WFg3+!
z6Y(fJ*wEI1P|Q3rO^y)#;6qB`&Y@JGLR?ZGP=8Ot~
zRqOTjj@I>cRLvY+(v57aV(%dx6ZI_6!>y-hQGfm@Jiw3gCq)KGETVzIC&r?$KQRuV
z$TSTVXsD0W$+fH~MjVG!7qALF2T&)Q$4`jj277SA0HuxxNcNj5LEo3!Da1w#6aZ$-
zAcusxb`UCy-9A~Jg1?*2CHrdZr6sqBv)|RSX~a~WRRiCQBStrYT~Nu7rMC|V1$XP0
zK6km?EnCs_0RcIwr%yxGTp7*Tz)9cB-Z*o6-S*SlX0`KS^h_Vl%1q)!d`e>OHgYM3
z_w-Qj@p1cm-##>aFl3VMln&B~UHQOHao&G2?=T3nfIQhKCdM+_Qsa-De;r%6xtV6h
z!NS96`4GJl9r|YZRo+;@wTd{ZwfcJVrRvC6dKcdoouS;`tS^PpzM#z?J63V(-dS@Q
zftf0E^N-v5&%T*oZM{-qrdS~m!*tR=l}6~iW11Bxa+wZoroNRksZV=hj;0J^EHiae
zy@1goQQ&lA56F#K;$@3o=9IR
zHkrVLUL>XHsMz?gD4gzFj^Wg*bz^}Dl4WL|d4)8EfH~IzDVexcj&$?}3V!H|(~^(?
z7a-}I&41!pT+R_x;0RO5ChCg3t5#ZeaLSW>~
z2w?ltKRPowQ1jyxkJvPpOrgg~f`lV$?yw=;lHq43F%HN%C)fPeTPD{PtRuZJB^iNo_1S49KaOv<+O
zgI}T&ThSon{NvzxjFD>tC0_8u-ifV2O5>G`HC#r|_yZ?i4^Pg6vAIVQV5Q84uy{q`
z3w=F1{?b401TE*~#RPRjXA9TT_gUW_zNdfkF}N4dT4RTt;bJ=b9wma~ZB^$sk4a&K
z{NL46T#h^S)~m*uYV2fPC+fLM=@p50SK5-c`utzZe;L)_$y-EtUOl%m?*D!?SdSlP
zB1}auP_1{|vL=%%g_EC%B|0$sRAnO>!pon_$ai5_(iV8d#~~~`l#EjPsq(ol3bV`0
zrau}<7W7*7y}D?t=6`Zt0Fz0kzR`8wsc1Te_8dUC-nIrP3kgKZLMm~a41~f@^lItl
zi*4-27Td!$x7ZFMY7iKt@=eHD)^!quT94YsDD5vJ0{nj-Iq)X@R-w)J#IP`{lWiw@
ztO^49nj~PEmf?{KjR68c>{G!Tq&v4p^5lN(rz}%cJ3Mo?9?zLdB>;eU>_DdTHL*n%~$W2bI>J3FEqkmWF6ewb6rZ8KJRCnSnzS~ac5B=
zcARpw#k+q#mH5gtS`waqV;QKKj^hd8oFmnzTu79Wq(aV#(Cw|
z#Tdy~*62&nRN9h!i?geS?z|7IOp53GE+q)ZzYYSk5>vI@6Sw*z=bhVcAvrh*3~Iyn
z3qm&Fw>Hj5*#~_l>bpD5D2P=v_ggDH)+t-5;hB~MCRjC4El>6;v73g^P1&;9DzT!>
z1l<7E5=f^N6R_t9vjVCm7L^7r`D#vM?^EbaYgXRIYDQHezFOd^PAyUB=eS1Hr*7Zx
zBj-FzLgB>I?~B4$>3vJW{;HO`z@h%DYx})}`~QGb2;Kh`PNB1Ya`ywHXq5}AJC}xf
zjgu6-C9GLJX&+S>{1AS8+7Oh2L&mv;W>VJKRQ@Vz*^`=xONnuDg~e` 
